….com-go-git-go-git-v5-vulnerability

build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (releases/v5.x)

* git: worktree, optimize infiles function for very large repos

The upstream Git enforces fail-safe heuristics to ensure that older git versions
will avoid handling repositories using extensions they are unaware of.

The logic is largely based on the value of core.repositoryformatversion. As per
official Git docs:
> This version specifies the rules for operating on the on-disk repository data.
> An implementation of git which does not understand a particular version
> advertised by an on-disk repository MUST NOT operate on that repository;
> doing so risks not only producing wrong results, but actually losing data.

Now go-git will ensure that:
- The git.Open logic will verify and enforces the extension support rules.
- go-git will keep track of built-in extensions that it supports.

This is a breaking change and it will force go-git to not be able to open
repositories that it in fact doesn't really support. Conversaly, the error
messages will be more useful (e.g. unknown extension vs object not found).

Upstream refs:
- https://git-scm.com/docs/git-config#Documentation/git-config.txt-extensions
- https://git-scm.com/docs/gitrepository-layout#_git_repository_format_versions

Signed-off-by: Paulo Gomes <[email protected]>

The test workflow for v5 diverged from main slightly, including its
job name, which caused it to not be in-sync with the latest repository
rulesets.

Signed-off-by: Paulo Gomes <[email protected]>

…1862)

* git: worktree, add benchmark for Status() with many files

Add benchmarks to measure Status() performance on repositories with
thousands of files. These benchmarks help identify optimization
opportunities in the status checking code path.

BenchmarkStatusClean measures worst-case performance: a clean repository
where every file's hash is computed unnecessarily. This is the primary
target for the upcoming metadata-first comparison optimization.

BenchmarkStatusModified measures a more realistic case with a small
percentage of modified files.

BenchmarkStatusLarge tests performance on larger repositories with 5000
files to ensure optimizations scale appropriately.

* plumbing: format/index, add ModTime field to Index struct

Store the modification time of the index file in the Index structure.
This timestamp is captured when the index is loaded and will be used
to properly handle the racy-git condition in the worktree status
optimization.

The ModTime is obtained by calling Stat() on the open file handle,
ensuring it corresponds exactly to the index content that was read.

Reference: https://git-scm.com/docs/racy-git

* git: utils/merkletrie/filesystem, optimize node hashing with metadata check

Implement metadata-first comparison to avoid unnecessary file hashing
when checking status. This matches native git's ie_match_stat() approach.

Before hashing a file, check if its metadata (mtime, size, mode) matches
the index entry. If metadata matches AND the file's mtime is before the
index file's mtime (not in racy-git window), reuse the hash from the
index instead of reading and hashing the file content.

This optimization dramatically reduces I/O operations for Status() calls
on unchanged files:
- Clean repository (2000 files): 769ms → 143ms (~5.4x faster)
- Repository with 1% modified (2000 files): ~202ms
- Large repository (5000 files): ~533ms

The optimization includes:
- O(1) index entry lookup using a pre-built map
- Cached modification time from ReadDir (no extra Lstat calls)
- Size, mtime, and mode comparison before any file I/O
- Racy-git check using idx.ModTime to ensure correctness

This is the same "trust the index" optimization that makes native git
status fast. The implementation:
1. Builds an entry map on root node creation for fast lookups
2. Caches file metadata (mtime, size, mode) from ReadDir
3. Compares cached metadata with index entries before hashing
4. Checks for racy-git condition (file mtime >= index mtime)
5. Only hashes files when metadata differs or in racy window

The optimization is backward compatible - when idx is nil, the function
works without optimization.

Includes test demonstrating proper racy-git handling.

Reference: https://git-scm.com/docs/racy-git

* git: utils/merkletrie/filesystem, require racy git check for metadata optimization

The metadata-first optimization for git status compares file metadata
(size, mtime, mode) against the index to avoid expensive content hashing.
To ensure correctness, it relies on a "racy git" safety check when files
are modified in the same second the index was written.

However, with in-memory storage (memory.NewStorage()), idx.ModTime is never
set (remains zero), silently skipping the racy git check. On Windows—where
time.Now() has coarser resolution (~15ms)—a tracked file could be modified
with the same size and mtime, incorrectly appearing unchanged and causing
false negatives in status checks.

This fix conservatively disables the metadata optimization when the racy
git check cannot be performed (idx is nil or idx.ModTime is zero), ensuring
correctness. This only affects in-memory storage used in tests; production
filesystem storage always has idx.ModTime set and retains the full optimization.

Fixes CI test failure in TestStatusCheckedInBeforeIgnored.

* storage: set ModTime in memory storage to enable racy git optimization

The metadata-first optimization relies on racy git detection, which requires
idx.ModTime to be set. A prior change disabled this optimization when ModTime
was zero to ensure correctness. However, this inadvertently disabled the
optimization for all in-memory storage usage.

This change re-enables the optimization by making memory storage set ModTime
to time.Now() during SetIndex, simulating filesystem storage behavior where
ModTime represents the index file's modification time. With ModTime properly
set, the racy git check can now function correctly for in-memory storage.

Additionally, update the index round-trip test to verify that ModTime is
set by SetIndex before zeroing both sides for structural comparison.

* git: utils/merkletrie/filesystem, add nil guard

Also add a nil guard in metadataMatches to safely handle cases where no index
entry is available, preventing potential panics.

* storage: Remove redundant verification

Signed-off-by: Paulo Gomes <[email protected]>

Align behaviour with upstream and v6, whereby all loose and packed objects
are saved on disk as read-only as they are not meant to be modified due
to their nature, as they are content addressable files.

Signed-off-by: Paulo Gomes <[email protected]>

Loose object files are content-addressable and imutable. They should be
created on demand and deleted on repacking. However, they should not be
overwritten - assuming the initial file isn't corrupted.

The previous lack of validation meant those files were being overwritten
when in fact they could just be ignored. In Linux, this was a non-issue,
however, in Windows this operation led to Access Denied errors.

Some additional moving parts of this fix:

- [go-billy](go-git/go-billy#187): Align
  behaviour supporting dir.NewObject():
    - Add support for Chmod in polyfill so that ChrootOS is able to
      chmod files.
    - Ensure temporary directories are created for BoundOS to avoid
      errors when trying to create the temporary file used for loose
      files.
- This PR:
    - Ensure that in Windows, packed and loose object files are created
      as read-only, which in this case means setting the flag
      windows.FILE_ATTRIBUTE_READONLY via x/sys/windows.
    - Skip renaming the temporary file into the existing loose object,
      instead simply delete the temporary file.

Relates to:
- Southclaws/sampctl#422
- git-bug/git-bug#1142
- entireio/cli#455

Signed-off-by: Paulo Gomes <[email protected]>

storage: filesystem, Avoid overwriting loose obj files