use capsicum on FreeBSD Thanks to the design of Got, the libexec helpers don't need any resource (in fact they run under pledge "stdio recvfd" on OpenBSD) and so using cap_enter(2) on FreeBSD is dead-easy. While the main process can't be sandboxed on FreeBSD (needs to exec the helpers), all the tough work is done by these small libexec helpers which is also the biggest attack surface. tested by naddy, ok thomas

convert delta cache to a hash table This approach uses more memory but is much faster. To offset the additional memory usage somewhat the cache now stores very small deltas only. However, overall memory usage goes up. Hopefully we will find a way to reduce this later. ok op@

apply time-based rate-limiting to got-index-pack progress output

portable: add support for landlock landlock is a new set of linux APIs that is conceptually similar to unveil(2): the idea is to restrict what a process can do on a specified part of the filesystem. There are some differences in the behaviour: the major one being that the landlock ruleset is inherited across execve(2). This just restricts the libexec helpers by completely revoking ANY filesystem access; after all they are the biggest attack surface. got send/fetch/clone *may* end up spawning ssh(1), so at the moment is not possible to landlock the main process. From Omar Polo.

plug memory leak in an error path of read_packed_object()

fix wrong function names in error messages from got-index-pack.c

portable: add FreeBSD support This adds the capability to compile got-portable on FreeBSD.

portable: initial Linux compilation This commit modifies the GoT main branch to be able to compile it under linux.

verify object ID checksums while loose objects are being accessed

switch from SIMPLEQ to equivalent STAILQ macros The singly-linked tail queue macros were added to OpenBSD 6.9 and are more widely available on other systems. ok stsp

fix the type of variable 'idx' in update_packidx()

use size_t for loop indices to avoid signedness warnings; by emaste@freebsd Same change as 16aeacf7088d, for subdirectories other than lib/

fix potential type mismatches between format specifiers and arguments Cast printf arguments of type time_t and off_t to long long to match the %lld format specifier on platforms where this might not be the case. In parse.y, switch the number variable to long long because all its interactions are with that type anyway. ok millert stsp

Stop including <sys/syslimits.h> directly. POSIX says the limits defined there are available from <limits.h>, which almost all affected source files already included anyway. ok millert stsp

zap trailing tabs

use the POSIX standard endian functions and explicitly include <endian.h> ok stsp

do not rely on <zlib.h> to pull in <unistd.h> ok stsp

make got-index-pack check the expected pack checksum passed from main process

make got-index-pack compute and verify the pack file's SHA1 checksum

move functions from privsep.c to the helpers which use them where possible

write large objects to disk when resolving deltas; raise in-mem delta threshold

tweak delta cache size in got-index-pack

use qsort(3) instead of mergesort(3) to avoid a large spike in memory usage

write CRC info in one chunk rather than calling write(2) once per object

don't forget to send a final progress notification from got-index-pack