Re: Size of the security-tracker repository

--TJ2KWthtpyqCGNZy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Sylvain Beucler wrote...

> On 04/06/2026 19:25, Christoph Biedl wrote:
> > Quite frankly, I doubt I'm telling anything new here ...
>=20
> Indeed:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D908678

Oh boy. I could make some extra waves there if anyone considers this
necessary.

> > .git/objects/pack has 28 Gbytes, and given the current rate this will
> > grow beyond 100 by the end of the year.
>=20
> Local delta compression (.pack files) sizes this down drastically, around
> 4-5GB. It's done regularly in the background by default by Git, or through
> 'git gc'.

This I can confirm, the auto-gc brought this down to 5.3G last night.
Aside, that process was also blatantly ignoring the gc.bigPackThreshold
settings, but that's another story.

Still, this is a lot worse than ealier: On April 7th the total size of
=2Egit/objects/ was just 1571M here - a day later things started to go
downhill.

> > What did I miss?
>=20
> See the BTS entry above for a discussion.
> Among obstacles: rewriting the Git history (now requires around 2-3 days =
of
> computing), getting an agreement and official review, adapting the tools.

It's a bit saddening nothing has happened about this while everybody
should have been aware this will not resolve by itself - but rather get
worse over time :(

Data point about history rewriting, there are now 149k commits. If
rewriting a single commit takes just one second, the above number is
sensible.

> Independently, there's also a partial per-CVE rewrite for git-log purpose=
s:
> https://salsa.debian.org/lts-team/cvehist
> (which is another thing to adapt if the tracker repo changes ;))

Whatever improves the situation and assert it's not going to hit again.

    Christoph

--TJ2KWthtpyqCGNZy
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEWXMI+726A12MfJXdxCxY61kUkv0FAmolxWoACgkQxCxY61kU
kv3i9xAAtiHTg+UGxnRTgTJq8nhHvIvzcK5eZydx742PhgekHVA9SqFSxmZToX3T
hCQGNnpjnX0SmYk06ySZNlqe3KXrpWmr8ROZVCCcZ94KyynqIqEv7pL7ujfN9jpd
fV+cO4Y/+1+rFR7Q4m2ILhu7f40RcB2udqWa742j/fziFTi7c/cPtMnzp+WZr2cE
1oKpBWDVNCpPObSNHgTwyIS+ZCmUo/BezILOMScvdq+9RBNjjODxT3apV4f0Vxyx
9y7UmkvSup2fvAtEzuJLku3dA970vPocwJvEwgD4VRT/ZppCgGblme41YCZjxBRv
4GtSpUarbRTXGUofOvdQpyW9IpETuw7mZpgWNI3PWqGThCTaC4QJN6XVyC5C/UR6
5oBlkVGovoWTMxj6+VitJ95OMK2eARfvasT000uMdjqWq4wsoxkK2hy6EkZ6248Q
BOlUQxQvhGMnx+ECgsZm7n0mn3KqOJ3IK1UBXypTSMi7KvsBgCya8EMughIIRs7e
H0/xN1oPfPZLmD9kpjeC/CSnmbfdh+5gWc4m+kUauln3hprTBWVEE7aUVWSr6LXL
L6tg5+408w8WWvq1XiQJN+Iyaz1AOwK/wN5HgCIPMaxmF9c6WrcYCxk84qGWT/Zm
zl163H1Yi3Z2hXMcqiEgi3DHvsGSFx1DTyULKZeBDuOokGHHsIo=
=Migk
-----END PGP SIGNATURE-----

--TJ2KWthtpyqCGNZy--