Timeline

ListFiles took any parseable artifact named by a B card as the baseline, so a delta manifest or a control artifact produced a partial or empty file set. Sections 4.7.3 and 8.3 require the target to be a baseline manifest: a checkin with no B card of its own. ListFiles now returns an error otherwise. check-in: 9fbe647b7f user: [email protected] tags: main, trunk

Checkin wrote any F-card filename it was given. The artifact format's writer profile (4.6.1) forbids a backslash and anything but valid UTF-8, surrogates and overlong forms included; fossil rejects a manifest that names one. storeFileBlobs now refuses such a name or old name before storing anything. check-in: 357d10dac6 user: [email protected] tags: main, trunk

The delta format holds integers below 2^32 only, so a producer must not write a target length or copy offset at or past that. Create now returns ErrTooLarge for such inputs; Deltify then stores the content whole, as fossil does when a delta is not worthwhile, and the other callers propagate the error. Apply's header check becomes >= so it refuses exactly what Create will not write. The bound is tested on lengths, as a direct test needs a 4 GiB input. check-in: 38eddf43f1 user: [email protected] tags: main, trunk

blob.Store, StoreDelta and StoreDeltaRaw now share writeRow, which fills a phantom row of the same name in place (content, size, and removal from the phantom table) as fossil's content_put does, and returns that rid. existingName no longer treats a phantom as stored content, so a check-in of a file matching a known phantom stores the file instead of recording a manifest that points at nothing. check-in: 23cfc00bfe user: [email protected] tags: main, trunk

ResolveVersion chose a tag by tagxref.mtime instead of the carrying check-in's event.mtime, fell back to the tip when no check-in carried sym-trunk, tried a plain name before an artifact-hash prefix, and recognized none of fossil's rid:, tag:, root:, start:, merge-in: or NAME:TIMESTAMP forms nor the trailing-punctuation retry.

It is now a port of fossil's symbolic_name_to_rid (src/name.c), written as an ordered sequence of small attempts in fossil's order: tip (which, like fossil, falls through to the ordinary forms when there is no check-in), rid:, tag:, root:/start:/merge-in: (branch points, via start_of_branch and, for merge-in, the youngest ancestor in the branch), NAME:TIMESTAMP, then a 4-64 character hex prefix (tried before a plain tag, matching any artifact and reporting more than one match as ambiguous), then a plain sym- tag chosen by event.mtime, and finally a retry with one or two trailing punctuation characters removed. There is no tip fallback for an unknown name. The exported signature is unchanged; "" still means tip.

NAME:TIMESTAMP now rounds the boundary UP to the last millisecond of the stated precision (fossil's fossil_roundup_date / fossil_expand_datetime): a bare date becomes 23:59:59.999, HH:MM becomes :59.999, HH:MM:SS becomes .999. The compact YYYYMMDD forms, a fractional-second suffix and a trailing Z/UTC designator are accepted; the time is read as UTC, matching fossil's default timeline-utc. Bare YYYY-MM and hour-only forms are not supported. Unit tests cover the three round-up precisions (inside/outside the window), the zulu designator and the ambiguous-prefix path. check-in: 329ce1ad02 user: [email protected] tags: main, trunk

branch.Create accepted a name an open branch already used, letting a second branch of the same name be created; and branch.List marked a branch closed when any check-in on it carried a closed tag, so closing a non-tip check-in hid an open branch.

Create now checks branch_is_open first (an open leaf whose active branch is the name) and refuses before building any artifact, so nothing is stored on refusal, matching `fossil branch new`. The check uses fossil's exact tag types: a propagating branch tag (tagtype=2) and a singleton closed tag (tagtype=1). List now derives a branch's closed state from its newest check-in's closed tag, the row fossil's branch-list query reads, so a branch with an open tip lists open. Unit tests cover the refusal, the no-stored-blob guarantee and reuse of a closed branch's name. check-in: faf47b6220 user: [email protected] tags: main, trunk

BranchLeaves joined the leaf table without excluding leaves that carry a closed tag, so a closed leaf still counted toward a branch's leaves, and WouldFork, built on it, reported a fork for a version that was not itself a leaf. This made a closed leaf look like an open one and a non-leaf commit look like it would fork.

BranchLeaves now excludes any leaf with a closed tag (tagtype>0), matching fossil's leaf_is_closed_sql, so it returns a branch's open leaves. WouldFork is now fossil's leaf_ambiguity: the current version must itself be an open leaf (is_a_leaf AND not closed) before another open leaf on the same branch can make a commit fork; a non-leaf or closed version returns false. currentBranch now surfaces a real query error instead of masking it as "trunk". Unit tests cover the open-sibling, closed-sibling and non-leaf-parent cases. check-in: f8496d12cc user: [email protected] tags: main, trunk

The new erratum to draft-fossil-sync-protocol-00 §7.3 has the server answer uvgimme only for a requester with Read, with Clone implying Read, and refuse silently otherwise. fossil 2.28 answers any uvgimme.

- The erratum is copied unmodified into conformance/rfcs/erratum and pinned in requirements/sync.tsv, with two new requirements, SP-7.3-11 and SP-7.3-12. - Server cases can carry a fossil note again: a case that expects something fossil(1) does not do says why, and fails once fossil(1) does it. sync.7.3.uvgimme-no-read uses it, so the case flags the day CI's pinned fossil takes the matching patch. - sync.7.3.uvgimme-clone-implies-read finds that go-libfossil's read gates ignore Clone; it is marked as a gap, tracked in #312. check-in: 2cb62c37bc user: [email protected] tags: main, trunk

* test(conformance): sync-protocol conformance suite (#262)

Checks go-libfossil against draft-fossil-sync-protocol-00, requirement by requirement: 149 requirements, 199 cases. Server cases send raw requests to Repo.XferHandler and, through `fossil http --in`, to fossil(1) on a copy of the same repository; client cases drive the public Sync and Clone against a scripted peer, with fossil(1)'s client run against the same script for most of them; HTTP cases cover redirects, status codes and media types; interop cases run whole exchanges in both directions.

Known failures are marked with the placeholder #0 until their issues are filed, so TestCoverage fails until then.

* test(conformance): sync suite review fixes (#262)

Cases for the requirements that had none where fossil(1) can show the behavior: server-version, the SHA3 gate, shun admission, cookie and cleartext logins, pushed configuration, ci-unlock, cluster brackets, the clone's unversioned catalog and the pull-only message. Two rows added: link ARG handling and the short uvigot.

A fossil(1) disagreement, a harness failure or a deviation other than the one named now fails a case whatever its mark. The server's log output is discarded in the tests.

* test(conformance): mark sync gaps with their issues; drop gaps v0.11.1 closed (#262)

v0.11.1's read gate and redirect policy make seven sync cases conform, so their gap marks are removed. The rest are marked with the issues that track each fix: #296 and #299-#310.

* test(conformance): accept either fossil refusal of a negative clone SEQNO

fossil 2.28's macOS build answers clone 3 -1 with clone_seqno 0 and its Linux build, which CI pins, with the invalid-sequence error alone. The draft leaves the reply open; the case now holds go-libfossil only to sending no content. check-in: 80c72b27c7 user: [email protected] tags: main, trunk