vfs: simplify path audit disabling in stream clone

The whole 'mustaudit' API is quite complex compared to its actual usage by its
unique user in stream clone.

Instead we add a "auditpath" parameter to 'vfs.__call_'. The stream clone code
then explicitly open files with path auditing disabled.

The 'mustaudit' API will be cleaned up in the next changeset.

mercurial/streamclone.py

@@ -1,417 +1,418 b''
 # streamclone.py - producing and consuming streaming repository data
 #
 # Copyright 2015 Gregory Szorc <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import struct
 
 from .i18n import _
 from . import (
     branchmap,
     error,
     phases,
     store,
     util,
 )
 
 def canperformstreamclone(pullop, bailifbundle2supported=False):
     """Whether it is possible to perform a streaming clone as part of pull.
 
     ``bailifbundle2supported`` will cause the function to return False if
     bundle2 stream clones are supported. It should only be called by the
     legacy stream clone code path.
 
     Returns a tuple of (supported, requirements). ``supported`` is True if
     streaming clone is supported and False otherwise. ``requirements`` is
     a set of repo requirements from the remote, or ``None`` if stream clone
     isn't supported.
     """
     repo = pullop.repo
     remote = pullop.remote
 
     bundle2supported = False
     if pullop.canusebundle2:
         if 'v1' in pullop.remotebundle2caps.get('stream', []):
             bundle2supported = True
         # else
             # Server doesn't support bundle2 stream clone or doesn't support
             # the versions we support. Fall back and possibly allow legacy.
 
     # Ensures legacy code path uses available bundle2.
     if bailifbundle2supported and bundle2supported:
         return False, None
     # Ensures bundle2 doesn't try to do a stream clone if it isn't supported.
     #elif not bailifbundle2supported and not bundle2supported:
     #    return False, None
 
     # Streaming clone only works on empty repositories.
     if len(repo):
         return False, None
 
     # Streaming clone only works if all data is being requested.
     if pullop.heads:
         return False, None
 
     streamrequested = pullop.streamclonerequested
 
     # If we don't have a preference, let the server decide for us. This
     # likely only comes into play in LANs.
     if streamrequested is None:
         # The server can advertise whether to prefer streaming clone.
         streamrequested = remote.capable('stream-preferred')
 
     if not streamrequested:
         return False, None
 
     # In order for stream clone to work, the client has to support all the
     # requirements advertised by the server.
     #
     # The server advertises its requirements via the "stream" and "streamreqs"
     # capability. "stream" (a value-less capability) is advertised if and only
     # if the only requirement is "revlogv1." Else, the "streamreqs" capability
     # is advertised and contains a comma-delimited list of requirements.
     requirements = set()
     if remote.capable('stream'):
         requirements.add('revlogv1')
     else:
         streamreqs = remote.capable('streamreqs')
         # This is weird and shouldn't happen with modern servers.
         if not streamreqs:
             pullop.repo.ui.warn(_(
                 'warning: stream clone requested but server has them '
                 'disabled\n'))
             return False, None
 
         streamreqs = set(streamreqs.split(','))
         # Server requires something we don't support. Bail.
         missingreqs = streamreqs - repo.supportedformats
         if missingreqs:
             pullop.repo.ui.warn(_(
                 'warning: stream clone requested but client is missing '
                 'requirements: %s\n') % ', '.join(sorted(missingreqs)))
             pullop.repo.ui.warn(
                 _('(see https://www.mercurial-scm.org/wiki/MissingRequirement '
                   'for more information)\n'))
             return False, None
         requirements = streamreqs
 
     return True, requirements
 
 def maybeperformlegacystreamclone(pullop):
     """Possibly perform a legacy stream clone operation.
 
     Legacy stream clones are performed as part of pull but before all other
     operations.
 
     A legacy stream clone will not be performed if a bundle2 stream clone is
     supported.
     """
     supported, requirements = canperformstreamclone(pullop)
 
     if not supported:
         return
 
     repo = pullop.repo
     remote = pullop.remote
 
     # Save remote branchmap. We will use it later to speed up branchcache
     # creation.
     rbranchmap = None
     if remote.capable('branchmap'):
         rbranchmap = remote.branchmap()
 
     repo.ui.status(_('streaming all changes\n'))
 
     fp = remote.stream_out()
     l = fp.readline()
     try:
         resp = int(l)
     except ValueError:
         raise error.ResponseError(
             _('unexpected response from remote server:'), l)
     if resp == 1:
         raise error.Abort(_('operation forbidden by server'))
     elif resp == 2:
         raise error.Abort(_('locking the remote repository failed'))
     elif resp != 0:
         raise error.Abort(_('the server sent an unknown error code'))
 
     l = fp.readline()
     try:
         filecount, bytecount = map(int, l.split(' ', 1))
     except (ValueError, TypeError):
         raise error.ResponseError(
             _('unexpected response from remote server:'), l)
 
     with repo.lock():
         consumev1(repo, fp, filecount, bytecount)
 
         # new requirements = old non-format requirements +
         #                    new format-related remote requirements
         # requirements from the streamed-in repository
         repo.requirements = requirements | (
                 repo.requirements - repo.supportedformats)
         repo._applyopenerreqs()
         repo._writerequirements()
 
         if rbranchmap:
             branchmap.replacecache(repo, rbranchmap)
 
         repo.invalidate()
 
 def allowservergeneration(repo):
     """Whether streaming clones are allowed from the server."""
     if not repo.ui.configbool('server', 'uncompressed', True, untrusted=True):
         return False
 
     # The way stream clone works makes it impossible to hide secret changesets.
     # So don't allow this by default.
     secret = phases.hassecret(repo)
     if secret:
         return repo.ui.configbool('server', 'uncompressedallowsecret')
 
     return True
 
 # This is it's own function so extensions can override it.
 def _walkstreamfiles(repo):
     return repo.store.walk()
 
 def generatev1(repo):
     """Emit content for version 1 of a streaming clone.
 
     This returns a 3-tuple of (file count, byte size, data iterator).
 
     The data iterator consists of N entries for each file being transferred.
     Each file entry starts as a line with the file name and integer size
     delimited by a null byte.
 
     The raw file data follows. Following the raw file data is the next file
     entry, or EOF.
 
     When used on the wire protocol, an additional line indicating protocol
     success will be prepended to the stream. This function is not responsible
     for adding it.
 
     This function will obtain a repository lock to ensure a consistent view of
     the store is captured. It therefore may raise LockError.
     """
     entries = []
     total_bytes = 0
     # Get consistent snapshot of repo, lock during scan.
     with repo.lock():
         repo.ui.debug('scanning\n')
         for name, ename, size in _walkstreamfiles(repo):
             if size:
                 entries.append((name, size))
                 total_bytes += size
 
     repo.ui.debug('%d files, %d bytes to transfer\n' %
                   (len(entries), total_bytes))
 
     svfs = repo.svfs
     oldaudit = svfs.mustaudit
     debugflag = repo.ui.debugflag
     svfs.mustaudit = False
 
     def emitrevlogdata():
         try:
             for name, size in entries:
                 if debugflag:
                     repo.ui.debug('sending %s (%d bytes)\n' % (name, size))
                 # partially encode name over the wire for backwards compat
                 yield '%s\0%d\n' % (store.encodedir(name), size)
                 if size <= 65536:
-                    with svfs(name, 'rb') as fp:
+                    with svfs(name, 'rb', auditpath=False) as fp:
                         yield fp.read(size)
                 else:
-                    for chunk in util.filechunkiter(svfs(name), limit=size):
+                    data = svfs(name, auditpath=False)
+                    for chunk in util.filechunkiter(data, limit=size):
                         yield chunk
         finally:
             svfs.mustaudit = oldaudit
 
     return len(entries), total_bytes, emitrevlogdata()
 
 def generatev1wireproto(repo):
     """Emit content for version 1 of streaming clone suitable for the wire.
 
     This is the data output from ``generatev1()`` with a header line
     indicating file count and byte size.
     """
     filecount, bytecount, it = generatev1(repo)
     yield '%d %d\n' % (filecount, bytecount)
     for chunk in it:
         yield chunk
 
 def generatebundlev1(repo, compression='UN'):
     """Emit content for version 1 of a stream clone bundle.
 
     The first 4 bytes of the output ("HGS1") denote this as stream clone
     bundle version 1.
 
     The next 2 bytes indicate the compression type. Only "UN" is currently
     supported.
 
     The next 16 bytes are two 64-bit big endian unsigned integers indicating
     file count and byte count, respectively.
 
     The next 2 bytes is a 16-bit big endian unsigned short declaring the length
     of the requirements string, including a trailing \0. The following N bytes
     are the requirements string, which is ASCII containing a comma-delimited
     list of repo requirements that are needed to support the data.
 
     The remaining content is the output of ``generatev1()`` (which may be
     compressed in the future).
 
     Returns a tuple of (requirements, data generator).
     """
     if compression != 'UN':
         raise ValueError('we do not support the compression argument yet')
 
     requirements = repo.requirements & repo.supportedformats
     requires = ','.join(sorted(requirements))
 
     def gen():
         yield 'HGS1'
         yield compression
 
         filecount, bytecount, it = generatev1(repo)
         repo.ui.status(_('writing %d bytes for %d files\n') %
                          (bytecount, filecount))
 
         yield struct.pack('>QQ', filecount, bytecount)
         yield struct.pack('>H', len(requires) + 1)
         yield requires + '\0'
 
         # This is where we'll add compression in the future.
         assert compression == 'UN'
 
         seen = 0
         repo.ui.progress(_('bundle'), 0, total=bytecount, unit=_('bytes'))
 
         for chunk in it:
             seen += len(chunk)
             repo.ui.progress(_('bundle'), seen, total=bytecount,
                              unit=_('bytes'))
             yield chunk
 
         repo.ui.progress(_('bundle'), None)
 
     return requirements, gen()
 
 def consumev1(repo, fp, filecount, bytecount):
     """Apply the contents from version 1 of a streaming clone file handle.
 
     This takes the output from "stream_out" and applies it to the specified
     repository.
 
     Like "stream_out," the status line added by the wire protocol is not
     handled by this function.
     """
     with repo.lock():
         repo.ui.status(_('%d files to transfer, %s of data\n') %
                        (filecount, util.bytecount(bytecount)))
         handled_bytes = 0
         repo.ui.progress(_('clone'), 0, total=bytecount, unit=_('bytes'))
         start = util.timer()
 
         # TODO: get rid of (potential) inconsistency
         #
         # If transaction is started and any @filecache property is
         # changed at this point, it causes inconsistency between
         # in-memory cached property and streamclone-ed file on the
         # disk. Nested transaction prevents transaction scope "clone"
         # below from writing in-memory changes out at the end of it,
         # even though in-memory changes are discarded at the end of it
         # regardless of transaction nesting.
         #
         # But transaction nesting can't be simply prohibited, because
         # nesting occurs also in ordinary case (e.g. enabling
         # clonebundles).
 
         with repo.transaction('clone'):
             with repo.svfs.backgroundclosing(repo.ui, expectedcount=filecount):
                 for i in xrange(filecount):
                     # XXX doesn't support '\n' or '\r' in filenames
                     l = fp.readline()
                     try:
                         name, size = l.split('\0', 1)
                         size = int(size)
                     except (ValueError, TypeError):
                         raise error.ResponseError(
                             _('unexpected response from remote server:'), l)
                     if repo.ui.debugflag:
                         repo.ui.debug('adding %s (%s)\n' %
                                       (name, util.bytecount(size)))
                     # for backwards compat, name was partially encoded
                     path = store.decodedir(name)
                     with repo.svfs(path, 'w', backgroundclose=True) as ofp:
                         for chunk in util.filechunkiter(fp, limit=size):
                             handled_bytes += len(chunk)
                             repo.ui.progress(_('clone'), handled_bytes,
                                              total=bytecount, unit=_('bytes'))
                             ofp.write(chunk)
 
             # force @filecache properties to be reloaded from
             # streamclone-ed file at next access
             repo.invalidate(clearfilecache=True)
 
         elapsed = util.timer() - start
         if elapsed <= 0:
             elapsed = 0.001
         repo.ui.progress(_('clone'), None)
         repo.ui.status(_('transferred %s in %.1f seconds (%s/sec)\n') %
                        (util.bytecount(bytecount), elapsed,
                         util.bytecount(bytecount / elapsed)))
 
 def readbundle1header(fp):
     compression = fp.read(2)
     if compression != 'UN':
         raise error.Abort(_('only uncompressed stream clone bundles are '
             'supported; got %s') % compression)
 
     filecount, bytecount = struct.unpack('>QQ', fp.read(16))
     requireslen = struct.unpack('>H', fp.read(2))[0]
     requires = fp.read(requireslen)
 
     if not requires.endswith('\0'):
         raise error.Abort(_('malformed stream clone bundle: '
                             'requirements not properly encoded'))
 
     requirements = set(requires.rstrip('\0').split(','))
 
     return filecount, bytecount, requirements
 
 def applybundlev1(repo, fp):
     """Apply the content from a stream clone bundle version 1.
 
     We assume the 4 byte header has been read and validated and the file handle
     is at the 2 byte compression identifier.
     """
     if len(repo):
         raise error.Abort(_('cannot apply stream clone bundle on non-empty '
                             'repo'))
 
     filecount, bytecount, requirements = readbundle1header(fp)
     missingreqs = requirements - repo.supportedformats
     if missingreqs:
         raise error.Abort(_('unable to apply stream clone: '
                             'unsupported format: %s') %
                             ', '.join(sorted(missingreqs)))
 
     consumev1(repo, fp, filecount, bytecount)
 
 class streamcloneapplier(object):
     """Class to manage applying streaming clone bundles.
 
     We need to wrap ``applybundlev1()`` in a dedicated type to enable bundle
     readers to perform bundle type-specific functionality.
     """
     def __init__(self, fh):
         self._fh = fh
 
     def apply(self, repo):
         return applybundlev1(repo, self._fh)

mercurial/vfs.py

@@ -1,641 +1,643 b''
 # vfs.py - Mercurial 'vfs' classes
 #
 #  Copyright Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 from __future__ import absolute_import
 
 import contextlib
 import errno
 import os
 import shutil
 import stat
 import tempfile
 import threading
 
 from .i18n import _
 from . import (
     error,
     pathutil,
     pycompat,
     util,
 )
 
 class abstractvfs(object):
     """Abstract base class; cannot be instantiated"""
 
     def __init__(self, *args, **kwargs):
         '''Prevent instantiation; don't call this from subclasses.'''
         raise NotImplementedError('attempted instantiating ' + str(type(self)))
 
     def tryread(self, path):
         '''gracefully return an empty string for missing files'''
         try:
             return self.read(path)
         except IOError as inst:
             if inst.errno != errno.ENOENT:
                 raise
         return ""
 
     def tryreadlines(self, path, mode='rb'):
         '''gracefully return an empty array for missing files'''
         try:
             return self.readlines(path, mode=mode)
         except IOError as inst:
             if inst.errno != errno.ENOENT:
                 raise
         return []
 
     @util.propertycache
     def open(self):
         '''Open ``path`` file, which is relative to vfs root.
 
         Newly created directories are marked as "not to be indexed by
         the content indexing service", if ``notindexed`` is specified
         for "write" mode access.
         '''
         return self.__call__
 
     def read(self, path):
         with self(path, 'rb') as fp:
             return fp.read()
 
     def readlines(self, path, mode='rb'):
         with self(path, mode=mode) as fp:
             return fp.readlines()
 
     def write(self, path, data, backgroundclose=False):
         with self(path, 'wb', backgroundclose=backgroundclose) as fp:
             return fp.write(data)
 
     def writelines(self, path, data, mode='wb', notindexed=False):
         with self(path, mode=mode, notindexed=notindexed) as fp:
             return fp.writelines(data)
 
     def append(self, path, data):
         with self(path, 'ab') as fp:
             return fp.write(data)
 
     def basename(self, path):
         """return base element of a path (as os.path.basename would do)
 
         This exists to allow handling of strange encoding if needed."""
         return os.path.basename(path)
 
     def chmod(self, path, mode):
         return os.chmod(self.join(path), mode)
 
     def dirname(self, path):
         """return dirname element of a path (as os.path.dirname would do)
 
         This exists to allow handling of strange encoding if needed."""
         return os.path.dirname(path)
 
     def exists(self, path=None):
         return os.path.exists(self.join(path))
 
     def fstat(self, fp):
         return util.fstat(fp)
 
     def isdir(self, path=None):
         return os.path.isdir(self.join(path))
 
     def isfile(self, path=None):
         return os.path.isfile(self.join(path))
 
     def islink(self, path=None):
         return os.path.islink(self.join(path))
 
     def isfileorlink(self, path=None):
         '''return whether path is a regular file or a symlink
 
         Unlike isfile, this doesn't follow symlinks.'''
         try:
             st = self.lstat(path)
         except OSError:
             return False
         mode = st.st_mode
         return stat.S_ISREG(mode) or stat.S_ISLNK(mode)
 
     def reljoin(self, *paths):
         """join various elements of a path together (as os.path.join would do)
 
         The vfs base is not injected so that path stay relative. This exists
         to allow handling of strange encoding if needed."""
         return os.path.join(*paths)
 
     def split(self, path):
         """split top-most element of a path (as os.path.split would do)
 
         This exists to allow handling of strange encoding if needed."""
         return os.path.split(path)
 
     def lexists(self, path=None):
         return os.path.lexists(self.join(path))
 
     def lstat(self, path=None):
         return os.lstat(self.join(path))
 
     def listdir(self, path=None):
         return os.listdir(self.join(path))
 
     def makedir(self, path=None, notindexed=True):
         return util.makedir(self.join(path), notindexed)
 
     def makedirs(self, path=None, mode=None):
         return util.makedirs(self.join(path), mode)
 
     def makelock(self, info, path):
         return util.makelock(info, self.join(path))
 
     def mkdir(self, path=None):
         return os.mkdir(self.join(path))
 
     def mkstemp(self, suffix='', prefix='tmp', dir=None, text=False):
         fd, name = tempfile.mkstemp(suffix=suffix, prefix=prefix,
                                     dir=self.join(dir), text=text)
         dname, fname = util.split(name)
         if dir:
             return fd, os.path.join(dir, fname)
         else:
             return fd, fname
 
     def readdir(self, path=None, stat=None, skip=None):
         return util.listdir(self.join(path), stat, skip)
 
     def readlock(self, path):
         return util.readlock(self.join(path))
 
     def rename(self, src, dst, checkambig=False):
         """Rename from src to dst
 
         checkambig argument is used with util.filestat, and is useful
         only if destination file is guarded by any lock
         (e.g. repo.lock or repo.wlock).
         """
         srcpath = self.join(src)
         dstpath = self.join(dst)
         oldstat = checkambig and util.filestat.frompath(dstpath)
         if oldstat and oldstat.stat:
             def dorename(spath, dpath):
                 ret = util.rename(spath, dpath)
                 newstat = util.filestat.frompath(dpath)
                 if newstat.isambig(oldstat):
                     # stat of renamed file is ambiguous to original one
                     return ret, newstat.avoidambig(dpath, oldstat)
                 return ret, True
             ret, avoided = dorename(srcpath, dstpath)
             if not avoided:
                 # simply copy to change owner of srcpath (see issue5418)
                 util.copyfile(dstpath, srcpath)
                 ret, avoided = dorename(srcpath, dstpath)
             return ret
         return util.rename(srcpath, dstpath)
 
     def readlink(self, path):
         return os.readlink(self.join(path))
 
     def removedirs(self, path=None):
         """Remove a leaf directory and all empty intermediate ones
         """
         return util.removedirs(self.join(path))
 
     def rmtree(self, path=None, ignore_errors=False, forcibly=False):
         """Remove a directory tree recursively
 
         If ``forcibly``, this tries to remove READ-ONLY files, too.
         """
         if forcibly:
             def onerror(function, path, excinfo):
                 if function is not os.remove:
                     raise
                 # read-only files cannot be unlinked under Windows
                 s = os.stat(path)
                 if (s.st_mode & stat.S_IWRITE) != 0:
                     raise
                 os.chmod(path, stat.S_IMODE(s.st_mode) | stat.S_IWRITE)
                 os.remove(path)
         else:
             onerror = None
         return shutil.rmtree(self.join(path),
                              ignore_errors=ignore_errors, onerror=onerror)
 
     def setflags(self, path, l, x):
         return util.setflags(self.join(path), l, x)
 
     def stat(self, path=None):
         return os.stat(self.join(path))
 
     def unlink(self, path=None):
         return util.unlink(self.join(path))
 
     def tryunlink(self, path=None):
         """Attempt to remove a file, ignoring missing file errors."""
         util.tryunlink(self.join(path))
 
     def unlinkpath(self, path=None, ignoremissing=False):
         return util.unlinkpath(self.join(path), ignoremissing=ignoremissing)
 
     def utime(self, path=None, t=None):
         return os.utime(self.join(path), t)
 
     def walk(self, path=None, onerror=None):
         """Yield (dirpath, dirs, files) tuple for each directories under path
 
         ``dirpath`` is relative one from the root of this vfs. This
         uses ``os.sep`` as path separator, even you specify POSIX
         style ``path``.
 
         "The root of this vfs" is represented as empty ``dirpath``.
         """
         root = os.path.normpath(self.join(None))
         # when dirpath == root, dirpath[prefixlen:] becomes empty
         # because len(dirpath) < prefixlen.
         prefixlen = len(pathutil.normasprefix(root))
         for dirpath, dirs, files in os.walk(self.join(path), onerror=onerror):
             yield (dirpath[prefixlen:], dirs, files)
 
     @contextlib.contextmanager
     def backgroundclosing(self, ui, expectedcount=-1):
         """Allow files to be closed asynchronously.
 
         When this context manager is active, ``backgroundclose`` can be passed
         to ``__call__``/``open`` to result in the file possibly being closed
         asynchronously, on a background thread.
         """
         # This is an arbitrary restriction and could be changed if we ever
         # have a use case.
         vfs = getattr(self, 'vfs', self)
         if getattr(vfs, '_backgroundfilecloser', None):
             raise error.Abort(
                 _('can only have 1 active background file closer'))
 
         with backgroundfilecloser(ui, expectedcount=expectedcount) as bfc:
             try:
                 vfs._backgroundfilecloser = bfc
                 yield bfc
             finally:
                 vfs._backgroundfilecloser = None
 
 class vfs(abstractvfs):
     '''Operate files relative to a base directory
 
     This class is used to hide the details of COW semantics and
     remote file access from higher level code.
     '''
     def __init__(self, base, audit=True, expandpath=False, realpath=False):
         if expandpath:
             base = util.expandpath(base)
         if realpath:
             base = os.path.realpath(base)
         self.base = base
         self.mustaudit = audit
         self.createmode = None
         self._trustnlink = None
 
     @property
     def mustaudit(self):
         return self._audit
 
     @mustaudit.setter
     def mustaudit(self, onoff):
         self._audit = onoff
         if onoff:
             self.audit = pathutil.pathauditor(self.base)
         else:
             self.audit = util.always
 
     @util.propertycache
     def _cansymlink(self):
         return util.checklink(self.base)
 
     @util.propertycache
     def _chmod(self):
         return util.checkexec(self.base)
 
     def _fixfilemode(self, name):
         if self.createmode is None or not self._chmod:
             return
         os.chmod(name, self.createmode & 0o666)
 
     def __call__(self, path, mode="r", text=False, atomictemp=False,
-                 notindexed=False, backgroundclose=False, checkambig=False):
+                 notindexed=False, backgroundclose=False, checkambig=False,
+                 auditpath=True):
         '''Open ``path`` file, which is relative to vfs root.
 
         Newly created directories are marked as "not to be indexed by
         the content indexing service", if ``notindexed`` is specified
         for "write" mode access.
 
         If ``backgroundclose`` is passed, the file may be closed asynchronously.
         It can only be used if the ``self.backgroundclosing()`` context manager
         is active. This should only be specified if the following criteria hold:
 
         1. There is a potential for writing thousands of files. Unless you
            are writing thousands of files, the performance benefits of
            asynchronously closing files is not realized.
         2. Files are opened exactly once for the ``backgroundclosing``
            active duration and are therefore free of race conditions between
            closing a file on a background thread and reopening it. (If the
            file were opened multiple times, there could be unflushed data
            because the original file handle hasn't been flushed/closed yet.)
 
         ``checkambig`` argument is passed to atomictemplfile (valid
         only for writing), and is useful only if target file is
         guarded by any lock (e.g. repo.lock or repo.wlock).
         '''
-        if self._audit:
-            r = util.checkosfilename(path)
-            if r:
-                raise error.Abort("%s: %r" % (r, path))
-        self.audit(path)
+        if auditpath:
+            if self._audit:
+                r = util.checkosfilename(path)
+                if r:
+                    raise error.Abort("%s: %r" % (r, path))
+            self.audit(path)
         f = self.join(path)
 
         if not text and "b" not in mode:
             mode += "b" # for that other OS
 
         nlink = -1
         if mode not in ('r', 'rb'):
             dirname, basename = util.split(f)
             # If basename is empty, then the path is malformed because it points
             # to a directory. Let the posixfile() call below raise IOError.
             if basename:
                 if atomictemp:
                     util.makedirs(dirname, self.createmode, notindexed)
                     return util.atomictempfile(f, mode, self.createmode,
                                                checkambig=checkambig)
                 try:
                     if 'w' in mode:
                         util.unlink(f)
                         nlink = 0
                     else:
                         # nlinks() may behave differently for files on Windows
                         # shares if the file is open.
                         with util.posixfile(f):
                             nlink = util.nlinks(f)
                             if nlink < 1:
                                 nlink = 2 # force mktempcopy (issue1922)
                 except (OSError, IOError) as e:
                     if e.errno != errno.ENOENT:
                         raise
                     nlink = 0
                     util.makedirs(dirname, self.createmode, notindexed)
                 if nlink > 0:
                     if self._trustnlink is None:
                         self._trustnlink = nlink > 1 or util.checknlink(f)
                     if nlink > 1 or not self._trustnlink:
                         util.rename(util.mktempcopy(f), f)
         fp = util.posixfile(f, mode)
         if nlink == 0:
             self._fixfilemode(f)
 
         if checkambig:
             if mode in ('r', 'rb'):
                 raise error.Abort(_('implementation error: mode %s is not'
                                     ' valid for checkambig=True') % mode)
             fp = checkambigatclosing(fp)
 
         if backgroundclose:
             if not self._backgroundfilecloser:
                 raise error.Abort(_('backgroundclose can only be used when a '
                                   'backgroundclosing context manager is active')
                                   )
 
             fp = delayclosedfile(fp, self._backgroundfilecloser)
 
         return fp
 
     def symlink(self, src, dst):
         self.audit(dst)
         linkname = self.join(dst)
         util.tryunlink(linkname)
 
         util.makedirs(os.path.dirname(linkname), self.createmode)
 
         if self._cansymlink:
             try:
                 os.symlink(src, linkname)
             except OSError as err:
                 raise OSError(err.errno, _('could not symlink to %r: %s') %
                               (src, err.strerror), linkname)
         else:
             self.write(dst, src)
 
     def join(self, path, *insidef):
         if path:
             return os.path.join(self.base, path, *insidef)
         else:
             return self.base
 
 opener = vfs
 
 class auditvfs(object):
     def __init__(self, vfs):
         self.vfs = vfs
 
     @property
     def mustaudit(self):
         return self.vfs.mustaudit
 
     @mustaudit.setter
     def mustaudit(self, onoff):
         self.vfs.mustaudit = onoff
 
     @property
     def options(self):
         return self.vfs.options
 
     @options.setter
     def options(self, value):
         self.vfs.options = value
 
 class filtervfs(abstractvfs, auditvfs):
     '''Wrapper vfs for filtering filenames with a function.'''
 
     def __init__(self, vfs, filter):
         auditvfs.__init__(self, vfs)
         self._filter = filter
 
     def __call__(self, path, *args, **kwargs):
         return self.vfs(self._filter(path), *args, **kwargs)
 
     def join(self, path, *insidef):
         if path:
             return self.vfs.join(self._filter(self.vfs.reljoin(path, *insidef)))
         else:
             return self.vfs.join(path)
 
 filteropener = filtervfs
 
 class readonlyvfs(abstractvfs, auditvfs):
     '''Wrapper vfs preventing any writing.'''
 
     def __init__(self, vfs):
         auditvfs.__init__(self, vfs)
 
     def __call__(self, path, mode='r', *args, **kw):
         if mode not in ('r', 'rb'):
             raise error.Abort(_('this vfs is read only'))
         return self.vfs(path, mode, *args, **kw)
 
     def join(self, path, *insidef):
         return self.vfs.join(path, *insidef)
 
 class closewrapbase(object):
     """Base class of wrapper, which hooks closing
 
     Do not instantiate outside of the vfs layer.
     """
     def __init__(self, fh):
         object.__setattr__(self, r'_origfh', fh)
 
     def __getattr__(self, attr):
         return getattr(self._origfh, attr)
 
     def __setattr__(self, attr, value):
         return setattr(self._origfh, attr, value)
 
     def __delattr__(self, attr):
         return delattr(self._origfh, attr)
 
     def __enter__(self):
         return self._origfh.__enter__()
 
     def __exit__(self, exc_type, exc_value, exc_tb):
         raise NotImplementedError('attempted instantiating ' + str(type(self)))
 
     def close(self):
         raise NotImplementedError('attempted instantiating ' + str(type(self)))
 
 class delayclosedfile(closewrapbase):
     """Proxy for a file object whose close is delayed.
 
     Do not instantiate outside of the vfs layer.
     """
     def __init__(self, fh, closer):
         super(delayclosedfile, self).__init__(fh)
         object.__setattr__(self, r'_closer', closer)
 
     def __exit__(self, exc_type, exc_value, exc_tb):
         self._closer.close(self._origfh)
 
     def close(self):
         self._closer.close(self._origfh)
 
 class backgroundfilecloser(object):
     """Coordinates background closing of file handles on multiple threads."""
     def __init__(self, ui, expectedcount=-1):
         self._running = False
         self._entered = False
         self._threads = []
         self._threadexception = None
 
         # Only Windows/NTFS has slow file closing. So only enable by default
         # on that platform. But allow to be enabled elsewhere for testing.
         defaultenabled = pycompat.osname == 'nt'
         enabled = ui.configbool('worker', 'backgroundclose', defaultenabled)
 
         if not enabled:
             return
 
         # There is overhead to starting and stopping the background threads.
         # Don't do background processing unless the file count is large enough
         # to justify it.
         minfilecount = ui.configint('worker', 'backgroundcloseminfilecount')
         # FUTURE dynamically start background threads after minfilecount closes.
         # (We don't currently have any callers that don't know their file count)
         if expectedcount > 0 and expectedcount < minfilecount:
             return
 
         maxqueue = ui.configint('worker', 'backgroundclosemaxqueue')
         threadcount = ui.configint('worker', 'backgroundclosethreadcount')
 
         ui.debug('starting %d threads for background file closing\n' %
                  threadcount)
 
         self._queue = util.queue(maxsize=maxqueue)
         self._running = True
 
         for i in range(threadcount):
             t = threading.Thread(target=self._worker, name='backgroundcloser')
             self._threads.append(t)
             t.start()
 
     def __enter__(self):
         self._entered = True
         return self
 
     def __exit__(self, exc_type, exc_value, exc_tb):
         self._running = False
 
         # Wait for threads to finish closing so open files don't linger for
         # longer than lifetime of context manager.
         for t in self._threads:
             t.join()
 
     def _worker(self):
         """Main routine for worker thread."""
         while True:
             try:
                 fh = self._queue.get(block=True, timeout=0.100)
                 # Need to catch or the thread will terminate and
                 # we could orphan file descriptors.
                 try:
                     fh.close()
                 except Exception as e:
                     # Stash so can re-raise from main thread later.
                     self._threadexception = e
             except util.empty:
                 if not self._running:
                     break
 
     def close(self, fh):
         """Schedule a file for closing."""
         if not self._entered:
             raise error.Abort(_('can only call close() when context manager '
                               'active'))
 
         # If a background thread encountered an exception, raise now so we fail
         # fast. Otherwise we may potentially go on for minutes until the error
         # is acted on.
         if self._threadexception:
             e = self._threadexception
             self._threadexception = None
             raise e
 
         # If we're not actively running, close synchronously.
         if not self._running:
             fh.close()
             return
 
         self._queue.put(fh, block=True, timeout=None)
 
 class checkambigatclosing(closewrapbase):
     """Proxy for a file object, to avoid ambiguity of file stat
 
     See also util.filestat for detail about "ambiguity of file stat".
 
     This proxy is useful only if the target file is guarded by any
     lock (e.g. repo.lock or repo.wlock)
 
     Do not instantiate outside of the vfs layer.
     """
     def __init__(self, fh):
         super(checkambigatclosing, self).__init__(fh)
         object.__setattr__(self, r'_oldstat', util.filestat.frompath(fh.name))
 
     def _checkambig(self):
         oldstat = self._oldstat
         if oldstat.stat:
             newstat = util.filestat.frompath(self._origfh.name)
             if newstat.isambig(oldstat):
                 # stat of changed file is ambiguous to original one
                 newstat.avoidambig(self._origfh.name, oldstat)
 
     def __exit__(self, exc_type, exc_value, exc_tb):
         self._origfh.__exit__(exc_type, exc_value, exc_tb)
         self._checkambig()
 
     def close(self):
         self._origfh.close()
         self._checkambig()