cmd/gitbayd/backup_test.go

  1package main
  2
  3import (
  4	"archive/tar"
  5	"compress/gzip"
  6	"crypto/sha256"
  7	"encoding/hex"
  8	"errors"
  9	"io"
 10	"io/fs"
 11	"os"
 12	"os/exec"
 13	"path/filepath"
 14	"sort"
 15	"strconv"
 16	"strings"
 17	"testing"
 18	"time"
 19
 20	"filippo.io/age"
 21
 22	"gitbay.org/gitbay/internal/backuplock"
 23	"gitbay.org/gitbay/internal/config"
 24	"gitbay.org/gitbay/internal/gitutil"
 25)
 26
 27// members lists the archive's entries by name.
 28func members(t *testing.T, path string) []string {
 29	t.Helper()
 30	f, err := os.Open(path)
 31	if err != nil {
 32		t.Fatal(err)
 33	}
 34	defer f.Close()
 35	gz, err := gzip.NewReader(f)
 36	if err != nil {
 37		t.Fatal(err)
 38	}
 39	var names []string
 40	tr := tar.NewReader(gz)
 41	for {
 42		hdr, err := tr.Next()
 43		if err == io.EOF {
 44			break
 45		}
 46		if err != nil {
 47			t.Fatal(err)
 48		}
 49		names = append(names, hdr.Name)
 50	}
 51	sort.Strings(names)
 52	return names
 53}
 54
 55// --db-only is what makes an hourly schedule affordable, so it has to leave
 56// the repositories out and still carry a restorable database.
 57func TestBackupDBOnlyOmitsRepositories(t *testing.T) {
 58	cfg := testConfig(t)
 59	root := cfg.Server.Root
 60	s, err := openStore(cfg)
 61	if err != nil {
 62		t.Fatal(err)
 63	}
 64	s.Close()
 65
 66	repo := filepath.Join(root, "repos", "krz", "thing.git")
 67	if err := os.MkdirAll(repo, 0o750); err != nil {
 68		t.Fatal(err)
 69	}
 70	if err := os.WriteFile(filepath.Join(repo, "HEAD"), []byte("ref: refs/heads/main\n"), 0o640); err != nil {
 71		t.Fatal(err)
 72	}
 73
 74	full := filepath.Join(t.TempDir(), "full.tar.gz")
 75	if err := runBackup(cfg, full, false); err != nil {
 76		t.Fatalf("full backup: %v", err)
 77	}
 78	dbOnly := filepath.Join(t.TempDir(), "db.tar.gz")
 79	if err := runBackup(cfg, dbOnly, true); err != nil {
 80		t.Fatalf("db-only backup: %v", err)
 81	}
 82
 83	fullNames := members(t, full)
 84	if len(fullNames) < 2 {
 85		t.Fatalf("full backup carries only %v", fullNames)
 86	}
 87	var sawRepo bool
 88	for _, n := range fullNames {
 89		if n == "repos/krz/thing.git/HEAD" {
 90			sawRepo = true
 91		}
 92	}
 93	if !sawRepo {
 94		t.Errorf("full backup is missing the repository: %v", fullNames)
 95	}
 96
 97	if got := members(t, dbOnly); len(got) != 1 || got[0] != "gitbay.db" {
 98		t.Errorf("db-only backup carries %v, want [gitbay.db]", got)
 99	}
100
101	fi, err := os.Stat(dbOnly)
102	if err != nil {
103		t.Fatal(err)
104	}
105	if fi.Size() == 0 {
106		t.Error("db-only backup is empty")
107	}
108}
109
110func TestBackupEncryptedToAgeRecipient(t *testing.T) {
111	cfg := testConfig(t)
112	id, err := age.GenerateX25519Identity()
113	if err != nil {
114		t.Fatal(err)
115	}
116	cfg.Backup.AgeRecipients = []string{id.Recipient().String()}
117	s, err := openStore(cfg)
118	if err != nil {
119		t.Fatal(err)
120	}
121	s.Close()
122
123	out := filepath.Join(t.TempDir(), "b.tar.gz.age")
124	if err := runBackup(cfg, out, true); err != nil {
125		t.Fatal(err)
126	}
127	head := make([]byte, 22)
128	f, err := os.Open(out)
129	if err != nil {
130		t.Fatal(err)
131	}
132	_, err = io.ReadFull(f, head)
133	f.Close()
134	if err != nil {
135		t.Fatal(err)
136	}
137	if string(head) != "age-encryption.org/v1\n" {
138		t.Fatalf("archive is not age-encrypted: %q", head)
139	}
140
141	if err := verifyBackup(out, ""); err == nil || !strings.Contains(err.Error(), "--identity") {
142		t.Fatalf("verify without an identity: %v", err)
143	}
144	idFile := filepath.Join(t.TempDir(), "backup-identity.txt")
145	if err := os.WriteFile(idFile, []byte(id.String()+"\n"), 0o600); err != nil {
146		t.Fatal(err)
147	}
148	if err := verifyBackup(out, idFile); err != nil {
149		t.Fatalf("verify with the identity: %v", err)
150	}
151	other, err := age.GenerateX25519Identity()
152	if err != nil {
153		t.Fatal(err)
154	}
155	otherFile := filepath.Join(t.TempDir(), "other.txt")
156	if err := os.WriteFile(otherFile, []byte(other.String()+"\n"), 0o600); err != nil {
157		t.Fatal(err)
158	}
159	var noMatch *age.NoIdentityMatchError
160	if err := verifyBackup(out, otherFile); !errors.As(err, &noMatch) {
161		t.Fatalf("verify with another identity: %v, want a no-identity-match error", err)
162	}
163}
164
165// leftovers lists what a backup run left in dir besides the archive.
166func leftovers(t *testing.T, dir string) []string {
167	t.Helper()
168	ents, err := os.ReadDir(dir)
169	if err != nil {
170		t.Fatal(err)
171	}
172	var names []string
173	for _, e := range ents {
174		if strings.HasPrefix(e.Name(), ".") {
175			names = append(names, e.Name())
176		}
177	}
178	return names
179}
180
181// The snapshot directory and the archive's temporary file are removed
182// whether the run succeeds or fails, and a failed run leaves no archive.
183func TestBackupLeavesNoTemporaries(t *testing.T) {
184	cfg := testConfig(t)
185	id, err := age.GenerateX25519Identity()
186	if err != nil {
187		t.Fatal(err)
188	}
189	cfg.Backup.AgeRecipients = []string{id.Recipient().String()}
190	s, err := openStore(cfg)
191	if err != nil {
192		t.Fatal(err)
193	}
194	s.Close()
195
196	dir := t.TempDir()
197	out := filepath.Join(dir, "ok.tar.gz.age")
198	if err := runBackup(cfg, out, false); err != nil {
199		t.Fatal(err)
200	}
201	if got := leftovers(t, dir); len(got) != 0 {
202		t.Errorf("after a successful run: %v", got)
203	}
204	fi, err := os.Stat(out)
205	if err != nil {
206		t.Fatal(err)
207	}
208	if fi.Mode().Perm() != 0o600 {
209		t.Errorf("archive mode %v, want 0600", fi.Mode().Perm())
210	}
211
212	// A file the walk cannot read fails the run after the snapshot and
213	// the temporary archive exist. Root reads a mode-0 file, so the case
214	// needs an unprivileged user.
215	if os.Geteuid() == 0 {
216		t.Log("running as root: skipping the mid-walk failure case")
217	} else {
218		unreadable := filepath.Join(cfg.Server.Root, "unreadable")
219		if err := os.WriteFile(unreadable, []byte("x"), 0o000); err != nil {
220			t.Fatal(err)
221		}
222		failed := filepath.Join(dir, "failed.tar.gz.age")
223		err := runBackup(cfg, failed, false)
224		os.Remove(unreadable)
225		if err == nil {
226			t.Fatal("backup with an unreadable file succeeded")
227		}
228		if _, err := os.Stat(failed); !os.IsNotExist(err) {
229			t.Errorf("failed run left an archive: %v", err)
230		}
231		if got := leftovers(t, dir); len(got) != 0 {
232			t.Errorf("after a failed run: %v", got)
233		}
234	}
235
236	bad := cfg
237	bad.Backup.AgeRecipients = []string{"age1x"}
238	if err := runBackup(bad, filepath.Join(dir, "bad.tar.gz.age"), true); err == nil {
239		t.Fatal("backup with a bad recipient succeeded")
240	}
241	if got := leftovers(t, dir); len(got) != 0 {
242		t.Errorf("after a bad recipient: %v", got)
243	}
244}
245
246func TestBackupRefusesAgeNameWithoutRecipients(t *testing.T) {
247	cfg := testConfig(t)
248	out := filepath.Join(t.TempDir(), "b.tar.gz.age")
249	err := runBackup(cfg, out, true)
250	if err == nil || !strings.Contains(err.Error(), "age_recipients") {
251		t.Fatalf("got %v, want a refusal naming age_recipients", err)
252	}
253}
254
255// A truncated archive fails verification even when the tar stream's end
256// markers survive: gzip's trailer and age's final chunk are checked.
257func TestVerifyRejectsTruncatedArchive(t *testing.T) {
258	cfg := testConfig(t)
259	s, err := openStore(cfg)
260	if err != nil {
261		t.Fatal(err)
262	}
263	s.Close()
264	dir := t.TempDir()
265	plain := filepath.Join(dir, "p.tar.gz")
266	if err := runBackup(cfg, plain, true); err != nil {
267		t.Fatal(err)
268	}
269	id, err := age.GenerateX25519Identity()
270	if err != nil {
271		t.Fatal(err)
272	}
273	enc := cfg
274	enc.Backup.AgeRecipients = []string{id.Recipient().String()}
275	sealed := filepath.Join(dir, "e.tar.gz.age")
276	if err := runBackup(enc, sealed, true); err != nil {
277		t.Fatal(err)
278	}
279	idFile := filepath.Join(dir, "id.txt")
280	if err := os.WriteFile(idFile, []byte(id.String()+"\n"), 0o600); err != nil {
281		t.Fatal(err)
282	}
283	if err := verifyBackup(plain, ""); err != nil {
284		t.Fatalf("intact plain archive: %v", err)
285	}
286	if err := verifyBackup(sealed, idFile); err != nil {
287		t.Fatalf("intact encrypted archive: %v", err)
288	}
289
290	for _, c := range []struct {
291		src      string
292		cut      int
293		identity string
294	}{
295		{plain, 1, ""},
296		{sealed, 1, idFile},
297		{sealed, 100, idFile},
298	} {
299		data, err := os.ReadFile(c.src)
300		if err != nil {
301			t.Fatal(err)
302		}
303		short := filepath.Join(dir, "short-"+filepath.Base(c.src))
304		if err := os.WriteFile(short, data[:len(data)-c.cut], 0o600); err != nil {
305			t.Fatal(err)
306		}
307		if err := verifyBackup(short, c.identity); err == nil {
308			t.Errorf("%s cut by %d bytes verified", filepath.Base(c.src), c.cut)
309		}
310	}
311}
312
313func TestArchivePath(t *testing.T) {
314	now := time.Date(2026, 9, 27, 9, 0, 0, 0, time.UTC)
315	plain := testConfig(t)
316	enc := plain
317	enc.Backup.AgeRecipients = []string{"age1x"}
318	for _, c := range []struct {
319		out  string
320		cfg  config.Config
321		want string
322	}{
323		{"", plain, "gitbay-backup-20260927-090000.tar.gz"},
324		{"", enc, "gitbay-backup-20260927-090000.tar.gz.age"},
325		{"/b/x.tar.gz", enc, "/b/x.tar.gz.age"},
326		{"/b/x.tar.gz.age", enc, "/b/x.tar.gz.age"},
327		{"/b/x.tar.gz", plain, "/b/x.tar.gz"},
328	} {
329		if got := archivePath(c.out, c.cfg, now); got != c.want {
330			t.Errorf("archivePath(%q) = %q, want %q", c.out, got, c.want)
331		}
332	}
333}
334
335func gitIn(t *testing.T, dir string, args ...string) string {
336	t.Helper()
337	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
338	cmd.Env = append(os.Environ(),
339		"GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@e",
340		"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@e")
341	out, err := cmd.CombinedOutput()
342	if err != nil {
343		t.Fatalf("git %v: %v\n%s", args, err, out)
344	}
345	return strings.TrimSpace(string(out))
346}
347
348// verify runs git's connectivity check on every repository the
349// database names: a repository missing an object fails it.
350func TestVerifyChecksConnectivity(t *testing.T) {
351	cfg := testConfig(t)
352	st, err := openStore(cfg)
353	if err != nil {
354		t.Fatal(err)
355	}
356	uid, err := st.CreateUser("krz", false)
357	if err != nil {
358		t.Fatal(err)
359	}
360	if _, err := st.CreateRepo("user", uid, "thing", "public"); err != nil {
361		t.Fatal(err)
362	}
363	st.Close()
364
365	work := t.TempDir()
366	gitIn(t, work, "init", "-q", "-b", "main")
367	if err := os.WriteFile(filepath.Join(work, "a.txt"), []byte("a\n"), 0o644); err != nil {
368		t.Fatal(err)
369	}
370	gitIn(t, work, "add", "a.txt")
371	gitIn(t, work, "commit", "-q", "-m", "one")
372	dir := filepath.Join(cfg.Server.Root, "repos", "krz", "thing.git")
373	gitIn(t, work, "clone", "-q", "--bare", work, dir)
374
375	good := filepath.Join(t.TempDir(), "good.tar.gz")
376	if err := runBackup(cfg, good, false); err != nil {
377		t.Fatal(err)
378	}
379	if err := verifyBackup(good, ""); err != nil {
380		t.Fatalf("intact archive: %v", err)
381	}
382
383	blob := gitIn(t, dir, "rev-parse", "HEAD:a.txt")
384	if err := os.Remove(filepath.Join(dir, "objects", blob[:2], blob[2:])); err != nil {
385		t.Fatal(err)
386	}
387	bad := filepath.Join(t.TempDir(), "bad.tar.gz")
388	if err := runBackup(cfg, bad, false); err != nil {
389		t.Fatal(err)
390	}
391	err = verifyBackup(bad, "")
392	if err == nil || !strings.Contains(err.Error(), "krz/thing") || !strings.Contains(err.Error(), "connectivity") {
393		t.Fatalf("archive with a missing blob: %v", err)
394	}
395}
396
397// A full backup waits for a delete under way, and does not archive its
398// own lock file.
399func TestFullBackupWaitsForRepositoryMoves(t *testing.T) {
400	cfg := testConfig(t)
401	s, err := openStore(cfg)
402	if err != nil {
403		t.Fatal(err)
404	}
405	s.Close()
406	inFlight, err := backuplock.TryShared(cfg.Server.Root)
407	if err != nil {
408		t.Fatal(err)
409	}
410	out := filepath.Join(t.TempDir(), "b.tar.gz")
411	done := make(chan error, 1)
412	go func() { done <- runBackup(cfg, out, false) }()
413	select {
414	case err := <-done:
415		t.Fatalf("backup finished while a delete held the lock: %v", err)
416	case <-time.After(200 * time.Millisecond):
417	}
418	inFlight()
419	select {
420	case err := <-done:
421		if err != nil {
422			t.Fatal(err)
423		}
424	case <-time.After(10 * time.Second):
425		t.Fatal("backup never started after the delete finished")
426	}
427	for _, n := range members(t, out) {
428		if n == backuplock.Name {
429			t.Fatalf("archive carries %s", n)
430		}
431	}
432}
433
434// A repository with every ref packed keeps its empty refs/heads and
435// refs/tags directories through backup and extraction, the same as a real
436// restore would: git needs refs/ to recognize a bare repository at all,
437// even when every ref lives in packed-refs (#259).
438func TestBackupPreservesPackedRefDirs(t *testing.T) {
439	cfg := testConfig(t)
440	st, err := openStore(cfg)
441	if err != nil {
442		t.Fatal(err)
443	}
444	uid, err := st.CreateUser("krz", false)
445	if err != nil {
446		t.Fatal(err)
447	}
448	if _, err := st.CreateRepo("user", uid, "thing", "public"); err != nil {
449		t.Fatal(err)
450	}
451	st.Close()
452
453	work := t.TempDir()
454	gitIn(t, work, "init", "-q", "-b", "main")
455	if err := os.WriteFile(filepath.Join(work, "a.txt"), []byte("a\n"), 0o644); err != nil {
456		t.Fatal(err)
457	}
458	gitIn(t, work, "add", "a.txt")
459	gitIn(t, work, "commit", "-q", "-m", "one")
460	dir := filepath.Join(cfg.Server.Root, "repos", "krz", "thing.git")
461	gitIn(t, work, "clone", "-q", "--bare", work, dir)
462	gitIn(t, dir, "pack-refs", "--all")
463	entries, err := os.ReadDir(filepath.Join(dir, "refs", "heads"))
464	if err != nil {
465		t.Fatal(err)
466	}
467	if len(entries) != 0 {
468		t.Fatalf("refs/heads not empty after pack-refs --all: %v", entries)
469	}
470
471	archive := filepath.Join(t.TempDir(), "b.tar.gz")
472	if err := runBackup(cfg, archive, false); err != nil {
473		t.Fatal(err)
474	}
475
476	// verify sees the archive exactly as a restore would: no workaround.
477	if err := verifyBackup(archive, ""); err != nil {
478		t.Fatalf("verify: %v", err)
479	}
480
481	restored := t.TempDir()
482	if out, err := exec.Command("tar", "-xzf", archive, "-C", restored).CombinedOutput(); err != nil {
483		t.Fatalf("extract: %v\n%s", err, out)
484	}
485	restoredRepo := filepath.Join(restored, "repos", "krz", "thing.git")
486	if got := gitIn(t, restoredRepo, "rev-parse", "--verify", "HEAD"); got == "" {
487		t.Fatal("rev-parse --verify HEAD returned nothing after restore")
488	}
489	gitIn(t, restoredRepo, "fsck", "--connectivity-only", "--no-progress", "--no-dangling")
490}
491
492// A commit pushed after a repository's refs are archived and before its
493// objects are leaves the archive with the earlier refs and every object
494// they reach, plus the new ones unreferenced (#259).
495func TestBackupArchivesRefsBeforeObjects(t *testing.T) {
496	cfg := testConfig(t)
497	st, err := openStore(cfg)
498	if err != nil {
499		t.Fatal(err)
500	}
501	uid, err := st.CreateUser("krz", false)
502	if err != nil {
503		t.Fatal(err)
504	}
505	if _, err := st.CreateRepo("user", uid, "thing", "public"); err != nil {
506		t.Fatal(err)
507	}
508	st.Close()
509
510	work := t.TempDir()
511	gitIn(t, work, "init", "-q", "-b", "main")
512	if err := os.WriteFile(filepath.Join(work, "a.txt"), []byte("a\n"), 0o644); err != nil {
513		t.Fatal(err)
514	}
515	gitIn(t, work, "add", "a.txt")
516	gitIn(t, work, "commit", "-q", "-m", "one")
517	dir := filepath.Join(cfg.Server.Root, "repos", "krz", "thing.git")
518	gitIn(t, work, "clone", "-q", "--bare", work, dir)
519	first := gitIn(t, dir, "rev-parse", "refs/heads/main")
520
521	var second string
522	afterRefs = func(repo string) {
523		if repo != dir {
524			return
525		}
526		if err := os.WriteFile(filepath.Join(work, "b.txt"), []byte("b\n"), 0o644); err != nil {
527			t.Fatal(err)
528		}
529		gitIn(t, work, "add", "b.txt")
530		gitIn(t, work, "commit", "-q", "-m", "two")
531		gitIn(t, work, "push", "-q", dir, "main")
532		second = gitIn(t, dir, "rev-parse", "refs/heads/main")
533	}
534	t.Cleanup(func() { afterRefs = func(string) {} })
535
536	archive := filepath.Join(t.TempDir(), "b.tar.gz")
537	if err := runBackup(cfg, archive, false); err != nil {
538		t.Fatal(err)
539	}
540	if second == "" || second == first {
541		t.Fatal("the push between the refs and the objects did not happen")
542	}
543	if err := verifyBackup(archive, ""); err != nil {
544		t.Fatalf("verify: %v", err)
545	}
546	restored := t.TempDir()
547	if out, err := exec.Command("tar", "-xzf", archive, "-C", restored).CombinedOutput(); err != nil {
548		t.Fatalf("extract: %v\n%s", err, out)
549	}
550	repo := filepath.Join(restored, "repos", "krz", "thing.git")
551	if got := gitIn(t, repo, "rev-parse", "refs/heads/main"); got != first {
552		t.Errorf("archived main is %s, want %s from before the push", got, first)
553	}
554	gitIn(t, repo, "cat-file", "-e", second)
555}
556
557// A pack removed between the walk listing it and reading it is skipped,
558// and verify's fsck then reports what it held; a vanished file outside
559// objects/ still fails the backup.
560func TestBackupSkipsVanishedObjects(t *testing.T) {
561	cfg := testConfig(t)
562	st, err := openStore(cfg)
563	if err != nil {
564		t.Fatal(err)
565	}
566	uid, err := st.CreateUser("krz", false)
567	if err != nil {
568		t.Fatal(err)
569	}
570	if _, err := st.CreateRepo("user", uid, "thing", "public"); err != nil {
571		t.Fatal(err)
572	}
573	st.Close()
574
575	work := t.TempDir()
576	gitIn(t, work, "init", "-q", "-b", "main")
577	if err := os.WriteFile(filepath.Join(work, "a.txt"), []byte("a\n"), 0o644); err != nil {
578		t.Fatal(err)
579	}
580	gitIn(t, work, "add", "a.txt")
581	gitIn(t, work, "commit", "-q", "-m", "one")
582	dir := filepath.Join(cfg.Server.Root, "repos", "krz", "thing.git")
583	gitIn(t, work, "clone", "-q", "--bare", work, dir)
584	gitIn(t, dir, "repack", "-q", "-a", "-d")
585
586	removed := ""
587	beforeAdd = func(path string) {
588		if removed == "" && strings.HasSuffix(path, ".pack") {
589			removed = path
590			os.Remove(path)
591		}
592	}
593	t.Cleanup(func() { beforeAdd = func(string) {} })
594	archive := filepath.Join(t.TempDir(), "b.tar.gz")
595	if err := runBackup(cfg, archive, false); err != nil {
596		t.Fatalf("backup with a vanished pack: %v", err)
597	}
598	if removed == "" {
599		t.Fatal("no pack was archived")
600	}
601	for _, n := range members(t, archive) {
602		if strings.HasSuffix(n, ".pack") {
603			t.Errorf("archive carries %s", n)
604		}
605	}
606	if err := verifyBackup(archive, ""); err == nil || !strings.Contains(err.Error(), "connectivity") {
607		t.Errorf("verify of an archive missing its pack: %v", err)
608	}
609
610	beforeAdd = func(path string) {
611		if strings.HasSuffix(path, filepath.Join("thing.git", "config")) {
612			os.Remove(path)
613		}
614	}
615	err = runBackup(cfg, filepath.Join(t.TempDir(), "c.tar.gz"), false)
616	if !errors.Is(err, fs.ErrNotExist) {
617		t.Fatalf("backup with a vanished config: %v, want not-exist", err)
618	}
619}
620
621// gc refuses while a full backup holds the lock.
622func TestGCRefusedDuringBackup(t *testing.T) {
623	cfg := testConfig(t)
624	release, err := backuplock.Hold(cfg.Server.Root)
625	if err != nil {
626		t.Fatal(err)
627	}
628	defer release()
629	if err := runGC(cfg, "", false, false); !errors.Is(err, backuplock.ErrBusy) {
630		t.Fatalf("gc during a backup: %v", err)
631	}
632}
633
634// A backup and its verify need no key file: sealed values are copied as
635// they are. A missing database is refused rather than created.
636func TestBackupNeedsNoKeyFile(t *testing.T) {
637	cfg := testConfig(t)
638	out := filepath.Join(t.TempDir(), "b.tar.gz")
639	if err := runBackup(cfg, out, false); !errors.Is(err, fs.ErrNotExist) {
640		t.Fatalf("backup without a database: %v", err)
641	}
642	if _, err := os.Stat(filepath.Join(cfg.Server.Root, "gitbay.db")); !os.IsNotExist(err) {
643		t.Fatalf("backup created a database: %v", err)
644	}
645	s, err := openStore(cfg)
646	if err != nil {
647		t.Fatal(err)
648	}
649	s.Close()
650	if err := os.Remove(cfg.Server.SecretKeyFile); err != nil {
651		t.Fatal(err)
652	}
653	if err := runBackup(cfg, out, false); err != nil {
654		t.Fatalf("backup without the key file: %v", err)
655	}
656	if err := verifyBackup(out, ""); err != nil {
657		t.Fatalf("verify without the key file: %v", err)
658	}
659}
660
661// A run removes what a killed run left beside the archive once it is a
662// day old, and leaves younger ones, which may belong to a run under way.
663func TestBackupRemovesStaleTemporaries(t *testing.T) {
664	cfg := testConfig(t)
665	s, err := openStore(cfg)
666	if err != nil {
667		t.Fatal(err)
668	}
669	s.Close()
670	dir := t.TempDir()
671	old := time.Now().Add(-25 * time.Hour)
672	mk := func(name string, isDir bool, mtime time.Time) {
673		p := filepath.Join(dir, name)
674		if isDir {
675			if err := os.Mkdir(p, 0o700); err != nil {
676				t.Fatal(err)
677			}
678		} else if err := os.WriteFile(p, []byte("x"), 0o600); err != nil {
679			t.Fatal(err)
680		}
681		if err := os.Chtimes(p, mtime, mtime); err != nil {
682			t.Fatal(err)
683		}
684	}
685	mk(".gitbay-snap-old", true, old)
686	mk(".b.tar.gz.tmp-123", false, old)
687	mk(".gitbay-snap-new", true, time.Now())
688	mk(".b.tar.gz.tmp-456", false, time.Now())
689	mk(".keep", false, old)
690	mk(".notes.tmp-draft", false, old)
691	if err := runBackup(cfg, filepath.Join(dir, "b.tar.gz"), true); err != nil {
692		t.Fatal(err)
693	}
694	got := leftovers(t, dir)
695	want := []string{".b.tar.gz.tmp-456", ".gitbay-snap-new", ".keep", ".notes.tmp-draft"}
696	sort.Strings(got)
697	if strings.Join(got, " ") != strings.Join(want, " ") {
698		t.Errorf("left %v, want %v", got, want)
699	}
700}
701
702// An archive written under server.root, directly or through a symlink,
703// would be in the next full backup, so it is refused.
704func TestBackupRefusesOutputInsideRoot(t *testing.T) {
705	cfg := testConfig(t)
706	s, err := openStore(cfg)
707	if err != nil {
708		t.Fatal(err)
709	}
710	s.Close()
711	link := filepath.Join(t.TempDir(), "link")
712	if err := os.Symlink(cfg.Server.Root, link); err != nil {
713		t.Fatal(err)
714	}
715	for _, out := range []string{
716		filepath.Join(cfg.Server.Root, "b.tar.gz"),
717		filepath.Join(cfg.Server.Root, "backups", "b.tar.gz"),
718		filepath.Join(link, "b.tar.gz"),
719	} {
720		if err := runBackup(cfg, out, true); err == nil || !strings.Contains(err.Error(), "inside server.root") {
721			t.Errorf("%s: %v", out, err)
722		}
723	}
724}
725
726// verify does not extract objects/info/alternates, so an archived
727// repository cannot borrow objects from paths outside the archive.
728func TestVerifyIgnoresAlternates(t *testing.T) {
729	cfg := testConfig(t)
730	st, err := openStore(cfg)
731	if err != nil {
732		t.Fatal(err)
733	}
734	uid, err := st.CreateUser("krz", false)
735	if err != nil {
736		t.Fatal(err)
737	}
738	if _, err := st.CreateRepo("user", uid, "thing", "public"); err != nil {
739		t.Fatal(err)
740	}
741	st.Close()
742
743	work := t.TempDir()
744	gitIn(t, work, "init", "-q", "-b", "main")
745	if err := os.WriteFile(filepath.Join(work, "a.txt"), []byte("a\n"), 0o644); err != nil {
746		t.Fatal(err)
747	}
748	gitIn(t, work, "add", "a.txt")
749	gitIn(t, work, "commit", "-q", "-m", "one")
750	dir := filepath.Join(cfg.Server.Root, "repos", "krz", "thing.git")
751	gitIn(t, work, "clone", "-q", "--bare", "--shared", work, dir)
752	if _, err := os.Stat(filepath.Join(dir, "objects", "info", "alternates")); err != nil {
753		t.Fatal(err)
754	}
755	gitIn(t, dir, "fsck", "--connectivity-only", "--no-progress")
756
757	archive := filepath.Join(t.TempDir(), "b.tar.gz")
758	if err := runBackup(cfg, archive, false); err != nil {
759		t.Fatal(err)
760	}
761	if err := verifyBackup(archive, ""); err == nil || !strings.Contains(err.Error(), "connectivity") {
762		t.Fatalf("verify of a repository whose objects are only in an alternate: %v", err)
763	}
764}
765
766func TestBorrowsObjectsMember(t *testing.T) {
767	for name, want := range map[string]bool{
768		"repos/a/b.git/objects/info/alternates":      true,
769		"repos/a/b.git/objects/info/./alternates":    true,
770		"repos/a/b.git/objects/info/Alternates":      true,
771		"repos/a/b.git/objects/info/http-alternates": true,
772		"repos/a/b.git/objects/info/packs":           false,
773		"repos/a/b.git/refs/heads/alternates":        false,
774		"repos/a/b.git/commondir":                    true,
775		"repos/a/b.git/CommonDir":                    true,
776		"repos/a/b.git/refs/heads/commondir":         false,
777	} {
778		if got := borrowsObjects(name); got != want {
779			t.Errorf("borrowsObjects(%q) = %v, want %v", name, got, want)
780		}
781	}
782}
783
784// verify does not extract a commondir, so an archived repository with
785// none of its own objects cannot pass by pointing git at a repository on
786// the host.
787func TestVerifyIgnoresCommondir(t *testing.T) {
788	cfg := testConfig(t)
789	st, err := openStore(cfg)
790	if err != nil {
791		t.Fatal(err)
792	}
793	uid, err := st.CreateUser("krz", false)
794	if err != nil {
795		t.Fatal(err)
796	}
797	if _, err := st.CreateRepo("user", uid, "thing", "public"); err != nil {
798		t.Fatal(err)
799	}
800	st.Close()
801
802	work := t.TempDir()
803	gitIn(t, work, "init", "-q", "-b", "main")
804	if err := os.WriteFile(filepath.Join(work, "a.txt"), []byte("a\n"), 0o644); err != nil {
805		t.Fatal(err)
806	}
807	gitIn(t, work, "add", "a.txt")
808	gitIn(t, work, "commit", "-q", "-m", "one")
809	host := filepath.Join(t.TempDir(), "host.git")
810	gitIn(t, work, "clone", "-q", "--bare", work, host)
811	gitIn(t, host, "pack-refs", "--all")
812
813	// A repository whose refs are its own and whose objects directory is
814	// empty, borrowing everything else from host through commondir.
815	dir := filepath.Join(cfg.Server.Root, "repos", "krz", "thing.git")
816	for _, d := range []string{"objects", "refs"} {
817		if err := os.MkdirAll(filepath.Join(dir, d), 0o755); err != nil {
818			t.Fatal(err)
819		}
820	}
821	packed, err := os.ReadFile(filepath.Join(host, "packed-refs"))
822	if err != nil {
823		t.Fatal(err)
824	}
825	for name, body := range map[string]string{
826		"HEAD":        "ref: refs/heads/main\n",
827		"packed-refs": string(packed),
828		"commondir":   host + "\n",
829	} {
830		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o644); err != nil {
831			t.Fatal(err)
832		}
833	}
834	if err := gitutil.FsckConnectivity(dir); err != nil {
835		t.Fatalf("with commondir on the host the repository should pass: %v", err)
836	}
837
838	archive := filepath.Join(t.TempDir(), "b.tar.gz")
839	if err := runBackup(cfg, archive, false); err != nil {
840		t.Fatal(err)
841	}
842	if err := verifyBackup(archive, ""); err == nil || !strings.Contains(err.Error(), "connectivity") {
843		t.Fatalf("verify of a repository whose objects are only in its commondir: %v", err)
844	}
845}
846
847// verify checks each release asset the database names against its
848// recorded digest, and each archived LFS object against its name.
849func TestVerifyChecksReleaseAssetsAndLFS(t *testing.T) {
850	cfg := testConfig(t)
851	root := cfg.Server.Root
852	st, err := openStore(cfg)
853	if err != nil {
854		t.Fatal(err)
855	}
856	uid, err := st.CreateUser("krz", false)
857	if err != nil {
858		t.Fatal(err)
859	}
860	rid, err := st.CreateRepo("user", uid, "thing", "public")
861	if err != nil {
862		t.Fatal(err)
863	}
864	relID, err := st.CreateRelease(rid, "v1", "v1", "", uid, "md")
865	if err != nil {
866		t.Fatal(err)
867	}
868	asset := []byte("binary\n")
869	sum := sha256.Sum256(asset)
870	if err := st.AddReleaseAsset(relID, "tool", int64(len(asset)), hex.EncodeToString(sum[:])); err != nil {
871		t.Fatal(err)
872	}
873	st.Close()
874	dir := filepath.Join(root, "repos", "krz", "thing.git")
875	gitIn(t, root, "init", "-q", "--bare", dir)
876	assetFile := filepath.Join(dir, "gitbay-releases", strconv.FormatInt(relID, 10), "tool")
877	writeFile(t, assetFile, asset)
878	obj := []byte("large\n")
879	oid := sha256.Sum256(obj)
880	o := hex.EncodeToString(oid[:])
881	writeFile(t, filepath.Join(root, "lfs", o[:2], o[2:4], o), obj)
882	// An upload in progress stages a temporary file beside the objects.
883	writeFile(t, filepath.Join(root, "lfs", o[:2], o[2:4], ".upload-123"), []byte("partial"))
884
885	good := filepath.Join(t.TempDir(), "good.tar.gz")
886	if err := runBackup(cfg, good, false); err != nil {
887		t.Fatal(err)
888	}
889	if err := verifyBackup(good, ""); err != nil {
890		t.Fatalf("intact archive: %v", err)
891	}
892
893	writeFile(t, assetFile, []byte("tampered\n"))
894	wrong := strings.Repeat("0", 64)
895	writeFile(t, filepath.Join(root, "lfs", "00", "00", wrong), obj)
896	bad := filepath.Join(t.TempDir(), "bad.tar.gz")
897	if err := runBackup(cfg, bad, false); err != nil {
898		t.Fatal(err)
899	}
900	err = verifyBackup(bad, "")
901	if err == nil || !strings.Contains(err.Error(), "krz/thing release") || !strings.Contains(err.Error(), wrong) {
902		t.Fatalf("archive with a bad asset and LFS object: %v", err)
903	}
904	if strings.Contains(err.Error(), o) || strings.Contains(err.Error(), ".upload-") {
905		t.Fatalf("intact LFS object or upload staging file reported: %v", err)
906	}
907}
908
909func writeFile(t *testing.T, p string, b []byte) {
910	t.Helper()
911	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
912		t.Fatal(err)
913	}
914	if err := os.WriteFile(p, b, 0o644); err != nil {
915		t.Fatal(err)
916	}
917}