Re: [Monotone-devel] Database gone wild...

[Nathaniel Smith]

On Fri, Mar 09, 2007 at 01:15:25PM +1100, William Uther wrote:
> Can someone please explain to me why a DB can pass a db check, then  
> you sync with someone, then you don't pass a db check.  Surely  
> monotone should refuse to accept stuff it knows is broken.
> 
> I know how it happens.  I just want to see if anyone thinks this is  
> actually a good idea.  I am rapidly coming to believe that is it a  
> REALLY bad idea.  Users, who need to be using this system so just  
> turning off write access isn't a reasonable solution, keep pushing  
> the same broken crap back into my cleaned up db.

Mostly it is because 'db check' is really hair-trigger.  Put one cert
in a slightly non-canonical arrangement, and it starts screaming, 'the
sky is falling!  the sky is falling!'... Being exhaustive and paranoid
is good, but it doesn't really explain itself very well to users, and
that scares them a lot.

Obviously this is a bug, but more in 'db check' than anything else.
Monotone actually creates revisions with missing or mismatched certs
in normal operation (somewhat odd circumstances, granted, but still).
The actual invariants that mtn needs to work correctly, are all
checked during sync.

I don't know what the best thing to do about the invalid certs is.
The only real options once we notice a broken cert in our database are
to ignore it entirely, or print a warning.  Obviously the latter is
annoying, and honestly the former seems wrong, but is still kind of
tempting, given how little use the warning is in practice...

> It is somewhat frustrating...

Sorry about that :-/

-- Nathaniel

-- 
Details are all that matters; God dwells there, and you never get to
see Him if you don't struggle to get them right. -- Stephen Jay Gould