Show audit status?

Here's the current hovercard:

I deployed the --sshd-key %k stuff to secure and it looks like that shaved ~1,000-2000ms off the total cost. The ssh-auth cost has dropped to about 200ms:

I saw things hang during deploy and the OpenSSH bug should have been fixed years ago.

I configured ControlMaster on secure.

I am running through GPG for the first time:

I've moved the issue in PHI1264 (roughly, "commenting on an unpublished commit should still work normally") here from T13284, since it ended up not really fitting into that scope particularly well.

This fix is not retroactive (and, I think, isn't easy to make retroactive in an obviously safe way) so you'll need to manually repair affected repositories if you want to fix existing commits affected by this bug. This bug doesn't likely doesn't have any far-reaching implications so there's no need to go on a grand adventure to hunt these down, but if you've run into some you can fix them like this:

Add a bin/repository refs --rebuild or similar flag to repair repositories affected by this bug.

If this theory holds up, the "swap a branch" case can be reproduced like this:

Retrying this on the patch:

The "import a repo" case can be reproduced like this:

If this theory holds up, the "swap a branch" case can be reproduced like this:

If this theory holds up, the "swap a branch" case can be reproduced like this:

The algorithm in PhabricatorRepositoryRefEngine->updateRefs() is approximately:

See PHI1447. In this case, the install reports a sequence of events roughly like this:

I understand this was supposed to be mentioned here: Herald ignores commits that are ancestors of permanent refs if they were previously pushed to some other non-permanent ref.

Also remaining is to extend this behavior to the HTTP pathway (and to Mercurial/SVN, eventually).

• if we have already retried 3 times, do not retry;

we'll reduce silly client-visible behavior where you request /tourtle.git instead of /turtle.git and the server seems confused...

See also https://discourse.phabricator-community.org/t/diffusion-search-how-to-do-case-insensitive-search/2854/.

See PHI1367, which featured a specific case where git repack unambiguously did something good instead of being magic fairy dust that we sprinkle around to ward off demons.

See also https://phabricator.wikimedia.org/T197935.

This is sort of generically concerning to me:

See also PHI1318. The new behavior here has tightened our rules about which users we act as.

See PHI1312. The modified JIRA rules reportedly misfire on URIs with anchors or parameters. For now, the plan is to just skip these URIs. In the future, we might specialize URIs which (for example) link to comments on foreign objects.

If this table is retained, there's a mystery meat "branch" icon meaning "default branch" in the leftmost column. This should get a label/tip.

The shallow <hash> frames can not advertise capabilities.

Here's what goes over the wire:

To reproduce this, you can:

A sort of broad issue here is that Herald sometimes knows (or could know, or could guess, or maybe could speculate) that a rule won't do what you expect, but it doesn't tell you.