T-KAU0-backup-isolate-store-git

State: planning/draft · Impact: medium · Complexity: small

Goal

A user’s own git setup can change what gets backed up. A file listed in ~/.config/git/ignore is silently left out of every snapshot. This task makes the store’s git ignore the user’s global ignore, attributes and templates, so a backup holds the whole vault on every machine.

Today

• config::ensure_store_locked pins user.name, user.email and commit.gpgsign=false on first init, and core.autocrlf=false and core.quotepath=false on every run, in the store’s config.
• It pins nothing for core.excludesFile or core.attributesFile. When those are unset, git reads $XDG_CONFIG_HOME/git/ignore (default ~/.config/git/ignore) and $XDG_CONFIG_HOME/git/attributes. Setting GIT_CONFIG_GLOBAL and GIT_CONFIG_NOSYSTEM does not stop this. A reproduction with both set still dropped a file listed in ~/.config/git/ignore from add -A. Setting core.excludesFile=/dev/null in the store config fixed it.
• This affects production now. A user’s ~/.config/git/ignore silently drops files from their backups. A user’s global attributes can change binary detection, and with it the numstat counts.
• git::init_bare runs git init --bare --initial-branch=main. It copies git’s templates, and a user init.templateDir applies. So stores differ by machine, and a user template can install hooks into the store.
• The doc comment on git::scratch() in git.rs says its git_env neutralises the developer’s git config. It has the same gap: a developer’s XDG ignore can drop fixture files.

Proposed

Piece	Shape
Ignore	ensure_store_locked pins core.excludesFile=/dev/null in the store config on every run, beside core.autocrlf, so existing stores get it too.
Attributes	The same for core.attributesFile=/dev/null.
Templates	init_bare runs git init --bare --template= --initial-branch=main. An empty template means no sample hooks and no user template, so new stores are the same everywhere.
Store excludes	The store’s info/exclude stays the only ignore list.

This applies to whatever git runs, PATH git today and the bundled git from T-UPPP-backup-bundle-git later.

Approach

1. Add the two pins to the every-run block in ensure_store_locked. Extend the comment there.
2. Pass --template= in init_bare. Update its doc comment.
3. Fix the scratch() doc comment in git.rs. Point XDG_CONFIG_HOME at the temp dir in its git_env too, so tests never read the developer’s XDG files.
4. Add the tests in the ACs.

Areas

Area	Note
solutions/determined/crates/determined-backup/src/config.rs	Store config pins
solutions/determined/crates/determined-backup/src/git.rs	init_bare --template=; scratch() env and comment

Acceptance criteria

• AC-1: With XDG_CONFIG_HOME pointing at a directory whose git/ignore lists a vault file, a snapshot still contains that file.
• AC-2: With a git/attributes there that marks a text file binary (or -diff), its numstat counts are unchanged.
• AC-3: A store created with a user init.templateDir that holds a hook has no hooks/ entries from it.
• AC-4: An existing store gains both pins on the next ensure_store. the_store_config_pins_survive_a_second_ensure checks them.
• AC-5: The change notes the behavior change: files a user’s global ignore used to drop are now backed up.

Out of scope

• Bundling git, and the env isolation that comes with it (GIT_CONFIG_GLOBAL, GIT_CONFIG_NOSYSTEM, GIT_EXEC_PATH, GIT_TERMINAL_PROMPT). See T-UPPP-backup-bundle-git.

Dependencies

• none

---

← Back to Tasks