Artifact d857c1645d380c7f8ae331193d700572d504f911f06f12e3d0f24d7ed51046de:
- File
cli/repo_clone.go
— part of check-in
[8802c5704f]
at
2026-10-29 02:06:06
on branch feat/horizon-peer-serving
— fix(sync): a horizon store refuses a pull it does not hold and mints no seed
A server over a horizon clone answered a horizon pull or sync at an earlier C from its own partial graph. It now refuses any horizon pull whose held set is not a subset of its own with one error card and no content, rolled back whole, and a go-libfossil client fails the round on that reply (draft-fossil-horizon-00 §6.4). partial-mirror serves it, as it does an uncovered clone. The clone coverage check now judges the horizon the request asked for, not the depth serving cut it to.
A store at a structural horizon no longer mints a seed from its own seed: it answers a structural request at the content level (§6.2.3) and names its horizon-history-url. The requester falls back and reports HorizonRemedy, naming C and the dense origin that holds the manifests below it; the CLI prints it.
The concept doc states when a horizon store may serve a horizon peer. Conformance covers §6.4 on the pull path, a structural store answering as content, and the fallback a structural clone takes from such a peer; zit pulls from a go-libfossil horizon store in both outcomes.
Closes #490 (user: [email protected], size: 5832) [annotate] [blame] [check-ins using]
package cli import ( "context" "fmt" "net/url" "time" libfossil "github.com/danmestas/go-libfossil" "github.com/danmestas/go-libfossil/internal/auth" ) // RepoCloneCmd clones a remote Fossil repository. type RepoCloneCmd struct { URL string `arg:"" optional:"" help:"Remote Fossil server URL"` Path string `arg:"" optional:"" help:"Local path for new repository file"` User string `short:"u" help:"Username for clone auth"` Pass string `short:"p" help:"Password for clone auth"` Invite string `help:"Invite token (from fossil invite)"` Timeout time.Duration `default:"10m" help:"Abort the clone if it runs longer than this; 0 disables the deadline"` Horizon string `help:"Clone a horizon store: elide blobs below this check-in, given as tip, a branch or tag, or its full 40 or 64 digit hash; the origin resolves a name, or the clone does over what an origin that cannot sends it; what each rule would hold needs a local repository ('repo cone cost') or a peer that exposes it out of band, as the origin's horizon-served URL may"` Depth int `help:"With --horizon, step the check-in back this many check-ins along primary parents, stopping at a root"` Leaves bool `help:"With --horizon, also hold every open leaf's ancestry back to the check-in, for merging across live branches offline; costly: on a repository with old unmerged branches that is nearly the whole history"` Structural bool `help:"With --horizon, also elide the manifests below the check-in, deriving their branch and tag state from the origin's seed"` Cone []string `name:"cone" help:"Clone a sparse store: fetch only this path's subtree (repeatable)"` ConeNot []string `name:"cone-not" help:"Carve this path out of a --cone (repeatable)"` SeedKey string `name:"seed-key" help:"The origin's public key, an SSH public key line or an OpenPGP fingerprint: with --structural, a horizon seed not signed by it is discarded and the clone falls back to the content horizon; kept as the horizon-seed-key setting"` } // cloneContext builds the context that bounds a clone. A positive timeout caps // the whole operation; zero (or negative) disables the deadline for a very // large repository, returning a plain cancellable context so the caller still // gets uniform cleanup through the returned cancel. func cloneContext(parent context.Context, timeout time.Duration) (context.Context, context.CancelFunc) { if timeout > 0 { return context.WithTimeout(parent, timeout) } return context.WithCancel(parent) } func (c *RepoCloneCmd) Run(g *Globals) error { if c.Invite != "" { token, err := auth.DecodeInviteToken(c.Invite) if err != nil { return fmt.Errorf("invalid invite token: %w", err) } if c.URL == "" { c.URL = token.URL } if c.User == "" { c.User = token.Login } if c.Pass == "" { c.Pass = token.Password } } if c.URL == "" { return fmt.Errorf("URL required (provide as argument or via --invite token)") } if c.Path == "" { return fmt.Errorf("path required") } storeCone, horizon, err := cloneConeFlags(c.Cone, c.ConeNot, c.Horizon, c.Depth, c.Leaves, c.Structural) if err != nil { return err } if c.Leaves { warnLeavesCost() } ctx, cancel := cloneContext(context.Background(), c.Timeout) defer cancel() transport := libfossil.NewHTTPTransport(c.URL) opts := libfossil.CloneOpts{ User: c.User, Password: c.Pass, StoreCone: storeCone, SeedKey: c.SeedKey, Horizon: horizon, HorizonDepth: c.Depth, } r, result, err := libfossil.Clone(ctx, c.Path, transport, opts) if err != nil { return fmt.Errorf("clone failed: %w", err) } defer r.Close() // fossil clone remembers its source as last-sync-url, the default peer // for later syncs, widening and required-content recovery. if err := r.SetConfig("last-sync-url", rememberedSyncURL(c.URL)); err != nil { return fmt.Errorf("clone: remember %s: %w", c.URL, err) } fmt.Printf("Cloned into %s\n", c.Path) fmt.Printf(" Rounds: %d\n", result.Rounds) fmt.Printf(" Blobs: %d\n", result.BlobsRecvd) fmt.Printf(" Project-code: %s\n", result.ProjectCode) if storeCone != nil || horizon != nil { fmt.Printf(" Elided: %d\n", result.Elided) } if result.HorizonResolved != "" { reportResolved(c.Horizon, c.Depth, result) } if c.Structural { // Horizon §6.2.5: a client reports which mode a transfer used. if result.HorizonFallback { fmt.Println(" Horizon: content (the origin did not serve the structural horizon)") } else { fmt.Println(" Horizon: structural") } } if result.HorizonHistoryURL != "" { fmt.Printf(" History: %s\n", result.HorizonHistoryURL) } if result.HorizonRemedy != "" { fmt.Printf(" Remedy: %s\n", result.HorizonRemedy) } return nil } // rememberedSyncURL is url as fossil stores last-sync-url: a user name stays, // a password never does. An unparsable URL is stored as given, since the // clone already reached it. func rememberedSyncURL(raw string) string { u, err := url.Parse(raw) if err != nil || u.User == nil { return raw } u.User = url.User(u.User.Username()) return u.String() } // reportResolved says which check-in a named horizon resolved to, who // resolved it, and when history ran out before the depth asked for. func reportResolved(name string, depth int, result *libfossil.CloneResult) { by := "origin" if result.HorizonResolvedLocally { by = "this clone; the origin does not resolve horizon names" } fmt.Printf(" Horizon at: %s (%s, resolved by %s)\n", result.HorizonResolved, name, by) if result.HorizonSteps < depth { fmt.Printf(" History ran out after %d of %d steps back\n", result.HorizonSteps, depth) } }