Now, that local cache path defaults to `$HOME/.gvfsCache`, there's no need to specify --local-cache-path explicitly.

Native notifications can now have actions associated with them.
When user clicks on the action button on a notification bubble,
VFSForGit will run a Command in response.
Example: Mount_Failure notification can specifiy the gvfs command
"gvfs mount <path>" as its associated action. Actionable
notifications also have an actionTitle, which get displayed as
text in a Button control on the Notification bubble.

Other details
- Commands are run using Terminal app.
- Terminal is launched using Applescript.
- Only UpgradeAvailable and Mount_Failure notifications are
actionable now.
- VFSForGitNotification class now confirms to NSCoding protocol.
  VFSForGitNotification object holds details of the notification
  including associated commands. It is archived and sent to the
  OS notification center. When user clicks the notification
  bubble, the archived VFSForGitNotification is retrieved from
  the native notification, its associated Command is read and
  executed.

Initial cut of Health Feature

Signed-off-by: Derrick Stolee <dstolee@microsoft.com>

…sc.exe

The [InnoSetup constants documentation](http://www.jrsoftware.org/ishelp/index.php?topic=consts) lists `{sys}` as the way to expand to what is typically `C:\Windows\System32`. This _should_ reduce issues with `PATH` modifications or system drive swaps.

I manually tested upgrade to see that these paths were expanded correctly.

The git process was launched using a PATH environment variable with the
gvfs hooks path to make sure that when a path in the repo was included in
the user's PATH environment variable that it would only search outside
the repo.  This was when the code was using git cat-file to hydrate files
and searching for gvfs hooks would cause it to hydrate files which would
cause it to search for hooks and it would be in a loop.

This is no longer the case, the code is using libgit2 and the hooks are not
called.  Since the gvfs hooks root was only used for setting the PATH for
the git process, all references to it can be removed.

- Add comments where needed
- Stop creating BlobSizeConnections in OnEnumerateDirectory
- Remove populateSizes parameter from GetProjectedItems

Proper error message for 'git gui' on Mac

Currently the output for running functional tests put the service logs
and the run times for each of the tests at the end after the actual test
summary results. This makes finding the actual results of failures harder
to find since you have to scroll up an indeterminate amount to get to
the results.

This change will move the test run summary to the bottom of the output.
So you can go straight to the bottom to see any failures.

Increasing precision of timestamps being logged

…EnumerateDirectory

Mac: Don't download file sizes as part of OnEnumerateDirectory

…t results at the end

Add SetupFixture for teardown to get the test results at the end

…se sensitive volumes

[Mac] Don't allow cloning or mounting on case sensitive volumes

Now, that local cache path defaults to $HOME/.gvfsCache, there's no need to specify --local-cache-path explicitly.

…UNDLE_VERSION. Additionally, make BUNDLE_VERSION Major.Minor

…FS logging daemon

Mac: Add version information to kext and PrjFS logging daemon

…e use of gvfs hooks root

No longer set PATH for git process and remove use of gvfs hooks root

Some organizational improvements to the code, since the SubDirectoryInfo
object has named fields. Sub directory list now shows the fraction
of files which are hydrated, sorting remains by number of hydrated files
Added unit tests for the newly available information, the total number
of files per sub directory.

Handle corrupt objects on Mac

…nd Include verbs

… but not in the included list

…olders

…ssed

* Extend GitRepoTests to allow include mode

The GitRepoTests can be initialized with a ValidateWorkingTree
mode that is currently a boolean. If enabled, we will add extra
checks to make sure the working tree of our virtual enlistment
matches the enlistment from a vanilla Git repo.

To extend this to the "include" mode, we need to first modify
this boolean into an enum and add it as an extra option.

Second, we need to be very careful about what we are comparing.
We will no longer virtualize outside of the included folders.
Be careful to include files in the root directory.

The functional tests can then be run with "--partial-mode" to
exercise only this option, which will isolate the test failures
to this setting AND keep the test suite from getting too slow.

Currently, the partial mode space is probably wider than
necessary and can be reduced in later iterations. This
does provide _some_ coverage.

Signed-off-by: Derrick Stolee <dstolee@microsoft.com>

* Use enum for passing into all tests instead of an int

* Clean up functional tests file system should extensions

* Rename argument to --include-mode to match the feature

* Add included folders below top level

* Add unit tests, comments, and renamed variables to make code more understandable

* Update include verb to give more information to the user

* Change OnFolderCreated to have an out parameter instead of return value

* Add comment for when there is an EIOError and why OnFileConvertedToFull is called

* Log warning when TryAddIncludedFolder gets an exception from the database

* Remove isDirectory parameter from MarkDirectoryAsPlaceholder since it is not used

* Rename IncludedFoldersList to GetIncludedFolders

* Revert changes to the GitIndexProjection constructor

* Add test for mac creating a folder and file that are excluded

…t and it's sparse (#1348)

* Normalize paths that are saved in the sparse table

* Add comment for how the IsRecursive for a sparse folder is set

* Add verification for mockCommand3 in GVFSDatabaseTests

* Rename sparse test

* Add some validation to sparse folder test

* Rename method that validate folders to ValidateFoldersInSparseList

* Add to and update the sparse tests

* Add tests for various paths for the sparse verb and trim spaces

…class (#1379)

* Use IsIncluded only on folder entries

* Add more tests for SortedFolderEntries

* Add comments for better understanding of the code

* Remove call to GetFolderSparseState in UpdateOrDeleteFilePlaceholder

…nly specific folders

Add sparse verb for allowing projection of only specific folders

Repair jobs run while the GVFS enlistment is not mounted,
which on Linux requires us to use the backing root in order
to access the .git contents.

This protects the vnodeType parameter of the KextLog_VnodeOp() macro from bugs due to operator precedence in expanded expressions.

…ot I/O

This change is in preparation for enabling I/O protection for offline virtualization roots.

 * Processes which must access the contents of offline roots, such as VFSForGit's own, may register with the kext to be granted permission by opening a new type of user client connection to the kext's service. There is no restriction on this mechanism, it simply prevents accidental untracked changes.
 * There are new unit tests covering the new functionality.

This change rearranges the TryGetVirtualizationRoot() and HandleVnodeOperation() logic to include decision points to deny or allow certain file operations if the root's provider is offline, to protect the integrity of the repository. All the new logic is added, but operations are not yet denied.

Some new tests for HandleVnodeOperation are also added to cover the new code paths.

If for some reason the provider does not respond to a kernel request originating from an authorisation check callback, we now deny that authorisation.

Writes of any kind to empty files in an offline root should be denied to prevent data loss when the provider comes back online. File deletions meanwhile must be allowed so that the user may recursively delete the entire repository even if it is not mounted.

A test has been added to verify that write access to empty files is indeed denied.

…root

Placeholder (non-full) files, although hydrated, should not be modified while the provider is offline, as the provider would miss the PreConvertToFull/FileModified events. This change enforces this and updates the tests to reflect this new expected behaviour.

Renaming a file or directory in an offline virtualisation root should not be permitted. This change implements that functionality on OS versions which enable us to distinguish between KAUTH_VNODE_DELETE operations that are caused by a rename operation versus not. Older OSes necessarily must allow any KAUTH_VNODE_DELETE operation.

This adds a unit test for disallowing file renames in offline roots on Mojave or newer, while also testing that on High Sierra, the rename is not blocked.

…ion stage

This causes the offline root check to block the file renaming operation at the hydration stage for empty files. The unit test is updated to check both the empty and hydrated scenarios.

…of 128

Some reduction in code complexity, as 128 ought to be enough for anyone.

Performing a blocking memory allocation while holding a lock in a vnode listener callback is not necessarily safe. (There is potential for a deadlock in low-memory situations.) When growing the virtualization root array, this was exactly what the existing code was doing. This change restructures the virtualization root insertion logic so that the lock can be dropped for allocating the larger memory block. Dropping the lock means it must be re-checked whether an insertion is necessary, which was not readily possible with the old code structure.

…en updating placeholders

Mac: Do not lookup or download file sizes when updating placeholders

Stop passing around KeyValuePairs instead of data objects
Update unit tests accordingly

See microsoft/git#167 for details.

This package also includes a Linux installer, since we have updated the build definition since the last Git update.

Mac kext: Drop lock for allocating virtualization root array memory

Performing a blocking memory allocation while holding a lock in a vnode listener callback is not necessarily safe. (There is potential for a deadlock in low-memory situations.) When growing the virtualization root array, this was exactly what the existing code was doing. This change restructures the virtualization root insertion logic so that the lock can be dropped for allocating the larger memory block. Dropping the lock means it must be re-checked whether an insertion is still necessary, which was not readily possible with the old code structure.

…oots

Mac ProjFS: Deny I/O on offline roots, with exceptions, part 1

This is the first stage of implementing #182 - the kext now blocks write I/O to empty or placeholder files on offline roots.

I/O needs to be blocked when:

1. A message failed to deliver to the provider.
2. A process attempts to write to an empty file in an offline root (this file would subsequently be overwritten by a hydration event)
3. A process attempts to write to a placeholder (hydrated unmodified) file when the provider is offline. The file would not show up in git status and could be overwritten by a subsequent checkout/rebase/merge.
4. A process attempts to rename a file in an offline root.
5. A process attempts to read/execute an empty file in an offline root. The result of the read would be bad data, so failing with denied authorisation is preferable to letting the bad data propagate.
6. A process attempts to create files or directories in an offline root.

This change implements cases 1-4. Cases 5-6 will be covered in a future change.

At first glance this seems like it would be a very simple change, but in practice, some processes must be allowed unfettered access to files in offline roots. So a large part of this patch set is dedicated to implementing a system for allowing exceptions - there is a new type of IOKit user client for processes which need unrestricted access to offline roots, and this needed to be implemented all the way through from kext, via native lib, to (managed) VFS4G code proper.

Next, the vnode handler, which is in the actual business of denying or allowing file access, has been expanded to allow returning different results based on whether the root's provider is offline.

Finally, "deny" results are actually returned for a number of different cases - so far, this only includes writes. Even this caused some test failures, so the test process itself needs to register as an exception with unrestricted offline root access.

On some platforms (notably Linux), we may receive only a pre-rename
notification event rather than a pre-delete event, so the
virtualization instance's OnPreRename() handler becomes responsible
for ensuring that, outside of a GVFS lock, the .git/index file can
not be renamed or renamed over.

The BasicFileSystemTests.DeleteIndexFileFails() test handles
the case of a true delete of .git/index, as well as platforms
which deliver a pre-delete event on the source path prior to
a rename action.

As well, several GVFSLockTests tests such as
LockPreventsRenameFromInsideWorkingTreeOnTopOfIndex() test the
case of a file being renamed to .git/index, but no existing test
checks for the case of .git/index being renamed to another path
(although DeleteIndexFileFails() suffices on platforms which
send a pre-delete event).

Therefore we add an explicit MoveIndexFileFails() functional test
to cover this case.

This PR does two things:

Updates Git to include the slow commit-graph write fix from microsoft/git#168. Also see #1420 for the M153 hotfix.

Removes the multi-pack-index writes from the PostFetchStep and instead only writes the multi-pack-index during the PackfileMaintenanceStep. In order to get the most out of the step, we need to ensure we have a multi-pack-index before running the expire and repack steps. Also, we can only expire the packs from that day if they are contained in the multi-pack-index.

If we agree that we should send (2) as a hotfix to the M155 release (in addition to (1), which is necessary), then I'll create a hotfix PR to that branch.

Update the following dependencies:

  NUnit:              3.10.1 -> 3.12.0
  NUnitLite:          3.10.1 -> 3.12.0
  NUnite3TestAdapter: 3.10.1 -> 3.13.0

This update includes a fix for the following issue we have have observed
in our CI builds, where tests fail with the following exception:

  System.InvalidOperationException: Stack empty.

Which appears to be this issue #2772 in https://github.com/nunit/nunit

which indicates it is fixed in NUnit 3.12.

…tional tests

Mac: Fix and enable remaining dehydrate functional tests

Update NUnit dependencies

The mac uninstall script did not remove the GVFS service directory, resulting
in GVFS artifacts being left around. This change updates the uninstall script
to also remove the GVFS service directory. This brings the behavior of the mac
uninstall script to match the Windows uninstall script in
src/Scripts/UninstallGVFS.bat.

One motivation for this change was that the Mac Functional test machines were
gathering cruft from repeated test runs, such as the list of registered
repositories in the repo-registry growing. This apparently caused the GVFS
service start up time to grow, resulting in test failures.

…service directory

Update mac uninstall script to remove GVFS service directory

SubDirectoryInfo Object

…bles

Add lock around writes to SQLite database tables

- When amfid is invoked to check the code signature of a library which has not been hydrated,
  blocking hydration would cause the launch of an application which depends on the library to fail,
  so amfid should always be allowed to hydrate.

Include panic logs for vfs in diagnose

…en only in path

Remove '/System/Volumes/Data' when only in path

…'amfid' to hydrate

Allow privileged system service 'amfid' to hydrate