[RFC GSoC PATCH] environment: move core.trustctime to repo_settings

[RFC GSoC PATCH] environment: move core.trustctime to repo_settings

[Ayush Jha]

The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.

This change continues the effort to move global configuration into struct repo_settings, as discussed in
<20260208062949.596-1-kumarayushjha123@gmail.com>.

Move trust_ctime into struct repo_settings so that it is associated with a repository instance.

Add repo_settings_get_trust_ctime() to lazily read the
core.trustctime configuration value, defaulting to true.

Update statinfo.c to use the new accessor instead of the global variable.

Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
---
 environment.c   | 5 -----
 environment.h   | 1 -
 repo-settings.c | 7 +++++++
 repo-settings.h | 8 ++++++++
 statinfo.c      | 4 ++--
 5 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/environment.c b/environment.c
index 8ffbf92d50..95bd0db63c 100644
--- a/environment.c
+++ b/environment.c
@@ -41,7 +41,6 @@ static int pack_compression_seen;
 static int zlib_compression_seen;
 
 int trust_executable_bit = 1;
-int trust_ctime = 1;
 int check_stat = 1;
 int has_symlinks = 1;
 int minimum_abbrev = 4, default_abbrev = -1;
@@ -308,10 +307,6 @@ int git_default_core_config(const char *var, const char *value,
 		trust_executable_bit = git_config_bool(var, value);
 		return 0;
 	}
-	if (!strcmp(var, "core.trustctime")) {
-		trust_ctime = git_config_bool(var, value);
-		return 0;
-	}
 	if (!strcmp(var, "core.checkstat")) {
 		if (!value)
 			return config_error_nonbool(var);
diff --git a/environment.h b/environment.h
index 27f657af04..148103ea51 100644
--- a/environment.h
+++ b/environment.h
@@ -145,7 +145,6 @@ extern char *git_work_tree_cfg;
 
 /* Environment bits from configuration mechanism */
 extern int trust_executable_bit;
-extern int trust_ctime;
 extern int check_stat;
 extern int has_symlinks;
 extern int minimum_abbrev, default_abbrev;
diff --git a/repo-settings.c b/repo-settings.c
index 208e09ff17..bb7d983023 100644
--- a/repo-settings.c
+++ b/repo-settings.c
@@ -233,3 +233,10 @@ void repo_settings_reset_shared_repository(struct repository *repo)
 {
 	repo->settings.shared_repository_initialized = 0;
 }
+
+int repo_settings_get_trust_ctime(struct repository *repo)
+{
+	if (repo->settings.trust_ctime < 0)
+		repo_cfg_bool(repo, "core.trustctime", &repo->settings.trust_ctime, 1);
+	return repo->settings.trust_ctime;
+}
diff --git a/repo-settings.h b/repo-settings.h
index cad9c3f0cc..709f86108b 100644
--- a/repo-settings.h
+++ b/repo-settings.h
@@ -70,6 +70,8 @@ struct repo_settings {
 	int max_allowed_tree_depth;
 
 	char *hooks_path;
+
+	int trust_ctime;
 };
 #define REPO_SETTINGS_INIT { \
 	.shared_repository = -1, \
@@ -81,6 +83,7 @@ struct repo_settings {
 	.packed_git_window_size = DEFAULT_PACKED_GIT_WINDOW_SIZE, \
 	.packed_git_limit = DEFAULT_PACKED_GIT_LIMIT, \
 	.max_allowed_tree_depth = DEFAULT_MAX_ALLOWED_TREE_DEPTH, \
+	.trust_ctime = -1, \
 }
 
 void prepare_repo_settings(struct repository *r);
@@ -90,6 +93,11 @@ void repo_settings_clear(struct repository *r);
 enum log_refs_config repo_settings_get_log_all_ref_updates(struct repository *repo);
 /* Read the value for "core.warnAmbiguousRefs". */
 int repo_settings_get_warn_ambiguous_refs(struct repository *repo);
+/* Read and set the value for "core.attributesfile". */
+const char *repo_settings_get_attributes_file(struct repository *repo);
+
+/* Read the value for "core.trustctime". */
+int repo_settings_get_trust_ctime(struct repository *repo);
 /* Read the value for "core.hooksPath". */
 const char *repo_settings_get_hooks_path(struct repository *repo);
 
diff --git a/statinfo.c b/statinfo.c
index 30a164b0e6..ebc8faef27 100644
--- a/statinfo.c
+++ b/statinfo.c
@@ -66,14 +66,14 @@ int match_stat_data(const struct stat_data *sd, struct stat *st)
 
 	if (sd->sd_mtime.sec != (unsigned int)st->st_mtime)
 		changed |= MTIME_CHANGED;
-	if (trust_ctime && check_stat &&
+	if (repo_settings_get_trust_ctime(the_repository) && check_stat &&
 	    sd->sd_ctime.sec != (unsigned int)st->st_ctime)
 		changed |= CTIME_CHANGED;
 
 #ifdef USE_NSEC
 	if (check_stat && sd->sd_mtime.nsec != ST_MTIME_NSEC(*st))
 		changed |= MTIME_CHANGED;
-	if (trust_ctime && check_stat &&
+	if (repo_settings_get_trust_ctime(the_repository) && check_stat &&
 	    sd->sd_ctime.nsec != ST_CTIME_NSEC(*st))
 		changed |= CTIME_CHANGED;
 #endif
-- 
2.53.0.windows.1

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

[Junio C Hamano]

Ayush Jha <kumarayushjha123@gmail.com> writes:

> The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
>
> This change continues the effort to move global configuration into struct repo_settings, as discussed in
> <20260208062949.596-1-kumarayushjha123@gmail.com>.
>
> Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
>
> Add repo_settings_get_trust_ctime() to lazily read the
> core.trustctime configuration value, defaulting to true.
>
> Update statinfo.c to use the new accessor instead of the global variable.
>
> Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> ---
>  environment.c   | 5 -----
>  environment.h   | 1 -
>  repo-settings.c | 7 +++++++
>  repo-settings.h | 8 ++++++++
>  statinfo.c      | 4 ++--
>  5 files changed, 17 insertions(+), 8 deletions(-)

Doesn't this regress end-user experience when the configuration
variable is misspelled, e.g. "[core] trustctime = bad"?  We used to
run git_config_bool() from git_config(git_default_condfig) fairly
early in the program, and would have died before doing anythihng to
give the user a chance to fix the configuration files before going
forward.

Now we will run deep into codepath and would not notice the
misconfigured core.trustctime until the code happens to ask to
compare the filesystem stat data and in-core index stat data.

I think this is a recurring theme, e.g.

https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/
https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/

That other topic Olamide has been working on seems to have settled
*not* to lazily load into repo_settings to avoid the problem.
Instead it reads and parses at the same places in the code path as
before, but into a repo_config_values structure that is associated
with the repository in question (which typically is the_repository).

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

[Ayush Jha]

Hi Junio,

Thank you for the feedback. You are absolutely right that the
lazy-loading approach regresses the user experience by delaying
detection of configuration errors.

To address this, I propose parsing core.trustctime in
prepare_repo_settings() in repo-settings.c. This would ensure the
configuration is read eagerly during repository initialization,
preserving the historical “fail fast” behavior where invalid boolean
values cause an immediate fatal error.

The repo_settings_get_trust_ctime() accessor would then simply return
the pre-parsed value from r->settings.trust_ctime.

Does this approach sound reasonable?

Thanks,
Ayush

On Wed, Feb 18, 2026 at 12:44 AM Junio C Hamano <gitster@pobox.com> wrote:
>
> Ayush Jha <kumarayushjha123@gmail.com> writes:
>
> > The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
> >
> > This change continues the effort to move global configuration into struct repo_settings, as discussed in
> > <20260208062949.596-1-kumarayushjha123@gmail.com>.
> >
> > Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
> >
> > Add repo_settings_get_trust_ctime() to lazily read the
> > core.trustctime configuration value, defaulting to true.
> >
> > Update statinfo.c to use the new accessor instead of the global variable.
> >
> > Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> > ---
> >  environment.c   | 5 -----
> >  environment.h   | 1 -
> >  repo-settings.c | 7 +++++++
> >  repo-settings.h | 8 ++++++++
> >  statinfo.c      | 4 ++--
> >  5 files changed, 17 insertions(+), 8 deletions(-)
>
> Doesn't this regress end-user experience when the configuration
> variable is misspelled, e.g. "[core] trustctime = bad"?  We used to
> run git_config_bool() from git_config(git_default_condfig) fairly
> early in the program, and would have died before doing anythihng to
> give the user a chance to fix the configuration files before going
> forward.
>
> Now we will run deep into codepath and would not notice the
> misconfigured core.trustctime until the code happens to ask to
> compare the filesystem stat data and in-core index stat data.
>
> I think this is a recurring theme, e.g.
>
> https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/
> https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/
>
> That other topic Olamide has been working on seems to have settled
> *not* to lazily load into repo_settings to avoid the problem.
> Instead it reads and parses at the same places in the code path as
> before, but into a repo_config_values structure that is associated
> with the repository in question (which typically is the_repository).
>

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

[Bello Olamide]

On Wed, 18 Feb 2026 at 12:04, Ayush Jha <kumarayushjha123@gmail.com> wrote:
>
> Hi Junio,
>
> Thank you for the feedback. You are absolutely right that the
> lazy-loading approach regresses the user experience by delaying
> detection of configuration errors.
>
> To address this, I propose parsing core.trustctime in
> prepare_repo_settings() in repo-settings.c. This would ensure the
> configuration is read eagerly during repository initialization,
> preserving the historical “fail fast” behavior where invalid boolean
> values cause an immediate fatal error.
>
> The repo_settings_get_trust_ctime() accessor would then simply return
> the pre-parsed value from r->settings.trust_ctime.
>
> Does this approach sound reasonable?
>
> Thanks,
> Ayush
>
> On Wed, Feb 18, 2026 at 12:44 AM Junio C Hamano <gitster@pobox.com> wrote:
> >
> > Ayush Jha <kumarayushjha123@gmail.com> writes:
> >
> > > The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
> > >
> > > This change continues the effort to move global configuration into struct repo_settings, as discussed in
> > > <20260208062949.596-1-kumarayushjha123@gmail.com>.
> > >
> > > Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
> > >
> > > Add repo_settings_get_trust_ctime() to lazily read the
> > > core.trustctime configuration value, defaulting to true.
> > >
> > > Update statinfo.c to use the new accessor instead of the global variable.
> > >
> > > Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> > > ---
> > >  environment.c   | 5 -----
> > >  environment.h   | 1 -
> > >  repo-settings.c | 7 +++++++
> > >  repo-settings.h | 8 ++++++++
> > >  statinfo.c      | 4 ++--
> > >  5 files changed, 17 insertions(+), 8 deletions(-)
> >
> > Doesn't this regress end-user experience when the configuration
> > variable is misspelled, e.g. "[core] trustctime = bad"?  We used to
> > run git_config_bool() from git_config(git_default_condfig) fairly
> > early in the program, and would have died before doing anythihng to
> > give the user a chance to fix the configuration files before going
> > forward.
> >
> > Now we will run deep into codepath and would not notice the
> > misconfigured core.trustctime until the code happens to ask to
> > compare the filesystem stat data and in-core index stat data.
> >
> > I think this is a recurring theme, e.g.
> >
> > https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/
> > https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/
> >
> > That other topic Olamide has been working on seems to have settled
> > *not* to lazily load into repo_settings to avoid the problem.
> > Instead it reads and parses at the same places in the code path as
> > before, but into a repo_config_values structure that is associated
> > with the repository in question (which typically is the_repository).
> >

Hello Ayush
Thank you for your interest in this topic.

As Junio pointed out in his response to you, I have submitted patches that
settle not to lazily load into repo_settings. but instead to read and parse into
the struct repo_config_values structure associated with the repository.

I will continue working to move other repo specific configuration variables
in environment.c into this struct once these patches have been accepted.
Thanks

Olamide

Re: [RFC GSoC PATCH] environment: move core.trustctime to repo_settings

[Ayush Jha]

Hello Olamide,

Thank you for the update. Since you are already working on a more
robust pattern (repo_config_values) for this, I will drop my patch to
avoid conflicts and duplicated effort.

Best regards,
Ayush

On Wed, Feb 18, 2026 at 4:52 PM Bello Olamide <belkid98@gmail.com> wrote:
>
> On Wed, 18 Feb 2026 at 12:04, Ayush Jha <kumarayushjha123@gmail.com> wrote:
> >
> > Hi Junio,
> >
> > Thank you for the feedback. You are absolutely right that the
> > lazy-loading approach regresses the user experience by delaying
> > detection of configuration errors.
> >
> > To address this, I propose parsing core.trustctime in
> > prepare_repo_settings() in repo-settings.c. This would ensure the
> > configuration is read eagerly during repository initialization,
> > preserving the historical “fail fast” behavior where invalid boolean
> > values cause an immediate fatal error.
> >
> > The repo_settings_get_trust_ctime() accessor would then simply return
> > the pre-parsed value from r->settings.trust_ctime.
> >
> > Does this approach sound reasonable?
> >
> > Thanks,
> > Ayush
> >
> > On Wed, Feb 18, 2026 at 12:44 AM Junio C Hamano <gitster@pobox.com> wrote:
> > >
> > > Ayush Jha <kumarayushjha123@gmail.com> writes:
> > >
> > > > The core.trustctime configuration variable is currently stored as a global in environment.c. This prevents it from being repository-specific, which is problematic when multiple repository instances are used within the same process.
> > > >
> > > > This change continues the effort to move global configuration into struct repo_settings, as discussed in
> > > > <20260208062949.596-1-kumarayushjha123@gmail.com>.
> > > >
> > > > Move trust_ctime into struct repo_settings so that it is associated with a repository instance.
> > > >
> > > > Add repo_settings_get_trust_ctime() to lazily read the
> > > > core.trustctime configuration value, defaulting to true.
> > > >
> > > > Update statinfo.c to use the new accessor instead of the global variable.
> > > >
> > > > Signed-off-by: Ayush Jha <kumarayushjha123@gmail.com>
> > > > ---
> > > >  environment.c   | 5 -----
> > > >  environment.h   | 1 -
> > > >  repo-settings.c | 7 +++++++
> > > >  repo-settings.h | 8 ++++++++
> > > >  statinfo.c      | 4 ++--
> > > >  5 files changed, 17 insertions(+), 8 deletions(-)
> > >
> > > Doesn't this regress end-user experience when the configuration
> > > variable is misspelled, e.g. "[core] trustctime = bad"?  We used to
> > > run git_config_bool() from git_config(git_default_condfig) fairly
> > > early in the program, and would have died before doing anythihng to
> > > give the user a chance to fix the configuration files before going
> > > forward.
> > >
> > > Now we will run deep into codepath and would not notice the
> > > misconfigured core.trustctime until the code happens to ask to
> > > compare the filesystem stat data and in-core index stat data.
> > >
> > > I think this is a recurring theme, e.g.
> > >
> > > https://lore.kernel.org/git/32fceddc-c867-4a47-bde8-c873279edbc1@gmail.com/
> > > https://lore.kernel.org/git/a881499d-e236-4f8e-a217-b6bce69e3e3c@gmail.com/
> > >
> > > That other topic Olamide has been working on seems to have settled
> > > *not* to lazily load into repo_settings to avoid the problem.
> > > Instead it reads and parses at the same places in the code path as
> > > before, but into a repo_config_values structure that is associated
> > > with the repository in question (which typically is the_repository).
> > >
>
> Hello Ayush
> Thank you for your interest in this topic.
>
> As Junio pointed out in his response to you, I have submitted patches that
> settle not to lazily load into repo_settings. but instead to read and parse into
> the struct repo_config_values structure associated with the repository.
>
> I will continue working to move other repo specific configuration variables
> in environment.c into this struct once these patches have been accepted.
> Thanks
>
> Olamide