Define a proper abstraction for project names and use it elsewhere in
the codebase.
The character `@` is formally reserved for PR previews from this point,
and any project names using it must be well-formed: contain no more
than a single `@` followed by a positive number.
In commit 600c8a7848, we have introduced
an unintentionally breaking change to how redirects are handled, thus
breaking every single-page application deployed to a non-index project.
This cannot be easily fixed due to Codeberg Pages already having a mix
of broken and fixed redirects in manifests without any way to tell them
apart, but we can at least emit a diagnostic for redirects that are
statically known to be broken at deploy time.
See also #273.
The listener is no longer only used for Caddy integration; it is now
a general purpose reverse proxy endpoint that can be used with e.g.
Traefik terminating TLS.
Fixes#260.
This includes:
* Verifying that the blobs' contents corresponds to their name/hash.
* Verifying that blob references in manifests and audit records refer
to blobs that exist and have matching hash.
The action differs by object type:
* Blobs with mismatching content hash are removed.
* Manifests referring to nonexistent or invalid blobs are replaced
with placeholders.
* Audit records with manifests referring to the same are detached.
This preserves the audit log in more scenarios.
The check is conservative in that all "recent enough" manifests are
skipped. The repair process is functionally equivalent to a concurrent
GC run; we don't yet have GC, and it's not feasible to implement it as
a prerequisite for this urgently needed feature, so we take an approach
that may require several re-runs in case of very recent data corruption.
While dealing with an unrelated incident I got extremely confused by
what appeared to be sha256 names with 74 characters in them. This was
never intentional, a refactoring of how temporary files are created has
created a call site with this format.
This command replaces corrupted manifests and audit records with
placeholders indicating the corrupt status of the object in question.
As a result, other operations (many of which require that all objects
can be parsed) continue to work as expected.
The contents of a corrupted site manifest is replaced with a human
readable index page explaining the situation, and every URL is
rewritten to point to that index page.
Hostnames are lowercase ASCII, so preview upload authorization would
always fail for repositories whose owners have uppercase letters in
their usernames.
Resolves: https://codeberg.org/git-pages/git-pages/issues/228
Certain S3 compatible storage providers does not support path style
bucket lookup anymore, add config option to manually specify DNS style
for minio.
Signed-off-by: imi415 <imi415@imi.moe>
The implementation contains both data races on single-word memory
accesses as well as multiple-word memory accesses which can result
in observing torn writes. It is unsafe and unsalvageable without
wrapping every access to global state into a mutex, or else stopping
request processing during a reload. Both are invasive options.
Since the server restarts very quickly, remove the handler to fix this.
For If-Modified-Since checks on the last change marker, only ever send
timestamps that we previously received from the server. This sidesteps
issues like races and anything dealing with clock precision.
Also make the code simpler to follow: handleFilterUpdates() now owns
lastRefresh, and refresh() now owns lastChanged.
Also retry with an exponential backoff if we fail to refresh the cache.
All sends to accessCh are non-blocking and are not affected.
V12-Ref: F-77198
This addresses an authorization bypass (which could occur only on
Windows).
A more principled way to do this would be to use `os.Root.OpenRoot`
and scope the actual filesystem operations per-domain. However, I
prototyped this and it was complicated enough that it wasn't clear
whether this would not introduce new issues.
V12-Ref: F-77209
Before this commit, the reader opened by `GetBlob` was not closed.
This does not matter for the current implementation of the S3 backend,
but for the FS backend the file descriptor was only closed by
the `os.file` finalizer.
V12-Ref: F-77205
This avoids exhausting RAM when reading e.g. a repository with a single
extremely large file. Note that there is still a risk of exhausting
space in `/tmp`.
V12-Ref: F-77211
Catherine
Xavier Vello
miyuko
phanirithvij
imi415
Koen Oostveen
Andrew Cassidy