Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.debian.security > #6511

Re: Size of the security-tracker repository

From Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
Newsgroups linux.debian.security
Subject Re: Size of the security-tracker repository
Date 2026-06-07 21:30 +0200
Message-ID <N3rm1-b5kq-9@gated-at.bofh.it> (permalink)
References <N2kcV-ajpd-1@gated-at.bofh.it> <N2Tkl-aHHx-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


[Multipart message — attachments visible in raw view] - view raw

Sylvain Beucler wrote...

> On 04/06/2026 19:25, Christoph Biedl wrote:
> > Quite frankly, I doubt I'm telling anything new here ...
> 
> Indeed:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908678

Oh boy. I could make some extra waves there if anyone considers this
necessary.

> > .git/objects/pack has 28 Gbytes, and given the current rate this will
> > grow beyond 100 by the end of the year.
> 
> Local delta compression (.pack files) sizes this down drastically, around
> 4-5GB. It's done regularly in the background by default by Git, or through
> 'git gc'.

This I can confirm, the auto-gc brought this down to 5.3G last night.
Aside, that process was also blatantly ignoring the gc.bigPackThreshold
settings, but that's another story.

Still, this is a lot worse than ealier: On April 7th the total size of
.git/objects/ was just 1571M here - a day later things started to go
downhill.

> > What did I miss?
> 
> See the BTS entry above for a discussion.
> Among obstacles: rewriting the Git history (now requires around 2-3 days of
> computing), getting an agreement and official review, adapting the tools.

It's a bit saddening nothing has happened about this while everybody
should have been aware this will not resolve by itself - but rather get
worse over time :(

Data point about history rewriting, there are now 149k commits. If
rewriting a single commit takes just one second, the above number is
sensible.

> Independently, there's also a partial per-CVE rewrite for git-log purposes:
> https://salsa.debian.org/lts-team/cvehist
> (which is another thing to adapt if the tracker repo changes ;))

Whatever improves the situation and assert it's not going to hit again.

    Christoph

Back to linux.debian.security | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

Size of the security-tracker repository Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2026-06-04 19:40 +0200
  Re: Size of the security-tracker repository Sylvain Beucler <beuc@beuc.net> - 2026-06-06 09:10 +0200
    Re: Size of the security-tracker repository Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2026-06-07 21:30 +0200
      Re: Size of the security-tracker repository Sylvain Beucler <beuc@beuc.net> - 2026-06-11 07:30 +0200
        Re: Size of the security-tracker repository Sylvain Beucler <beuc@beuc.net> - 2026-06-12 07:40 +0200

csiph-web