When we fetch from a remote, we do a revision walk to make
sure that what we received is connected to our existing
history. We do not do the same check for clone, which should
be able to check that we received an intact history graph.

The upside of this patch is that it will make clone more
resilient against propagating repository corruption. The
downside is that we will now traverse "rev-list --objects
--all" down to the roots, which may take some time (it is
especially noticeable for a "--local --bare" clone).

Note that we need to adjust t5710, which tries to make such
a bogus clone. Rather than checking after the fact that our
clone is bogus, we can simplify it to just make sure "git
clone" reports failure.
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

When clone is populating the working tree, it ignores the
return status from unpack_trees; this means we may report a
successful clone, even when the checkout fails.

When checkout fails, we may want to leave the $GIT_DIR in
place, as it might be possible to recover the data through
further use of "git checkout" (e.g., if the checkout failed
due to a transient error, disk full, etc). However, we
already die on a number of other checkout-related errors, so
this patch follows that pattern.

In addition to marking a now-passing test, we need to adjust
t5710, which blindly assumed it could make bogus clones of
very deep alternates hierarchies. By using "--bare", we can
avoid it actually touching any objects.
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

We try not to let corruption pass unnoticed over fetches and
clones. For the most part, this works, but there are some
broken corner cases, including:

  1. We do not detect missing objects over git-aware
     transports. This is a little hard to test, because the
     sending side will actually complain about the missing
     object.

     To fool it, we corrupt a repository such that we have a
     "misnamed" object: it claims to be sha1 X, but is
     really Y. This lets the sender blindly transmit it, but
     it is the receiver's responsibility to verify that what
     it got is sane (and it does not).

  2. We do not detect missing or misnamed blobs during the
     checkout phase of clone.
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

When we are streaming an index blob to disk, we store the
error from stream_blob_to_fd in the "result" variable, and
then immediately overwrite that with the return value of
"close". That means we catch errors on close (e.g., problems
committing the file to disk), but miss anything which
happened before then.

We can fix this by using bitwise-OR to accumulate errors in
our result variable.

While we're here, we can also simplify the error handling
with an early return, which makes it easier to see under
which circumstances we need to clean up.
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

We do not have many tests for handling corrupt objects. This
new test at least checks that we detect a byte error in a
corrupt blob object while streaming it out with cat-file.
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

The read_istream_loose function loops on inflating a chunk of data
from an mmap'd loose object. We end the loop when we run out
of space in our output buffer, or if we see a zlib error.

We need to treat Z_BUF_ERROR specially, though, as it is not
fatal; it is just zlib's way of telling us that we need to
either feed it more input or give it more output space. It
is perfectly normal for us to hit this when we are at the
end of our buffer.

However, we may also get Z_BUF_ERROR because we have run out
of input. In a well-formed object, this should not happen,
because we have fed the whole mmap'd contents to zlib. But
if the object is truncated or corrupt, we will loop forever,
never giving zlib any more data, but continuing to ask it to
inflate.

We can fix this by considering it an error when zlib returns
Z_BUF_ERROR but we still have output space left (which means
it must want more input, which we know is a truncation
error). It would not be sufficient to just check whether
zlib had consumed all the input at the start of the loop, as
it might still want to generate output from what is in its
internal state.
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

The filter istream pulls data from an "upstream" stream,
running it through a filter function. However, we did not
properly notice when the upstream filter yielded an error,
and just returned what we had read. Instead, we should
propagate the error.
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

It's possible for read_istream to return an error, in which
case we just end up in an infinite loop (aside from EOF, we
do not even look at the result, but just feed it straight
into our running hash).
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

We call read_istream, but never check its return value for
errors. This can lead to us looping infinitely, as we just
keep trying to write "-1" bytes (and we do not notice the
error, as we simply check that write_in_full reports the
same number of bytes we fed it, which of course is also -1).
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Not that we do not actively encourage having annotated tags outside
refs/tags/ hierarchy, but they were not advertised correctly to the
ls-remote and fetch with recent version of Git.

* jk/fully-peeled-packed-ref:
  pack-refs: add fully-peeled trait
  pack-refs: write peeled entry for non-tags
  use parse_object_or_die instead of die("bad object")
  avoid segfaults on parse_object failure

* jk/fast-export-object-lookup:
  fast-export: do not load blob objects twice
  fast-export: rename handle_object function

Recent optimization broke shallow clones.

* jk/peel-ref:
  upload-pack: load non-tip "want" objects from disk
  upload-pack: make sure "want" objects are parsed
  upload-pack: drop lookup-before-parse optimization

"git cmd -- ':(top'" was not diagnosed as an invalid syntax, and
instead the parser kept reading beyond the end of the string.

* lf/setup-prefix-pathspec:
  setup.c: check that the pathspec magic ends with ")"
  setup.c: stop prefix_pathspec() from looping past the end of string

"git tag -f <tag>" always said "Updated tag '<tag>'" even when
creating a new tag (i.e. not overwriting nor updating).

* ph/tag-force-no-warn-on-creation:
  tag: --force does not have to warn when creating tags

A few workarounds for systems with unsigned time_t.

* mg/unsigned-time-t:
  Fix time offset calculation in case of unsigned time_t
  date.c: fix unsigned time_t comparison

* jk/suppress-clang-warning:
  fix clang -Wtautological-compare with unsigned enum

"git p4" did not behave well when the path to the root of the P4
client was not its real path.

* pw/p4-symlinked-root:
  git p4: avoid expanding client paths in chdir
  git p4 test: should honor symlink in p4 client root
  git p4 test: make sure P4CONFIG relative path works

"git archive" reports a failure when asked to create an archive out
of an empty tree.  It would be more intuitive to give an empty
archive back in such a case.

* jk/empty-archive:
  archive: handle commits with an empty tree
  test-lib: factor out $GIT_UNZIP setup

When "format-patch" quoted a non-ascii strings on the header files,
it incorrectly applied rfc2047 and chopped a single character in
the middle of it.

* ks/rfc2047-one-char-at-a-time:
  format-patch: RFC 2047 says multi-octet character may not be split

An aliased command spawned from a bare repository that does not say
it is bare with "core.bare = yes" is treated as non-bare by mistake.

* jk/alias-in-bare:
  setup: suppress implicit "." work-tree for bare repos
  environment: add GIT_PREFIX to local_repo_env
  cache.h: drop LOCAL_REPO_ENV_SIZE

The new "--follow-tags" option tells "git push" to push relevant
annotated tags when pushing branches out.

* jc/push-follow-tag:
  push: --follow-tags
  commit.c: use clear_commit_marks_many() in in_merge_bases_many()
  commit.c: add in_merge_bases_many()
  commit.c: add clear_commit_marks_many()

In "git reflog expire", REACHABLE bit was not cleared from the
correct objects.

* jc/maint-reflog-expire-clean-mark-typofix:
  reflog: fix typo in "reflog expire" clean-up codepath

The logic used by "git diff -M --stat" to shorten the names of
files before and after a rename did not work correctly when the
common prefix and suffix between the two filenames overlapped.

* ap/maint-diff-rename-avoid-overlap:
  tests: make sure rename pretty print works
  diff: prevent pprint_rename from underrunning input
  diff: Fix rename pretty-print when suffix and prefix overlap

There was no Porcelain way to say "I no longer am interested in
this submodule", once you express your interest in a submodule with
"submodule init".  "submodule deinit" is the way to do so.

* jl/submodule-deinit:
  submodule: add 'deinit' command

The "--match=<pattern>" option of "git describe", when used with
"--all" to allow refs that are not annotated tags to be used as a
base of description, did not restrict the output from the command
to those that match the given pattern.

We may want to have a looser matching that does not restrict to tags,
but that can be done as a follow-up topic; this step is purely a bugfix.

* jc/describe:
  describe: --match=<pattern> must limit the refs even when used with --all

Teach "git pull --rebase" to pass "-v/-q" command line options to
underlying "git rebase".

* pe/pull-rebase-v-q:
  pull: Apply -q and -v options to rebase mode as well

* maint:
  Start preparing for 1.8.2.1
  transport.c: help gcc 4.6.3 users by squelching compiler warning

... at the same time, preparation for 1.8.1.6 also has started ;-)
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

In the v1.8.0 era, we changed symbols that do not have to be global
to file scope static, but a few functions in graph.c were used by
CGit from sideways bypassing the entry points of the API the
in-tree users use.

* jk/graph-c-expose-symbols-for-cgit:
  Revert "graph.c: mark private file-scope symbols as static"

* maint-1.8.1:
  bundle: Add colons to list headings in "verify"
  bundle: Fix "verify" output if history is complete
  Documentation: filter-branch env-filter example
  git-filter-branch.txt: clarify ident variables usage
  git-compat-util.h: Provide missing netdb.h definitions
  describe: Document --match pattern format
  Documentation/githooks: Explain pre-rebase parameters
  update-index: list supported idx versions and their features
  diff-options: unconfuse description of --color
  read-cache.c: use INDEX_FORMAT_{LB,UB} in verify_hdr()
  index-format.txt: mention of v4 is missing in some places

"git bundle verify" did not say "records a complete history" for a
bundle that does not have any prerequisites.

* lf/bundle-verify-list-prereqs:
  bundle: Add colons to list headings in "verify"
  bundle: Fix "verify" output if history is complete

Add an example use of "--env-filter" in "filter-branch"
documentation.

* tk/doc-filter-branch:
  Documentation: filter-branch env-filter example
  git-filter-branch.txt: clarify ident variables usage

Some sources failed to compile on systems that lack NI_MAXHOST in
their system header.

* dm/ni-maxhost-may-be-missing:
  git-compat-util.h: Provide missing netdb.h definitions

The "--match=<pattern>" argument "git describe" takes uses glob
pattern but it wasn't obvious from the documentation.

* gp/describe-match-uses-glob-pattern:
  describe: Document --match pattern format

The v4 index format was not documented.

* nd/doc-index-format:
  update-index: list supported idx versions and their features
  read-cache.c: use INDEX_FORMAT_{LB,UB} in verify_hdr()
  index-format.txt: mention of v4 is missing in some places

The arguments given to pre-rebase hook were not documented.

* wk/doc-pre-rebase:
  Documentation/githooks: Explain pre-rebase parameters

The "--color=<when>" argument to the commands in the diff family
was described poorly.

* jc/color-diff-doc:
  diff-options: unconfuse description of --color

To a human reader, it is quite obvious that cmp is assigned before
it is used, but gcc 4.6.3 that ships with Ubuntu 12.04 is among
those that do not get this right.
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>