| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
lorry currently updates a git repository in its working area like this:
1. Delete old backup and debug repositories
2. Copy active repository (git) to backup (git-pre-update)
3. Perform conversion in active repository
4. If conversion failed, restore the backup:
1. Copy active repository to debug (git-post-fail)
2. Delete active repository
3. Copy backup repository to active
5. If conversion succeeded: delete git-pre-update
If step 3 or 4 is interrupted, for example because of a system reboot,
the active repository may be left missing or broken. On the next
update, the backup will be deleted.
Replace this with the following process:
1. Look for repositories 'git-a' and 'git-b'. The one with a higher
update count (or the only one that exists and has an update count
file) is the active repository. The other is the the temporary
repository. In case neither exists, 'git-a' is the temporary
repository.
2. Delete old temporary repository, if it exists
3. Copy active repository, if it exists, to temporary repository
(excluding the update count file)
4. Perform conversion in temporary repository
5. If conversion succeeded, make the temporary repository active by
writing the new update count file
6. If conversion failed, move the temporary repository to debug as
before
We need to migrate the working state, so if there is a 'git' and no
'git-a', add an update count of 1 to 'git' and move it to 'git-a'.
Also delete the old-style backup repository.
Update test cases to expect the new filenames.
lorry should now be crash-proof, in the sense that killing it at any
point will leave the last successful update in place. However, an
unclean system shutdown (e.g. kernel crash) that does not flush all
writes to persistent storage may still result in the active repository
being left broken.
Closes: #8.
|
