[PATCH v4 0/2] blame: ignore revs in HEAD:.git-blame-ignore-revs by default

["Ravi Mistry via GitGitGadget" <gitgitgadget@gmail.com>]

This series teaches git-blame(1) and git-annotate(1) to automatically use
the HEAD:.git-blame-ignore-revs blob by default if it exists, so local runs
match hosting platforms without requiring manual blame.ignoreRevsFile
configuration in every clone. This restarts the stalled attempt in PR
https://github.com/gitgitgadget/git/pull/1809
(https://lore.kernel.org/git/pull.1809.v2.git.1728707867.gitgitgadget@gmail.com/)
and addresses https://github.com/gitgitgadget/git/issues/1494.

Changes since v3:

 * Patch 2/2 caps the size of the default HEAD:.git-blame-ignore-revs blob
   at IGNORE_REVS_MAX_FILE_SIZE (100MB, matching ATTR_MAX_FILE_SIZE from
   3c50032ff5 ("attr: ignore overly large gitattributes files", 2022-12-01))
   via odb_read_object_info() before calling odb_read_object(), skipping
   oversized blobs with a warning without loading them into memory.

Changes since v2:

 * Patch 2/2 uses sb->repo instead of the_repository in
   parse_default_ignore_revs_blob().

Changes since v1:

 * Split the series into two commits.
 * Patch 1/2 hardens oidset_parse_file_carefully() in oidset.c and
   peel_to_commit_oid() in builtin/blame.c before exposing them to
   upstream-controlled content at a well-known path:
   * Reject lines containing embedded NUL bytes via memchr() so trailing
     bytes after a NUL cannot be silently ignored.
   * Pass OBJECT_INFO_LOOKUP_REPLACE | OBJECT_INFO_SKIP_FETCH_OBJECT |
     OBJECT_INFO_QUICK to odb_read_object_info_extended() and peel tags one
     layer per iteration so missing OIDs or tag targets do not trigger lazy
     promisor fetches or pack directory rescans in partial clones, and
     verify that each peeled target matches the tag's declared type.
 * Patch 2/2 reads the committed HEAD:.git-blame-ignore-revs blob (in both
   bare and non-bare repositories) instead of reading a file from the
   working tree, matching hosting platforms even when an untracked file is
   present or a tracked one has local modifications. The tree entry is
   checked with S_ISREG() so non-regular entries (such as committed
   symlinks) are skipped, parsed in memory via
   oidset_parse_buffer_carefully(), and bypassed without reading if cleared
   via blame.ignoreRevsFile="" or --no-ignore-revs-file.

Ravi Mistry (2):
  blame: harden ignore-revs parser and tag peeling
  blame: ignore revs in HEAD:.git-blame-ignore-revs

 Documentation/blame-options.adoc |   8 +-
 Documentation/config/blame.adoc  |   9 +-
 builtin/blame.c                  |  74 +++++++++-
 oidset.c                         |  81 ++++++++---
 oidset.h                         |   9 ++
 t/t8013-blame-ignore-revs.sh     | 235 +++++++++++++++++++++++++++++++
 6 files changed, 381 insertions(+), 35 deletions(-)


base-commit: fa7f9290efe2bd22dd736689597b474b93798e11
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2224%2Frmistry%2Fblame-default-ignore-revs-v4
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2224/rmistry/blame-default-ignore-revs-v4
Pull-Request: https://github.com/gitgitgadget/git/pull/2224

Range-diff vs v3:

 1:  2e12486c0d = 1:  2e12486c0d blame: harden ignore-revs parser and tag peeling
 2:  72a87d1c34 ! 2:  76d597dfa8 blame: ignore revs in HEAD:.git-blame-ignore-revs
     @@ Commit message
            reading the object so that non-regular tree entries (such as a
            committed symbolic link whose blob stores a target path rather than
            revision IDs, a subdirectory, or a gitlink) are skipped instead of
     -      being read and rejected as malformed object names. The blob is parsed
     -      in memory via a new oidset_parse_buffer_carefully() helper in
     -      oidset.c that shares line parsing with oidset_parse_file_carefully().
     +      being read and rejected as malformed object names. Its size is checked
     +      via odb_read_object_info() and capped at IGNORE_REVS_MAX_FILE_SIZE
     +      (100MB, matching ATTR_MAX_FILE_SIZE from 3c50032ff5 ("attr: ignore
     +      overly large gitattributes files", 2022-12-01)) so an oversized blob
     +      is skipped with a warning without being loaded into memory. The blob
     +      is parsed in memory via a new oidset_parse_buffer_carefully() helper
     +      in oidset.c that shares line parsing with
     +      oidset_parse_file_carefully().
          - In build_ignorelist(), ignore-revs entries are processed starting
            after the last empty string entry. This ensures setting
            blame.ignoreRevsFile to "" or passing --ignore-revs-file "" or
     @@ Commit message
          add comprehensive test coverage in t8013 for the default blob lookup,
          subdirectory invocations, bare repositories, uncommitted and untracked
          working-tree files, CLI and config overrides, committed symlink
     -    entries, and comments and whitespace handling.
     +    entries, overly large blobs, and comments and whitespace handling.
      
          Based-on-patch-by: Abhijeetsingh Meena <abhijeet040403@gmail.com>
          Helped-by: Kristoffer Haugsbakk <code@khaugsbakk.name>
     @@ builtin/blame.c: static int peel_to_commit_oid(struct object_id *oid_ret, void *
       	}
       }
       
     ++#define IGNORE_REVS_MAX_FILE_SIZE (100 * 1024 * 1024)
     ++
      +static void parse_default_ignore_revs_blob(struct blame_scoreboard *sb,
      +					   const char *name)
      +{
     @@ builtin/blame.c: static int peel_to_commit_oid(struct object_id *oid_ret, void *
      +	if (!S_ISREG(oc.mode))
      +		goto out;
      +
     ++	if (odb_read_object_info(sb->repo->objects, &oid, &size) != OBJ_BLOB)
     ++		goto out;
     ++	if (size >= IGNORE_REVS_MAX_FILE_SIZE) {
     ++		warning(_("ignoring overly large ignore-revs blob '%s'"), name);
     ++		goto out;
     ++	}
     ++
      +	buf = odb_read_object(sb->repo->objects, &oid, &type, &size);
      +	if (!buf)
      +		goto out;
     @@ t/t8013-blame-ignore-revs.sh: test_expect_success 'ignore-revs-file peels chaine
      +'
      +
      +test_expect_success 'blame works when HEAD:.git-blame-ignore-revs does not exist and ignores untracked file' '
     ++	test_when_finished "rm -f .git-blame-ignore-revs" &&
      +	git rm -f .git-blame-ignore-revs &&
      +	test_tick &&
      +	git commit -m "remove .git-blame-ignore-revs" &&
     @@ t/t8013-blame-ignore-revs.sh: test_expect_success 'ignore-revs-file peels chaine
      +	git rev-parse DEF_B >expect &&
      +	test_cmp expect actual
      +'
     ++
     ++test_expect_success EXPENSIVE 'overly large default HEAD:.git-blame-ignore-revs blob is ignored' '
     ++	blob=$(dd if=/dev/zero bs=1048576 count=101 2>/dev/null |
     ++		git hash-object -w --stdin) &&
     ++	git update-index --add --cacheinfo 100644,$blob,.git-blame-ignore-revs &&
     ++	test_tick &&
     ++	git commit -m "overly large .git-blame-ignore-revs" &&
     ++	test_when_finished "git reset --hard HEAD~" &&
     ++	git blame --line-porcelain def-file >blame_raw 2>err &&
     ++	sed -ne "/^[0-9a-f][0-9a-f]* [0-9][0-9]* 1/s/ .*//p" blame_raw >actual &&
     ++	git rev-parse DEF_B >expect &&
     ++	test_cmp expect actual &&
     ++	test_grep "warning: ignoring overly large ignore-revs blob '\''HEAD:.git-blame-ignore-revs'\''" err
     ++'
      +
       test_done

-- 
gitgitgadget