mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-28 18:22:06 +01:00
b6f5df3b3f
Follow-up to #752. After a directory save verifies an object, later saves trust it while its file signature is unchanged. A file damaged in place with the same length and modification time (bit rot, or a tool that restores timestamps) was trusted until the writer was recreated. - The signature also carries inode, device and change time on Unix, which an in-place rewrite changes even when the modification time is restored. - Each directory save re-reads and re-checks cached objects, oldest-checked first, up to DEFAULT_REVERIFY_BUDGET (16 MiB of compressed data; at least one object), so over enough saves every object is read again and a damaged one is rewritten. Repeat saves of small documents stay a full check; large ones pay a bounded cost per save. PcraftWriter::set_reverify_budget tunes it (0 = trust signatures, u64::MAX = check all). - PcraftWriter's doc comment states what the cache trusts. - Tests: a same-size, same-mtime tamper is repaired on the next save (fails with the budget at 0 on Windows, where there is no change time), and with a 1-byte budget the rolling re-check reaches the damaged object within one pass over the objects. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>