-
SECURITY: Refuse to write a checkout entry whose leading path resolves
through a symlink. `build_index_from_tree` (used by `reset_index` and
thus by `clone`/`checkout`) materialized a tree in sorted order without
checking leading components, so a tree pairing a symlink `link` with a
descendant `link/foo` wrote `foo` through the link to an arbitrary
absolute path. The same `verify_leading_dirs` guard already used by
porcelain and stash is now applied here.
(Jelmer Vernooij, reported by Hugh Lewis) -
Fix `Bundle.store_objects()` silently dropping every OFS_DELTA/REF_DELTA
object in the bundle's pack instead of resolving it, leaving the target
object store missing most objects with no error raised. Delta resolution
now goes through `PackInflater`, matching how packs are ingested
elsewhere in the object store code.
(theVinchi, #2312)