A push no longer sends a replaced binary file's old content again (closes #136) 570e35310f31

- **`oxy serve` takes a push of more than 2 MB (#138).** It set no request limit of its own, so axum's default of 2 MB applied, and a larger push part was cut off with `Broken pipe` at the client and nothing in the server's log. It now takes up to 4 GiB a request (`oxy_server::BODY_LIMIT`), OxygenHub's default `push_body_limit`; OxygenHub was not affected.

- **A push no longer sends a replaced or removed binary file's old content again (#136).** A bundle carried both the old and the new blob of every binary file a change replaces, so a change removing ~1,100 tracked cache files (oxygenhub-android's set-up) pushed all of them again, over 100 MB, though the hub stored each when it was added. The old blob is always the new blob of a change the replacement depends on, which the receiver already holds or which the same bundle carries, so pushes and fetch answers now carry only the new one.

            // A replacement's new content only: its old content is the new

            // content of a change it depends on, which the receiver holds or

            // which this bundle carries (oxygen#136: removing ~1,100 binary

            // files sent them all again).

                if let Edit::Replace { new: Some(b), .. } = e {

                    if self.store.has(b) {

                        if let Ok(blob) = Blob::decode(&self.store.get_typed(b, ObjectType::Blob)?)

                        {

                            if max_blob.is_some_and(|m| blob.length > m) {

                                continue;

                            objects.insert(*b);

                            objects.extend(blob.chunks.iter().copied());

/// oxygen#136: a bundle carries a replaced binary file's new content

/// only. Its old content came with the change that added it, so removing

/// or replacing a file sends no old blob again; the remote and a clone of

/// it are whole.

#[test]

fn a_replacement_does_not_send_the_old_content_again() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin = root.join("origin");

    Repo::init_bare_unbound(&origin).unwrap();

    let main = root.join("main");

    let mut repo = Repo::init(&main).unwrap();

    repo.config

        .set("remote.origin.url", &origin.to_string_lossy())

        .unwrap();

    repo.save_config().unwrap();

    let blobs = |b: &Bundle| {

        b.objects

            .iter()

            .filter(|(ty, _)| *ty == ObjectType::Blob)

            .count()

    };

    write(&main, "bin.dat", b"\0\x01first binary");

    write(&main, "gone.dat", b"\0\x02to be removed");

    let added = repo.commit("add", &[]).unwrap();

    assert!(repo.push("origin", false).unwrap()[0].ok);

    write(&main, "bin.dat", b"\0\x01second binary");

    fs::remove_file(main.join("gone.dat")).unwrap();

    let changed = repo.commit("replace and remove", &[]).unwrap();

    assert_eq!(blobs(&repo.bundle_for(&[changed]).unwrap()), 1);

    assert_eq!(blobs(&repo.bundle_for(&[added, changed]).unwrap()), 3);

    assert!(repo.push("origin", false).unwrap()[0].ok);

    let origin = Repo::open(&origin).unwrap();

    assert_eq!(origin.fsck().unwrap().problems, vec![]);

    let back = Repo::clone(&origin.root().to_string_lossy(), &root.join("back")).unwrap();

    assert_eq!(back.fsck().unwrap().problems, vec![]);

    assert_eq!(

        fs::read(root.join("back/bin.dat")).unwrap(),

        b"\0\x01second binary"

    );

    assert!(!root.join("back/gone.dat").exists());

}

| `Bundle` | `{0: [[change bytes, [Signature]]], 1: [signed attestation], 2: [[type name, object bytes]], 3: [signed policy]}`; changes in dependency order; objects are chunks, blobs, identities, and states only, and include the text blobs of every change in the bundle and their chunks, so a bundle can be read on its own, and the `new` blob of every `Replace` (with its chunks) unless left out by size; never a replacement's `old` blob, which is the `new` of a change it depends on (§8.1), held by the receiver or carried by the same bundle (oxygen#136); a push that moves a bookmark also carries the identity that signed the move and, for a delegate, the identity it acts for, so a receiver that has seen no change by that key can check it (oxygenhub#129), and a push that sends tags carries each tag signer's identity and, for a short-lived key, its certificate likewise (oxygen#129); key 3 (optional) holds the policies between the receiver's serial and the one sent with a push, ascending; key 4 (optional, only when there are any) holds signed certificates (§14.7) of short-lived keys that signed what the bundle carries or the push's attestation, their keys' and issuers' identities among the objects; a receiver keeps each that verifies with its issuer and refuses a bundle with one that does not |