crates/oxy-core/src/repo/fsck.rs at eaf3e9068180 · andymccall/oxygen

# eaf3e9068180 oxygen / crates / oxy-core / src / repo / fsck.rs

17.6 KiB · Rust · last changed Store large inserts as text blobs (change format 2) 1 month ago source blame history raw

//! Repository integrity check (spec §21.1): `oxy fsck`.
//!
//! Reads everything and changes nothing. Four passes:
//!
//! 1. every stored object: header, length, hash, and that its body decodes
//!    as its type says;
//! 2. the operation log: every operation reachable from the head is
//!    present and decodes, and clocks never run backwards;
//! 3. references: the current view's bookmarks, tags, remote bookmarks,
//!    workspaces and policy, then the dependency closure of everything
//!    they name, with each change's author identity, blobs and chunks,
//!    and each change's signatures or seals;
//! 4. derived data: every bookmark's state validates, every checkpoint
//!    restores exactly the state it names, and reference and tag
//!    attestations carry good signatures.
//!
//! Missing blobs are warnings, not errors, in a partial clone
//! (`filter.max-blob` or a sparse filter), and changes beyond a shallow
//! boundary are expected to be absent.

use super::*;
use std::collections::{HashSet, VecDeque};

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
pub enum Severity {
    /// Worth knowing; the repository is still sound.
    Warning,
    /// Data is missing, corrupt or fails verification.
    Error,
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Problem {
    pub severity: Severity,
    /// The object the problem is about, when there is one.
    pub object: Option<ObjectRef>,
    pub what: String,
}

#[derive(Clone, Debug, Default, PartialEq, Eq)]
pub struct FsckReport {
    pub objects: usize,
    pub ops: usize,
    /// Changes checked, working-copy changes included.
    pub changes: usize,
    /// Committed changes authenticated by their own signature or by a seal.
    pub signed: usize,
    pub unsigned: usize,
    pub checkpoints: usize,
    pub attestations: usize,
    pub problems: Vec<Problem>,
}

impl FsckReport {
    pub fn errors(&self) -> usize {
        self.problems
            .iter()
            .filter(|p| p.severity == Severity::Error)
            .count()
    }

    pub fn warnings(&self) -> usize {
        self.problems
            .iter()
            .filter(|p| p.severity == Severity::Warning)
            .count()
    }

    fn error(&mut self, object: Option<ObjectRef>, what: impl Into<String>) {
        self.problems.push(Problem {
            severity: Severity::Error,
            object,
            what: what.into(),
        });
    }

    fn warn(&mut self, object: Option<ObjectRef>, what: impl Into<String>) {
        self.problems.push(Problem {
            severity: Severity::Warning,
            object,
            what: what.into(),
        });
    }
}

/// Whether `body` decodes as an object of type `ty`.
fn decodes(ty: ObjectType, body: &[u8]) -> std::result::Result<(), String> {
    let r = match ty {
        ObjectType::Chunk => Ok(()),
        ObjectType::Blob => Blob::decode(body).map(|_| ()),
        // Structure only: the text blobs are checked with the change graph.
        ObjectType::Change => {
            Change::decode_with(body, &mut |_, _| Ok(vec![Vec::new()])).map(|_| ())
        }
        ObjectType::Checkpoint => crate::objects::Checkpoint::decode(body).map(|_| ()),
        ObjectType::Op => match Op::decode(body) {
            Ok(_) => Ok(()),
            Err(e) => Op::decode_format1(body).map(|_| ()).map_err(|_| e),
        },
        ObjectType::Attest => Attest::decode(body).map(|_| ()),
        ObjectType::Identity => Identity::decode(body).map(|_| ()),
        ObjectType::Policy => crate::policy::Policy::decode(body).map(|_| ()),
        ObjectType::Receipt => crate::receipt::Receipt::decode(body).map(|_| ()),
        ObjectType::State => crate::objects::StateObject::decode(body).map(|_| ()),
    };
    r.map_err(|e| e.to_string())
}

impl Repo {
    /// Check the whole repository; see the module documentation.
    pub fn fsck(&self) -> Result<FsckReport> {
        let mut rep = FsckReport::default();
        let bad = self.fsck_objects(&mut rep)?;
        self.fsck_ops(&mut rep, &bad);
        self.fsck_references(&mut rep, &bad)?;
        self.fsck_derived(&mut rep)?;
        rep.problems.sort_by_key(|p| std::cmp::Reverse(p.severity));
        Ok(rep)
    }

    /// Pass 1. Returns the objects that failed, so later passes report
    /// them once rather than at every reference.
    fn fsck_objects(&self, rep: &mut FsckReport) -> Result<HashSet<ObjectRef>> {
        let mut bad = HashSet::new();
        for r in self.store.list()? {
            rep.objects += 1;
            match self.store.get(&r) {
                Ok((ty, body)) => {
                    if let Err(e) = decodes(ty, &body) {
                        rep.error(
                            Some(r),
                            format!("{} object does not decode: {e}", ty.name()),
                        );
                        bad.insert(r);
                    }
                }
                Err(e) => {
                    rep.error(Some(r), format!("unreadable object: {e}"));
                    bad.insert(r);
                }
            }
        }
        Ok(bad)
    }

    /// Pass 2.
    fn fsck_ops(&self, rep: &mut FsckReport, bad: &HashSet<ObjectRef>) {
        let head = match fs::read_to_string(self.oxy.join("ops").join("head")) {
            Ok(h) => h,
            Err(e) => {
                rep.error(None, format!("cannot read .oxy/ops/head: {e}"));
                return;
            }
        };
        let Some(head) = ObjectRef::from_hex(head.trim()) else {
            rep.error(None, ".oxy/ops/head does not hold an object reference");
            return;
        };
        let mut seen = HashSet::new();
        let mut queue: VecDeque<(ObjectRef, Option<(ObjectRef, u64)>)> =
            VecDeque::from([(head, None)]);
        while let Some((r, child)) = queue.pop_front() {
            if !seen.insert(r) {
                continue;
            }
            if bad.contains(&r) {
                continue;
            }
            let body = match self.store.get_typed(&r, ObjectType::Op) {
                Ok(b) => b,
                Err(StoreError::NotFound(_)) => {
                    let by = child
                        .map(|(c, _)| format!(", the parent of operation {}", c.short(12)))
                        .unwrap_or_default();
                    rep.error(
                        Some(r),
                        format!("operation missing{by}; the log is cut here"),
                    );
                    continue;
                }
                Err(e) => {
                    rep.error(Some(r), format!("operation unreadable: {e}"));
                    continue;
                }
            };
            rep.ops += 1;
            let (parents, wall_ms) = match Op::decode(&body) {
                Ok(op) => (op.parents, op.hlc.wall_ms),
                Err(_) => match Op::decode_format1(&body) {
                    Ok(op) => (op.parents, op.hlc.wall_ms),
                    Err(e) => {
                        rep.error(Some(r), format!("operation does not decode: {e}"));
                        continue;
                    }
                },
            };
            if let Some((c, child_ms)) = child {
                if wall_ms > child_ms {
                    rep.warn(
                        Some(c),
                        format!(
                            "operation is timed before its parent {} (a clock was wrong)",
                            r.short(12)
                        ),
                    );
                }
            }
            queue.extend(parents.into_iter().map(|p| (p, Some((r, wall_ms)))));
        }
    }

    /// Pass 3.
    fn fsck_references(&self, rep: &mut FsckReport, bad: &HashSet<ObjectRef>) -> Result<()> {
        let view = match self.view() {
            Ok(v) => v,
            Err(e) => {
                rep.error(None, format!("cannot read the current view: {e}"));
                return Ok(());
            }
        };
        let boundary = self.boundary();
        let partial = self.config.max_blob.is_some() || !self.config.sparse_paths.is_empty();

        let mut roots: Vec<(ChangeHash, String)> = Vec::new();
        let mut states: Vec<(ObjectRef, String)> = Vec::new();
        states.extend(
            view.bookmarks
                .iter()
                .map(|(n, s)| (*s, format!("bookmark {n}"))),
        );
        states.extend(view.tags.iter().map(|(n, s)| (*s, format!("tag {n}"))));
        for (remote, bms) in &view.remotes {
            states.extend(bms.iter().map(|(n, s)| (*s, format!("{remote}/{n}"))));
        }
        for (st, what) in states {
            match self.store.get_state(&st) {
                Ok(s) => roots.extend(s.heads.into_iter().map(|h| (h, what.clone()))),
                Err(e) if !bad.contains(&st) => {
                    rep.error(Some(st), format!("state of {what} unusable: {e}"))
                }
                Err(_) => {}
            }
        }
        for (ws, h) in &view.workspaces {
            roots.push((*h, format!("workspace {}", ws.to_hex())));
        }
        if let Some(p) = view.policy {
            match self.store.get_typed(&p, ObjectType::Policy) {
                Ok(bytes) => {
                    if let Ok(policy) = crate::policy::Policy::decode(&bytes) {
                        for id in &policy.identities {
                            if !self.store.has(&id.hash()) {
                                rep.warn(
                                    Some(id.hash()),
                                    "an identity the policy names is not stored",
                                );
                            }
                        }
                    }
                }
                Err(e) if !bad.contains(&p) => {
                    rep.error(Some(p), format!("the policy is unusable: {e}"))
                }
                Err(_) => {}
            }
        }

        // Working-copy changes are never signed; they are checked but not tallied.
        let working: HashSet<ChangeHash> = view.workspaces.values().copied().collect();
        let mut seen: HashSet<ChangeHash> = HashSet::new();
        let mut blobs_seen: HashSet<ObjectRef> = HashSet::new();
        let mut stack = roots;
        while let Some((h, needed_by)) = stack.pop() {
            if !seen.insert(h) {
                continue;
            }
            let c = match self.store.get_change(&h) {
                Ok(c) => c,
                Err(StoreError::NotFound(_)) if boundary.contains(&h) => continue,
                Err(StoreError::NotFound(_)) => {
                    rep.error(Some(h), format!("change missing, needed by {needed_by}"));
                    continue;
                }
                Err(e) => {
                    if !bad.contains(&h) {
                        rep.error(Some(h), format!("change unusable: {e}"));
                    }
                    continue;
                }
            };
            rep.changes += 1;
            let label = format!("change {}", h.short(12));
            stack.extend(c.deps.iter().map(|d| (*d, label.clone())));
            if !c.author.is_zero() && !self.store.has(&c.author) {
                rep.warn(
                    Some(h),
                    format!("author identity {} is not stored", c.author.short(12)),
                );
            }
            for e in &c.edits {
                let Edit::Replace { old, new, .. } = e else {
                    continue;
                };
                for b in [old, new].into_iter().flatten() {
                    if !blobs_seen.insert(*b) {
                        continue;
                    }
                    self.fsck_blob(rep, *b, &label, partial, bad);
                }
            }
            if working.contains(&h) {
                continue;
            }
            match self.authenticate_change(&h) {
                Ok(SignatureStatus::Valid { .. }) => rep.signed += 1,
                Ok(SignatureStatus::Unsigned) => rep.unsigned += 1,
                Ok(SignatureStatus::Invalid(why)) => {
                    rep.error(Some(h), format!("bad signature: {why}"))
                }
                Err(e) => rep.error(Some(h), format!("cannot check signatures: {e}")),
            }
        }
        Ok(())
    }

    fn fsck_blob(
        &self,
        rep: &mut FsckReport,
        b: ObjectRef,
        used_by: &str,
        partial: bool,
        bad: &HashSet<ObjectRef>,
    ) {
        match self.store.get_typed(&b, ObjectType::Blob) {
            Ok(bytes) => {
                let Ok(blob) = Blob::decode(&bytes) else {
                    return;
                };
                for ch in blob.chunks {
                    if !self.store.has(&ch) {
                        rep.error(
                            Some(ch),
                            format!("chunk missing from blob {} ({used_by})", b.short(12)),
                        );
                    }
                }
            }
            Err(StoreError::NotFound(_)) if partial => rep.warn(
                Some(b),
                format!("blob not fetched ({used_by}); expected in a partial clone"),
            ),
            Err(StoreError::NotFound(_)) => rep.error(Some(b), format!("blob missing ({used_by})")),
            Err(e) if !bad.contains(&b) => {
                rep.error(Some(b), format!("blob unusable ({used_by}): {e}"))
            }
            Err(_) => {}
        }
    }

    /// Pass 4.
    fn fsck_derived(&self, rep: &mut FsckReport) -> Result<()> {
        let Ok(view) = self.view() else { return Ok(()) };
        let shallow = self.is_shallow();
        if !shallow {
            for (name, st) in &view.bookmarks {
                let Ok(s) = self.store.get_state(st) else {
                    continue;
                };
                if let Err(e) = self.load_state_full(&s.heads) {
                    rep.error(
                        Some(*st),
                        format!("bookmark {name} does not form a valid state: {e}"),
                    );
                }
            }
        }
        for r in self.checkpoint_refs()? {
            rep.checkpoints += 1;
            let cp = match self.store.get_typed(&r, ObjectType::Checkpoint) {
                Ok(b) => match crate::objects::Checkpoint::decode(&b) {
                    Ok(cp) => cp,
                    Err(_) => continue,
                },
                Err(StoreError::NotFound(_)) => {
                    rep.warn(
                        Some(r),
                        "checkpoint pointer names a missing checkpoint; it will be rewritten",
                    );
                    continue;
                }
                Err(_) => continue,
            };
            let payload = match self.read_blob(&cp.payload) {
                Ok(p) => p,
                Err(e) => {
                    rep.error(Some(r), format!("checkpoint payload unreadable: {e}"));
                    continue;
                }
            };
            if let Err(e) = self.state_from_checkpoint(&payload) {
                rep.error(Some(r), format!("checkpoint payload does not decode: {e}"));
                continue;
            }
            // The payload must be what the named changes produce, in its own version.
            let version = crate::cbor::decode(&payload).ok().and_then(|v| {
                crate::objects::map(&v, "payload").ok().and_then(|m| {
                    m.get(&0)
                        .and_then(|x| crate::objects::uint(x, "version").ok())
                })
            });
            let expected = |full: &State| {
                if version == Some(crate::state::CHECKPOINT_INDEX_VERSION) {
                    full.checkpoint_index(&full.checkpoint_file_graphs(), Repo::blob_ref)
                } else {
                    full.checkpoint_payload()
                }
            };
            if !shallow {
                match self.load_state_full(&cp.heads) {
                    Ok(full) if expected(&full) != payload => {
                        rep.error(Some(r), "checkpoint disagrees with the changes it names")
                    }
                    Ok(_) => {}
                    Err(e) => rep.error(
                        Some(r),
                        format!("checkpoint names changes that do not form a state: {e}"),
                    ),
                }
            }
        }
        let mut attests = Vec::new();
        for name in view.bookmarks.keys() {
            if let Ok(Some((r, _))) = self.latest_ref_attest(name) {
                attests.push((r, format!("bookmark {name}")));
            }
        }
        for name in view.tags.keys() {
            if let Ok(Some((r, _))) = self.tag_attest(name) {
                attests.push((r, format!("tag {name}")));
            }
        }
        for (r, what) in attests {
            rep.attestations += 1;
            let sigs = self.store.signatures(&r)?;
            if sigs.is_empty() {
                rep.warn(Some(r), format!("attestation for {what} is unsigned"));
            }
            for sig in sigs {
                match self.store.get_identity(&sig.key) {
                    Ok(id) => {
                        if let Err(e) = verify_signature(&id, &sig, Domain::Attest, &r) {
                            rep.error(
                                Some(r),
                                format!("attestation for {what} has a bad signature: {e}"),
                            );
                        }
                    }
                    Err(_) => rep.warn(
                        Some(r),
                        format!(
                            "attestation for {what} is signed by {}, whose identity is not stored",
                            sig.key.short(12)
                        ),
                    ),
                }
            }
        }
        Ok(())
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1	//! Repository integrity check (spec §21.1): `oxy fsck`.
2	//!
3	//! Reads everything and changes nothing. Four passes:
4	//!
5	//! 1. every stored object: header, length, hash, and that its body decodes
6	//! as its type says;
7	//! 2. the operation log: every operation reachable from the head is
8	//! present and decodes, and clocks never run backwards;
9	//! 3. references: the current view's bookmarks, tags, remote bookmarks,
10	//! workspaces and policy, then the dependency closure of everything
11	//! they name, with each change's author identity, blobs and chunks,
12	//! and each change's signatures or seals;
13	//! 4. derived data: every bookmark's state validates, every checkpoint
14	//! restores exactly the state it names, and reference and tag
15	//! attestations carry good signatures.
16	//!
17	//! Missing blobs are warnings, not errors, in a partial clone
18	//! (`filter.max-blob` or a sparse filter), and changes beyond a shallow
19	//! boundary are expected to be absent.
20
21	use super::*;
22	use std::collections::{HashSet, VecDeque};
23
24	#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
25	pub enum Severity {
26	/// Worth knowing; the repository is still sound.
27	Warning,
28	/// Data is missing, corrupt or fails verification.
29	Error,
30	}
31
32	#[derive(Clone, Debug, PartialEq, Eq)]
33	pub struct Problem {
34	pub severity: Severity,
35	/// The object the problem is about, when there is one.
36	pub object: Option<ObjectRef>,
37	pub what: String,
38	}
39
40	#[derive(Clone, Debug, Default, PartialEq, Eq)]
41	pub struct FsckReport {
42	pub objects: usize,
43	pub ops: usize,
44	/// Changes checked, working-copy changes included.
45	pub changes: usize,
46	/// Committed changes authenticated by their own signature or by a seal.
47	pub signed: usize,
48	pub unsigned: usize,
49	pub checkpoints: usize,
50	pub attestations: usize,
51	pub problems: Vec<Problem>,
52	}
53
54	impl FsckReport {
55	pub fn errors(&self) -> usize {
56	self.problems
57	.iter()
58	.filter(\|p\| p.severity == Severity::Error)
59	.count()
60	}
61
62	pub fn warnings(&self) -> usize {
63	self.problems
64	.iter()
65	.filter(\|p\| p.severity == Severity::Warning)
66	.count()
67	}
68
69	fn error(&mut self, object: Option<ObjectRef>, what: impl Into<String>) {
70	self.problems.push(Problem {
71	severity: Severity::Error,
72	object,
73	what: what.into(),
74	});
75	}
76
77	fn warn(&mut self, object: Option<ObjectRef>, what: impl Into<String>) {
78	self.problems.push(Problem {
79	severity: Severity::Warning,
80	object,
81	what: what.into(),
82	});
83	}
84	}
85
86	/// Whether `body` decodes as an object of type `ty`.
87	fn decodes(ty: ObjectType, body: &[u8]) -> std::result::Result<(), String> {
88	let r = match ty {
89	ObjectType::Chunk => Ok(()),
90	ObjectType::Blob => Blob::decode(body).map(\|_\| ()),
91	// Structure only: the text blobs are checked with the change graph.
92	ObjectType::Change => {
93	Change::decode_with(body, &mut \|_, _\| Ok(vec![Vec::new()])).map(\|_\| ())
94	}
95	ObjectType::Checkpoint => crate::objects::Checkpoint::decode(body).map(\|_\| ()),
96	ObjectType::Op => match Op::decode(body) {
97	Ok(_) => Ok(()),
98	Err(e) => Op::decode_format1(body).map(\|_\| ()).map_err(\|_\| e),
99	},
100	ObjectType::Attest => Attest::decode(body).map(\|_\| ()),
101	ObjectType::Identity => Identity::decode(body).map(\|_\| ()),
102	ObjectType::Policy => crate::policy::Policy::decode(body).map(\|_\| ()),
103	ObjectType::Receipt => crate::receipt::Receipt::decode(body).map(\|_\| ()),
104	ObjectType::State => crate::objects::StateObject::decode(body).map(\|_\| ()),
105	};
106	r.map_err(\|e\| e.to_string())
107	}
108
109	impl Repo {
110	/// Check the whole repository; see the module documentation.
111	pub fn fsck(&self) -> Result<FsckReport> {
112	let mut rep = FsckReport::default();
113	let bad = self.fsck_objects(&mut rep)?;
114	self.fsck_ops(&mut rep, &bad);
115	self.fsck_references(&mut rep, &bad)?;
116	self.fsck_derived(&mut rep)?;
117	rep.problems.sort_by_key(\|p\| std::cmp::Reverse(p.severity));
118	Ok(rep)
119	}
120
121	/// Pass 1. Returns the objects that failed, so later passes report
122	/// them once rather than at every reference.
123	fn fsck_objects(&self, rep: &mut FsckReport) -> Result<HashSet<ObjectRef>> {
124	let mut bad = HashSet::new();
125	for r in self.store.list()? {
126	rep.objects += 1;
127	match self.store.get(&r) {
128	Ok((ty, body)) => {
129	if let Err(e) = decodes(ty, &body) {
130	rep.error(
131	Some(r),
132	format!("{} object does not decode: {e}", ty.name()),
133	);
134	bad.insert(r);
135	}
136	}
137	Err(e) => {
138	rep.error(Some(r), format!("unreadable object: {e}"));
139	bad.insert(r);
140	}
141	}
142	}
143	Ok(bad)
144	}
145
146	/// Pass 2.
147	fn fsck_ops(&self, rep: &mut FsckReport, bad: &HashSet<ObjectRef>) {
148	let head = match fs::read_to_string(self.oxy.join("ops").join("head")) {
149	Ok(h) => h,
150	Err(e) => {
151	rep.error(None, format!("cannot read .oxy/ops/head: {e}"));
152	return;
153	}
154	};
155	let Some(head) = ObjectRef::from_hex(head.trim()) else {
156	rep.error(None, ".oxy/ops/head does not hold an object reference");
157	return;
158	};
159	let mut seen = HashSet::new();
160	let mut queue: VecDeque<(ObjectRef, Option<(ObjectRef, u64)>)> =
161	VecDeque::from([(head, None)]);
162	while let Some((r, child)) = queue.pop_front() {
163	if !seen.insert(r) {
164	continue;
165	}
166	if bad.contains(&r) {
167	continue;
168	}
169	let body = match self.store.get_typed(&r, ObjectType::Op) {
170	Ok(b) => b,
171	Err(StoreError::NotFound(_)) => {
172	let by = child
173	.map(\|(c, _)\| format!(", the parent of operation {}", c.short(12)))
174	.unwrap_or_default();
175	rep.error(
176	Some(r),
177	format!("operation missing{by}; the log is cut here"),
178	);
179	continue;
180	}
181	Err(e) => {
182	rep.error(Some(r), format!("operation unreadable: {e}"));
183	continue;
184	}
185	};
186	rep.ops += 1;
187	let (parents, wall_ms) = match Op::decode(&body) {
188	Ok(op) => (op.parents, op.hlc.wall_ms),
189	Err(_) => match Op::decode_format1(&body) {
190	Ok(op) => (op.parents, op.hlc.wall_ms),
191	Err(e) => {
192	rep.error(Some(r), format!("operation does not decode: {e}"));
193	continue;
194	}
195	},
196	};
197	if let Some((c, child_ms)) = child {
198	if wall_ms > child_ms {
199	rep.warn(
200	Some(c),
201	format!(
202	"operation is timed before its parent {} (a clock was wrong)",
203	r.short(12)
204	),
205	);
206	}
207	}
208	queue.extend(parents.into_iter().map(\|p\| (p, Some((r, wall_ms)))));
209	}
210	}
211
212	/// Pass 3.
213	fn fsck_references(&self, rep: &mut FsckReport, bad: &HashSet<ObjectRef>) -> Result<()> {
214	let view = match self.view() {
215	Ok(v) => v,
216	Err(e) => {
217	rep.error(None, format!("cannot read the current view: {e}"));
218	return Ok(());
219	}
220	};
221	let boundary = self.boundary();
222	let partial = self.config.max_blob.is_some() \|\| !self.config.sparse_paths.is_empty();
223
224	let mut roots: Vec<(ChangeHash, String)> = Vec::new();
225	let mut states: Vec<(ObjectRef, String)> = Vec::new();
226	states.extend(
227	view.bookmarks
228	.iter()
229	.map(\|(n, s)\| (*s, format!("bookmark {n}"))),
230	);
231	states.extend(view.tags.iter().map(\|(n, s)\| (*s, format!("tag {n}"))));
232	for (remote, bms) in &view.remotes {
233	states.extend(bms.iter().map(\|(n, s)\| (*s, format!("{remote}/{n}"))));
234	}
235	for (st, what) in states {
236	match self.store.get_state(&st) {
237	Ok(s) => roots.extend(s.heads.into_iter().map(\|h\| (h, what.clone()))),
238	Err(e) if !bad.contains(&st) => {
239	rep.error(Some(st), format!("state of {what} unusable: {e}"))
240	}
241	Err(_) => {}
242	}
243	}
244	for (ws, h) in &view.workspaces {
245	roots.push((*h, format!("workspace {}", ws.to_hex())));
246	}
247	if let Some(p) = view.policy {
248	match self.store.get_typed(&p, ObjectType::Policy) {
249	Ok(bytes) => {
250	if let Ok(policy) = crate::policy::Policy::decode(&bytes) {
251	for id in &policy.identities {
252	if !self.store.has(&id.hash()) {
253	rep.warn(
254	Some(id.hash()),
255	"an identity the policy names is not stored",
256	);
257	}
258	}
259	}
260	}
261	Err(e) if !bad.contains(&p) => {
262	rep.error(Some(p), format!("the policy is unusable: {e}"))
263	}
264	Err(_) => {}
265	}
266	}
267
268	// Working-copy changes are never signed; they are checked but not tallied.
269	let working: HashSet<ChangeHash> = view.workspaces.values().copied().collect();
270	let mut seen: HashSet<ChangeHash> = HashSet::new();
271	let mut blobs_seen: HashSet<ObjectRef> = HashSet::new();
272	let mut stack = roots;
273	while let Some((h, needed_by)) = stack.pop() {
274	if !seen.insert(h) {
275	continue;
276	}
277	let c = match self.store.get_change(&h) {
278	Ok(c) => c,
279	Err(StoreError::NotFound(_)) if boundary.contains(&h) => continue,
280	Err(StoreError::NotFound(_)) => {
281	rep.error(Some(h), format!("change missing, needed by {needed_by}"));
282	continue;
283	}
284	Err(e) => {
285	if !bad.contains(&h) {
286	rep.error(Some(h), format!("change unusable: {e}"));
287	}
288	continue;
289	}
290	};
291	rep.changes += 1;
292	let label = format!("change {}", h.short(12));
293	stack.extend(c.deps.iter().map(\|d\| (*d, label.clone())));
294	if !c.author.is_zero() && !self.store.has(&c.author) {
295	rep.warn(
296	Some(h),
297	format!("author identity {} is not stored", c.author.short(12)),
298	);
299	}
300	for e in &c.edits {
301	let Edit::Replace { old, new, .. } = e else {
302	continue;
303	};
304	for b in [old, new].into_iter().flatten() {
305	if !blobs_seen.insert(*b) {
306	continue;
307	}
308	self.fsck_blob(rep, *b, &label, partial, bad);
309	}
310	}
311	if working.contains(&h) {
312	continue;
313	}
314	match self.authenticate_change(&h) {
315	Ok(SignatureStatus::Valid { .. }) => rep.signed += 1,
316	Ok(SignatureStatus::Unsigned) => rep.unsigned += 1,
317	Ok(SignatureStatus::Invalid(why)) => {
318	rep.error(Some(h), format!("bad signature: {why}"))
319	}
320	Err(e) => rep.error(Some(h), format!("cannot check signatures: {e}")),
321	}
322	}
323	Ok(())
324	}
325
326	fn fsck_blob(
327	&self,
328	rep: &mut FsckReport,
329	b: ObjectRef,
330	used_by: &str,
331	partial: bool,
332	bad: &HashSet<ObjectRef>,
333	) {
334	match self.store.get_typed(&b, ObjectType::Blob) {
335	Ok(bytes) => {
336	let Ok(blob) = Blob::decode(&bytes) else {
337	return;
338	};
339	for ch in blob.chunks {
340	if !self.store.has(&ch) {
341	rep.error(
342	Some(ch),
343	format!("chunk missing from blob {} ({used_by})", b.short(12)),
344	);
345	}
346	}
347	}
348	Err(StoreError::NotFound(_)) if partial => rep.warn(
349	Some(b),
350	format!("blob not fetched ({used_by}); expected in a partial clone"),
351	),
352	Err(StoreError::NotFound(_)) => rep.error(Some(b), format!("blob missing ({used_by})")),
353	Err(e) if !bad.contains(&b) => {
354	rep.error(Some(b), format!("blob unusable ({used_by}): {e}"))
355	}
356	Err(_) => {}
357	}
358	}
359
360	/// Pass 4.
361	fn fsck_derived(&self, rep: &mut FsckReport) -> Result<()> {
362	let Ok(view) = self.view() else { return Ok(()) };
363	let shallow = self.is_shallow();
364	if !shallow {
365	for (name, st) in &view.bookmarks {
366	let Ok(s) = self.store.get_state(st) else {
367	continue;
368	};
369	if let Err(e) = self.load_state_full(&s.heads) {
370	rep.error(
371	Some(*st),
372	format!("bookmark {name} does not form a valid state: {e}"),
373	);
374	}
375	}
376	}
377	for r in self.checkpoint_refs()? {
378	rep.checkpoints += 1;
379	let cp = match self.store.get_typed(&r, ObjectType::Checkpoint) {
380	Ok(b) => match crate::objects::Checkpoint::decode(&b) {
381	Ok(cp) => cp,
382	Err(_) => continue,
383	},
384	Err(StoreError::NotFound(_)) => {
385	rep.warn(
386	Some(r),
387	"checkpoint pointer names a missing checkpoint; it will be rewritten",
388	);
389	continue;
390	}
391	Err(_) => continue,
392	};
393	let payload = match self.read_blob(&cp.payload) {
394	Ok(p) => p,
395	Err(e) => {
396	rep.error(Some(r), format!("checkpoint payload unreadable: {e}"));
397	continue;
398	}
399	};
400	if let Err(e) = self.state_from_checkpoint(&payload) {
401	rep.error(Some(r), format!("checkpoint payload does not decode: {e}"));
402	continue;
403	}
404	// The payload must be what the named changes produce, in its own version.
405	let version = crate::cbor::decode(&payload).ok().and_then(\|v\| {
406	crate::objects::map(&v, "payload").ok().and_then(\|m\| {
407	m.get(&0)
408	.and_then(\|x\| crate::objects::uint(x, "version").ok())
409	})
410	});
411	let expected = \|full: &State\| {
412	if version == Some(crate::state::CHECKPOINT_INDEX_VERSION) {
413	full.checkpoint_index(&full.checkpoint_file_graphs(), Repo::blob_ref)
414	} else {
415	full.checkpoint_payload()
416	}
417	};
418	if !shallow {
419	match self.load_state_full(&cp.heads) {
420	Ok(full) if expected(&full) != payload => {
421	rep.error(Some(r), "checkpoint disagrees with the changes it names")
422	}
423	Ok(_) => {}
424	Err(e) => rep.error(
425	Some(r),
426	format!("checkpoint names changes that do not form a state: {e}"),
427	),
428	}
429	}
430	}
431	let mut attests = Vec::new();
432	for name in view.bookmarks.keys() {
433	if let Ok(Some((r, _))) = self.latest_ref_attest(name) {
434	attests.push((r, format!("bookmark {name}")));
435	}
436	}
437	for name in view.tags.keys() {
438	if let Ok(Some((r, _))) = self.tag_attest(name) {
439	attests.push((r, format!("tag {name}")));
440	}
441	}
442	for (r, what) in attests {
443	rep.attestations += 1;
444	let sigs = self.store.signatures(&r)?;
445	if sigs.is_empty() {
446	rep.warn(Some(r), format!("attestation for {what} is unsigned"));
447	}
448	for sig in sigs {
449	match self.store.get_identity(&sig.key) {
450	Ok(id) => {
451	if let Err(e) = verify_signature(&id, &sig, Domain::Attest, &r) {
452	rep.error(
453	Some(r),
454	format!("attestation for {what} has a bad signature: {e}"),
455	);
456	}
457	}
458	Err(_) => rep.warn(
459	Some(r),
460	format!(
461	"attestation for {what} is signed by {}, whose identity is not stored",
462	sig.key.short(12)
463	),
464	),
465	}
466	}
467	}
468	Ok(())
469	}
470	}

Keyboard