append_only and prune interaction

[rakajack]

Is it safe to automatically run prune (from the safe client) on append_only repository?

Is there a protection from the following situation:

1. Hacked client A with append_only access iterates over chunk id's from the cache and put() garbage to them.
2. Client B with full access runs a prune command.

[enkore]

No, there is no protection for that. If hacked client A just deleted important archives and client B would prune after that, with full access and not in append-only mode, then the data will be gone. Your example is a bit more involved, but has the same effect - the old, valid data would be deleted through the prune.

Therefore if this process is automated, then there should be some checks done that the expected archives (IDs) are still in place, and that an archive check should be run. I guess we should say so in the docs if we don't do already.

[ThomasWaldmann]

Fixed by #1744.