lfs: verify lfs object content when transferring to and from the remote store

This avoids inserting corrupt files into the usercache, and local and remote
stores.  One down side is that the bad file won't be available locally for
forensic purposes after a remote download.  I'm thinking about adding an
'incoming' directory to the local lfs store to handle the download, and then
move it to the 'objects' directory after it passes verification.  That would
have the additional benefit of not concatenating each transfer chunk in memory
until the full file is transferred.

Verification isn't needed when the data is passed back through the revlog
interface or when the oid was just calculated, but otherwise it is on by
default.  The additional overhead should be well worth avoiding problems with
file based remote stores, or buggy lfs servers.

Having two different verify functions is a little sad, but the full data of the
blob is mostly passed around in memory, because that's what the revlog interface
wants.  The upload function, however, chunks up the data.  It would be ideal if
that was how the content is always handled, but that's probably a huge project.

I don't really like printing the long hash, but `hg debugdata` isn't a public
interface, and is the only way to get it.  The filelog and revision info is
nowhere near this area, so recommending `hg verify` is the easiest thing to do.

hgext/lfs/blobstore.py

@@ -1,395 +1,428 b''
 # blobstore.py - local and remote (speaking Git-LFS protocol) blob storages
 #
 # Copyright 2017 Facebook, Inc.
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
+import hashlib
 import json
 import os
 import re
 import socket
 
 from mercurial.i18n import _
 
 from mercurial import (
     error,
     pathutil,
     url as urlmod,
     util,
     vfs as vfsmod,
     worker,
 )
 
 from ..largefiles import lfutil
 
 # 64 bytes for SHA256
 _lfsre = re.compile(r'\A[a-f0-9]{64}\Z')
 
 class lfsvfs(vfsmod.vfs):
     def join(self, path):
         """split the path at first two characters, like: XX/XXXXX..."""
         if not _lfsre.match(path):
             raise error.ProgrammingError('unexpected lfs path: %s' % path)
         return super(lfsvfs, self).join(path[0:2], path[2:])
 
     def walk(self, path=None, onerror=None):
         """Yield (dirpath, [], oids) tuple for blobs under path
 
         Oids only exist in the root of this vfs, so dirpath is always ''.
         """
         root = os.path.normpath(self.base)
         # when dirpath == root, dirpath[prefixlen:] becomes empty
         # because len(dirpath) < prefixlen.
         prefixlen = len(pathutil.normasprefix(root))
         oids = []
 
         for dirpath, dirs, files in os.walk(self.reljoin(self.base, path or ''),
                                             onerror=onerror):
             dirpath = dirpath[prefixlen:]
 
             # Silently skip unexpected files and directories
             if len(dirpath) == 2:
                 oids.extend([dirpath + f for f in files
                              if _lfsre.match(dirpath + f)])
 
         yield ('', [], oids)
 
 class filewithprogress(object):
     """a file-like object that supports __len__ and read.
 
     Useful to provide progress information for how many bytes are read.
     """
 
     def __init__(self, fp, callback):
         self._fp = fp
         self._callback = callback # func(readsize)
         fp.seek(0, os.SEEK_END)
         self._len = fp.tell()
         fp.seek(0)
 
     def __len__(self):
         return self._len
 
     def read(self, size):
         if self._fp is None:
             return b''
         data = self._fp.read(size)
         if data:
             if self._callback:
                 self._callback(len(data))
         else:
             self._fp.close()
             self._fp = None
         return data
 
 class local(object):
     """Local blobstore for large file contents.
 
     This blobstore is used both as a cache and as a staging area for large blobs
     to be uploaded to the remote blobstore.
     """
 
     def __init__(self, repo):
         fullpath = repo.svfs.join('lfs/objects')
         self.vfs = lfsvfs(fullpath)
         usercache = lfutil._usercachedir(repo.ui, 'lfs')
         self.cachevfs = lfsvfs(usercache)
         self.ui = repo.ui
 
-    def write(self, oid, data):
+    def write(self, oid, data, verify=True):
         """Write blob to local blobstore."""
+        if verify:
+            _verify(oid, data)
+
         with self.vfs(oid, 'wb', atomictemp=True) as fp:
             fp.write(data)
 
         # XXX: should we verify the content of the cache, and hardlink back to
         # the local store on success, but truncate, write and link on failure?
         if not self.cachevfs.exists(oid):
             self.ui.note(_('lfs: adding %s to the usercache\n') % oid)
             lfutil.link(self.vfs.join(oid), self.cachevfs.join(oid))
 
-    def read(self, oid):
+    def read(self, oid, verify=True):
         """Read blob from local blobstore."""
         if not self.vfs.exists(oid):
+            blob = self._read(self.cachevfs, oid, verify)
+            self.ui.note(_('lfs: found %s in the usercache\n') % oid)
             lfutil.link(self.cachevfs.join(oid), self.vfs.join(oid))
-            self.ui.note(_('lfs: found %s in the usercache\n') % oid)
         else:
             self.ui.note(_('lfs: found %s in the local lfs store\n') % oid)
-        return self.vfs.read(oid)
+            blob = self._read(self.vfs, oid, verify)
+        return blob
+
+    def _read(self, vfs, oid, verify):
+        """Read blob (after verifying) from the given store"""
+        blob = vfs.read(oid)
+        if verify:
+            _verify(oid, blob)
+        return blob
 
     def has(self, oid):
         """Returns True if the local blobstore contains the requested blob,
         False otherwise."""
         return self.cachevfs.exists(oid) or self.vfs.exists(oid)
 
 class _gitlfsremote(object):
 
     def __init__(self, repo, url):
         ui = repo.ui
         self.ui = ui
         baseurl, authinfo = url.authinfo()
         self.baseurl = baseurl.rstrip('/')
         useragent = repo.ui.config('experimental', 'lfs.user-agent')
         if not useragent:
             useragent = 'mercurial/%s git/2.15.1' % util.version()
         self.urlopener = urlmod.opener(ui, authinfo, useragent)
         self.retry = ui.configint('lfs', 'retry')
 
     def writebatch(self, pointers, fromstore):
         """Batch upload from local to remote blobstore."""
         self._batch(pointers, fromstore, 'upload')
 
     def readbatch(self, pointers, tostore):
         """Batch download from remote to local blostore."""
         self._batch(pointers, tostore, 'download')
 
     def _batchrequest(self, pointers, action):
         """Get metadata about objects pointed by pointers for given action
 
         Return decoded JSON object like {'objects': [{'oid': '', 'size': 1}]}
         See https://github.com/git-lfs/git-lfs/blob/master/docs/api/batch.md
         """
         objects = [{'oid': p.oid(), 'size': p.size()} for p in pointers]
         requestdata = json.dumps({
             'objects': objects,
             'operation': action,
         })
         batchreq = util.urlreq.request('%s/objects/batch' % self.baseurl,
                                        data=requestdata)
         batchreq.add_header('Accept', 'application/vnd.git-lfs+json')
         batchreq.add_header('Content-Type', 'application/vnd.git-lfs+json')
         try:
             rawjson = self.urlopener.open(batchreq).read()
         except util.urlerr.httperror as ex:
             raise LfsRemoteError(_('LFS HTTP error: %s (action=%s)')
                                  % (ex, action))
         try:
             response = json.loads(rawjson)
         except ValueError:
             raise LfsRemoteError(_('LFS server returns invalid JSON: %s')
                                  % rawjson)
         return response
 
     def _checkforservererror(self, pointers, responses):
         """Scans errors from objects
 
         Returns LfsRemoteError if any objects has an error"""
         for response in responses:
             error = response.get('error')
             if error:
                 ptrmap = {p.oid(): p for p in pointers}
                 p = ptrmap.get(response['oid'], None)
                 if error['code'] == 404 and p:
                     filename = getattr(p, 'filename', 'unknown')
                     raise LfsRemoteError(
                         _(('LFS server error. Remote object '
                           'for file %s not found: %r')) % (filename, response))
                 raise LfsRemoteError(_('LFS server error: %r') % response)
 
     def _extractobjects(self, response, pointers, action):
         """extract objects from response of the batch API
 
         response: parsed JSON object returned by batch API
         return response['objects'] filtered by action
         raise if any object has an error
         """
         # Scan errors from objects - fail early
         objects = response.get('objects', [])
         self._checkforservererror(pointers, objects)
 
         # Filter objects with given action. Practically, this skips uploading
         # objects which exist in the server.
         filteredobjects = [o for o in objects if action in o.get('actions', [])]
         # But for downloading, we want all objects. Therefore missing objects
         # should be considered an error.
         if action == 'download':
             if len(filteredobjects) < len(objects):
                 missing = [o.get('oid', '?')
                            for o in objects
                            if action not in o.get('actions', [])]
                 raise LfsRemoteError(
                     _('LFS server claims required objects do not exist:\n%s')
                     % '\n'.join(missing))
 
         return filteredobjects
 
     def _basictransfer(self, obj, action, localstore):
         """Download or upload a single object using basic transfer protocol
 
         obj: dict, an object description returned by batch API
         action: string, one of ['upload', 'download']
         localstore: blobstore.local
 
         See https://github.com/git-lfs/git-lfs/blob/master/docs/api/\
         basic-transfers.md
         """
         oid = str(obj['oid'])
 
         href = str(obj['actions'][action].get('href'))
         headers = obj['actions'][action].get('header', {}).items()
 
         request = util.urlreq.request(href)
         if action == 'upload':
             # If uploading blobs, read data from local blobstore.
+            with localstore.vfs(oid) as fp:
+                _verifyfile(oid, fp)
             request.data = filewithprogress(localstore.vfs(oid), None)
             request.get_method = lambda: 'PUT'
 
         for k, v in headers:
             request.add_header(k, v)
 
         response = b''
         try:
             req = self.urlopener.open(request)
             while True:
                 data = req.read(1048576)
                 if not data:
                     break
                 response += data
         except util.urlerr.httperror as ex:
             raise LfsRemoteError(_('HTTP error: %s (oid=%s, action=%s)')
                                  % (ex, oid, action))
 
         if action == 'download':
             # If downloading blobs, store downloaded data to local blobstore
-            localstore.write(oid, response)
+            localstore.write(oid, response, verify=True)
 
     def _batch(self, pointers, localstore, action):
         if action not in ['upload', 'download']:
             raise error.ProgrammingError('invalid Git-LFS action: %s' % action)
 
         response = self._batchrequest(pointers, action)
         objects = self._extractobjects(response, pointers, action)
         total = sum(x.get('size', 0) for x in objects)
         sizes = {}
         for obj in objects:
             sizes[obj.get('oid')] = obj.get('size', 0)
         topic = {'upload': _('lfs uploading'),
                  'download': _('lfs downloading')}[action]
         if self.ui.verbose and len(objects) > 1:
             self.ui.write(_('lfs: need to transfer %d objects (%s)\n')
                           % (len(objects), util.bytecount(total)))
         self.ui.progress(topic, 0, total=total)
         def transfer(chunk):
             for obj in chunk:
                 objsize = obj.get('size', 0)
                 if self.ui.verbose:
                     if action == 'download':
                         msg = _('lfs: downloading %s (%s)\n')
                     elif action == 'upload':
                         msg = _('lfs: uploading %s (%s)\n')
                     self.ui.write(msg % (obj.get('oid'),
                                   util.bytecount(objsize)))
                 retry = self.retry
                 while True:
                     try:
                         self._basictransfer(obj, action, localstore)
                         yield 1, obj.get('oid')
                         break
                     except socket.error as ex:
                         if retry > 0:
                             if self.ui.verbose:
                                 self.ui.write(
                                     _('lfs: failed: %r (remaining retry %d)\n')
                                     % (ex, retry))
                             retry -= 1
                             continue
                         raise
 
         oids = worker.worker(self.ui, 0.1, transfer, (),
                              sorted(objects, key=lambda o: o.get('oid')))
         processed = 0
         for _one, oid in oids:
             processed += sizes[oid]
             self.ui.progress(topic, processed, total=total)
             if self.ui.verbose:
                 self.ui.write(_('lfs: processed: %s\n') % oid)
         self.ui.progress(topic, pos=None, total=total)
 
     def __del__(self):
         # copied from mercurial/httppeer.py
         urlopener = getattr(self, 'urlopener', None)
         if urlopener:
             for h in urlopener.handlers:
                 h.close()
                 getattr(h, "close_all", lambda : None)()
 
 class _dummyremote(object):
     """Dummy store storing blobs to temp directory."""
 
     def __init__(self, repo, url):
         fullpath = repo.vfs.join('lfs', url.path)
         self.vfs = lfsvfs(fullpath)
 
     def writebatch(self, pointers, fromstore):
         for p in pointers:
-            content = fromstore.read(p.oid())
+            content = fromstore.read(p.oid(), verify=True)
             with self.vfs(p.oid(), 'wb', atomictemp=True) as fp:
                 fp.write(content)
 
     def readbatch(self, pointers, tostore):
         for p in pointers:
             content = self.vfs.read(p.oid())
-            tostore.write(p.oid(), content)
+            tostore.write(p.oid(), content, verify=True)
 
 class _nullremote(object):
     """Null store storing blobs to /dev/null."""
 
     def __init__(self, repo, url):
         pass
 
     def writebatch(self, pointers, fromstore):
         pass
 
     def readbatch(self, pointers, tostore):
         pass
 
 class _promptremote(object):
     """Prompt user to set lfs.url when accessed."""
 
     def __init__(self, repo, url):
         pass
 
     def writebatch(self, pointers, fromstore, ui=None):
         self._prompt()
 
     def readbatch(self, pointers, tostore, ui=None):
         self._prompt()
 
     def _prompt(self):
         raise error.Abort(_('lfs.url needs to be configured'))
 
 _storemap = {
     'https': _gitlfsremote,
     'http': _gitlfsremote,
     'file': _dummyremote,
     'null': _nullremote,
     None: _promptremote,
 }
 
+def _verify(oid, content):
+    realoid = hashlib.sha256(content).hexdigest()
+    if realoid != oid:
+        raise error.Abort(_('detected corrupt lfs object: %s') % oid,
+                          hint=_('run hg verify'))
+
+def _verifyfile(oid, fp):
+    sha256 = hashlib.sha256()
+    while True:
+        data = fp.read(1024 * 1024)
+        if not data:
+            break
+        sha256.update(data)
+    realoid = sha256.hexdigest()
+    if realoid != oid:
+        raise error.Abort(_('detected corrupt lfs object: %s') % oid,
+                          hint=_('run hg verify'))
+
 def remote(repo):
     """remotestore factory. return a store in _storemap depending on config"""
     defaulturl = ''
 
     # convert deprecated configs to the new url. TODO: remove this if other
     # places are migrated to the new url config.
     # deprecated config: lfs.remotestore
     deprecatedstore = repo.ui.config('lfs', 'remotestore')
     if deprecatedstore == 'dummy':
         # deprecated config: lfs.remotepath
         defaulturl = 'file://' + repo.ui.config('lfs', 'remotepath')
     elif deprecatedstore == 'git-lfs':
         # deprecated config: lfs.remoteurl
         defaulturl = repo.ui.config('lfs', 'remoteurl')
     elif deprecatedstore == 'null':
         defaulturl = 'null://'
 
     url = util.url(repo.ui.config('lfs', 'url', defaulturl))
     scheme = url.scheme
     if scheme not in _storemap:
         raise error.Abort(_('lfs: unknown url scheme: %s') % scheme)
     return _storemap[scheme](repo, url)
 
 class LfsRemoteError(error.RevlogError):
     pass

hgext/lfs/wrapper.py

@@ -1,323 +1,325 b''
 # wrapper.py - methods wrapping core mercurial logic
 #
 # Copyright 2017 Facebook, Inc.
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import hashlib
 
 from mercurial.i18n import _
 from mercurial.node import bin, nullid, short
 
 from mercurial import (
     error,
     filelog,
     revlog,
     util,
 )
 
 from ..largefiles import lfutil
 
 from . import (
     blobstore,
     pointer,
 )
 
 def supportedoutgoingversions(orig, repo):
     versions = orig(repo)
     versions.discard('01')
     versions.discard('02')
     versions.add('03')
     return versions
 
 def allsupportedversions(orig, ui):
     versions = orig(ui)
     versions.add('03')
     return versions
 
 def bypasscheckhash(self, text):
     return False
 
 def readfromstore(self, text):
     """Read filelog content from local blobstore transform for flagprocessor.
 
     Default tranform for flagprocessor, returning contents from blobstore.
     Returns a 2-typle (text, validatehash) where validatehash is True as the
     contents of the blobstore should be checked using checkhash.
     """
     p = pointer.deserialize(text)
     oid = p.oid()
     store = self.opener.lfslocalblobstore
     if not store.has(oid):
         p.filename = getattr(self, 'indexfile', None)
         self.opener.lfsremoteblobstore.readbatch([p], store)
-    text = store.read(oid)
+
+    # The caller will validate the content
+    text = store.read(oid, verify=False)
 
     # pack hg filelog metadata
     hgmeta = {}
     for k in p.keys():
         if k.startswith('x-hg-'):
             name = k[len('x-hg-'):]
             hgmeta[name] = p[k]
     if hgmeta or text.startswith('\1\n'):
         text = filelog.packmeta(hgmeta, text)
 
     return (text, True)
 
 def writetostore(self, text):
     # hg filelog metadata (includes rename, etc)
     hgmeta, offset = filelog.parsemeta(text)
     if offset and offset > 0:
         # lfs blob does not contain hg filelog metadata
         text = text[offset:]
 
     # git-lfs only supports sha256
     oid = hashlib.sha256(text).hexdigest()
-    self.opener.lfslocalblobstore.write(oid, text)
+    self.opener.lfslocalblobstore.write(oid, text, verify=False)
 
     # replace contents with metadata
     longoid = 'sha256:%s' % oid
     metadata = pointer.gitlfspointer(oid=longoid, size=str(len(text)))
 
     # by default, we expect the content to be binary. however, LFS could also
     # be used for non-binary content. add a special entry for non-binary data.
     # this will be used by filectx.isbinary().
     if not util.binary(text):
         # not hg filelog metadata (affecting commit hash), no "x-hg-" prefix
         metadata['x-is-binary'] = '0'
 
     # translate hg filelog metadata to lfs metadata with "x-hg-" prefix
     if hgmeta is not None:
         for k, v in hgmeta.iteritems():
             metadata['x-hg-%s' % k] = v
 
     rawtext = metadata.serialize()
     return (rawtext, False)
 
 def _islfs(rlog, node=None, rev=None):
     if rev is None:
         if node is None:
             # both None - likely working copy content where node is not ready
             return False
         rev = rlog.rev(node)
     else:
         node = rlog.node(rev)
     if node == nullid:
         return False
     flags = rlog.flags(rev)
     return bool(flags & revlog.REVIDX_EXTSTORED)
 
 def filelogaddrevision(orig, self, text, transaction, link, p1, p2,
                        cachedelta=None, node=None,
                        flags=revlog.REVIDX_DEFAULT_FLAGS, **kwds):
     threshold = self.opener.options['lfsthreshold']
     textlen = len(text)
     # exclude hg rename meta from file size
     meta, offset = filelog.parsemeta(text)
     if offset:
         textlen -= offset
 
     if threshold and textlen > threshold:
         flags |= revlog.REVIDX_EXTSTORED
 
     return orig(self, text, transaction, link, p1, p2, cachedelta=cachedelta,
                 node=node, flags=flags, **kwds)
 
 def filelogrenamed(orig, self, node):
     if _islfs(self, node):
         rawtext = self.revision(node, raw=True)
         if not rawtext:
             return False
         metadata = pointer.deserialize(rawtext)
         if 'x-hg-copy' in metadata and 'x-hg-copyrev' in metadata:
             return metadata['x-hg-copy'], bin(metadata['x-hg-copyrev'])
         else:
             return False
     return orig(self, node)
 
 def filelogsize(orig, self, rev):
     if _islfs(self, rev=rev):
         # fast path: use lfs metadata to answer size
         rawtext = self.revision(rev, raw=True)
         metadata = pointer.deserialize(rawtext)
         return int(metadata['size'])
     return orig(self, rev)
 
 def filectxcmp(orig, self, fctx):
     """returns True if text is different than fctx"""
     # some fctx (ex. hg-git) is not based on basefilectx and do not have islfs
     if self.islfs() and getattr(fctx, 'islfs', lambda: False)():
         # fast path: check LFS oid
         p1 = pointer.deserialize(self.rawdata())
         p2 = pointer.deserialize(fctx.rawdata())
         return p1.oid() != p2.oid()
     return orig(self, fctx)
 
 def filectxisbinary(orig, self):
     if self.islfs():
         # fast path: use lfs metadata to answer isbinary
         metadata = pointer.deserialize(self.rawdata())
         # if lfs metadata says nothing, assume it's binary by default
         return bool(int(metadata.get('x-is-binary', 1)))
     return orig(self)
 
 def filectxislfs(self):
     return _islfs(self.filelog(), self.filenode())
 
 def convertsink(orig, sink):
     sink = orig(sink)
     if sink.repotype == 'hg':
         class lfssink(sink.__class__):
             def putcommit(self, files, copies, parents, commit, source, revmap,
                           full, cleanp2):
                 pc = super(lfssink, self).putcommit
                 node = pc(files, copies, parents, commit, source, revmap, full,
                           cleanp2)
 
                 if 'lfs' not in self.repo.requirements:
                     ctx = self.repo[node]
 
                     # The file list may contain removed files, so check for
                     # membership before assuming it is in the context.
                     if any(f in ctx and ctx[f].islfs() for f, n in files):
                         self.repo.requirements.add('lfs')
                         self.repo._writerequirements()
 
                         # Permanently enable lfs locally
                         with self.repo.vfs('hgrc', 'a', text=True) as fp:
                             fp.write('\n[extensions]\nlfs=\n')
 
                 return node
 
         sink.__class__ = lfssink
 
     return sink
 
 def vfsinit(orig, self, othervfs):
     orig(self, othervfs)
     # copy lfs related options
     for k, v in othervfs.options.items():
         if k.startswith('lfs'):
             self.options[k] = v
     # also copy lfs blobstores. note: this can run before reposetup, so lfs
     # blobstore attributes are not always ready at this time.
     for name in ['lfslocalblobstore', 'lfsremoteblobstore']:
         if util.safehasattr(othervfs, name):
             setattr(self, name, getattr(othervfs, name))
 
 def hgclone(orig, ui, opts, *args, **kwargs):
     result = orig(ui, opts, *args, **kwargs)
 
     if result is not None:
         sourcerepo, destrepo = result
         repo = destrepo.local()
 
         # When cloning to a remote repo (like through SSH), no repo is available
         # from the peer.  Therefore the hgrc can't be updated.
         if not repo:
             return result
 
         # If lfs is required for this repo, permanently enable it locally
         if 'lfs' in repo.requirements:
             with repo.vfs('hgrc', 'a', text=True) as fp:
                 fp.write('\n[extensions]\nlfs=\n')
 
     return result
 
 def hgpostshare(orig, sourcerepo, destrepo, bookmarks=True, defaultpath=None):
     orig(sourcerepo, destrepo, bookmarks, defaultpath)
 
     # If lfs is required for this repo, permanently enable it locally
     if 'lfs' in destrepo.requirements:
         with destrepo.vfs('hgrc', 'a', text=True) as fp:
             fp.write('\n[extensions]\nlfs=\n')
 
 def _canskipupload(repo):
     # if remotestore is a null store, upload is a no-op and can be skipped
     return isinstance(repo.svfs.lfsremoteblobstore, blobstore._nullremote)
 
 def candownload(repo):
     # if remotestore is a null store, downloads will lead to nothing
     return not isinstance(repo.svfs.lfsremoteblobstore, blobstore._nullremote)
 
 def uploadblobsfromrevs(repo, revs):
     '''upload lfs blobs introduced by revs
 
     Note: also used by other extensions e. g. infinitepush. avoid renaming.
     '''
     if _canskipupload(repo):
         return
     pointers = extractpointers(repo, revs)
     uploadblobs(repo, pointers)
 
 def prepush(pushop):
     """Prepush hook.
 
     Read through the revisions to push, looking for filelog entries that can be
     deserialized into metadata so that we can block the push on their upload to
     the remote blobstore.
     """
     return uploadblobsfromrevs(pushop.repo, pushop.outgoing.missing)
 
 def writenewbundle(orig, ui, repo, source, filename, bundletype, outgoing,
                    *args, **kwargs):
     """upload LFS blobs added by outgoing revisions on 'hg bundle'"""
     uploadblobsfromrevs(repo, outgoing.missing)
     return orig(ui, repo, source, filename, bundletype, outgoing, *args,
                 **kwargs)
 
 def extractpointers(repo, revs):
     """return a list of lfs pointers added by given revs"""
     ui = repo.ui
     if ui.debugflag:
         ui.write(_('lfs: computing set of blobs to upload\n'))
     pointers = {}
     for r in revs:
         ctx = repo[r]
         for p in pointersfromctx(ctx).values():
             pointers[p.oid()] = p
     return sorted(pointers.values())
 
 def pointersfromctx(ctx):
     """return a dict {path: pointer} for given single changectx"""
     result = {}
     for f in ctx.files():
         if f not in ctx:
             continue
         fctx = ctx[f]
         if not _islfs(fctx.filelog(), fctx.filenode()):
             continue
         try:
             result[f] = pointer.deserialize(fctx.rawdata())
         except pointer.InvalidPointer as ex:
             raise error.Abort(_('lfs: corrupted pointer (%s@%s): %s\n')
                               % (f, short(ctx.node()), ex))
     return result
 
 def uploadblobs(repo, pointers):
     """upload given pointers from local blobstore"""
     if not pointers:
         return
 
     remoteblob = repo.svfs.lfsremoteblobstore
     remoteblob.writebatch(pointers, repo.svfs.lfslocalblobstore)
 
 def upgradefinishdatamigration(orig, ui, srcrepo, dstrepo, requirements):
     orig(ui, srcrepo, dstrepo, requirements)
 
     srclfsvfs = srcrepo.svfs.lfslocalblobstore.vfs
     dstlfsvfs = dstrepo.svfs.lfslocalblobstore.vfs
 
     for dirpath, dirs, files in srclfsvfs.walk():
         for oid in files:
             ui.write(_('copying lfs blob %s\n') % oid)
             lfutil.link(srclfsvfs.join(oid), dstlfsvfs.join(oid))
 
 def upgraderequirements(orig, repo):
     reqs = orig(repo)
     if 'lfs' in repo.requirements:
         reqs.add('lfs')
     return reqs

tests/test-lfs-test-server.t

@@ -1,189 +1,187 b''
 #require lfs-test-server
 
   $ LFS_LISTEN="tcp://:$HGPORT"
   $ LFS_HOST="localhost:$HGPORT"
   $ LFS_PUBLIC=1
   $ export LFS_LISTEN LFS_HOST LFS_PUBLIC
 #if no-windows
   $ lfs-test-server &> lfs-server.log &
   $ echo $! >> $DAEMON_PIDS
 #else
   $ cat >> $TESTTMP/spawn.py <<EOF
   > import os
   > import subprocess
   > import sys
   > 
   > for path in os.environ["PATH"].split(os.pathsep):
   >     exe = os.path.join(path, 'lfs-test-server.exe')
   >     if os.path.exists(exe):
   >         with open('lfs-server.log', 'wb') as out:
   >             p = subprocess.Popen(exe, stdout=out, stderr=out)
   >             sys.stdout.write('%s\n' % p.pid)
   >             sys.exit(0)
   > sys.exit(1)
   > EOF
   $ $PYTHON $TESTTMP/spawn.py >> $DAEMON_PIDS
 #endif
 
   $ cat >> $HGRCPATH <<EOF
   > [extensions]
   > lfs=
   > [lfs]
   > url=http://foo:bar@$LFS_HOST/
   > threshold=1
   > EOF
 
   $ hg init repo1
   $ cd repo1
   $ echo THIS-IS-LFS > a
   $ hg commit -m a -A a
 
   $ hg init ../repo2
   $ hg push ../repo2 -v
   pushing to ../repo2
   searching for changes
   lfs: uploading 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b (12 bytes)
   lfs: processed: 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b
   1 changesets found
   uncompressed size of bundle content:
        * (changelog) (glob)
        * (manifests) (glob)
        *  a (glob)
   adding changesets
   adding manifests
   adding file changes
   added 1 changesets with 1 changes to 1 files
 
 Clear the cache to force a download
   $ rm -rf `hg config lfs.usercache`
   $ cd ../repo2
   $ hg update tip -v
   resolving manifests
   getting a
   lfs: downloading 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b (12 bytes)
   lfs: adding 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b to the usercache
   lfs: processed: 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b
   lfs: found 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b in the local lfs store
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
 
 When the server has some blobs already
 
   $ hg mv a b
   $ echo ANOTHER-LARGE-FILE > c
   $ echo ANOTHER-LARGE-FILE2 > d
   $ hg commit -m b-and-c -A b c d
   $ hg push ../repo1 -v | grep -v '^  '
   pushing to ../repo1
   searching for changes
   lfs: need to transfer 2 objects (39 bytes)
   lfs: uploading 37a65ab78d5ecda767e8622c248b5dbff1e68b1678ab0e730d5eb8601ec8ad19 (20 bytes)
   lfs: processed: 37a65ab78d5ecda767e8622c248b5dbff1e68b1678ab0e730d5eb8601ec8ad19
   lfs: uploading d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 (19 bytes)
   lfs: processed: d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
   1 changesets found
   uncompressed size of bundle content:
   adding changesets
   adding manifests
   adding file changes
   added 1 changesets with 3 changes to 3 files
 
 Clear the cache to force a download
   $ rm -rf `hg config lfs.usercache`
   $ hg --repo ../repo1 update tip -v
   resolving manifests
   getting b
   lfs: found 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b in the local lfs store
   getting c
   lfs: downloading d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 (19 bytes)
   lfs: adding d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 to the usercache
   lfs: processed: d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
   lfs: found d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 in the local lfs store
   getting d
   lfs: downloading 37a65ab78d5ecda767e8622c248b5dbff1e68b1678ab0e730d5eb8601ec8ad19 (20 bytes)
   lfs: adding 37a65ab78d5ecda767e8622c248b5dbff1e68b1678ab0e730d5eb8601ec8ad19 to the usercache
   lfs: processed: 37a65ab78d5ecda767e8622c248b5dbff1e68b1678ab0e730d5eb8601ec8ad19
   lfs: found 37a65ab78d5ecda767e8622c248b5dbff1e68b1678ab0e730d5eb8601ec8ad19 in the local lfs store
   3 files updated, 0 files merged, 0 files removed, 0 files unresolved
 
-Test a corrupt file download, but clear the cache first to force a download
-
-XXX: ideally, the validation would occur before polluting the usercache and
-local store, with a clearer error message.
+Test a corrupt file download, but clear the cache first to force a download.
 
   $ rm -rf `hg config lfs.usercache`
   $ cp $TESTTMP/lfs-content/d1/1e/1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 blob
   $ echo 'damage' > $TESTTMP/lfs-content/d1/1e/1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
   $ rm ../repo1/.hg/store/lfs/objects/d1/1e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
   $ rm ../repo1/*
+
+XXX: suggesting `hg verify` won't help with a corrupt file on the lfs server.
   $ hg --repo ../repo1 update -C tip -v
   resolving manifests
   getting a
   lfs: found 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b in the local lfs store
   getting b
   lfs: found 31cf46fbc4ecd458a0943c5b4881f1f5a6dd36c53d6167d5b69ac45149b38e5b in the local lfs store
   getting c
   lfs: downloading d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 (19 bytes)
-  lfs: adding d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 to the usercache
-  lfs: processed: d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
-  lfs: found d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 in the local lfs store
-  abort: integrity check failed on data/c.i:0!
+  abort: detected corrupt lfs object: d11e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
+  (run hg verify)
   [255]
 
-BUG: the corrupted blob was added to the usercache and local store
+The corrupted blob is not added to the usercache or local store
 
-  $ cat ../repo1/.hg/store/lfs/objects/d1/1e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 | $TESTDIR/f --sha256
-  sha256=fa82ca222fc9813afad3559637960bf311170cdd80ed35287f4623eb2320a660
-  $ cat `hg config lfs.usercache`/d1/1e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998 | $TESTDIR/f --sha256
-  sha256=fa82ca222fc9813afad3559637960bf311170cdd80ed35287f4623eb2320a660
+  $ test -f ../repo1/.hg/store/lfs/objects/d1/1e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
+  [1]
+  $ test -f `hg config lfs.usercache`/d1/1e1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
+  [1]
   $ cp blob $TESTTMP/lfs-content/d1/1e/1a642b60813aee592094109b406089b8dff4cb157157f753418ec7857998
 
 Test a corrupted file upload
 
   $ echo 'another lfs blob' > b
   $ hg ci -m 'another blob'
   $ echo 'damage' > .hg/store/lfs/objects/e6/59058e26b07b39d2a9c7145b3f99b41f797b6621c8076600e9cb7ee88291f0
   $ hg push -v ../repo1
   pushing to ../repo1
   searching for changes
   lfs: uploading e659058e26b07b39d2a9c7145b3f99b41f797b6621c8076600e9cb7ee88291f0 (17 bytes)
-  abort: HTTP error: HTTP Error 500: Internal Server Error (oid=e659058e26b07b39d2a9c7145b3f99b41f797b6621c8076600e9cb7ee88291f0, action=upload)!
+  abort: detected corrupt lfs object: e659058e26b07b39d2a9c7145b3f99b41f797b6621c8076600e9cb7ee88291f0
+  (run hg verify)
   [255]
 
 Check error message when the remote missed a blob:
 
   $ echo FFFFF > b
   $ hg commit -m b -A b
   $ echo FFFFF >> b
   $ hg commit -m b b
   $ rm -rf .hg/store/lfs
   $ rm -rf `hg config lfs.usercache`
   $ hg update -C '.^'
   abort: LFS server claims required objects do not exist:
   8e6ea5f6c066b44a0efa43bcce86aea73f17e6e23f0663df0251e7524e140a13!
   [255]
 
 Check error message when object does not exist:
 
   $ hg init test && cd test
   $ echo "[extensions]" >> .hg/hgrc
   $ echo "lfs=" >> .hg/hgrc
   $ echo "[lfs]" >> .hg/hgrc
   $ echo "threshold=1" >> .hg/hgrc
   $ echo a > a
   $ hg add a
   $ hg commit -m 'test'
   $ echo aaaaa > a
   $ hg commit -m 'largefile'
   $ hg debugdata .hg/store/data/a.i 1 # verify this is no the file content but includes "oid", the LFS "pointer".
   version https://git-lfs.github.com/spec/v1
   oid sha256:bdc26931acfb734b142a8d675f205becf27560dc461f501822de13274fe6fc8a
   size 6
   x-is-binary 0
   $ cd ..
   $ rm -rf `hg config lfs.usercache`
   $ hg --config 'lfs.url=https://dewey-lfs.vip.facebook.com/lfs' clone test test2
   updating to branch default
   abort: LFS server error. Remote object for file data/a.i not found:(.*)! (re)
   [255]
 
   $ $PYTHON $RUNTESTDIR/killdaemons.py $DAEMON_PIDS

tests/test-lfs.t

@@ -1,884 +1,867 b''
 # Initial setup
 
   $ cat >> $HGRCPATH << EOF
   > [extensions]
   > lfs=
   > [lfs]
   > threshold=1000B
   > EOF
 
   $ LONG=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
 
 # Prepare server and enable extension
   $ hg init server
   $ hg clone -q server client
   $ cd client
 
 # Commit small file
   $ echo s > smallfile
   $ hg commit -Aqm "add small file"
 
 # Commit large file
   $ echo $LONG > largefile
   $ grep lfs .hg/requires
   [1]
   $ hg commit --traceback -Aqm "add large file"
   $ grep lfs .hg/requires
   lfs
 
 # Ensure metadata is stored
   $ hg debugdata largefile 0
   version https://git-lfs.github.com/spec/v1
   oid sha256:f11e77c257047a398492d8d6cb9f6acf3aa7c4384bb23080b43546053e183e4b
   size 1501
   x-is-binary 0
 
 # Check the blobstore is populated
   $ find .hg/store/lfs/objects | sort
   .hg/store/lfs/objects
   .hg/store/lfs/objects/f1
   .hg/store/lfs/objects/f1/1e77c257047a398492d8d6cb9f6acf3aa7c4384bb23080b43546053e183e4b
 
 # Check the blob stored contains the actual contents of the file
   $ cat .hg/store/lfs/objects/f1/1e77c257047a398492d8d6cb9f6acf3aa7c4384bb23080b43546053e183e4b
   AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
 
 # Push changes to the server
 
   $ hg push
   pushing to $TESTTMP/server
   searching for changes
   abort: lfs.url needs to be configured
   [255]
 
   $ cat >> $HGRCPATH << EOF
   > [lfs]
   > url=file:$TESTTMP/dummy-remote/
   > EOF
 
   $ hg push -v | egrep -v '^(uncompressed| )'
   pushing to $TESTTMP/server
   searching for changes
   lfs: found f11e77c257047a398492d8d6cb9f6acf3aa7c4384bb23080b43546053e183e4b in the local lfs store
   2 changesets found
   adding changesets
   adding manifests
   adding file changes
   added 2 changesets with 2 changes to 2 files
 
 # Unknown URL scheme
 
   $ hg push --config lfs.url=ftp://foobar
   abort: lfs: unknown url scheme: ftp
   [255]
 
   $ cd ../
 
 # Initialize new client (not cloning) and setup extension
   $ hg init client2
   $ cd client2
   $ cat >> .hg/hgrc <<EOF
   > [paths]
   > default = $TESTTMP/server
   > EOF
 
 # Pull from server
   $ hg pull default
   pulling from $TESTTMP/server
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 2 changesets with 2 changes to 2 files
   new changesets b29ba743f89d:00c137947d30
   (run 'hg update' to get a working copy)
 
 # Check the blobstore is not yet populated
   $ [ -d .hg/store/lfs/objects ]
   [1]
 
 # Update to the last revision containing the large file
   $ hg update
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
 
 # Check the blobstore has been populated on update
   $ find .hg/store/lfs/objects | sort
   .hg/store/lfs/objects
   .hg/store/lfs/objects/f1
   .hg/store/lfs/objects/f1/1e77c257047a398492d8d6cb9f6acf3aa7c4384bb23080b43546053e183e4b
 
 # Check the contents of the file are fetched from blobstore when requested
   $ hg cat -r . largefile
   AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
 
 # Check the file has been copied in the working copy
   $ cat largefile
   AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
 
   $ cd ..
 
 # Check rename, and switch between large and small files
 
   $ hg init repo3
   $ cd repo3
   $ cat >> .hg/hgrc << EOF
   > [lfs]
   > threshold=10B
   > EOF
 
   $ echo LONGER-THAN-TEN-BYTES-WILL-TRIGGER-LFS > large
   $ echo SHORTER > small
   $ hg add . -q
   $ hg commit -m 'commit with lfs content'
 
   $ hg mv large l
   $ hg mv small s
   $ hg commit -m 'renames'
 
   $ echo SHORT > l
   $ echo BECOME-LARGER-FROM-SHORTER > s
   $ hg commit -m 'large to small, small to large'
 
   $ echo 1 >> l
   $ echo 2 >> s
   $ hg commit -m 'random modifications'
 
   $ echo RESTORE-TO-BE-LARGE > l
   $ echo SHORTER > s
   $ hg commit -m 'switch large and small again'
 
 # Test lfs_files template
 
   $ hg log -r 'all()' -T '{rev} {join(lfs_files, ", ")}\n'
   0 large
   1 l
   2 s
   3 s
   4 l
 
 # Push and pull the above repo
 
   $ hg --cwd .. init repo4
   $ hg push ../repo4
   pushing to ../repo4
   searching for changes
   adding changesets
   adding manifests
   adding file changes
   added 5 changesets with 10 changes to 4 files
 
   $ hg --cwd .. init repo5
   $ hg --cwd ../repo5 pull ../repo3
   pulling from ../repo3
   requesting all changes
   adding changesets
   adding manifests
   adding file changes
   added 5 changesets with 10 changes to 4 files
   new changesets fd47a419c4f7:5adf850972b9
   (run 'hg update' to get a working copy)
 
   $ cd ..
 
 # Test clone
 
   $ hg init repo6
   $ cd repo6
   $ cat >> .hg/hgrc << EOF
   > [lfs]
   > threshold=30B
   > EOF
 
   $ echo LARGE-BECAUSE-IT-IS-MORE-THAN-30-BYTES > large
   $ echo SMALL > small
   $ hg commit -Aqm 'create a lfs file' large small
   $ hg debuglfsupload -r 'all()' -v
   lfs: found 8e92251415339ae9b148c8da89ed5ec665905166a1ab11b09dca8fad83344738 in the local lfs store
 
   $ cd ..
 
   $ hg clone repo6 repo7
   updating to branch default
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ cd repo7
   $ hg config extensions --debug | grep lfs
   $TESTTMP/repo7/.hg/hgrc:*: extensions.lfs= (glob)
   $ cat large
   LARGE-BECAUSE-IT-IS-MORE-THAN-30-BYTES
   $ cat small
   SMALL
 
   $ cd ..
 
   $ hg --config extensions.share= share repo7 sharedrepo
   updating working directory
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg -R sharedrepo config extensions --debug | grep lfs
   $TESTTMP/sharedrepo/.hg/hgrc:*: extensions.lfs= (glob)
 
 # Test rename and status
 
   $ hg init repo8
   $ cd repo8
   $ cat >> .hg/hgrc << EOF
   > [lfs]
   > threshold=10B
   > EOF
 
   $ echo THIS-IS-LFS-BECAUSE-10-BYTES > a1
   $ echo SMALL > a2
   $ hg commit -m a -A a1 a2
   $ hg status
   $ hg mv a1 b1
   $ hg mv a2 a1
   $ hg mv b1 a2
   $ hg commit -m b
   $ hg status
   >>> with open('a2', 'wb') as f:
   ...     f.write(b'\1\nSTART-WITH-HG-FILELOG-METADATA')
   >>> with open('a1', 'wb') as f:
   ...     f.write(b'\1\nMETA\n')
   $ hg commit -m meta
   $ hg status
   $ hg log -T '{rev}: {file_copies} | {file_dels} | {file_adds}\n'
   2:  |  | 
   1: a1 (a2)a2 (a1) |  | 
   0:  |  | a1 a2
 
   $ for n in a1 a2; do
   >   for r in 0 1 2; do
   >     printf '\n%s @ %s\n' $n $r
   >     hg debugdata $n $r
   >   done
   > done
   
   a1 @ 0
   version https://git-lfs.github.com/spec/v1
   oid sha256:5bb8341bee63b3649f222b2215bde37322bea075a30575aa685d8f8d21c77024
   size 29
   x-is-binary 0
   
   a1 @ 1
   \x01 (esc)
   copy: a2
   copyrev: 50470ad23cf937b1f4b9f80bfe54df38e65b50d9
   \x01 (esc)
   SMALL
   
   a1 @ 2
   \x01 (esc)
   \x01 (esc)
   \x01 (esc)
   META
   
   a2 @ 0
   SMALL
   
   a2 @ 1
   version https://git-lfs.github.com/spec/v1
   oid sha256:5bb8341bee63b3649f222b2215bde37322bea075a30575aa685d8f8d21c77024
   size 29
   x-hg-copy a1
   x-hg-copyrev be23af27908a582af43e5cda209a5a9b319de8d4
   x-is-binary 0
   
   a2 @ 2
   version https://git-lfs.github.com/spec/v1
   oid sha256:876dadc86a8542f9798048f2c47f51dbf8e4359aed883e8ec80c5db825f0d943
   size 32
   x-is-binary 0
 
 # Verify commit hashes include rename metadata
 
   $ hg log -T '{rev}:{node|short} {desc}\n'
   2:0fae949de7fa meta
   1:9cd6bdffdac0 b
   0:7f96794915f7 a
 
   $ cd ..
 
 # Test bundle
 
   $ hg init repo9
   $ cd repo9
   $ cat >> .hg/hgrc << EOF
   > [lfs]
   > threshold=10B
   > [diff]
   > git=1
   > EOF
 
   $ for i in 0 single two three 4; do
   >   echo 'THIS-IS-LFS-'$i > a
   >   hg commit -m a-$i -A a
   > done
 
   $ hg update 2 -q
   $ echo 'THIS-IS-LFS-2-CHILD' > a
   $ hg commit -m branching -q
 
   $ hg bundle --base 1 bundle.hg -v
   lfs: found 5ab7a3739a5feec94a562d070a14f36dba7cad17e5484a4a89eea8e5f3166888 in the local lfs store
   lfs: found a9c7d1cd6ce2b9bbdf46ed9a862845228717b921c089d0d42e3bcaed29eb612e in the local lfs store
   lfs: found f693890c49c409ec33673b71e53f297681f76c1166daf33b2ad7ebf8b1d3237e in the local lfs store
   lfs: found fda198fea753eb66a252e9856915e1f5cddbe41723bd4b695ece2604ad3c9f75 in the local lfs store
   4 changesets found
   uncompressed size of bundle content:
        * (changelog) (glob)
        * (manifests) (glob)
        *  a (glob)
   $ hg --config extensions.strip= strip -r 2 --no-backup --force -q
   $ hg -R bundle.hg log -p -T '{rev} {desc}\n' a
   5 branching
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-two
   +THIS-IS-LFS-2-CHILD
   
   4 a-4
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-three
   +THIS-IS-LFS-4
   
   3 a-three
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-two
   +THIS-IS-LFS-three
   
   2 a-two
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-single
   +THIS-IS-LFS-two
   
   1 a-single
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-0
   +THIS-IS-LFS-single
   
   0 a-0
   diff --git a/a b/a
   new file mode 100644
   --- /dev/null
   +++ b/a
   @@ -0,0 +1,1 @@
   +THIS-IS-LFS-0
   
   $ hg bundle -R bundle.hg --base 1 bundle-again.hg -q
   $ hg -R bundle-again.hg log -p -T '{rev} {desc}\n' a
   5 branching
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-two
   +THIS-IS-LFS-2-CHILD
   
   4 a-4
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-three
   +THIS-IS-LFS-4
   
   3 a-three
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-two
   +THIS-IS-LFS-three
   
   2 a-two
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-single
   +THIS-IS-LFS-two
   
   1 a-single
   diff --git a/a b/a
   --- a/a
   +++ b/a
   @@ -1,1 +1,1 @@
   -THIS-IS-LFS-0
   +THIS-IS-LFS-single
   
   0 a-0
   diff --git a/a b/a
   new file mode 100644
   --- /dev/null
   +++ b/a
   @@ -0,0 +1,1 @@
   +THIS-IS-LFS-0
   
   $ cd ..
 
 # Test isbinary
 
   $ hg init repo10
   $ cd repo10
   $ cat >> .hg/hgrc << EOF
   > [extensions]
   > lfs=
   > [lfs]
   > threshold=1
   > EOF
   $ $PYTHON <<'EOF'
   > def write(path, content):
   >     with open(path, 'wb') as f:
   >         f.write(content)
   > write('a', b'\0\0')
   > write('b', b'\1\n')
   > write('c', b'\1\n\0')
   > write('d', b'xx')
   > EOF
   $ hg add a b c d
   $ hg diff --stat
    a |  Bin 
    b |    1 +
    c |  Bin 
    d |    1 +
    4 files changed, 2 insertions(+), 0 deletions(-)
   $ hg commit -m binarytest
   $ cat > $TESTTMP/dumpbinary.py << EOF
   > def reposetup(ui, repo):
   >     for n in 'abcd':
   >         ui.write(('%s: binary=%s\n') % (n, repo['.'][n].isbinary()))
   > EOF
   $ hg --config extensions.dumpbinary=$TESTTMP/dumpbinary.py id --trace
   a: binary=True
   b: binary=False
   c: binary=True
   d: binary=False
   b55353847f02 tip
 
   $ cd ..
 
 # Test fctx.cmp fastpath - diff without LFS blobs
 
   $ hg init repo11
   $ cd repo11
   $ cat >> .hg/hgrc <<EOF
   > [lfs]
   > threshold=1
   > EOF
   $ cat > ../patch.diff <<EOF
   > # HG changeset patch
   > 2
   > 
   > diff --git a/a b/a
   > old mode 100644
   > new mode 100755
   > EOF
 
   $ for i in 1 2 3; do
   >     cp ../repo10/a a
   >     if [ $i = 3 ]; then
   >         # make a content-only change
   >         hg import -q --bypass ../patch.diff
   >         hg update -q
   >         rm ../patch.diff
   >     else
   >         echo $i >> a
   >         hg commit -m $i -A a
   >     fi
   > done
   $ [ -d .hg/store/lfs/objects ]
 
   $ cd ..
 
   $ hg clone repo11 repo12 --noupdate
   $ cd repo12
   $ hg log --removed -p a -T '{desc}\n' --config diff.nobinary=1 --git
   2
   diff --git a/a b/a
   old mode 100644
   new mode 100755
   
   2
   diff --git a/a b/a
   Binary file a has changed
   
   1
   diff --git a/a b/a
   new file mode 100644
   Binary file a has changed
   
   $ [ -d .hg/store/lfs/objects ]
   [1]
 
   $ cd ..
 
 # Verify the repos
 
   $ cat > $TESTTMP/dumpflog.py << EOF
   > # print raw revision sizes, flags, and hashes for certain files
   > import hashlib
   > from mercurial import revlog
   > from mercurial.node import short
   > def hash(rawtext):
   >     h = hashlib.sha512()
   >     h.update(rawtext)
   >     return h.hexdigest()[:4]
   > def reposetup(ui, repo):
   >     # these 2 files are interesting
   >     for name in ['l', 's']:
   >         fl = repo.file(name)
   >         if len(fl) == 0:
   >             continue
   >         sizes = [revlog.revlog.rawsize(fl, i) for i in fl]
   >         texts = [fl.revision(i, raw=True) for i in fl]
   >         flags = [int(fl.flags(i)) for i in fl]
   >         hashes = [hash(t) for t in texts]
   >         print('  %s: rawsizes=%r flags=%r hashes=%r'
   >               % (name, sizes, flags, hashes))
   > EOF
 
   $ for i in client client2 server repo3 repo4 repo5 repo6 repo7 repo8 repo9 \
   >          repo10; do
   >   echo 'repo:' $i
   >   hg --cwd $i verify --config extensions.dumpflog=$TESTTMP/dumpflog.py -q
   > done
   repo: client
   repo: client2
   repo: server
   repo: repo3
     l: rawsizes=[211, 6, 8, 141] flags=[8192, 0, 0, 8192] hashes=['d2b8', '948c', 'cc88', '724d']
     s: rawsizes=[74, 141, 141, 8] flags=[0, 8192, 8192, 0] hashes=['3c80', 'fce0', '874a', '826b']
   repo: repo4
     l: rawsizes=[211, 6, 8, 141] flags=[8192, 0, 0, 8192] hashes=['d2b8', '948c', 'cc88', '724d']
     s: rawsizes=[74, 141, 141, 8] flags=[0, 8192, 8192, 0] hashes=['3c80', 'fce0', '874a', '826b']
   repo: repo5
     l: rawsizes=[211, 6, 8, 141] flags=[8192, 0, 0, 8192] hashes=['d2b8', '948c', 'cc88', '724d']
     s: rawsizes=[74, 141, 141, 8] flags=[0, 8192, 8192, 0] hashes=['3c80', 'fce0', '874a', '826b']
   repo: repo6
   repo: repo7
   repo: repo8
   repo: repo9
   repo: repo10
 
 repo12 doesn't have any cached lfs files and its source never pushed its
 files.  Therefore, the files don't exist in the remote store.  Use the files in
 the user cache.
 
   $ test -d $TESTTMP/repo12/.hg/store/lfs/objects
   [1]
 
   $ hg --config extensions.share= share repo12 repo13
   updating working directory
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg -R repo13 -q verify
 
   $ hg clone repo12 repo14
   updating to branch default
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg -R repo14 -q verify
 
 If the source repo doesn't have the blob (maybe it was pulled or cloned with
 --noupdate), the blob is still accessible via the global cache to send to the
 remote store.
 
   $ rm -rf $TESTTMP/repo14/.hg/store/lfs
   $ hg init repo15
   $ hg -R repo14 push repo15
   pushing to repo15
   searching for changes
   adding changesets
   adding manifests
   adding file changes
   added 3 changesets with 2 changes to 1 files
   $ hg -R repo14 -q verify
 
 Test damaged file scenarios.  (This also damages the usercache because of the
 hardlinks.)
 
   $ echo 'damage' >> repo5/.hg/store/lfs/objects/66/100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e
 
 Repo with damaged lfs objects in any revision will fail verification.
 
   $ hg -R repo5 verify
   checking changesets
   checking manifests
   crosschecking files in changesets and manifests
   checking files
    l@1: unpacking 46a2f24864bc: integrity check failed on data/l.i:0
    large@0: unpacking 2c531e0992ff: integrity check failed on data/large.i:0
   4 files, 5 changesets, 10 total revisions
   2 integrity errors encountered!
   (first damaged changeset appears to be 0)
   [1]
 
 Updates work after cloning a damaged repo, if the damaged lfs objects aren't in
 the update destination.  Those objects won't be added to the new repo's store
 because they aren't accessed.
 
   $ hg clone -v repo5 fromcorrupt
   updating to branch default
   resolving manifests
   getting l
   lfs: found 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b in the usercache
   getting s
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ test -f fromcorrupt/.hg/store/lfs/objects/66/100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e
   [1]
 
 Verify will copy/link all lfs objects into the local store that aren't already
 present.  Bypass the corrupted usercache to show that verify works when fed by
 the (uncorrupted) remote store.
 
   $ hg -R fromcorrupt --config lfs.usercache=emptycache verify -v
   repository uses revlog format 1
   checking changesets
   checking manifests
   crosschecking files in changesets and manifests
   checking files
   lfs: adding 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e to the usercache
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
   lfs: found 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b in the local lfs store
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
   lfs: adding 89b6070915a3d573ff3599d1cda305bc5e38549b15c4847ab034169da66e1ca8 to the usercache
   lfs: found 89b6070915a3d573ff3599d1cda305bc5e38549b15c4847ab034169da66e1ca8 in the local lfs store
   lfs: adding b1a6ea88da0017a0e77db139a54618986e9a2489bee24af9fe596de9daac498c to the usercache
   lfs: found b1a6ea88da0017a0e77db139a54618986e9a2489bee24af9fe596de9daac498c in the local lfs store
   4 files, 5 changesets, 10 total revisions
 
 BUG: Verify will copy/link a corrupted file from the usercache into the local
 store, and poison it.  (The verify with a good remote now fails.)
 
   $ rm -r fromcorrupt/.hg/store/lfs/objects/66/100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e
   $ hg -R fromcorrupt verify -v
   repository uses revlog format 1
   checking changesets
   checking manifests
   crosschecking files in changesets and manifests
   checking files
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the usercache
    l@1: unpacking 46a2f24864bc: integrity check failed on data/l.i:0
   lfs: found 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b in the local lfs store
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
    large@0: unpacking 2c531e0992ff: integrity check failed on data/large.i:0
   lfs: found 89b6070915a3d573ff3599d1cda305bc5e38549b15c4847ab034169da66e1ca8 in the local lfs store
   lfs: found b1a6ea88da0017a0e77db139a54618986e9a2489bee24af9fe596de9daac498c in the local lfs store
   4 files, 5 changesets, 10 total revisions
   2 integrity errors encountered!
   (first damaged changeset appears to be 0)
   [1]
   $ hg -R fromcorrupt --config lfs.usercache=emptycache verify -v
   repository uses revlog format 1
   checking changesets
   checking manifests
   crosschecking files in changesets and manifests
   checking files
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
    l@1: unpacking 46a2f24864bc: integrity check failed on data/l.i:0
   lfs: found 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b in the local lfs store
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
    large@0: unpacking 2c531e0992ff: integrity check failed on data/large.i:0
   lfs: found 89b6070915a3d573ff3599d1cda305bc5e38549b15c4847ab034169da66e1ca8 in the local lfs store
   lfs: found b1a6ea88da0017a0e77db139a54618986e9a2489bee24af9fe596de9daac498c in the local lfs store
   4 files, 5 changesets, 10 total revisions
   2 integrity errors encountered!
   (first damaged changeset appears to be 0)
   [1]
 
 Damaging a file required by the update destination fails the update.
 
   $ echo 'damage' >> $TESTTMP/dummy-remote/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b
   $ hg --config lfs.usercache=emptycache clone -v repo5 fromcorrupt2
   updating to branch default
   resolving manifests
   getting l
-  lfs: adding 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b to the usercache
-  lfs: found 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b in the local lfs store
-  abort: integrity check failed on data/l.i:3!
+  abort: detected corrupt lfs object: 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b
+  (run hg verify)
   [255]
 
-BUG: A corrupted lfs blob either shouldn't be created after a transfer from a
-file://remotestore, or it shouldn't be left behind.
+A corrupted lfs blob is not transferred from a file://remotestore to the
+usercache or local store.
 
-  $ cat emptycache/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b | $TESTDIR/f --sha256
-  sha256=40f67c7e91d554db4bc500f8f62c2e40f9f61daa5b62388e577bbae26f5396ff
-  $ cat fromcorrupt2/.hg/store/lfs/objects/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b | $TESTDIR/f --sha256
-  sha256=40f67c7e91d554db4bc500f8f62c2e40f9f61daa5b62388e577bbae26f5396ff
+  $ test -f emptycache/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b
+  [1]
+  $ test -f fromcorrupt2/.hg/store/lfs/objects/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b
+  [1]
 
   $ hg -R fromcorrupt2 verify
   checking changesets
   checking manifests
   crosschecking files in changesets and manifests
   checking files
    l@1: unpacking 46a2f24864bc: integrity check failed on data/l.i:0
-   l@4: unpacking 6f1ff1f39c11: integrity check failed on data/l.i:3
    large@0: unpacking 2c531e0992ff: integrity check failed on data/large.i:0
   4 files, 5 changesets, 10 total revisions
-  3 integrity errors encountered!
+  2 integrity errors encountered!
   (first damaged changeset appears to be 0)
   [1]
 
-BUG: push will happily send corrupt files upstream.  (The alternate dummy remote
+Corrupt local files are not sent upstream.  (The alternate dummy remote
 avoids the corrupt lfs object in the original remote.)
 
   $ mkdir $TESTTMP/dummy-remote2
   $ hg init dest
   $ hg -R fromcorrupt2 --config lfs.url=file:///$TESTTMP/dummy-remote2 push -v dest
   pushing to dest
   searching for changes
   lfs: found 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b in the local lfs store
   lfs: found 89b6070915a3d573ff3599d1cda305bc5e38549b15c4847ab034169da66e1ca8 in the local lfs store
   lfs: found b1a6ea88da0017a0e77db139a54618986e9a2489bee24af9fe596de9daac498c in the local lfs store
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
-  5 changesets found
-  uncompressed size of bundle content:
-       997 (changelog)
-      1032 (manifests)
-       841  l
-       272  large
-       788  s
-       139  small
-  adding changesets
-  adding manifests
-  adding file changes
-  added 5 changesets with 10 changes to 4 files
+  abort: detected corrupt lfs object: 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e
+  (run hg verify)
+  [255]
 
   $ hg -R fromcorrupt2 --config lfs.url=file:///$TESTTMP/dummy-remote2 verify -v
   repository uses revlog format 1
   checking changesets
   checking manifests
   crosschecking files in changesets and manifests
   checking files
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
    l@1: unpacking 46a2f24864bc: integrity check failed on data/l.i:0
   lfs: found 22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b in the local lfs store
-   l@4: unpacking 6f1ff1f39c11: integrity check failed on data/l.i:3
   lfs: found 66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e in the local lfs store
    large@0: unpacking 2c531e0992ff: integrity check failed on data/large.i:0
   lfs: found 89b6070915a3d573ff3599d1cda305bc5e38549b15c4847ab034169da66e1ca8 in the local lfs store
   lfs: found b1a6ea88da0017a0e77db139a54618986e9a2489bee24af9fe596de9daac498c in the local lfs store
   4 files, 5 changesets, 10 total revisions
-  3 integrity errors encountered!
+  2 integrity errors encountered!
   (first damaged changeset appears to be 0)
   [1]
 
   $ cat $TESTTMP/dummy-remote2/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b | $TESTDIR/f --sha256
-  sha256=40f67c7e91d554db4bc500f8f62c2e40f9f61daa5b62388e577bbae26f5396ff
+  sha256=22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b
   $ cat fromcorrupt2/.hg/store/lfs/objects/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b | $TESTDIR/f --sha256
-  sha256=40f67c7e91d554db4bc500f8f62c2e40f9f61daa5b62388e577bbae26f5396ff
-
-  $ cat $TESTTMP/dummy-remote2/66/100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e
-  LONGER-THAN-TEN-BYTES-WILL-TRIGGER-LFS
-  damage
-  $ cat $TESTTMP/dummy-remote2/22/f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b
-  RESTORE-TO-BE-LARGE
-  damage
+  sha256=22f66a3fc0b9bf3f012c814303995ec07099b3a9ce02a7af84b5970811074a3b
+  $ test -f $TESTTMP/dummy-remote2/66/100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e
+  [1]
 
 Accessing a corrupt file will complain
 
   $ hg --cwd fromcorrupt2 cat -r 0 large
   abort: integrity check failed on data/large.i:0!
   [255]
 
 lfs -> normal -> lfs round trip conversions are possible.  The threshold for the
 lfs destination is specified here because it was originally listed in the local
 .hgrc, and the global one is too high to trigger lfs usage.  For lfs -> normal,
 there's no 'lfs' destination repo requirement.  For normal -> lfs, there is.
 
 XXX: There's not a great way to ensure that the conversion to normal files
 actually converts _everything_ to normal.  The extension needs to be loaded for
 the source, but there's no way to disable it for the destination.  The best that
 can be done is to raise the threshold so that lfs isn't used on the destination.
 It doesn't like using '!' to unset the value on the command line.
 
   $ hg --config extensions.convert= --config lfs.threshold=1000M \
   >    convert repo8 convert_normal
   initializing destination convert_normal repository
   scanning source...
   sorting...
   converting...
   2 a
   1 b
   0 meta
   $ grep 'lfs' convert_normal/.hg/requires
   [1]
   $ hg --cwd convert_normal debugdata a1 0
   THIS-IS-LFS-BECAUSE-10-BYTES
 
   $ hg --config extensions.convert= --config lfs.threshold=10B \
   >    convert convert_normal convert_lfs
   initializing destination convert_lfs repository
   scanning source...
   sorting...
   converting...
   2 a
   1 b
   0 meta
   $ hg --cwd convert_lfs debugdata a1 0
   version https://git-lfs.github.com/spec/v1
   oid sha256:5bb8341bee63b3649f222b2215bde37322bea075a30575aa685d8f8d21c77024
   size 29
   x-is-binary 0
   $ grep 'lfs' convert_lfs/.hg/requires
   lfs
 
 This convert is trickier, because it contains deleted files (via `hg mv`)
 
   $ hg --config extensions.convert= --config lfs.threshold=1000M \
   >    convert repo3 convert_normal2
   initializing destination convert_normal2 repository
   scanning source...
   sorting...
   converting...
   4 commit with lfs content
   3 renames
   2 large to small, small to large
   1 random modifications
   0 switch large and small again
   $ grep 'lfs' convert_normal2/.hg/requires
   [1]
   $ hg --cwd convert_normal2 debugdata large 0
   LONGER-THAN-TEN-BYTES-WILL-TRIGGER-LFS
 
   $ hg --config extensions.convert= --config lfs.threshold=10B \
   >    convert convert_normal2 convert_lfs2
   initializing destination convert_lfs2 repository
   scanning source...
   sorting...
   converting...
   4 commit with lfs content
   3 renames
   2 large to small, small to large
   1 random modifications
   0 switch large and small again
   $ grep 'lfs' convert_lfs2/.hg/requires
   lfs
   $ hg --cwd convert_lfs2 debugdata large 0
   version https://git-lfs.github.com/spec/v1
   oid sha256:66100b384bf761271b407d79fc30cdd0554f3b2c5d944836e936d584b88ce88e
   size 39
   x-is-binary 0
 
   $ hg -R convert_lfs2 config --debug extensions | grep lfs
   $TESTTMP/convert_lfs2/.hg/hgrc:*: extensions.lfs= (glob)
 
 Committing deleted files works:
 
   $ hg init $TESTTMP/repo-del
   $ cd $TESTTMP/repo-del
   $ echo 1 > A
   $ hg commit -m 'add A' -A A
   $ hg rm A
   $ hg commit -m 'rm A'