From 05056b8aa2cc6cdb9eff12badb03d6143b6ae5e5 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Thu, 16 Jan 2025 13:37:06 +0000
Subject: [PATCH 001/125] [v10.0/forgejo] Refactor e2e tests to simplify
 authentication setup (#6585)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6400

Replaced manual login and context loading across tests with Playwright's `test.use` configuration for user authentication. This simplifies test setup, improves readability, and reduces repetition.

#6362 first part

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Co-authored-by: Julian Schlarb <julian.schlarb@denktmit.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6585
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 .gitignore                                  |   1 +
 tests/e2e/README.md                         |  14 ++-
 tests/e2e/actions.test.e2e.ts               |  89 ++++++--------
 tests/e2e/dashboard-ci-status.test.e2e.ts   |  21 ++--
 tests/e2e/git-notes.test.e2e.ts             |  12 +-
 tests/e2e/issue-comment.test.e2e.ts         |  21 ++--
 tests/e2e/issue-sidebar.test.e2e.ts         |  36 ++----
 tests/e2e/markdown-editor.test.e2e.ts       |  26 +---
 tests/e2e/org-settings.test.e2e.ts          |   9 +-
 tests/e2e/profile_actions.test.e2e.ts       |   8 +-
 tests/e2e/reaction-selectors.test.e2e.ts    |  12 +-
 tests/e2e/release.test.e2e.ts               |  12 +-
 tests/e2e/repo-code.test.e2e.ts             |  41 +++----
 tests/e2e/repo-migrate.test.e2e.ts          |  16 +--
 tests/e2e/repo-new.test.e2e.ts              |  21 ++--
 tests/e2e/repo-settings.test.e2e.ts         |  17 +--
 tests/e2e/right-settings-button.test.e2e.ts |  68 +++++------
 tests/e2e/utils_e2e.ts                      |  30 ++++-
 tests/e2e/utils_e2e_test.go                 | 127 ++++++++++++++++++++
 19 files changed, 327 insertions(+), 254 deletions(-)

diff --git a/.gitignore b/.gitignore
index 744577248d..f040fdaf37 100644
--- a/.gitignore
+++ b/.gitignore
@@ -72,6 +72,7 @@ cpu.out
 /tests/e2e/reports
 /tests/e2e/test-artifacts
 /tests/e2e/test-snapshots
+/tests/e2e/.auth
 /tests/*.ini
 /tests/**/*.git/**/*.sample
 /node_modules
diff --git a/tests/e2e/README.md b/tests/e2e/README.md
index 8d8858bfd5..35fc5e7d1d 100644
--- a/tests/e2e/README.md
+++ b/tests/e2e/README.md
@@ -250,16 +250,18 @@ test('For anyone', async ({page}) => {
 If you need a user account, you can use something like:
 
 ~~~js
-import {test, login_user, login} from './utils_e2e.ts';
+import {test} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2'); // or another user
-});
+// reuse user2 token from scope `shared`
+test.use({user: 'user2', authScope: 'shared'})
 
-test('For signed users only', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
+test('For signed users only', async ({page}) => {
+
+})
 ~~~
 
+users are created in [utils_e2e_test.go](utils_e2e_test.go)
+
 ### Run tests very selectively
 
 Browser testing can take some time.
diff --git a/tests/e2e/actions.test.e2e.ts b/tests/e2e/actions.test.e2e.ts
index a66b608080..6236fe70d3 100644
--- a/tests/e2e/actions.test.e2e.ts
+++ b/tests/e2e/actions.test.e2e.ts
@@ -10,72 +10,61 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, login_user, save_visual, load_logged_in_context} from './utils_e2e.ts';
-
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+import {save_visual, test} from './utils_e2e.ts';
 
 const workflow_trigger_notification_text = 'This workflow has a workflow_dispatch event trigger.';
+test.describe('Workflow Authenticated user2', () => {
+  test.use({user: 'user2'});
 
-test('workflow dispatch present', async ({browser}, workerInfo) => {
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  const page = await context.newPage();
+  test('workflow dispatch present', async ({page}) => {
+    await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
 
-  await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
+    await expect(page.getByText(workflow_trigger_notification_text)).toBeVisible();
 
-  await expect(page.getByText(workflow_trigger_notification_text)).toBeVisible();
+    const run_workflow_btn = page.locator('#workflow_dispatch_dropdown>button');
+    await expect(run_workflow_btn).toBeVisible();
 
-  const run_workflow_btn = page.locator('#workflow_dispatch_dropdown>button');
-  await expect(run_workflow_btn).toBeVisible();
-
-  const menu = page.locator('#workflow_dispatch_dropdown>.menu');
-  await expect(menu).toBeHidden();
-  await run_workflow_btn.click();
-  await expect(menu).toBeVisible();
-  await save_visual(page);
-});
-
-test('workflow dispatch error: missing inputs', async ({browser}, workerInfo) => {
-  test.skip(workerInfo.project.name === 'Mobile Safari', 'Flaky behaviour on mobile safari; see https://codeberg.org/forgejo/forgejo/pulls/3334#issuecomment-2033383');
-
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  const page = await context.newPage();
-
-  await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
-
-  await page.locator('#workflow_dispatch_dropdown>button').click();
-
-  // Remove the required attribute so we can trigger the error message!
-  await page.evaluate(() => {
-    const elem = document.querySelector('input[name="inputs[string2]"]');
-    elem?.removeAttribute('required');
+    const menu = page.locator('#workflow_dispatch_dropdown>.menu');
+    await expect(menu).toBeHidden();
+    await run_workflow_btn.click();
+    await expect(menu).toBeVisible();
+    await save_visual(page);
   });
 
-  await page.locator('#workflow-dispatch-submit').click();
+  test('dispatch error: missing inputs', async ({page}, testInfo) => {
+    test.skip(testInfo.project.name === 'Mobile Safari', 'Flaky behaviour on mobile safari; see https://codeberg.org/forgejo/forgejo/pulls/3334#issuecomment-2033383');
 
-  await expect(page.getByText('Require value for input "String w/o. default".')).toBeVisible();
-  await save_visual(page);
-});
+    await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
 
-test('workflow dispatch success', async ({browser}, workerInfo) => {
-  test.skip(workerInfo.project.name === 'Mobile Safari', 'Flaky behaviour on mobile safari; see https://codeberg.org/forgejo/forgejo/pulls/3334#issuecomment-2033383');
+    await page.locator('#workflow_dispatch_dropdown>button').click();
 
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  const page = await context.newPage();
+    // Remove the required attribute so we can trigger the error message!
+    await page.evaluate(() => {
+      const elem = document.querySelector('input[name="inputs[string2]"]');
+      elem?.removeAttribute('required');
+    });
 
-  await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
+    await page.locator('#workflow-dispatch-submit').click();
 
-  await page.locator('#workflow_dispatch_dropdown>button').click();
+    await expect(page.getByText('Require value for input "String w/o. default".')).toBeVisible();
+    await save_visual(page);
+  });
 
-  await page.fill('input[name="inputs[string2]"]', 'abc');
-  await save_visual(page);
-  await page.locator('#workflow-dispatch-submit').click();
+  test('dispatch success', async ({page}, testInfo) => {
+    test.skip(testInfo.project.name === 'Mobile Safari', 'Flaky behaviour on mobile safari; see https://codeberg.org/forgejo/forgejo/pulls/3334#issuecomment-2033383');
+    await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
 
-  await expect(page.getByText('Workflow run was successfully requested.')).toBeVisible();
+    await page.locator('#workflow_dispatch_dropdown>button').click();
 
-  await expect(page.locator('.run-list>:first-child .run-list-meta', {hasText: 'now'})).toBeVisible();
-  await save_visual(page);
+    await page.fill('input[name="inputs[string2]"]', 'abc');
+    await save_visual(page);
+    await page.locator('#workflow-dispatch-submit').click();
+
+    await expect(page.getByText('Workflow run was successfully requested.')).toBeVisible();
+
+    await expect(page.locator('.run-list>:first-child .run-list-meta', {hasText: 'now'})).toBeVisible();
+    await save_visual(page);
+  });
 });
 
 test('workflow dispatch box not available for unauthenticated users', async ({page}) => {
diff --git a/tests/e2e/dashboard-ci-status.test.e2e.ts b/tests/e2e/dashboard-ci-status.test.e2e.ts
index 1d23122b44..800fc951e6 100644
--- a/tests/e2e/dashboard-ci-status.test.e2e.ts
+++ b/tests/e2e/dashboard-ci-status.test.e2e.ts
@@ -3,21 +3,24 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, login_user, save_visual, load_logged_in_context} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
-test('Correct link and tooltip', async ({browser}, workerInfo) => {
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  const page = await context.newPage();
+test.describe.configure({retries: 2});
+
+test('Correct link and tooltip', async ({page}, testInfo) => {
+  if (testInfo.retry) {
+    await page.goto('/user2/test_workflows/actions');
+  }
+
+  const searchResponse = page.waitForResponse((resp) => resp.url().includes('/repo/search?') && resp.status() === 200);
   const response = await page.goto('/?repo-search-query=test_workflows');
   expect(response?.status()).toBe(200);
 
+  await searchResponse;
+
   const repoStatus = page.locator('.dashboard-repos .repo-owner-name-list > li:nth-child(1) > a:nth-child(2)');
-  // wait for network activity to cease (so status was loaded in frontend)
-  await page.waitForLoadState('networkidle'); // eslint-disable-line playwright/no-networkidle
   await expect(repoStatus).toHaveAttribute('href', '/user2/test_workflows/actions', {timeout: 10000});
   await expect(repoStatus).toHaveAttribute('data-tooltip-content', /^(Error|Failure)$/);
   await save_visual(page);
diff --git a/tests/e2e/git-notes.test.e2e.ts b/tests/e2e/git-notes.test.e2e.ts
index 8b80a3aa77..4245853b24 100644
--- a/tests/e2e/git-notes.test.e2e.ts
+++ b/tests/e2e/git-notes.test.e2e.ts
@@ -1,14 +1,10 @@
 // @ts-check
-import {test, expect} from '@playwright/test';
-import {login_user, save_visual, load_logged_in_context} from './utils_e2e.ts';
+import {expect} from '@playwright/test';
+import {save_visual, test} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
-test('Change git note', async ({browser}, workerInfo) => {
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  const page = await context.newPage();
+test('Change git note', async ({page}) => {
   let response = await page.goto('/user2/repo1/commit/65f1bf27bc3bf70f64657658635e66094edbcb4d');
   expect(response?.status()).toBe(200);
 
diff --git a/tests/e2e/issue-comment.test.e2e.ts b/tests/e2e/issue-comment.test.e2e.ts
index 4fce16764b..933e65fa32 100644
--- a/tests/e2e/issue-comment.test.e2e.ts
+++ b/tests/e2e/issue-comment.test.e2e.ts
@@ -5,14 +5,11 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, save_visual, login_user, login} from './utils_e2e.ts';
+import {test, save_visual} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
-test('Menu accessibility', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
+test('Menu accessibility', async ({page}) => {
   await page.goto('/user2/repo1/issues/1');
   await expect(page.getByLabel('user2 reacted eyes. Remove eyes')).toBeVisible();
   await expect(page.getByLabel('reacted laugh. Remove laugh')).toBeVisible();
@@ -24,9 +21,8 @@ test('Menu accessibility', async ({browser}, workerInfo) => {
   await expect(page.getByLabel('user1, user2 reacted laugh. Remove laugh')).toBeVisible();
 });
 
-test('Hyperlink paste behaviour', async ({browser}, workerInfo) => {
+test('Hyperlink paste behaviour', async ({page}, workerInfo) => {
   test.skip(['Mobile Safari', 'Mobile Chrome', 'webkit'].includes(workerInfo.project.name), 'Mobile clients seem to have very weird behaviour with this test, which I cannot confirm with real usage');
-  const page = await login({browser}, workerInfo);
   await page.goto('/user2/repo1/issues/new');
   await page.locator('textarea').click();
   // same URL
@@ -58,8 +54,7 @@ test('Hyperlink paste behaviour', async ({browser}, workerInfo) => {
   await page.locator('textarea').fill('');
 });
 
-test('Always focus edit tab first on edit', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
+test('Always focus edit tab first on edit', async ({page}) => {
   const response = await page.goto('/user2/repo1/issues/1');
   expect(response?.status()).toBe(200);
 
@@ -82,9 +77,8 @@ test('Always focus edit tab first on edit', async ({browser}, workerInfo) => {
   await save_visual(page);
 });
 
-test('Quote reply', async ({browser}, workerInfo) => {
+test('Quote reply', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name !== 'firefox', 'Uses Firefox specific selection quirks');
-  const page = await login({browser}, workerInfo);
   const response = await page.goto('/user2/repo1/issues/1');
   expect(response?.status()).toBe(200);
 
@@ -157,9 +151,8 @@ test('Quote reply', async ({browser}, workerInfo) => {
   await editorTextarea.fill('');
 });
 
-test('Pull quote reply', async ({browser}, workerInfo) => {
+test('Pull quote reply', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name !== 'firefox', 'Uses Firefox specific selection quirks');
-  const page = await login({browser}, workerInfo);
   const response = await page.goto('/user2/commitsonpr/pulls/1/files');
   expect(response?.status()).toBe(200);
 
diff --git a/tests/e2e/issue-sidebar.test.e2e.ts b/tests/e2e/issue-sidebar.test.e2e.ts
index f4d50a13ba..fe2a6cec87 100644
--- a/tests/e2e/issue-sidebar.test.e2e.ts
+++ b/tests/e2e/issue-sidebar.test.e2e.ts
@@ -7,14 +7,13 @@
 /* eslint playwright/expect-expect: ["error", { "assertFunctionNames": ["check_wip"] }] */
 
 import {expect, type Page} from '@playwright/test';
-import {test, save_visual, login_user, login} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
 test.describe('Pull: Toggle WIP', () => {
   const prTitle = 'pull5';
+
   async function toggle_wip_to({page}, should: boolean) {
     await page.waitForLoadState('domcontentloaded');
     if (should) {
@@ -39,8 +38,7 @@ test.describe('Pull: Toggle WIP', () => {
     }
   }
 
-  test.beforeEach(async ({browser}, workerInfo) => {
-    const page = await login({browser}, workerInfo);
+  test.beforeEach(async ({page}) => {
     const response = await page.goto('/user2/repo1/pulls/5');
     expect(response?.status()).toBe(200); // Status OK
     // ensure original title
@@ -50,9 +48,8 @@ test.describe('Pull: Toggle WIP', () => {
     await check_wip({page}, false);
   });
 
-  test('simple toggle', async ({browser}, workerInfo) => {
+  test('simple toggle', async ({page}, workerInfo) => {
     test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
-    const page = await login({browser}, workerInfo);
     await page.goto('/user2/repo1/pulls/5');
     // toggle to WIP
     await toggle_wip_to({page}, true);
@@ -62,9 +59,8 @@ test.describe('Pull: Toggle WIP', () => {
     await check_wip({page}, false);
   });
 
-  test('manual edit', async ({browser}, workerInfo) => {
+  test('manual edit', async ({page}, workerInfo) => {
     test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
-    const page = await login({browser}, workerInfo);
     await page.goto('/user2/repo1/pulls/5');
     // manually edit title to another prefix
     await page.locator('#issue-title-edit-show').click();
@@ -76,9 +72,8 @@ test.describe('Pull: Toggle WIP', () => {
     await check_wip({page}, false);
   });
 
-  test('maximum title length', async ({browser}, workerInfo) => {
+  test('maximum title length', async ({page}, workerInfo) => {
     test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
-    const page = await login({browser}, workerInfo);
     await page.goto('/user2/repo1/pulls/5');
     // check maximum title length is handled gracefully
     const maxLenStr = prTitle + 'a'.repeat(240);
@@ -96,17 +91,16 @@ test.describe('Pull: Toggle WIP', () => {
   });
 });
 
-test('Issue: Labels', async ({browser}, workerInfo) => {
+test('Issue: Labels', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
 
-  async function submitLabels({page}: {page: Page}) {
+  async function submitLabels({page}: { page: Page }) {
     const submitted = page.waitForResponse('/user2/repo1/issues/labels');
     await page.locator('textarea').first().click(); // close via unrelated element
     await submitted;
     await page.waitForLoadState();
   }
 
-  const page = await login({browser}, workerInfo);
   // select label list in sidebar only
   const labelList = page.locator('.issue-content-right .labels-list a');
   const response = await page.goto('/user2/repo1/issues/1');
@@ -144,9 +138,8 @@ test('Issue: Labels', async ({browser}, workerInfo) => {
   await expect(labelList.filter({hasText: 'label1'})).toBeVisible();
 });
 
-test('Issue: Assignees', async ({browser}, workerInfo) => {
+test('Issue: Assignees', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
-  const page = await login({browser}, workerInfo);
   // select label list in sidebar only
   const assigneesList = page.locator('.issue-content-right .assignees.list .selected .item a');
 
@@ -182,9 +175,8 @@ test('Issue: Assignees', async ({browser}, workerInfo) => {
   await expect(page.locator('.ui.assignees.list .item.no-select')).toBeHidden();
 });
 
-test('New Issue: Assignees', async ({browser}, workerInfo) => {
+test('New Issue: Assignees', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
-  const page = await login({browser}, workerInfo);
   // select label list in sidebar only
   const assigneesList = page.locator('.issue-content-right .assignees.list .selected .item');
 
@@ -224,9 +216,8 @@ test('New Issue: Assignees', async ({browser}, workerInfo) => {
   await save_visual(page);
 });
 
-test('Issue: Milestone', async ({browser}, workerInfo) => {
+test('Issue: Milestone', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
-  const page = await login({browser}, workerInfo);
 
   const response = await page.goto('/user2/repo1/issues/1');
   expect(response?.status()).toBe(200);
@@ -248,9 +239,8 @@ test('Issue: Milestone', async ({browser}, workerInfo) => {
   await expect(page.locator('.timeline-item.event').last()).toContainText('user2 removed this from the milestone1 milestone');
 });
 
-test('New Issue: Milestone', async ({browser}, workerInfo) => {
+test('New Issue: Milestone', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Unable to get tests working on Safari Mobile, see https://codeberg.org/forgejo/forgejo/pulls/3445#issuecomment-1789636');
-  const page = await login({browser}, workerInfo);
 
   const response = await page.goto('/user2/repo1/issues/new');
   expect(response?.status()).toBe(200);
diff --git a/tests/e2e/markdown-editor.test.e2e.ts b/tests/e2e/markdown-editor.test.e2e.ts
index ca2d6e01b6..762113d563 100644
--- a/tests/e2e/markdown-editor.test.e2e.ts
+++ b/tests/e2e/markdown-editor.test.e2e.ts
@@ -5,21 +5,16 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, save_visual, load_logged_in_context, login_user} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
-test('Markdown image preview behaviour', async ({browser}, workerInfo) => {
+test('Markdown image preview behaviour', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Flaky behaviour on mobile safari;');
 
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-
   // Editing the root README.md file for image preview
   const editPath = '/user2/repo1/src/branch/master/README.md';
 
-  const page = await context.newPage();
   const response = await page.goto(editPath, {waitUntil: 'domcontentloaded'});
   expect(response?.status()).toBe(200);
 
@@ -43,12 +38,9 @@ test('Markdown image preview behaviour', async ({browser}, workerInfo) => {
   await save_visual(page);
 });
 
-test('markdown indentation', async ({browser}, workerInfo) => {
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-
+test('markdown indentation', async ({page}) => {
   const initText = `* first\n* second\n* third\n* last`;
 
-  const page = await context.newPage();
   const response = await page.goto('/user2/repo1/issues/new');
   expect(response?.status()).toBe(200);
 
@@ -116,12 +108,9 @@ test('markdown indentation', async ({browser}, workerInfo) => {
   await expect(textarea).toHaveValue(initText);
 });
 
-test('markdown list continuation', async ({browser}, workerInfo) => {
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-
+test('markdown list continuation', async ({page}) => {
   const initText = `* first\n* second\n* third\n* last`;
 
-  const page = await context.newPage();
   const response = await page.goto('/user2/repo1/issues/new');
   expect(response?.status()).toBe(200);
 
@@ -213,10 +202,7 @@ test('markdown list continuation', async ({browser}, workerInfo) => {
   }
 });
 
-test('markdown insert table', async ({browser}, workerInfo) => {
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-
-  const page = await context.newPage();
+test('markdown insert table', async ({page}) => {
   const response = await page.goto('/user2/repo1/issues/new');
   expect(response?.status()).toBe(200);
 
diff --git a/tests/e2e/org-settings.test.e2e.ts b/tests/e2e/org-settings.test.e2e.ts
index 22a8bc0e2d..df554e0674 100644
--- a/tests/e2e/org-settings.test.e2e.ts
+++ b/tests/e2e/org-settings.test.e2e.ts
@@ -5,16 +5,13 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, save_visual, login_user, login} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 import {validate_form} from './shared/forms.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
-test('org team settings', async ({browser}, workerInfo) => {
+test('org team settings', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Cannot get it to work - as usual');
-  const page = await login({browser}, workerInfo);
   const response = await page.goto('/org/org3/teams/team1/edit');
   expect(response?.status()).toBe(200);
 
diff --git a/tests/e2e/profile_actions.test.e2e.ts b/tests/e2e/profile_actions.test.e2e.ts
index 65090e62b2..a66dc43aab 100644
--- a/tests/e2e/profile_actions.test.e2e.ts
+++ b/tests/e2e/profile_actions.test.e2e.ts
@@ -5,13 +5,11 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, save_visual, login_user, load_logged_in_context} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
-test('Follow actions', async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  const page = await context.newPage();
+test.use({user: 'user2'});
 
+test('Follow actions', async ({page}) => {
   await page.goto('/user1');
 
   // Check if following and then unfollowing works.
diff --git a/tests/e2e/reaction-selectors.test.e2e.ts b/tests/e2e/reaction-selectors.test.e2e.ts
index 3ce71b24d7..54b7d91869 100644
--- a/tests/e2e/reaction-selectors.test.e2e.ts
+++ b/tests/e2e/reaction-selectors.test.e2e.ts
@@ -4,11 +4,9 @@
 // @watch end
 
 import {expect, type Locator} from '@playwright/test';
-import {test, save_visual, login_user, load_logged_in_context} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
 const assertReactionCounts = (comment: Locator, counts: unknown) =>
   expect(async () => {
@@ -26,6 +24,7 @@ const assertReactionCounts = (comment: Locator, counts: unknown) =>
         ]),
       ),
     );
+    // eslint-disable-next-line playwright/no-standalone-expect
     return expect(reactions).toStrictEqual(counts);
   }).toPass();
 
@@ -35,10 +34,7 @@ async function toggleReaction(menu: Locator, reaction: string) {
   await menu.locator(`[role=menuitem][data-reaction-content="${reaction}"]`).click();
 }
 
-test('Reaction Selectors', async ({browser}, workerInfo) => {
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  const page = await context.newPage();
-
+test('Reaction Selectors', async ({page}) => {
   const response = await page.goto('/user2/repo1/issues/1');
   expect(response?.status()).toBe(200);
 
diff --git a/tests/e2e/release.test.e2e.ts b/tests/e2e/release.test.e2e.ts
index fefa446c59..49c67793e6 100644
--- a/tests/e2e/release.test.e2e.ts
+++ b/tests/e2e/release.test.e2e.ts
@@ -9,24 +9,18 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, login_user, save_visual, load_logged_in_context} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 import {validate_form} from './shared/forms.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
 test.describe.configure({
   timeout: 30000,
 });
 
-test('External Release Attachments', async ({browser, isMobile}, workerInfo) => {
+test('External Release Attachments', async ({page, isMobile}) => {
   test.skip(isMobile);
 
-  const context = await load_logged_in_context(browser, workerInfo, 'user2');
-  /** @type {import('@playwright/test').Page} */
-  const page = await context.newPage();
-
   // Click "New Release"
   await page.goto('/user2/repo2/releases');
   await page.click('.button.small.primary');
diff --git a/tests/e2e/repo-code.test.e2e.ts b/tests/e2e/repo-code.test.e2e.ts
index 264dd3a8e0..335fb5b7f5 100644
--- a/tests/e2e/repo-code.test.e2e.ts
+++ b/tests/e2e/repo-code.test.e2e.ts
@@ -5,13 +5,9 @@
 // @watch end
 
 import {expect, type Page} from '@playwright/test';
-import {test, save_visual, login_user, login} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 import {accessibilityCheck} from './shared/accessibility.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
-
 async function assertSelectedLines(page: Page, nums: string[]) {
   const pageAssertions = async () => {
     expect(
@@ -81,20 +77,23 @@ test('Readable diff', async ({page}, workerInfo) => {
   }
 });
 
-test('Username highlighted in commits', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
-  await page.goto('/user2/mentions-highlighted/commits/branch/main');
-  // check first commit
-  await page.getByRole('link', {name: 'A commit message which'}).click();
-  await expect(page.getByRole('link', {name: '@user2'})).toHaveCSS('background-color', /(.*)/);
-  await expect(page.getByRole('link', {name: '@user1'})).toHaveCSS('background-color', 'rgba(0, 0, 0, 0)');
-  await accessibilityCheck({page}, ['.commit-header'], [], []);
-  await save_visual(page);
-  // check second commit
-  await page.goto('/user2/mentions-highlighted/commits/branch/main');
-  await page.locator('tbody').getByRole('link', {name: 'Another commit which mentions'}).click();
-  await expect(page.getByRole('link', {name: '@user2'})).toHaveCSS('background-color', /(.*)/);
-  await expect(page.getByRole('link', {name: '@user1'})).toHaveCSS('background-color', 'rgba(0, 0, 0, 0)');
-  await accessibilityCheck({page}, ['.commit-header'], [], []);
-  await save_visual(page);
+test.describe('As authenticated user', () => {
+  test.use({user: 'user2'});
+
+  test('Username highlighted in commits', async ({page}) => {
+    await page.goto('/user2/mentions-highlighted/commits/branch/main');
+    // check first commit
+    await page.getByRole('link', {name: 'A commit message which'}).click();
+    await expect(page.getByRole('link', {name: '@user2'})).toHaveCSS('background-color', /(.*)/);
+    await expect(page.getByRole('link', {name: '@user1'})).toHaveCSS('background-color', 'rgba(0, 0, 0, 0)');
+    await accessibilityCheck({page}, ['.commit-header'], [], []);
+    await save_visual(page);
+    // check second commit
+    await page.goto('/user2/mentions-highlighted/commits/branch/main');
+    await page.locator('tbody').getByRole('link', {name: 'Another commit which mentions'}).click();
+    await expect(page.getByRole('link', {name: '@user2'})).toHaveCSS('background-color', /(.*)/);
+    await expect(page.getByRole('link', {name: '@user1'})).toHaveCSS('background-color', 'rgba(0, 0, 0, 0)');
+    await accessibilityCheck({page}, ['.commit-header'], [], []);
+    await save_visual(page);
+  });
 });
diff --git a/tests/e2e/repo-migrate.test.e2e.ts b/tests/e2e/repo-migrate.test.e2e.ts
index a0f9ab6c80..428c2cb171 100644
--- a/tests/e2e/repo-migrate.test.e2e.ts
+++ b/tests/e2e/repo-migrate.test.e2e.ts
@@ -3,15 +3,13 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, save_visual, login_user, load_logged_in_context} from './utils_e2e.ts';
+import {test, save_visual, test_context} from './utils_e2e.ts';
 
-test.beforeAll(({browser}, workerInfo) => login_user(browser, workerInfo, 'user2'));
+test.use({user: 'user2'});
 
-test('Migration Progress Page', async ({page: unauthedPage, browser}, workerInfo) => {
+test('Migration Progress Page', async ({page, browser}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Flaky actionability checks on Mobile Safari');
 
-  const page = await (await load_logged_in_context(browser, workerInfo, 'user2')).newPage();
-
   expect((await page.goto('/user2/invalidrepo'))?.status(), 'repo should not exist yet').toBe(404);
 
   await page.goto('/repo/migrate?service_type=1');
@@ -23,10 +21,12 @@ test('Migration Progress Page', async ({page: unauthedPage, browser}, workerInfo
   await form.locator('button.primary').click({timeout: 5000});
   await expect(page).toHaveURL('user2/invalidrepo');
   await save_visual(page);
-  // page screenshot of unauthedPage is checked automatically after the test
+  // page screenshot of unauthenticatedPage is checked automatically after the test
 
-  expect((await unauthedPage.goto('/user2/invalidrepo'))?.status(), 'public migration page should be accessible').toBe(200);
-  await expect(unauthedPage.locator('#repo_migrating_progress')).toBeVisible();
+  const ctx = await test_context(browser);
+  const unauthenticatedPage = await ctx.newPage();
+  expect((await unauthenticatedPage.goto('/user2/invalidrepo'))?.status(), 'public migration page should be accessible').toBe(200);
+  await expect(unauthenticatedPage.locator('#repo_migrating_progress')).toBeVisible();
 
   await page.reload();
   await expect(page.locator('#repo_migrating_failed')).toBeVisible();
diff --git a/tests/e2e/repo-new.test.e2e.ts b/tests/e2e/repo-new.test.e2e.ts
index c9cc29ad56..ad202825a0 100644
--- a/tests/e2e/repo-new.test.e2e.ts
+++ b/tests/e2e/repo-new.test.e2e.ts
@@ -4,15 +4,12 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, dynamic_id, save_visual, login_user, login} from './utils_e2e.ts';
+import {test, dynamic_id, save_visual} from './utils_e2e.ts';
 import {validate_form} from './shared/forms.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
-test('New repo: invalid', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
+test('New repo: invalid', async ({page}) => {
   const response = await page.goto('/repo/create');
   expect(response?.status()).toBe(200);
   // check that relevant form content is hidden or available
@@ -28,8 +25,7 @@ test('New repo: invalid', async ({browser}, workerInfo) => {
   await save_visual(page);
 });
 
-test('New repo: initialize', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
+test('New repo: initialize', async ({page}, workerInfo) => {
   const response = await page.goto('/repo/create');
   expect(response?.status()).toBe(200);
   // check that relevant form content is hidden or available
@@ -62,8 +58,7 @@ test('New repo: initialize', async ({browser}, workerInfo) => {
   await save_visual(page);
 });
 
-test('New repo: initialize later', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
+test('New repo: initialize later', async ({page}) => {
   const response = await page.goto('/repo/create');
   expect(response?.status()).toBe(200);
 
@@ -97,9 +92,8 @@ test('New repo: initialize later', async ({browser}, workerInfo) => {
   await save_visual(page);
 });
 
-test('New repo: from template', async ({browser}, workerInfo) => {
+test('New repo: from template', async ({page}, workerInfo) => {
   test.skip(['Mobile Safari', 'webkit'].includes(workerInfo.project.name), 'WebKit browsers seem to have CORS issues with localhost here.');
-  const page = await login({browser}, workerInfo);
   const response = await page.goto('/repo/create');
   expect(response?.status()).toBe(200);
 
@@ -114,8 +108,7 @@ test('New repo: from template', async ({browser}, workerInfo) => {
   await save_visual(page);
 });
 
-test('New repo: label set', async ({browser}, workerInfo) => {
-  const page = await login({browser}, workerInfo);
+test('New repo: label set', async ({page}) => {
   await page.goto('/repo/create');
 
   const reponame = dynamic_id();
diff --git a/tests/e2e/repo-settings.test.e2e.ts b/tests/e2e/repo-settings.test.e2e.ts
index 113b15181b..3d260866fb 100644
--- a/tests/e2e/repo-settings.test.e2e.ts
+++ b/tests/e2e/repo-settings.test.e2e.ts
@@ -7,16 +7,13 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, save_visual, login_user, login} from './utils_e2e.ts';
+import {test, save_visual} from './utils_e2e.ts';
 import {validate_form} from './shared/forms.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
+test.use({user: 'user2'});
 
-test('repo webhook settings', async ({browser}, workerInfo) => {
+test('repo webhook settings', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name === 'Mobile Safari', 'Cannot get it to work - as usual');
-  const page = await login({browser}, workerInfo);
   const response = await page.goto('/user2/repo1/settings/hooks/forgejo/new');
   expect(response?.status()).toBe(200);
 
@@ -35,9 +32,8 @@ test('repo webhook settings', async ({browser}, workerInfo) => {
 });
 
 test.describe('repo branch protection settings', () => {
-  test('form', async ({browser}, workerInfo) => {
-    test.skip(workerInfo.project.name === 'Mobile Safari', 'Cannot get it to work - as usual');
-    const page = await login({browser}, workerInfo);
+  test('form', async ({page}, {project}) => {
+    test.skip(project.name === 'Mobile Safari', 'Cannot get it to work - as usual');
     const response = await page.goto('/user2/repo1/settings/branches/edit');
     expect(response?.status()).toBe(200);
 
@@ -56,8 +52,7 @@ test.describe('repo branch protection settings', () => {
     await save_visual(page);
   });
 
-  test.afterEach(async ({browser}, workerInfo) => {
-    const page = await login({browser}, workerInfo);
+  test.afterEach(async ({page}) => {
     // delete the rule for the next test
     await page.goto('/user2/repo1/settings/branches/');
     await page.waitForLoadState('domcontentloaded');
diff --git a/tests/e2e/right-settings-button.test.e2e.ts b/tests/e2e/right-settings-button.test.e2e.ts
index bfb1800a27..e1c40fdd4d 100644
--- a/tests/e2e/right-settings-button.test.e2e.ts
+++ b/tests/e2e/right-settings-button.test.e2e.ts
@@ -5,19 +5,12 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test, login_user, load_logged_in_context} from './utils_e2e.ts';
+import {test} from './utils_e2e.ts';
 
-test.beforeAll(async ({browser}, workerInfo) => {
-  await login_user(browser, workerInfo, 'user2');
-});
-
-test.describe('desktop viewport', () => {
-  test.use({viewport: {width: 1920, height: 300}});
-
-  test('Settings button on right of repo header', async ({browser}, workerInfo) => {
-    const context = await load_logged_in_context(browser, workerInfo, 'user2');
-    const page = await context.newPage();
+test.describe('desktop viewport as user 2', () => {
+  test.use({user: 'user2', viewport: {width: 1920, height: 300}});
 
+  test('Settings button on right of repo header', async ({page}) => {
     await page.goto('/user2/repo1');
 
     const settingsBtn = page.locator('.overflow-menu-items>#settings-btn');
@@ -27,24 +20,7 @@ test.describe('desktop viewport', () => {
     await expect(page.locator('.overflow-menu-button')).toHaveCount(0);
   });
 
-  test('Settings button on right of repo header also when add more button is shown', async ({browser}, workerInfo) => {
-    await login_user(browser, workerInfo, 'user12');
-    const context = await load_logged_in_context(browser, workerInfo, 'user12');
-    const page = await context.newPage();
-
-    await page.goto('/user12/repo10');
-
-    const settingsBtn = page.locator('.overflow-menu-items>#settings-btn');
-    await expect(settingsBtn).toBeVisible();
-    await expect(settingsBtn).toHaveClass(/right/);
-
-    await expect(page.locator('.overflow-menu-button')).toHaveCount(0);
-  });
-
-  test('Settings button on right of org header', async ({browser}, workerInfo) => {
-    const context = await load_logged_in_context(browser, workerInfo, 'user2');
-    const page = await context.newPage();
-
+  test('Settings button on right of org header', async ({page}) => {
     await page.goto('/org3');
 
     const settingsBtn = page.locator('.overflow-menu-items>#settings-btn');
@@ -53,6 +29,24 @@ test.describe('desktop viewport', () => {
 
     await expect(page.locator('.overflow-menu-button')).toHaveCount(0);
   });
+});
+
+test.describe('desktop viewport as user12', () => {
+  test.use({user: 'user12', viewport: {width: 1920, height: 300}});
+
+  test('Settings button on right of repo header also when add more button is shown', async ({page}) => {
+    await page.goto('/user12/repo10');
+
+    const settingsBtn = page.locator('.overflow-menu-items>#settings-btn');
+    await expect(settingsBtn).toBeVisible();
+    await expect(settingsBtn).toHaveClass(/right/);
+
+    await expect(page.locator('.overflow-menu-button')).toHaveCount(0);
+  });
+});
+
+test.describe('desktop viewport, unauthenticated', () => {
+  test.use({viewport: {width: 1920, height: 300}});
 
   test('User overview overflow menu should not be influenced', async ({page}) => {
     await page.goto('/user2');
@@ -64,12 +58,9 @@ test.describe('desktop viewport', () => {
 });
 
 test.describe('small viewport', () => {
-  test.use({viewport: {width: 800, height: 300}});
-
-  test('Settings button in overflow menu of repo header', async ({browser}, workerInfo) => {
-    const context = await load_logged_in_context(browser, workerInfo, 'user2');
-    const page = await context.newPage();
+  test.use({user: 'user2', viewport: {width: 800, height: 300}});
 
+  test('Settings button in overflow menu of repo header', async ({page}) => {
     await page.goto('/user2/repo1');
 
     await expect(page.locator('.overflow-menu-items>#settings-btn')).toHaveCount(0);
@@ -89,10 +80,7 @@ test.describe('small viewport', () => {
     expect(Array.from(new Set(items))).toHaveLength(items.length);
   });
 
-  test('Settings button in overflow menu of org header', async ({browser}, workerInfo) => {
-    const context = await load_logged_in_context(browser, workerInfo, 'user2');
-    const page = await context.newPage();
-
+  test('Settings button in overflow menu of org header', async ({page}) => {
     await page.goto('/org3');
 
     await expect(page.locator('.overflow-menu-items>#settings-btn')).toHaveCount(0);
@@ -111,6 +99,10 @@ test.describe('small viewport', () => {
     const items = shownItems.concat(overflowItems);
     expect(Array.from(new Set(items))).toHaveLength(items.length);
   });
+});
+
+test.describe('small viewport, unauthenticated', () => {
+  test.use({viewport: {width: 800, height: 300}});
 
   test('User overview overflow menu should not be influenced', async ({page}) => {
     await page.goto('/user2');
diff --git a/tests/e2e/utils_e2e.ts b/tests/e2e/utils_e2e.ts
index 7e25441ea3..80412e437d 100644
--- a/tests/e2e/utils_e2e.ts
+++ b/tests/e2e/utils_e2e.ts
@@ -1,9 +1,31 @@
 import {expect, test as baseTest, type Browser, type BrowserContextOptions, type APIRequestContext, type TestInfo, type Page} from '@playwright/test';
 
-export const test = baseTest.extend({
-  context: async ({browser}, use) => {
-    return use(await test_context(browser));
+import * as path from 'node:path';
+
+const AUTH_PATH = 'tests/e2e/.auth';
+
+type AuthScope = 'logout' | 'shared' | 'webauthn';
+
+export type TestOptions = {
+  forEachTest: void
+  user: string | null;
+  authScope: AuthScope;
+};
+
+export const test = baseTest.extend<TestOptions>({
+  context: async ({browser, user, authScope, contextOptions}, use, {project}) => {
+    if (user && authScope) {
+      const browserName = project.name.toLowerCase().replace(' ', '-');
+      contextOptions.storageState = path.join(AUTH_PATH, `state-${browserName}-${user}-${authScope}.json`);
+    } else {
+      // if no user is given, ensure to have clean state
+      contextOptions.storageState = {cookies: [], origins: []};
+    }
+
+    return use(await test_context(browser, contextOptions));
   },
+  user: null,
+  authScope: 'shared',
   // see https://playwright.dev/docs/test-fixtures#adding-global-beforeeachaftereach-hooks
   forEachTest: [async ({page}, use) => {
     await use();
@@ -15,7 +37,7 @@ export const test = baseTest.extend({
   }, {auto: true}],
 });
 
-async function test_context(browser: Browser, options?: BrowserContextOptions) {
+export async function test_context(browser: Browser, options?: BrowserContextOptions) {
   const context = await browser.newContext(options);
 
   context.on('page', (page) => {
diff --git a/tests/e2e/utils_e2e_test.go b/tests/e2e/utils_e2e_test.go
index bf1a8a418c..96fd905363 100644
--- a/tests/e2e/utils_e2e_test.go
+++ b/tests/e2e/utils_e2e_test.go
@@ -5,17 +5,27 @@ package e2e
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
 	"regexp"
+	"strings"
 	"testing"
 	"time"
 
+	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/json"
+	modules_session "code.gitea.io/gitea/modules/session"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/tests"
 
+	"code.forgejo.org/go-chi/session"
 	"github.com/stretchr/testify/require"
 )
 
@@ -25,6 +35,8 @@ func onForgejoRunTB(t testing.TB, callback func(testing.TB, *url.URL), prepare .
 	if len(prepare) == 0 || prepare[0] {
 		defer tests.PrepareTestEnv(t, 1)()
 	}
+	createSessions(t)
+
 	s := http.Server{
 		Handler: testE2eWebRoutes,
 	}
@@ -64,3 +76,118 @@ func onForgejoRun(t *testing.T, callback func(*testing.T, *url.URL), prepare ...
 		callback(t.(*testing.T), u)
 	}, prepare...)
 }
+
+func createSessions(t testing.TB) {
+	t.Helper()
+	// copied from playwright.config.ts
+	browsers := []string{
+		"chromium",
+		"firefox",
+		"webkit",
+		"Mobile Chrome",
+		"Mobile Safari",
+	}
+	scopes := []string{
+		"shared",
+	}
+	users := []string{
+		"user1",
+		"user2",
+		"user12",
+		"user40",
+	}
+
+	authState := filepath.Join(filepath.Dir(setting.AppPath), "tests", "e2e", ".auth")
+	err := os.RemoveAll(authState)
+	require.NoError(t, err)
+
+	err = os.MkdirAll(authState, os.ModePerm)
+	require.NoError(t, err)
+
+	createSessionCookie := stateHelper(t)
+
+	for _, user := range users {
+		u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: strings.ToLower(user)})
+		for _, browser := range browsers {
+			for _, scope := range scopes {
+				stateFile := strings.ReplaceAll(strings.ToLower(fmt.Sprintf("state-%s-%s-%s.json", browser, user, scope)), " ", "-")
+				createSessionCookie(filepath.Join(authState, stateFile), u)
+			}
+		}
+	}
+}
+
+func stateHelper(t testing.TB) func(stateFile string, user *user_model.User) {
+	type Cookie struct {
+		Name     string `json:"name"`
+		Value    string `json:"value"`
+		Domain   string `json:"domain"`
+		Path     string `json:"path"`
+		Expires  int    `json:"expires"`
+		HTTPOnly bool   `json:"httpOnly"`
+		Secure   bool   `json:"secure"`
+		SameSite string `json:"sameSite"`
+	}
+
+	type BrowserState struct {
+		Cookies []Cookie `json:"cookies"`
+		Origins []string `json:"origins"`
+	}
+
+	options := session.Options{
+		Provider:       setting.SessionConfig.Provider,
+		ProviderConfig: setting.SessionConfig.ProviderConfig,
+		CookieName:     setting.SessionConfig.CookieName,
+		CookiePath:     setting.SessionConfig.CookiePath,
+		Gclifetime:     setting.SessionConfig.Gclifetime,
+		Maxlifetime:    setting.SessionConfig.Maxlifetime,
+		Secure:         setting.SessionConfig.Secure,
+		SameSite:       setting.SessionConfig.SameSite,
+		Domain:         setting.SessionConfig.Domain,
+	}
+
+	opt := session.PrepareOptions([]session.Options{options})
+
+	vsp := modules_session.VirtualSessionProvider{}
+	err := vsp.Init(opt.Maxlifetime, opt.ProviderConfig)
+	require.NoError(t, err)
+
+	return func(stateFile string, user *user_model.User) {
+		buf := make([]byte, opt.IDLength/2)
+		_, err = rand.Read(buf)
+		require.NoError(t, err)
+
+		sessionID := hex.EncodeToString(buf)
+
+		s, err := vsp.Read(sessionID)
+		require.NoError(t, err)
+
+		err = s.Set("uid", user.ID)
+		require.NoError(t, err)
+
+		err = s.Release()
+		require.NoError(t, err)
+
+		state := BrowserState{
+			Cookies: []Cookie{
+				{
+					Name:     opt.CookieName,
+					Value:    sessionID,
+					Domain:   setting.Domain,
+					Path:     "/",
+					Expires:  -1,
+					HTTPOnly: true,
+					Secure:   false,
+					SameSite: "Lax",
+				},
+			},
+			Origins: []string{},
+		}
+
+		jsonData, err := json.Marshal(state)
+		require.NoError(t, err)
+
+		err = os.WriteFile(stateFile, jsonData, 0o644)
+		require.NoError(t, err)
+	}
+}

From 26b7c6b86a8031c5d2cb2c27c7fafc057f46165b Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 17 Jan 2025 01:07:22 +0000
Subject: [PATCH 002/125] [v10.0/forgejo] tests(e2e): Various fixes to visual
 testing (#6587)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6569

Co-authored-by: Otto Richter <git@otto.splvs.net>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6587
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 tests/e2e/actions.test.e2e.ts               |  1 +
 tests/e2e/clipboard-copy.test.e2e.ts        |  5 ++++-
 tests/e2e/dashboard-ci-status.test.e2e.ts   |  5 +++--
 tests/e2e/e2e_test.go                       |  7 ++++++-
 tests/e2e/example.test.e2e.ts               |  3 ++-
 tests/e2e/explore.test.e2e.ts               |  3 ++-
 tests/e2e/markup.test.e2e.ts                |  3 ++-
 tests/e2e/repo-code.test.e2e.ts             |  2 ++
 tests/e2e/repo-commitgraph.test.e2e.ts      |  3 ++-
 tests/e2e/repo-migrate.test.e2e.ts          |  3 ++-
 tests/e2e/repo-wiki.test.e2e.ts             |  4 +++-
 tests/e2e/right-settings-button.test.e2e.ts |  5 ++++-
 tests/e2e/utils_e2e.ts                      | 10 +---------
 13 files changed, 34 insertions(+), 20 deletions(-)

diff --git a/tests/e2e/actions.test.e2e.ts b/tests/e2e/actions.test.e2e.ts
index 6236fe70d3..4e93b89ee0 100644
--- a/tests/e2e/actions.test.e2e.ts
+++ b/tests/e2e/actions.test.e2e.ts
@@ -71,4 +71,5 @@ test('workflow dispatch box not available for unauthenticated users', async ({pa
   await page.goto('/user2/test_workflows/actions?workflow=test-dispatch.yml&actor=0&status=0');
 
   await expect(page.locator('body')).not.toContainText(workflow_trigger_notification_text);
+  await save_visual(page);
 });
diff --git a/tests/e2e/clipboard-copy.test.e2e.ts b/tests/e2e/clipboard-copy.test.e2e.ts
index 70a3425868..2ae0e0dfff 100644
--- a/tests/e2e/clipboard-copy.test.e2e.ts
+++ b/tests/e2e/clipboard-copy.test.e2e.ts
@@ -8,7 +8,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
 test('copy src file path to clipboard', async ({page}, workerInfo) => {
   test.skip(['Mobile Safari', 'webkit'].includes(workerInfo.project.name), 'Apple clipboard API addon - starting at just $499!');
@@ -19,6 +19,7 @@ test('copy src file path to clipboard', async ({page}, workerInfo) => {
   await page.click('[data-clipboard-text]');
   const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
   expect(clipboardText).toContain('README.md');
+  await save_visual(page);
 });
 
 test('copy diff file path to clipboard', async ({page}, workerInfo) => {
@@ -30,4 +31,6 @@ test('copy diff file path to clipboard', async ({page}, workerInfo) => {
   await page.click('[data-clipboard-text]');
   const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
   expect(clipboardText).toContain('README.md');
+  await expect(page.getByText('Copied')).toBeVisible();
+  await save_visual(page);
 });
diff --git a/tests/e2e/dashboard-ci-status.test.e2e.ts b/tests/e2e/dashboard-ci-status.test.e2e.ts
index 800fc951e6..d35fe299ff 100644
--- a/tests/e2e/dashboard-ci-status.test.e2e.ts
+++ b/tests/e2e/dashboard-ci-status.test.e2e.ts
@@ -3,7 +3,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {save_visual, test} from './utils_e2e.ts';
+import {test} from './utils_e2e.ts';
 
 test.use({user: 'user2'});
 
@@ -23,5 +23,6 @@ test('Correct link and tooltip', async ({page}, testInfo) => {
   const repoStatus = page.locator('.dashboard-repos .repo-owner-name-list > li:nth-child(1) > a:nth-child(2)');
   await expect(repoStatus).toHaveAttribute('href', '/user2/test_workflows/actions', {timeout: 10000});
   await expect(repoStatus).toHaveAttribute('data-tooltip-content', /^(Error|Failure)$/);
-  await save_visual(page);
+  // ToDo: Ensure stable screenshot of dashboard. Known to be flaky: https://code.forgejo.org/forgejo/visual-browser-testing/commit/206d4cfb7a4af6d8d7043026cdd4d63708798b2a
+  // await save_visual(page);
 });
diff --git a/tests/e2e/e2e_test.go b/tests/e2e/e2e_test.go
index b8c89625c0..245bd347b8 100644
--- a/tests/e2e/e2e_test.go
+++ b/tests/e2e/e2e_test.go
@@ -89,6 +89,7 @@ func TestE2e(t *testing.T) {
 
 	runArgs := []string{"npx", "playwright", "test"}
 
+	_, testVisual := os.LookupEnv("VISUAL_TEST")
 	// To update snapshot outputs
 	if _, set := os.LookupEnv("ACCEPT_VISUAL"); set {
 		runArgs = append(runArgs, "--update-snapshots")
@@ -112,6 +113,10 @@ func TestE2e(t *testing.T) {
 			onForgejoRun(t, func(*testing.T, *url.URL) {
 				defer DeclareGitRepos(t)()
 				thisTest := runArgs
+				// when all tests are run, use unique artifacts directories per test to preserve artifacts from other tests
+				if testVisual {
+					thisTest = append(thisTest, "--output=tests/e2e/test-artifacts/"+testname)
+				}
 				thisTest = append(thisTest, path)
 				cmd := exec.Command(runArgs[0], thisTest...)
 				cmd.Env = os.Environ()
@@ -121,7 +126,7 @@ func TestE2e(t *testing.T) {
 				cmd.Stderr = os.Stderr
 
 				err := cmd.Run()
-				if err != nil {
+				if err != nil && !testVisual {
 					log.Fatal("Playwright Failed: %s", err)
 				}
 			})
diff --git a/tests/e2e/example.test.e2e.ts b/tests/e2e/example.test.e2e.ts
index b2a679a82d..97c5b8684b 100644
--- a/tests/e2e/example.test.e2e.ts
+++ b/tests/e2e/example.test.e2e.ts
@@ -5,7 +5,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
 test('Load Homepage', async ({page}) => {
   const response = await page.goto('/');
@@ -26,6 +26,7 @@ test('Register Form', async ({page}, workerInfo) => {
   expect(page.url()).toBe(`${workerInfo.project.use.baseURL}/`);
   await expect(page.locator('.secondary-nav span>img.ui.avatar')).toBeVisible();
   await expect(page.locator('.ui.positive.message.flash-success')).toHaveText('Account was successfully created. Welcome!');
+  await save_visual(page);
 });
 
 // eslint-disable-next-line playwright/no-skipped-test
diff --git a/tests/e2e/explore.test.e2e.ts b/tests/e2e/explore.test.e2e.ts
index 44c9b21f58..1bb5af3cc6 100644
--- a/tests/e2e/explore.test.e2e.ts
+++ b/tests/e2e/explore.test.e2e.ts
@@ -7,7 +7,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
 test('Explore view taborder', async ({page}) => {
   await page.goto('/explore/repos');
@@ -42,4 +42,5 @@ test('Explore view taborder', async ({page}) => {
     }
   }
   expect(res).toBe(exp);
+  await save_visual(page);
 });
diff --git a/tests/e2e/markup.test.e2e.ts b/tests/e2e/markup.test.e2e.ts
index 2726942d57..398a0a6300 100644
--- a/tests/e2e/markup.test.e2e.ts
+++ b/tests/e2e/markup.test.e2e.ts
@@ -3,7 +3,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
 test('markup with #xyz-mode-only', async ({page}) => {
   const response = await page.goto('/user2/repo1/issues/1');
@@ -13,4 +13,5 @@ test('markup with #xyz-mode-only', async ({page}) => {
   await expect(comment).toBeVisible();
   await expect(comment.locator('[src$="#gh-light-mode-only"]')).toBeVisible();
   await expect(comment.locator('[src$="#gh-dark-mode-only"]')).toBeHidden();
+  await save_visual(page);
 });
diff --git a/tests/e2e/repo-code.test.e2e.ts b/tests/e2e/repo-code.test.e2e.ts
index 335fb5b7f5..11b710c956 100644
--- a/tests/e2e/repo-code.test.e2e.ts
+++ b/tests/e2e/repo-code.test.e2e.ts
@@ -49,6 +49,7 @@ test('Line Range Selection', async ({page}) => {
   // out-of-bounds end line
   await page.goto(`${filePath}#L1-L100`);
   await assertSelectedLines(page, ['1', '2', '3']);
+  await save_visual(page);
 });
 
 test('Readable diff', async ({page}, workerInfo) => {
@@ -75,6 +76,7 @@ test('Readable diff', async ({page}, workerInfo) => {
       await expect(page.getByText(thisDiff.added, {exact: true})).toHaveCSS('background-color', 'rgb(134, 239, 172)');
     }
   }
+  await save_visual(page);
 });
 
 test.describe('As authenticated user', () => {
diff --git a/tests/e2e/repo-commitgraph.test.e2e.ts b/tests/e2e/repo-commitgraph.test.e2e.ts
index 5f0cad117a..39c5661900 100644
--- a/tests/e2e/repo-commitgraph.test.e2e.ts
+++ b/tests/e2e/repo-commitgraph.test.e2e.ts
@@ -5,7 +5,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
 test('Commit graph overflow', async ({page}) => {
   await page.goto('/user2/diff-test/graph');
@@ -28,4 +28,5 @@ test('Switch branch', async ({page}) => {
   await expect(page.locator('#loading-indicator')).toBeHidden();
   await expect(page.locator('#rel-container')).toBeVisible();
   await expect(page.locator('#rev-container')).toBeVisible();
+  await save_visual(page);
 });
diff --git a/tests/e2e/repo-migrate.test.e2e.ts b/tests/e2e/repo-migrate.test.e2e.ts
index 428c2cb171..5e67f89ed1 100644
--- a/tests/e2e/repo-migrate.test.e2e.ts
+++ b/tests/e2e/repo-migrate.test.e2e.ts
@@ -21,7 +21,6 @@ test('Migration Progress Page', async ({page, browser}, workerInfo) => {
   await form.locator('button.primary').click({timeout: 5000});
   await expect(page).toHaveURL('user2/invalidrepo');
   await save_visual(page);
-  // page screenshot of unauthenticatedPage is checked automatically after the test
 
   const ctx = await test_context(browser);
   const unauthenticatedPage = await ctx.newPage();
@@ -37,4 +36,6 @@ test('Migration Progress Page', async ({page, browser}, workerInfo) => {
   await save_visual(page);
   await deleteModal.getByRole('button', {name: 'Delete repository'}).click();
   await expect(page).toHaveURL('/');
+  // checked last to preserve the order of screenshots from first run
+  await save_visual(unauthenticatedPage);
 });
diff --git a/tests/e2e/repo-wiki.test.e2e.ts b/tests/e2e/repo-wiki.test.e2e.ts
index f32fe3fc91..4ce66da8bc 100644
--- a/tests/e2e/repo-wiki.test.e2e.ts
+++ b/tests/e2e/repo-wiki.test.e2e.ts
@@ -4,7 +4,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
 for (const searchTerm of ['space', 'consectetur']) {
   for (const width of [null, 2560, 4000]) {
@@ -23,6 +23,7 @@ for (const searchTerm of ['space', 'consectetur']) {
       await page.getByPlaceholder('Search wiki').dispatchEvent('keyup');
       // timeout is necessary because HTMX search could be slow
       await expect(page.locator('#wiki-search a[href]')).toBeInViewport({ratio: 1});
+      await save_visual(page);
     });
   }
 }
@@ -36,4 +37,5 @@ test(`Search results show titles (and not file names)`, async ({page}, workerInf
   // so we manually "type" the last letter
   await page.getByPlaceholder('Search wiki').dispatchEvent('keyup');
   await expect(page.locator('#wiki-search a[href] b')).toHaveText('Page With Spaced Name');
+  await save_visual(page);
 });
diff --git a/tests/e2e/right-settings-button.test.e2e.ts b/tests/e2e/right-settings-button.test.e2e.ts
index e1c40fdd4d..3bea329ba0 100644
--- a/tests/e2e/right-settings-button.test.e2e.ts
+++ b/tests/e2e/right-settings-button.test.e2e.ts
@@ -5,7 +5,7 @@
 // @watch end
 
 import {expect} from '@playwright/test';
-import {test} from './utils_e2e.ts';
+import {save_visual, test} from './utils_e2e.ts';
 
 test.describe('desktop viewport as user 2', () => {
   test.use({user: 'user2', viewport: {width: 1920, height: 300}});
@@ -54,6 +54,7 @@ test.describe('desktop viewport, unauthenticated', () => {
     await expect(page.locator('.overflow-menu-items>#settings-btn')).toHaveCount(0);
 
     await expect(page.locator('.overflow-menu-button')).toHaveCount(0);
+    await save_visual(page);
   });
 });
 
@@ -78,6 +79,7 @@ test.describe('small viewport', () => {
 
     const items = shownItems.concat(overflowItems);
     expect(Array.from(new Set(items))).toHaveLength(items.length);
+    await save_visual(page);
   });
 
   test('Settings button in overflow menu of org header', async ({page}) => {
@@ -121,5 +123,6 @@ test.describe('small viewport, unauthenticated', () => {
 
     const items = shownItems.concat(overflowItems);
     expect(Array.from(new Set(items))).toHaveLength(items.length);
+    await save_visual(page);
   });
 });
diff --git a/tests/e2e/utils_e2e.ts b/tests/e2e/utils_e2e.ts
index 80412e437d..ff921a2cf3 100644
--- a/tests/e2e/utils_e2e.ts
+++ b/tests/e2e/utils_e2e.ts
@@ -26,15 +26,6 @@ export const test = baseTest.extend<TestOptions>({
   },
   user: null,
   authScope: 'shared',
-  // see https://playwright.dev/docs/test-fixtures#adding-global-beforeeachaftereach-hooks
-  forEachTest: [async ({page}, use) => {
-    await use();
-    // some tests create a new page which is not yet available here
-    // only operate on tests that make the URL available
-    if (page.url() !== 'about:blank') {
-      await save_visual(page);
-    }
-  }, {auto: true}],
 });
 
 export async function test_context(browser: Browser, options?: BrowserContextOptions) {
@@ -128,6 +119,7 @@ export async function save_visual(page: Page) {
         // update order of recently created repos is not fully deterministic
         page.locator('.flex-item-main').filter({hasText: 'relative time in repo'}),
         page.locator('#activity-feed'),
+        page.locator('#user-heatmap'),
         // dynamic IDs in fixed-size inputs
         page.locator('input[value*="dyn-id-"]'),
       ],

From 2d1e1639131cdf5a54a4c847cf5efa6e50c18095 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 17 Jan 2025 08:15:16 +0000
Subject: [PATCH 003/125] [v10.0/forgejo] fix: reduce noise for the v303
 migration (#6594)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6591

Using SELECT `%s` FROM `%s` WHERE 0 = 1 to assert the existence of a column is simple but noisy: it shows errors in the migrations that are confusing for Forgejo admins because they are not actual errors.

Use introspection instead, which is more complicated but leads to the same result.

Add a test that ensures it works as expected, for all database types. Although the migration is run for all database types, it does not account for various scenarios and is never tested in the case a column does not exist.

Refs: https://codeberg.org/forgejo/forgejo/issues/6583

Co-authored-by: Earl Warren <contact@earl-warren.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6594
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 models/migrations/v1_23/v303.go      | 35 ++++++++++++++++++------
 models/migrations/v1_23/v303_test.go | 41 ++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 8 deletions(-)
 create mode 100644 models/migrations/v1_23/v303_test.go

diff --git a/models/migrations/v1_23/v303.go b/models/migrations/v1_23/v303.go
index e3ee180539..2fb37ac843 100644
--- a/models/migrations/v1_23/v303.go
+++ b/models/migrations/v1_23/v303.go
@@ -1,23 +1,27 @@
-// Copyright 2024 The Forgejo Authors.
-// SPDX-License-Identifier: MIT
+// Copyright 2025 The Forgejo Authors.
+// SPDX-License-Identifier: GPL-3.0-or-later
 
 package v1_23 //nolint
 
 import (
-	"fmt"
-
 	"code.gitea.io/gitea/models/migrations/base"
 
 	"xorm.io/xorm"
+	"xorm.io/xorm/schemas"
 )
 
 func GiteaLastDrop(x *xorm.Engine) error {
+	tables, err := x.DBMetas()
+	if err != nil {
+		return err
+	}
+
 	sess := x.NewSession()
 	defer sess.Close()
 
 	for _, drop := range []struct {
-		table string
-		field string
+		table  string
+		column string
 	}{
 		{"badge", "slug"},
 		{"oauth2_application", "skip_secondary_authorization"},
@@ -29,10 +33,25 @@ func GiteaLastDrop(x *xorm.Engine) error {
 		{"protected_branch", "force_push_allowlist_team_i_ds"},
 		{"protected_branch", "force_push_allowlist_deploy_keys"},
 	} {
-		if _, err := sess.Exec(fmt.Sprintf("SELECT `%s` FROM `%s` WHERE 0 = 1", drop.field, drop.table)); err != nil {
+		var table *schemas.Table
+		found := false
+
+		for _, table = range tables {
+			if table.Name == drop.table {
+				found = true
+				break
+			}
+		}
+
+		if !found {
 			continue
 		}
-		if err := base.DropTableColumns(sess, drop.table, drop.field); err != nil {
+
+		if table.GetColumn(drop.column) == nil {
+			continue
+		}
+
+		if err := base.DropTableColumns(sess, drop.table, drop.column); err != nil {
 			return err
 		}
 	}
diff --git a/models/migrations/v1_23/v303_test.go b/models/migrations/v1_23/v303_test.go
new file mode 100644
index 0000000000..752eacee0c
--- /dev/null
+++ b/models/migrations/v1_23/v303_test.go
@@ -0,0 +1,41 @@
+// Copyright 2025 The Forgejo Authors.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_23 //nolint
+
+import (
+	"testing"
+
+	migration_tests "code.gitea.io/gitea/models/migrations/test"
+
+	"github.com/stretchr/testify/require"
+	"xorm.io/xorm/schemas"
+)
+
+func Test_GiteaLastDrop(t *testing.T) {
+	type Badge struct {
+		ID   int64 `xorm:"pk autoincr"`
+		Slug string
+	}
+
+	x, deferable := migration_tests.PrepareTestEnv(t, 0, new(Badge))
+	defer deferable()
+	if x == nil || t.Failed() {
+		return
+	}
+
+	getColumn := func() *schemas.Column {
+		tables, err := x.DBMetas()
+		require.NoError(t, err)
+		require.Len(t, tables, 1)
+		table := tables[0]
+		require.Equal(t, "badge", table.Name)
+		return table.GetColumn("slug")
+	}
+
+	require.NotNil(t, getColumn(), "slug column exists")
+	require.NoError(t, GiteaLastDrop(x))
+	require.Nil(t, getColumn(), "slug column was deleted")
+	// idempotent
+	require.NoError(t, GiteaLastDrop(x))
+}

From 6d0bf55f0501e6c82671c8b746908b19f33462e5 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 17 Jan 2025 20:48:35 +0000
Subject: [PATCH 004/125] [v10.0/forgejo] fix: Reset content of comment edit
 field on cancel (#6601)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6595

Currently, the content of the text field is not reset when you cancel editing. This change resets the content of the text field when editing is canceled.

If this is not done and you click on cancel and then on edit again, you can no longer return to the initial content without completely reloading the page.

Co-authored-by: Beowulf <beowulf@beocode.eu>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6601
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 tests/e2e/issue-comment.test.e2e.ts | 21 +++++++++++++++++++++
 web_src/js/features/repo-legacy.js  |  1 +
 2 files changed, 22 insertions(+)

diff --git a/tests/e2e/issue-comment.test.e2e.ts b/tests/e2e/issue-comment.test.e2e.ts
index 933e65fa32..1c19f98c48 100644
--- a/tests/e2e/issue-comment.test.e2e.ts
+++ b/tests/e2e/issue-comment.test.e2e.ts
@@ -77,6 +77,27 @@ test('Always focus edit tab first on edit', async ({page}) => {
   await save_visual(page);
 });
 
+test('Reset content of comment edit field on cancel', async ({page}) => {
+  const response = await page.goto('/user2/repo1/issues/1');
+  expect(response?.status()).toBe(200);
+
+  const editorTextarea = page.locator('[id="_combo_markdown_editor_1"]');
+
+  // Change the content of the edit field
+  await page.click('#issue-1 .comment-container .context-menu');
+  await page.click('#issue-1 .comment-container .menu>.edit-content');
+  await expect(editorTextarea).toHaveValue('content for the first issue');
+  await editorTextarea.fill('some random string');
+  await expect(editorTextarea).toHaveValue('some random string');
+  await page.click('#issue-1 .comment-container .edit .cancel');
+
+  // Edit again and assert that the edit field should be reset to the initial content
+  await page.click('#issue-1 .comment-container .context-menu');
+  await page.click('#issue-1 .comment-container .menu>.edit-content');
+  await expect(editorTextarea).toHaveValue('content for the first issue');
+  await save_visual(page);
+});
+
 test('Quote reply', async ({page}, workerInfo) => {
   test.skip(workerInfo.project.name !== 'firefox', 'Uses Firefox specific selection quirks');
   const response = await page.goto('/user2/repo1/issues/1');
diff --git a/web_src/js/features/repo-legacy.js b/web_src/js/features/repo-legacy.js
index a4606aa3b5..7ce464c970 100644
--- a/web_src/js/features/repo-legacy.js
+++ b/web_src/js/features/repo-legacy.js
@@ -404,6 +404,7 @@ async function onEditContent(event) {
     e.preventDefault();
     showElem(renderContent);
     hideElem(editContentZone);
+    comboMarkdownEditor.value(rawContent.textContent);
     comboMarkdownEditor.attachedDropzoneInst?.emit('reload');
   };
 

From 28db11f2e79b8d03e27a00b460d860034b9af9b4 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Sat, 18 Jan 2025 19:43:08 +0000
Subject: [PATCH 005/125] [v10.0/forgejo] fix(ui): hide git note add button for
 commit if commit already has a note (#6614)

Backport: https://codeberg.org/forgejo/forgejo/pulls/6613

Regression from f5c0570533b0a835a88eb7337da841d071f2de6b

Co-authored-by: Beowulf <beowulf@beocode.eu>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6614
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 templates/repo/commit_page.tmpl | 8 +++++---
 tests/e2e/git-notes.test.e2e.ts | 3 +++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/templates/repo/commit_page.tmpl b/templates/repo/commit_page.tmpl
index 66be0c143d..36de789dd1 100644
--- a/templates/repo/commit_page.tmpl
+++ b/templates/repo/commit_page.tmpl
@@ -128,9 +128,11 @@
 											</form>
 										</div>
 									</div>
-									<div id="commit-notes-add-button" class="item">
-										{{ctx.Locale.Tr "repo.diff.git-notes.add"}}
-									</div>
+									{{if not .NoteRendered}}
+										<div id="commit-notes-add-button" class="item">
+											{{ctx.Locale.Tr "repo.diff.git-notes.add"}}
+										</div>
+									{{end}}
 								</div>
 							</div>
 						{{end}}
diff --git a/tests/e2e/git-notes.test.e2e.ts b/tests/e2e/git-notes.test.e2e.ts
index 4245853b24..1e2cbe76fc 100644
--- a/tests/e2e/git-notes.test.e2e.ts
+++ b/tests/e2e/git-notes.test.e2e.ts
@@ -8,6 +8,9 @@ test('Change git note', async ({page}) => {
   let response = await page.goto('/user2/repo1/commit/65f1bf27bc3bf70f64657658635e66094edbcb4d');
   expect(response?.status()).toBe(200);
 
+  // An add button should not be present, because the commit already has a commit note
+  await expect(page.locator('#commit-notes-add-button')).toHaveCount(0);
+
   await page.locator('#commit-notes-edit-button').click();
 
   let textarea = page.locator('textarea[name="notes"]');

From 627634a76ea6520dfdc393f775e10efd34fa91f0 Mon Sep 17 00:00:00 2001
From: Beowulf <beowulf@beocode.eu>
Date: Fri, 17 Jan 2025 18:22:43 +0100
Subject: [PATCH 006/125] Prevent prefix continuation if currently a text
 expander popup is open

This fixes that mentions and emoji autocompletion was broken in e.g. a
list, because the list handling take presidency over the text expansion.

(cherry picked from commit 276ef10dd5a1167a8bcc20599197f89ff7f9b8a4)
---
 tests/e2e/markdown-editor.test.e2e.ts         | 26 +++++++++++++++++++
 .../js/features/comp/ComboMarkdownEditor.js   |  2 ++
 2 files changed, 28 insertions(+)

diff --git a/tests/e2e/markdown-editor.test.e2e.ts b/tests/e2e/markdown-editor.test.e2e.ts
index 762113d563..1e30b8d3b9 100644
--- a/tests/e2e/markdown-editor.test.e2e.ts
+++ b/tests/e2e/markdown-editor.test.e2e.ts
@@ -224,3 +224,29 @@ test('markdown insert table', async ({page}) => {
   await expect(textarea).toHaveValue('| Header  | Header  |\n|---------|---------|\n| Content | Content |\n| Content | Content |\n| Content | Content |\n');
   await save_visual(page);
 });
+
+test('text expander has higher prio then prefix continuation', async ({page}) => {
+  const response = await page.goto('/user2/repo1/issues/new');
+  expect(response?.status()).toBe(200);
+
+  const textarea = page.locator('textarea[name=content]');
+  const initText = `* first`;
+  await textarea.fill(initText);
+  await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.indexOf('rst'), it.value.indexOf('rst')));
+  await textarea.press('End');
+
+  // Test emoji completion
+  await textarea.press('Enter');
+  await textarea.pressSequentially(':smile_c');
+  await textarea.press('Enter');
+  await expect(textarea).toHaveValue(`* first\n* 😸`);
+
+  // Test username completion
+  await textarea.press('Enter');
+  await textarea.pressSequentially('@user');
+  await textarea.press('Enter');
+  await expect(textarea).toHaveValue(`* first\n* 😸\n* @user2 `);
+
+  await textarea.press('Enter');
+  await expect(textarea).toHaveValue(`* first\n* 😸\n* @user2 \n* `);
+});
diff --git a/web_src/js/features/comp/ComboMarkdownEditor.js b/web_src/js/features/comp/ComboMarkdownEditor.js
index 8ae5defa47..707101190c 100644
--- a/web_src/js/features/comp/ComboMarkdownEditor.js
+++ b/web_src/js/features/comp/ComboMarkdownEditor.js
@@ -99,6 +99,8 @@ class ComboMarkdownEditor {
         e.target._shiftDown = true;
       }
       if (e.key === 'Enter' && !e.shiftKey && !e.ctrlKey && !e.altKey) {
+        // Prevent special line break handling if currently a text expander popup is open
+        if (this.textarea.hasAttribute('aria-expanded')) return;
         if (!this.breakLine()) return; // Nothing changed, let the default handler work.
         this.options?.onContentChanged?.(this, e);
         e.preventDefault();

From 348e0e1face01e952b59bdefc28ac48fdcf07d19 Mon Sep 17 00:00:00 2001
From: Beowulf <beowulf@beocode.eu>
Date: Fri, 17 Jan 2025 18:42:42 +0100
Subject: [PATCH 007/125] Leave list/quote expanison with double enter

When editing a list or similar syntax elements, pressing enter starts a
new line with the line introducer (e.g. `- ` for a plain list).
But currently it's uncomfortable when someone wants to leave the list.
Pressing enter again simply adds more and more lines with the prefix.

With this change the list is terminated if enter is pressed on a line
which contains the introducer but nothing else. This behavior is known
from other markdown editors like the on used by GitLab or GitHub.

Additionally I changed the regex for detecting a prefix.
- Why: With the change you can add a single whitespace at the end if you
  want to keep an "empty" line. So if you want to write:
  ```
  - First
  -
  - Third
  ```
  You just need to add a whitespace in the second line to prevent that
  the prefix will be removed.
- Changes in detail:
  - ordered bullet list prefix detection:
    nothing changed
  - todo list and unordered list prefix detection:
    have been split up:
    - todo list: Changed that only 1 to 4 whitespaces can be between the
      list char (`-`,`*`,`+`) and the checkbox (`[ ]`,`[x]`) - Why? If
      more then 4 spaces are between the list char and the checkbox,
      this is no longer detected as a prefix for a todo item based on
      the markdown standard. Due to the amount of spaces it is instead
      parsed as code.
    - unordered list: The prefix now needs to have exactly one space
      after the list char (`-`,`*`,`+`). More spaces will not be taken
      into account for detecting the prefix.
  - quote prefix detection:
    nothing changed

The current e2e-tests where simplified and duplicated tests where
removed. Test cases for the new functionality where added.

(cherry picked from commit 7ea62c5ce475db81f2930a569c98190a52e6cae6)
---
 tests/e2e/markdown-editor.test.e2e.ts         | 51 +++++++++----------
 .../js/features/comp/ComboMarkdownEditor.js   | 22 ++++++--
 2 files changed, 43 insertions(+), 30 deletions(-)

diff --git a/tests/e2e/markdown-editor.test.e2e.ts b/tests/e2e/markdown-editor.test.e2e.ts
index 1e30b8d3b9..35e9de2ea6 100644
--- a/tests/e2e/markdown-editor.test.e2e.ts
+++ b/tests/e2e/markdown-editor.test.e2e.ts
@@ -109,7 +109,7 @@ test('markdown indentation', async ({page}) => {
 });
 
 test('markdown list continuation', async ({page}) => {
-  const initText = `* first\n* second\n* third\n* last`;
+  const initText = `* first\n* second`;
 
   const response = await page.goto('/user2/repo1/issues/new');
   expect(response?.status()).toBe(200);
@@ -119,25 +119,20 @@ test('markdown list continuation', async ({page}) => {
   const indent = page.locator('button[data-md-action="indent"]');
   await textarea.fill(initText);
 
-  // Test continuation of '* ' prefix
-  await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.indexOf('cond'), it.value.indexOf('cond')));
+  // Test continuation of '    * ' prefix
+  await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.indexOf('rst'), it.value.indexOf('rst')));
+  await indent.click();
   await textarea.press('End');
   await textarea.press('Enter');
-  await textarea.pressSequentially('middle');
-  await expect(textarea).toHaveValue(`* first\n* second\n* middle\n* third\n* last`);
-
-  // Test continuation of '    * ' prefix
-  await indent.click();
-  await textarea.press('Enter');
   await textarea.pressSequentially('muddle');
-  await expect(textarea).toHaveValue(`* first\n* second\n${tab}* middle\n${tab}* muddle\n* third\n* last`);
+  await expect(textarea).toHaveValue(`${tab}* first\n${tab}* muddle\n* second`);
 
   // Test breaking in the middle of a line
   await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.lastIndexOf('ddle'), it.value.lastIndexOf('ddle')));
   await textarea.pressSequentially('tate');
   await textarea.press('Enter');
   await textarea.pressSequentially('me');
-  await expect(textarea).toHaveValue(`* first\n* second\n${tab}* middle\n${tab}* mutate\n${tab}* meddle\n* third\n* last`);
+  await expect(textarea).toHaveValue(`${tab}* first\n${tab}* mutate\n${tab}* meddle\n* second`);
 
   // Test not triggering when Shift held
   await textarea.fill(initText);
@@ -145,35 +140,36 @@ test('markdown list continuation', async ({page}) => {
   await textarea.press('Shift+Enter');
   await textarea.press('Enter');
   await textarea.pressSequentially('...but not least');
-  await expect(textarea).toHaveValue(`* first\n* second\n* third\n* last\n\n...but not least`);
+  await expect(textarea).toHaveValue(`* first\n* second\n\n...but not least`);
 
   // Test continuation of ordered list
-  await textarea.fill(`1. one\n2. two`);
+  await textarea.fill(`1. one`);
   await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.length, it.value.length));
   await textarea.press('Enter');
+  await textarea.pressSequentially(' ');
+  await textarea.press('Enter');
   await textarea.pressSequentially('three');
-  await expect(textarea).toHaveValue(`1. one\n2. two\n3. three`);
+  await textarea.press('Enter');
+  await textarea.press('Enter');
+  await expect(textarea).toHaveValue(`1. one\n2.  \n3. three\n\n`);
 
   // Test continuation of alternative ordered list syntax
-  await textarea.fill(`1) one\n2) two`);
+  await textarea.fill(`1) one`);
   await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.length, it.value.length));
   await textarea.press('Enter');
+  await textarea.pressSequentially(' ');
+  await textarea.press('Enter');
   await textarea.pressSequentially('three');
-  await expect(textarea).toHaveValue(`1) one\n2) two\n3) three`);
-
-  // Test continuation of blockquote
-  await textarea.fill(`> knowledge is power`);
-  await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.length, it.value.length));
   await textarea.press('Enter');
-  await textarea.pressSequentially('france is bacon');
-  await expect(textarea).toHaveValue(`> knowledge is power\n> france is bacon`);
+  await textarea.press('Enter');
+  await expect(textarea).toHaveValue(`1) one\n2)  \n3) three\n\n`);
 
   // Test continuation of checklists
-  await textarea.fill(`- [ ] have a problem\n- [x] create a solution`);
+  await textarea.fill(`- [ ]have a problem\n- [x]create a solution`);
   await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.length, it.value.length));
   await textarea.press('Enter');
   await textarea.pressSequentially('write a test');
-  await expect(textarea).toHaveValue(`- [ ] have a problem\n- [x] create a solution\n- [ ] write a test`);
+  await expect(textarea).toHaveValue(`- [ ]have a problem\n- [x]create a solution\n- [ ]write a test`);
 
   // Test all conceivable syntax (except ordered lists)
   const prefixes = [
@@ -189,7 +185,6 @@ test('markdown list continuation', async ({page}) => {
     '> ',
     '> > ',
     '- [ ] ',
-    '- [ ]', // This does seem to render, so allow.
     '* [ ] ',
     '+ [ ] ',
   ];
@@ -197,8 +192,12 @@ test('markdown list continuation', async ({page}) => {
     await textarea.fill(`${prefix}one`);
     await textarea.evaluate((it:HTMLTextAreaElement) => it.setSelectionRange(it.value.length, it.value.length));
     await textarea.press('Enter');
+    await textarea.pressSequentially(' ');
+    await textarea.press('Enter');
     await textarea.pressSequentially('two');
-    await expect(textarea).toHaveValue(`${prefix}one\n${prefix}two`);
+    await textarea.press('Enter');
+    await textarea.press('Enter');
+    await expect(textarea).toHaveValue(`${prefix}one\n${prefix} \n${prefix}two\n\n`);
   }
 });
 
diff --git a/web_src/js/features/comp/ComboMarkdownEditor.js b/web_src/js/features/comp/ComboMarkdownEditor.js
index 707101190c..89a252f6f3 100644
--- a/web_src/js/features/comp/ComboMarkdownEditor.js
+++ b/web_src/js/features/comp/ComboMarkdownEditor.js
@@ -409,13 +409,27 @@ class ComboMarkdownEditor {
     // Find the beginning of the current line.
     const lineStart = Math.max(0, value.lastIndexOf('\n', start - 1) + 1);
     // Find the end and extract the line.
-    const lineEnd = value.indexOf('\n', start);
-    const line = value.slice(lineStart, lineEnd === -1 ? value.length : lineEnd);
+    const nextLF = value.indexOf('\n', start);
+    const lineEnd = nextLF === -1 ? value.length : nextLF;
+    const line = value.slice(lineStart, lineEnd);
     // Match any whitespace at the start + any repeatable prefix + exactly one space after.
-    const prefix = line.match(/^\s*((\d+)[.)]\s|[-*+]\s+(\[[ x]\]\s?)?|(>\s+)+)?/);
+    const prefix = line.match(/^\s*((\d+)[.)]\s|[-*+]\s{1,4}\[[ x]\]\s?|[-*+]\s|(>\s?)+)?/);
 
     // Defer to browser if we can't do anything more useful, or if the cursor is inside the prefix.
-    if (!prefix || !prefix[0].length || lineStart + prefix[0].length > start) return false;
+    if (!prefix) return false;
+    const prefixLength = prefix[0].length;
+    if (!prefixLength || lineStart + prefixLength > start) return false;
+    // If the prefix is just indentation (which should always be an even number of spaces or tabs), check if a single whitespace is added to the end of the line.
+    // If this is the case do not leave the indentation and continue with the prefix.
+    if ((prefixLength % 2 === 1 && /^ +$/.test(prefix[0])) || /^\t+ $/.test(prefix[0])) {
+      prefix[0] = prefix[0].slice(0, prefixLength - 1);
+    } else if (prefixLength === lineEnd - lineStart) {
+      this.textarea.setSelectionRange(lineStart, lineEnd);
+      if (!document.execCommand('insertText', false, '\n')) {
+        this.textarea.setRangeText('\n');
+      }
+      return true;
+    }
 
     // Insert newline + prefix.
     let text = `\n${prefix[0]}`;

From 6020be2c8a88e27c052fc4dfbce37d985bd34416 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 22 Nov 2024 16:38:23 +0100
Subject: [PATCH 008/125] Run testing workflow unconditionally

---
 .forgejo/workflows/testing.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index eb3163d3ae..3d8ad443da 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -10,7 +10,6 @@ on:
 
 jobs:
   backend-checks:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     container:
       image: 'data.forgejo.org/oci/node:20-bookworm'
@@ -27,7 +26,6 @@ jobs:
       - run: su forgejo -c 'make --always-make -j$(nproc) lint-backend tidy-check swagger-check fmt-check swagger-validate' # ensure the "go-licenses" make target runs
       - uses: ./.forgejo/workflows-composite/build-backend
   frontend-checks:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     container:
       image: 'data.forgejo.org/oci/node:20-bookworm'
@@ -176,7 +174,6 @@ jobs:
           TAGS: bindata
           TEST_REDIS_SERVER: cacher:${{ matrix.cacher.port }}
   test-mysql:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs: [backend-checks, frontend-checks]
     container:
@@ -207,7 +204,6 @@ jobs:
         env:
           USE_REPO_TEST_DIR: 1
   test-pgsql:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs: [backend-checks, frontend-checks]
     container:
@@ -246,7 +242,6 @@ jobs:
           USE_REPO_TEST_DIR: 1
           TEST_LDAP: 1
   test-sqlite:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs: [backend-checks, frontend-checks]
     container:
@@ -269,14 +264,11 @@ jobs:
           TEST_TAGS: sqlite sqlite_unlock_notify
           USE_REPO_TEST_DIR: 1
   security-check:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs:
       - test-sqlite
       - test-pgsql
       - test-mysql
-      - test-remote-cacher
-      - test-unit
     container:
       image: 'data.forgejo.org/oci/node:20-bookworm'
       options: --tmpfs /tmp:exec,noatime

From b3f62a9af2248ad1e02eab9db68374cc90171ece Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 30 Apr 2024 12:33:18 +0200
Subject: [PATCH 009/125] Fix name in package-lock.json

The frontend-checks job started failing because the declared name does
not match the repository name.
---
 package-lock.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package-lock.json b/package-lock.json
index e081796a52..c5f1950e59 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,5 +1,5 @@
 {
-  "name": "forgejo",
+  "name": "forgejo-aneksajo",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

From d1788bd26743cd613d8cb597913a8bb5847937d3 Mon Sep 17 00:00:00 2001
From: Nick Guenther <nick.guenther@polymtl.ca>
Date: Sat, 30 Jul 2022 21:45:03 -0400
Subject: [PATCH 010/125] git-annex support

[git-annex](https://git-annex.branchable.com/) is a more complicated cousin to
git-lfs, storing large files in an optional-download side content.  Unlike lfs,
it allows mixing and matching storage remotes, so the content remote(s) doesn't
need to be on the same server as the git remote, making it feasible to scatter
a collection across cloud storage, old harddrives, or anywhere else storage can
be scavenged.  Since this can get complicated, fast, it has a content-tracking
database (`git annex whereis`) to help find everything later.

The use-case we imagine for including it in Gitea is just the simple case, where
we're primarily emulating git-lfs: each repo has its large content at the same URL.

Our motivation is so we can self-host https://www.datalad.org/ datasets, which
currently are only hostable by fragilely scrounging together cloud storage --
and having to manage all the credentials associated with all the pieces -- or at
https://openneuro.org which is fragile in its own ways.

Supporting git-annex also allows multiple Gitea instance to be annex remotes for
each other, mirroring the content or otherwise collaborating the split up the
hosting costs.

Enabling
--------

TODO

HTTP
----

TODO

Permission Checking
-------------------

This tweaks the API in routers/private/serv.go to expose the calling user's
computed permission, instead of just returning HTTP 403.

This doesn't fit in super well. It's the opposite from how the git-lfs support is
done, where there's a complete list of possible subcommands and their matching
permission levels, and then the API compares the requested with the actual level
and returns HTTP 403 if the check fails.

But it's necessary. The main git-annex verbs, 'git-annex-shell configlist' and
'git-annex-shell p2pstdio' are both either read-only or read-write operations,
depending on the state on disk on either end of the connection and what the user
asked it to ask for, with no way to know before git-annex examines the situation.
So tell the level via GIT_ANNEX_READONLY and trust it to handle itself.

In the older Gogs version, the permission was directly read in cmd/serv.go:

```
mode, err = db.UserAccessMode(user.ID, repo)
```
- https://github.com/G-Node/gogs/blob/966e925cf320beff768b192276774d9265706df5/internal/cmd/serv.go#L334

but in Gitea permission enforcement has been centralized in the API layer.
(perhaps so the cmd layer can avoid making direct DB connections?)

Deletion
--------

git-annex has this "lockdown" feature where it tries
really quite very hard to prevent you deleting its
data, to the point that even an rm -rf won't do it:
each file in annex/objects/ is nested inside a
folder with read-only permissions.

The recommended workaround is to run chmod -R +w when
you're sure you actually want to delete a repo. See
https://git-annex.branchable.com/internals/lockdown

So we edit util.RemoveAll() to do just that, so now
it's `chmod -R +w && rm -rf` instead of just `rm -rf`.
---
 cmd/serv.go             | 72 ++++++++++++++++++++++++++++++++++++++---
 modules/private/serv.go |  1 +
 modules/util/remove.go  | 34 ++++++++++++++++++-
 routers/private/serv.go | 12 +++++--
 4 files changed, 110 insertions(+), 9 deletions(-)

diff --git a/cmd/serv.go b/cmd/serv.go
index db67e36fa3..7d16547053 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -38,6 +38,7 @@ import (
 
 const (
 	lfsAuthenticateVerb = "git-lfs-authenticate"
+	gitAnnexShellVerb   = "git-annex-shell"
 )
 
 // CmdServ represents the available serv sub-command.
@@ -79,6 +80,7 @@ var (
 		"git-upload-archive": perm.AccessModeRead,
 		"git-receive-pack":   perm.AccessModeWrite,
 		lfsAuthenticateVerb:  perm.AccessModeNone,
+		gitAnnexShellVerb:    perm.AccessModeNone, // annex permissions are enforced by GIT_ANNEX_SHELL_READONLY, rather than the Gitea API
 	}
 	alphaDashDotPattern = regexp.MustCompile(`[^\w-\.]`)
 )
@@ -212,6 +214,29 @@ func runServ(c *cli.Context) error {
 		}
 	}
 
+	if verb == gitAnnexShellVerb {
+		// if !setting.Annex.Enabled { // TODO: https://github.com/neuropoly/gitea/issues/8
+		if false {
+			return fail(ctx, "Unknown git command", "git-annex request over SSH denied, git-annex support is disabled")
+		}
+
+		if len(words) < 3 {
+			return fail(ctx, "Too few arguments", "Too few arguments in cmd: %s", cmd)
+		}
+
+		// git-annex always puts the repo in words[2], unlike most other
+		// git subcommands; and it sometimes names repos like /~/, as if
+		// $HOME should get expanded while also being rooted. e.g.:
+		//   git-annex-shell 'configlist' '/~/user/repo'
+		//   git-annex-shell 'sendkey' '/user/repo 'key'
+		repoPath = words[2]
+		repoPath = strings.TrimPrefix(repoPath, "/")
+		repoPath = strings.TrimPrefix(repoPath, "~/")
+	}
+
+	// prevent directory traversal attacks
+	repoPath = filepath.Clean("/" + repoPath)[1:]
+
 	rr := strings.SplitN(repoPath, "/", 2)
 	if len(rr) != 2 {
 		return fail(ctx, "Invalid repository path", "Invalid repository path: %v", repoPath)
@@ -225,6 +250,18 @@ func runServ(c *cli.Context) error {
 	// so that username and reponame are not affected.
 	repoPath = strings.ToLower(strings.TrimSpace(repoPath))
 
+	// put the sanitized repoPath back into the argument list for later
+	if verb == gitAnnexShellVerb {
+		// git-annex-shell demands an absolute path
+		absRepoPath, err := filepath.Abs(filepath.Join(setting.RepoRootPath, repoPath))
+		if err != nil {
+			return fail(ctx, "Error locating repoPath", "%v", err)
+		}
+		words[2] = absRepoPath
+	} else {
+		words[1] = repoPath
+	}
+
 	if alphaDashDotPattern.MatchString(reponame) {
 		return fail(ctx, "Invalid repo name", "Invalid repo name: %s", reponame)
 	}
@@ -303,21 +340,46 @@ func runServ(c *cli.Context) error {
 		return nil
 	}
 
-	var gitcmd *exec.Cmd
 	gitBinPath := filepath.Dir(git.GitExecutable) // e.g. /usr/bin
 	gitBinVerb := filepath.Join(gitBinPath, verb) // e.g. /usr/bin/git-upload-pack
 	if _, err := os.Stat(gitBinVerb); err != nil {
 		// if the command "git-upload-pack" doesn't exist, try to split "git-upload-pack" to use the sub-command with git
 		// ps: Windows only has "git.exe" in the bin path, so Windows always uses this way
+		// ps: git-annex-shell and other extensions may not necessarily be in gitBinPath,
+		//     but '{gitBinPath}/git annex-shell' should be able to find them on $PATH.
 		verbFields := strings.SplitN(verb, "-", 2)
 		if len(verbFields) == 2 {
 			// use git binary with the sub-command part: "C:\...\bin\git.exe", "upload-pack", ...
-			gitcmd = exec.CommandContext(ctx, git.GitExecutable, verbFields[1], repoPath)
+			gitBinVerb = git.GitExecutable
+			words = append([]string{verbFields[1]}, words...)
 		}
 	}
-	if gitcmd == nil {
-		// by default, use the verb (it has been checked above by allowedCommands)
-		gitcmd = exec.CommandContext(ctx, gitBinVerb, repoPath)
+
+	// by default, use the verb (it has been checked above by allowedCommands)
+	gitcmd := exec.CommandContext(ctx, gitBinVerb, words[1:]...)
+
+	if verb == gitAnnexShellVerb {
+		// This doesn't get its own isolated section like LFS does, because LFS
+		// is handled by internal Gitea routines, but git-annex has to be shelled out
+		// to like other git subcommands, so we need to build up gitcmd.
+
+		// TODO: does this work on Windows?
+		gitcmd.Env = append(gitcmd.Env,
+			// "If set, disallows running git-shell to handle unknown commands."
+			// - git-annex-shell(1)
+			"GIT_ANNEX_SHELL_LIMITED=True",
+			// "If set, git-annex-shell will refuse to run commands
+			//  that do not operate on the specified directory."
+			// - git-annex-shell(1)
+			fmt.Sprintf("GIT_ANNEX_SHELL_DIRECTORY=%s", words[2]),
+		)
+		if results.UserMode < perm.AccessModeWrite {
+			// "If set, disallows any action that could modify the git-annex repository."
+			// - git-annex-shell(1)
+			// We set this when the backend API has told us that we don't have write permission to this repo.
+			log.Debug("Setting GIT_ANNEX_SHELL_READONLY=True")
+			gitcmd.Env = append(gitcmd.Env, "GIT_ANNEX_SHELL_READONLY=True")
+		}
 	}
 
 	process.SetSysProcAttribute(gitcmd)
diff --git a/modules/private/serv.go b/modules/private/serv.go
index 480a446954..6c7c753cf0 100644
--- a/modules/private/serv.go
+++ b/modules/private/serv.go
@@ -40,6 +40,7 @@ type ServCommandResults struct {
 	UserName    string
 	UserEmail   string
 	UserID      int64
+	UserMode    perm.AccessMode
 	OwnerName   string
 	RepoName    string
 	RepoID      int64
diff --git a/modules/util/remove.go b/modules/util/remove.go
index d1e38faf5f..0f41471fcc 100644
--- a/modules/util/remove.go
+++ b/modules/util/remove.go
@@ -4,7 +4,9 @@
 package util
 
 import (
+	"io/fs"
 	"os"
+	"path/filepath"
 	"runtime"
 	"syscall"
 	"time"
@@ -41,10 +43,40 @@ func Remove(name string) error {
 	return err
 }
 
-// RemoveAll removes the named file or (empty) directory with at most 5 attempts.
+// RemoveAll removes the named file or directory with at most 5 attempts.
 func RemoveAll(name string) error {
 	var err error
+
 	for i := 0; i < 5; i++ {
+		// Do chmod -R +w to help ensure the removal succeeds.
+		// In particular, in the git-annex case, this handles
+		// https://git-annex.branchable.com/internals/lockdown/ :
+		//
+		// > (The only bad consequence of this is that rm -rf .git
+		// > doesn't work unless you first run chmod -R +w .git)
+
+		err = filepath.WalkDir(name, func(path string, d fs.DirEntry, err error) error {
+			// NB: this is called WalkDir but it works on a single file too
+			if err == nil {
+				info, err := d.Info()
+				if err != nil {
+					return err
+				}
+
+				// 0200 == u+w, in octal unix permission notation
+				err = os.Chmod(path, info.Mode()|0o200)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			// try again
+			<-time.After(100 * time.Millisecond)
+			continue
+		}
+
 		err = os.RemoveAll(name)
 		if err == nil {
 			break
diff --git a/routers/private/serv.go b/routers/private/serv.go
index ef3920d359..b42fbc04f4 100644
--- a/routers/private/serv.go
+++ b/routers/private/serv.go
@@ -81,12 +81,14 @@ func ServCommand(ctx *context.PrivateContext) {
 	ownerName := ctx.Params(":owner")
 	repoName := ctx.Params(":repo")
 	mode := perm.AccessMode(ctx.FormInt("mode"))
+	verbs := ctx.FormStrings("verb")
 
 	// Set the basic parts of the results to return
 	results := private.ServCommandResults{
 		RepoName:  repoName,
 		OwnerName: ownerName,
 		KeyID:     keyID,
+		UserMode:  perm.AccessModeNone,
 	}
 
 	// Now because we're not translating things properly let's just default some English strings here
@@ -287,8 +289,10 @@ func ServCommand(ctx *context.PrivateContext) {
 			repo.IsPrivate ||
 			owner.Visibility.IsPrivate() ||
 			(user != nil && user.IsRestricted) || // user will be nil if the key is a deploykey
+			( /*setting.Annex.Enabled && */ len(verbs) > 0 && verbs[0] == "git-annex-shell") || // git-annex has its own permission enforcement, for which we expose results.UserMode
 			setting.Service.RequireSignInView) {
 		if key.Type == asymkey_model.KeyTypeDeploy {
+			results.UserMode = deployKey.Mode
 			if deployKey.Mode < mode {
 				ctx.JSON(http.StatusUnauthorized, private.Response{
 					UserMsg: fmt.Sprintf("Deploy Key: %d:%s is not authorized to %s %s/%s.", key.ID, key.Name, modeString, results.OwnerName, results.RepoName),
@@ -310,9 +314,9 @@ func ServCommand(ctx *context.PrivateContext) {
 				return
 			}
 
-			userMode := perm.UnitAccessMode(unitType)
+			results.UserMode = perm.UnitAccessMode(unitType)
 
-			if userMode < mode {
+			if results.UserMode < mode {
 				log.Warn("Failed authentication attempt for %s with key %s (not authorized to %s %s/%s) from %s", user.Name, key.Name, modeString, ownerName, repoName, ctx.RemoteAddr())
 				ctx.JSON(http.StatusUnauthorized, private.Response{
 					UserMsg: fmt.Sprintf("User: %d:%s with Key: %d:%s is not authorized to %s %s/%s.", user.ID, user.Name, key.ID, key.Name, modeString, ownerName, repoName),
@@ -353,6 +357,7 @@ func ServCommand(ctx *context.PrivateContext) {
 			})
 			return
 		}
+		results.UserMode = perm.AccessModeWrite
 		results.RepoID = repo.ID
 	}
 
@@ -381,13 +386,14 @@ func ServCommand(ctx *context.PrivateContext) {
 			return
 		}
 	}
-	log.Debug("Serv Results:\nIsWiki: %t\nDeployKeyID: %d\nKeyID: %d\tKeyName: %s\nUserName: %s\nUserID: %d\nOwnerName: %s\nRepoName: %s\nRepoID: %d",
+	log.Debug("Serv Results:\nIsWiki: %t\nDeployKeyID: %d\nKeyID: %d\tKeyName: %s\nUserName: %s\nUserID: %d\nUserMode: %d\nOwnerName: %s\nRepoName: %s\nRepoID: %d",
 		results.IsWiki,
 		results.DeployKeyID,
 		results.KeyID,
 		results.KeyName,
 		results.UserName,
 		results.UserID,
+		results.UserMode,
 		results.OwnerName,
 		results.RepoName,
 		results.RepoID)

From 054537989fb738c561d8e37494654a8f81455299 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Mon, 20 Jan 2025 20:28:39 +0000
Subject: [PATCH 011/125] [v10.0/forgejo] fix(ui): prevent overflow of branch
 selector in commit graph (#6636)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6617

Fix that the branch selector in the commit graph can overflow

| Previous | Now |
| :----: | :----: |
| ![grafik](/attachments/ab303490-2abc-46d8-8715-0750886fd111) | ![grafik](/attachments/63f919a9-bcc2-4969-8c8c-d265c1917e07) |
| ![grafik](/attachments/c0e6636f-52eb-4bf0-bf07-0139ec407e33) | ![grafik](/attachments/752aef87-9250-4bf6-b74a-5a1813394dbe) |
| ![grafik](/attachments/e61842dd-29c1-4517-86db-f068de9ff6e8) | ![grafik](/attachments/bf251b43-80fa-4e1a-9fbe-fd27e5f8d195) |

Fixes #6615

Co-authored-by: Beowulf <beowulf@beocode.eu>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6636
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 tests/e2e/repo-commitgraph.test.e2e.ts | 19 ++++++++++++++++++-
 web_src/css/features/gitgraph.css      | 19 +++++++++++++------
 2 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/tests/e2e/repo-commitgraph.test.e2e.ts b/tests/e2e/repo-commitgraph.test.e2e.ts
index 39c5661900..e8b85c5997 100644
--- a/tests/e2e/repo-commitgraph.test.e2e.ts
+++ b/tests/e2e/repo-commitgraph.test.e2e.ts
@@ -8,10 +8,27 @@ import {expect} from '@playwright/test';
 import {save_visual, test} from './utils_e2e.ts';
 
 test('Commit graph overflow', async ({page}) => {
-  await page.goto('/user2/diff-test/graph');
+  const response = await page.goto('/user2/repo1/graph');
+  expect(response?.status()).toBe(200);
+
+  await page.click('#flow-select-refs-dropdown');
+  const input = page.locator('#flow-select-refs-dropdown');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+  await input.press('Enter');
+
+  await expect(page.locator('#flow-select-refs-dropdown')).toBeInViewport({ratio: 1});
   await expect(page.getByRole('button', {name: 'Mono'})).toBeInViewport({ratio: 1});
   await expect(page.getByRole('button', {name: 'Color'})).toBeInViewport({ratio: 1});
   await expect(page.locator('.selection.search.dropdown')).toBeInViewport({ratio: 1});
+  await save_visual(page);
 });
 
 test('Switch branch', async ({page}) => {
diff --git a/web_src/css/features/gitgraph.css b/web_src/css/features/gitgraph.css
index 4da871da61..726ac7e9e2 100644
--- a/web_src/css/features/gitgraph.css
+++ b/web_src/css/features/gitgraph.css
@@ -23,6 +23,18 @@
   #git-graph-heading {
     align-items: center;
   }
+
+  #git-graph-heading-left {
+    margin-right: 1rem;
+  }
+
+  #git-graph-heading h2 {
+    flex-shrink: 0;
+  }
+
+  #git-graph-container #flow-select-refs-dropdown {
+    min-width: 250px;
+  }
 }
 
 @media (max-width: 767.98px) {
@@ -34,15 +46,10 @@
   #git-graph-heading-left {
     margin-bottom: 1rem;
   }
-
-  h2,
-  #flow-select-refs-dropdown {
-    max-width: 100%;
-  }
 }
 
 #git-graph-container #flow-select-refs-dropdown {
-  min-width: 250px;
+  flex-wrap: wrap;
 }
 
 #git-graph-container #flow-select-refs-dropdown .ui.label {

From 7546c4acf35c727e1f4c58e5c602ca1ca79c3afa Mon Sep 17 00:00:00 2001
From: Renovate Bot <forgejo-renovate-action@forgejo.org>
Date: Tue, 21 Jan 2025 09:32:40 +0000
Subject: [PATCH 012/125] Update dependency go to v1.23.5 (v10.0/forgejo)
 (#6644)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.23.4` -> `1.23.5` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - "* 0-3 * * *" (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xMDYuMCIsInVwZGF0ZWRJblZlciI6IjM5LjEwNi4wIiwidGFyZ2V0QnJhbmNoIjoidjEwLjAvZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6644
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index d5f48716ff..19bec3f81f 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module code.gitea.io/gitea
 
 go 1.23
 
-toolchain go1.23.4
+toolchain go1.23.5
 
 require (
 	code.forgejo.org/f3/gof3/v3 v3.10.2

From 5c5e1c87ba4ac6d36fe37c1975056530caa58481 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Tue, 21 Jan 2025 10:40:00 +0000
Subject: [PATCH 013/125] [v10.0/forgejo] fix: listing tokens must not require
 basic auth (#6643)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6633

When the change is reverted, the test fails as follows:

```sh
=== TestAPIGetTokens (tests/integration/api_token_test.go:34)
--- FAIL: TestAPIGetTokens (0.17s)
    testlogger.go:405: 2025/01/20 14:05:22 ...les/storage/local.go:33:NewLocalStorage() [I] Creating new Local Storage at /home/earl-warren/software/forgejo/tests/gitea-lfs-meta
    testlogger.go:405: 2025/01/20 14:05:22 ...eb/routing/logger.go:102:func1() [I] router: completed GET /api/v1/users/user2/tokens for test-mock:12345, 200 OK in 2.5ms @ user/app.go:24(user.ListAccessTokens)
    testlogger.go:405: 2025/01/20 14:05:22 ...eb/routing/logger.go:102:func1() [I] router: completed POST /api/v1/users/user1/tokens for test-mock:12345, 201 Created in 4.7ms @ user/app.go:75(user.CreateAccessToken)
    testlogger.go:405: 2025/01/20 14:05:22 ...eb/routing/logger.go:102:func1() [I] router: completed GET /api/v1/users/user2/tokens for test-mock:12345, 401 Unauthorized in 4.9ms @ v1/api.go:413(v1.Routes.func2.5.1.reqBasicOrRevProxyAuth.6)
    api_token_test.go:46:
        	Error Trace:	/home/earl-warren/software/forgejo/tests/integration/integration_test.go:556
        	            				/home/earl-warren/software/forgejo/tests/integration/api_token_test.go:46
        	Error:      	Not equal:
        	            	expected: 200
        	            	actual  : 401
        	Test:       	TestAPIGetTokens
        	Messages:   	Request: GET /api/v1/users/user2/tokens
    api_token_test.go:46: Response:  {"message":"auth required","url":"http://localhost:3003/api/swagger"}

    testlogger.go:405: 2025/01/20 14:05:22 ...eb/routing/logger.go:102:func1() [I] router: completed DELETE /api/v1/users/user1/tokens/94 for test-mock:12345, 204 No Content in 1.4ms @ user/app.go:145(user.DeleteAccessToken)
```

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/6633): <!--number 6633 --><!--line 0 --><!--description bGlzdGluZyB0b2tlbnMgbXVzdCBub3QgcmVxdWlyZSBiYXNpYyBhdXRo-->listing tokens must not require basic auth<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: Earl Warren <contact@earl-warren.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6643
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 routers/api/v1/api.go               |  6 +++---
 tests/integration/api_token_test.go | 17 +++++++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 4928c9ff58..18ab6ce287 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -907,9 +907,9 @@ func Routes() *web.Route {
 				m.Get("/repos", tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository), reqExploreSignIn(), user.ListUserRepos)
 				m.Group("/tokens", func() {
 					m.Combo("").Get(user.ListAccessTokens).
-						Post(bind(api.CreateAccessTokenOption{}), reqToken(), user.CreateAccessToken)
-					m.Combo("/{id}").Delete(reqToken(), user.DeleteAccessToken)
-				}, reqSelfOrAdmin(), reqBasicOrRevProxyAuth())
+						Post(bind(api.CreateAccessTokenOption{}), reqBasicOrRevProxyAuth(), reqToken(), user.CreateAccessToken)
+					m.Combo("/{id}").Delete(reqBasicOrRevProxyAuth(), reqToken(), user.DeleteAccessToken)
+				}, reqSelfOrAdmin())
 
 				m.Get("/activities/feeds", user.ListUserActivityFeeds)
 			}, context.UserAssignmentAPI(), checkTokenPublicOnly(), individualPermsChecker)
diff --git a/tests/integration/api_token_test.go b/tests/integration/api_token_test.go
index 01d18ef6f1..f94a0986f2 100644
--- a/tests/integration/api_token_test.go
+++ b/tests/integration/api_token_test.go
@@ -30,6 +30,23 @@ func TestAPICreateAndDeleteToken(t *testing.T) {
 	deleteAPIAccessToken(t, newAccessToken, user)
 }
 
+func TestAPIGetTokens(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+
+	// with basic auth...
+	req := NewRequest(t, "GET", "/api/v1/users/user2/tokens").
+		AddBasicAuth(user.Name)
+	MakeRequest(t, req, http.StatusOK)
+
+	// ... or with a token.
+	newAccessToken := createAPIAccessTokenWithoutCleanUp(t, "test-key-1", user, []auth_model.AccessTokenScope{auth_model.AccessTokenScopeAll})
+	req = NewRequest(t, "GET", "/api/v1/users/user2/tokens").
+		AddTokenAuth(newAccessToken.Token)
+	MakeRequest(t, req, http.StatusOK)
+	deleteAPIAccessToken(t, newAccessToken, user)
+}
+
 // TestAPIDeleteMissingToken ensures that error is thrown when token not found
 func TestAPIDeleteMissingToken(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()

From 61e345cd362db4968a2f5b5043e34387207749aa Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Wed, 22 Jan 2025 07:47:34 +0000
Subject: [PATCH 014/125] [v10.0/forgejo] fix: teach the doctor about orphaned
 two_factor rows (#6651)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6639

If a row in the two_factor table references a non existent user, it may contain a secret that has an invalid format. Such an orphaned row is never used and should be removed.

Improve the error message to suggest using the doctor to remove it.

Fixes: https://codeberg.org/forgejo/forgejo/issues/6637

## Testing

- make TAGS='sqlite sqlite_unlock_notify' watch
- make TAGS='sqlite  sqlite_unlock_notify' forgejo
- sqlite3 data/gitea.db 'INSERT INTO two_factor VALUES( 0, 500, "", "", "", "", 0, 0)'
- ./forgejo doctor check --run check-db-consistency
  ```
   [1] Check consistency of database
    - [W] Found 1 Orphaned TwoFactor without existing User
   OK

   All done (checks: 1).
   ```
-  ./forgejo doctor check --run check-db-consistency --fix
   ```
   [1] Check consistency of database
    - [I] Deleted 1 Orphaned TwoFactor without existing User
   OK

   All done (checks: 1).
   ```

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/6651): <!--number 6651 --><!--line 0 --><!--description Zml4OiB0ZWFjaCB0aGUgZG9jdG9yIGFib3V0IG9ycGhhbmVkIHR3b19mYWN0b3Igcm93cw==-->fix: teach the doctor about orphaned two_factor rows<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: Earl Warren <contact@earl-warren.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6651
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 modules/secret/secret.go         | 2 +-
 release-notes/6639.md            | 1 +
 services/doctor/dbconsistency.go | 3 +++
 3 files changed, 5 insertions(+), 1 deletion(-)
 create mode 100644 release-notes/6639.md

diff --git a/modules/secret/secret.go b/modules/secret/secret.go
index e70ae1839c..e3557b91b9 100644
--- a/modules/secret/secret.go
+++ b/modules/secret/secret.go
@@ -47,7 +47,7 @@ func AesDecrypt(key, text []byte) ([]byte, error) {
 	cfb.XORKeyStream(text, text)
 	data, err := base64.StdEncoding.DecodeString(string(text))
 	if err != nil {
-		return nil, fmt.Errorf("AesDecrypt invalid decrypted base64 string: %w", err)
+		return nil, fmt.Errorf("AesDecrypt invalid decrypted base64 string: %w - it can be caused by a change of the [security].SECRET_KEY setting or a database corruption - `forgejo doctor check --run check-db-consistency --fix` will get rid of orphaned rows found in the `two_factor` table and may fix this problem if they are the one with the invalid content", err)
 	}
 	return data, nil
 }
diff --git a/release-notes/6639.md b/release-notes/6639.md
new file mode 100644
index 0000000000..1bc01c12a3
--- /dev/null
+++ b/release-notes/6639.md
@@ -0,0 +1 @@
+Teach the doctor to remove orphaned two_factor with `forgejo doctor check --run check-db-consistency --fix`. Such rows may contain invalid data and [block the migration to v10](https://codeberg.org/forgejo/forgejo/issues/6637) with a message such as `failed: AesDecrypt invalid decrypted base64 string: illegal base64 data at input byte 0`.
diff --git a/services/doctor/dbconsistency.go b/services/doctor/dbconsistency.go
index 80f538d670..9e2fcb645f 100644
--- a/services/doctor/dbconsistency.go
+++ b/services/doctor/dbconsistency.go
@@ -246,6 +246,9 @@ func checkDBConsistency(ctx context.Context, logger log.Logger, autofix bool) er
 		// find authorization tokens without existing user
 		genericOrphanCheck("Authorization token without existing User",
 			"forgejo_auth_token", "user", "forgejo_auth_token.uid=`user`.id"),
+		// find two_factor without existing user
+		genericOrphanCheck("Orphaned TwoFactor without existing User",
+			"two_factor", "user", "`two_factor`.uid=`user`.id"),
 	)
 
 	for _, c := range consistencyChecks {

From eb83b054302b1cfc827f801503764d3c2c8210da Mon Sep 17 00:00:00 2001
From: Earl Warren <contact@earl-warren.org>
Date: Wed, 22 Jan 2025 14:52:04 +0100
Subject: [PATCH 015/125] chore(security): update security.txt with new
 expiration date

Same as https://forgejo.org/.well-known/security.txt

(cherry picked from commit 955f99b6a4f017ad8ff3c311ba234a48065dee51)
---
 public/.well-known/security.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/.well-known/security.txt b/public/.well-known/security.txt
index 2a75a8dcd2..0ac9f09d34 100644
--- a/public/.well-known/security.txt
+++ b/public/.well-known/security.txt
@@ -5,4 +5,4 @@ Policy: https://codeberg.org/forgejo/governance/src/commit/5c07b3801537212ed6be1
 Contact: mailto:security@forgejo.org
 Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/1B638BDF10969D627926B8D9F585D0F99E1FB56F
 Preferred-Languages: en
-Expires: 2025-10-25T00:00:00Z
+Expires: 2026-07-16T23:59:59.000Z

From 553fc3cc42b3d50c1a69c74f3db61b801337cdcf Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 24 Jan 2025 12:25:00 +0000
Subject: [PATCH 016/125] [v10.0/forgejo] fix: load settings for valid user and
 email check (#6678)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6674

- The doctor commands to check the validity of existing usernames and
email addresses depend on functionality that have configurable behavior
depending on the values of the `[service]` settings, so load them when
running the doctor command.
- Resolves #6664
- No unit test due to the architecture of doctor commands.

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6678
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 modules/setting/service.go  | 5 +++++
 services/doctor/breaking.go | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/modules/setting/service.go b/modules/setting/service.go
index 5a6cc254e0..74ed5cd3c9 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -138,6 +138,11 @@ func CompileEmailGlobList(sec ConfigSection, keys ...string) (globs []glob.Glob)
 	return globs
 }
 
+// LoadServiceSetting loads the service settings
+func LoadServiceSetting() {
+	loadServiceFrom(CfgProvider)
+}
+
 func loadServiceFrom(rootCfg ConfigProvider) {
 	sec := rootCfg.Section("service")
 	Service.ActiveCodeLives = sec.Key("ACTIVE_CODE_LIVE_MINUTES").MustInt(180)
diff --git a/services/doctor/breaking.go b/services/doctor/breaking.go
index 683ec97389..ec8433b8de 100644
--- a/services/doctor/breaking.go
+++ b/services/doctor/breaking.go
@@ -10,6 +10,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/validation"
 
 	"xorm.io/builder"
@@ -30,6 +31,8 @@ func iterateUserAccounts(ctx context.Context, each func(*user.User) error) error
 // addresses would be currently facing a error due to their invalid email address.
 // Ref: https://github.com/go-gitea/gitea/pull/19085 & https://github.com/go-gitea/gitea/pull/17688
 func checkUserEmail(ctx context.Context, logger log.Logger, _ bool) error {
+	setting.LoadServiceSetting()
+
 	// We could use quirky SQL to get all users that start without a [a-zA-Z0-9], but that would mean
 	// DB provider-specific SQL and only works _now_. So instead we iterate through all user accounts
 	// and use the validation.ValidateEmail function to be future-proof.
@@ -61,6 +64,8 @@ func checkUserEmail(ctx context.Context, logger log.Logger, _ bool) error {
 // are allowed for various reasons. This check helps with detecting users that, according
 // to our reserved names, don't have a valid username.
 func checkUserName(ctx context.Context, logger log.Logger, _ bool) error {
+	setting.LoadServiceSetting()
+
 	var invalidUserCount int64
 	if err := iterateUserAccounts(ctx, func(u *user.User) error {
 		if err := user.IsUsableUsername(u.Name); err != nil {

From d10034f4d8d3af44810849689513fa34515852dd Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Sat, 25 Jan 2025 01:15:27 +0000
Subject: [PATCH 017/125] [v10.0/forgejo] fix: add non allowed domain
 translation (#6684)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6677

- Was added in 2559c80bec27a41967b355d214253a83b9ee5dad and accidentally removed in 5a16c9d9c0fd25b25d5eaf1b0ab00f1c113e6b32.
- Reworded for clarity.
- Resolves #6661

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6684
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 options/locale/locale_en-US.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index d2f47adab2..cf69f6ef16 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -644,6 +644,7 @@ team_name_been_taken = The team name is already taken.
 team_no_units_error = Allow access to at least one repository section.
 email_been_used = The email address is already used.
 email_invalid = The email address is invalid.
+email_domain_is_not_allowed = The domain of the user's email address <b>%s</b> conflicts with EMAIL_DOMAIN_ALLOWLIST or EMAIL_DOMAIN_BLOCKLIST. Make sure you have set the email address correctly.
 openid_been_used = The OpenID address "%s" is already used.
 username_password_incorrect = Username or password is incorrect.
 password_complexity = Password does not pass complexity requirements:

From 0ecf28f37f1f472454d9d2f1f5151a18533b14ff Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Sat, 25 Jan 2025 11:38:02 +0000
Subject: [PATCH 018/125] [v10.0/forgejo] Fix inline file preview for rendered
 files (#6685)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6572

### What?

This fixes the inline file preview for rendered files (e.g., markdown). [Here, a live issue in v11](https://v11.next.forgejo.org/mahlzahn/test-inline-file-preview/issues/1) and [the same in v7 (with even more bugs)](https://v7.next.forgejo.org/mahlzahn/test-inline-file-preview/issues/1).

It fixes
1. the inline preview for possibly rendered files, when the link is specified with `?display=source`. This happens, e.g., if you are watching a (e.g., markdown) file in source and then want to link some of its lines.
2. the link to the source file inside the inline preview for possible rendered files (currently it links to the rendered version and then the `#L…` cannot point to the correct lines). This is done by always adding `?display=source` to the link.

### Screenshots
<details><summary>

#### Before

</summary>

![image](/attachments/898f82d5-d116-465a-89e2-ed83da189762)

</details>
<details><summary>

#### After

</summary>

![image](/attachments/41058620-47f3-4f6a-b427-66ef33c1a07f)

</details>

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

I think that this minor edit does not need special tests. Some backend tests have been updated to reflect the addition of URL parameters.

#### Manual testing
- create a repository with a file that can be rendered with couple of lines inside, e.g., a markdown README.md
- go to the source of this file (e.g., `…/src/branch/main/README.md`)
- click on the `<> View Source` button (or add `?display=source` to the URL)
- click on one of the lines, then on the three dots, then on ”Reference in a new issue“
- continue creating the issue

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Co-authored-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6685
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 modules/markup/file_preview.go                |   8 +-
 modules/markup/html_test.go                   | 103 ++++++++++++++++++
 .../0b/b53b56d70d253ce75c257d3cd6334a41ef2b6c | Bin 0 -> 77 bytes
 .../35/75ed7948fe86ab56b0a76f796f7995222bec65 | Bin 0 -> 44 bytes
 .../3c/95f14e5a0ab2c5ba9ee9a47ddc261af4968043 | Bin 0 -> 90 bytes
 .../72/1f0ce13d83f93d431b849a554a62948b85f573 |   1 +
 .../72/e0a44ea5761c9055995db18019e459576b3b27 | Bin 0 -> 44 bytes
 .../72/e1c77b65c7baa0e848557089148833fb54705e | Bin 0 -> 90 bytes
 .../8b/ccd5176c25898b57da2551e076f769054e0d8e | Bin 0 -> 21 bytes
 .../c9/8762531dd068cd818300a5f5c7dca5da79b510 | Bin 0 -> 80 bytes
 .../c9/913120ed2c1e27c1d7752ecdb7a504dc7cf6be | Bin 0 -> 170 bytes
 .../repo/repo1_filepreview/refs/heads/master  |   2 +-
 12 files changed, 112 insertions(+), 2 deletions(-)
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/0b/b53b56d70d253ce75c257d3cd6334a41ef2b6c
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/35/75ed7948fe86ab56b0a76f796f7995222bec65
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/3c/95f14e5a0ab2c5ba9ee9a47ddc261af4968043
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/72/1f0ce13d83f93d431b849a554a62948b85f573
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/72/e0a44ea5761c9055995db18019e459576b3b27
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/72/e1c77b65c7baa0e848557089148833fb54705e
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/8b/ccd5176c25898b57da2551e076f769054e0d8e
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/c9/8762531dd068cd818300a5f5c7dca5da79b510
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/c9/913120ed2c1e27c1d7752ecdb7a504dc7cf6be

diff --git a/modules/markup/file_preview.go b/modules/markup/file_preview.go
index 49a5f1e8ba..3caf08f7bb 100644
--- a/modules/markup/file_preview.go
+++ b/modules/markup/file_preview.go
@@ -77,6 +77,12 @@ func newFilePreview(ctx *RenderContext, node *html.Node, locale translation.Loca
 
 	commitSha := node.Data[m[4]:m[5]]
 	filePath := node.Data[m[6]:m[7]]
+	urlFullSource := urlFull
+	if strings.HasSuffix(filePath, "?display=source") {
+		filePath = strings.TrimSuffix(filePath, "?display=source")
+	} else if Type(filePath) != "" {
+		urlFullSource = node.Data[m[0]:m[6]] + filePath + "?display=source#" + node.Data[m[8]:m[1]]
+	}
 	hash := node.Data[m[8]:m[9]]
 
 	preview.start = m[0]
@@ -113,7 +119,7 @@ func newFilePreview(ctx *RenderContext, node *html.Node, locale translation.Loca
 		titleBuffer.WriteString(" &ndash; ")
 	}
 
-	err = html.Render(titleBuffer, createLink(urlFull, filePath, "muted"))
+	err = html.Render(titleBuffer, createLink(urlFullSource, filePath, "muted"))
 	if err != nil {
 		log.Error("failed to render filepathLink: %v", err)
 	}
diff --git a/modules/markup/html_test.go b/modules/markup/html_test.go
index 50ea70905c..702c5a716d 100644
--- a/modules/markup/html_test.go
+++ b/modules/markup/html_test.go
@@ -1026,4 +1026,107 @@ func TestRender_FilePreview(t *testing.T) {
 			localMetas,
 		)
 	})
+
+	commitFileURL := util.URLJoin(markup.TestRepoURL, "src", "commit", "c9913120ed2c1e27c1d7752ecdb7a504dc7cf6be", "path", "to", "file.md")
+
+	t.Run("rendered file with ?display=source", func(t *testing.T) {
+		testRender(
+			commitFileURL+"?display=source"+"#L1-L2",
+			`<p></p>`+
+				`<div class="file-preview-box">`+
+				`<div class="header">`+
+				`<div>`+
+				`<a href="http://localhost:3000/gogits/gogs/src/commit/c9913120ed2c1e27c1d7752ecdb7a504dc7cf6be/path/to/file.md?display=source#L1-L2" class="muted" rel="nofollow">path/to/file.md</a>`+
+				`</div>`+
+				`<span class="text small grey">`+
+				`Lines 1 to 2 in <a href="http://localhost:3000/gogits/gogs/src/commit/c9913120ed2c1e27c1d7752ecdb7a504dc7cf6be" class="text black" rel="nofollow">c991312</a>`+
+				`</span>`+
+				`</div>`+
+				`<div class="ui table">`+
+				`<table class="file-preview">`+
+				`<tbody>`+
+				`<tr>`+
+				`<td class="lines-num"><span data-line-number="1"></span></td>`+
+				`<td class="lines-code chroma"><code class="code-inner"><span class="gh"># A`+"\n"+`</span></code></td>`+
+				`</tr>`+
+				`<tr>`+
+				`<td class="lines-num"><span data-line-number="2"></span></td>`+
+				`<td class="lines-code chroma"><code class="code-inner"><span class="gh"></span>B`+"\n"+`</code></td>`+
+				`</tr>`+
+				`</tbody>`+
+				`</table>`+
+				`</div>`+
+				`</div>`+
+				`<p></p>`,
+			localMetas,
+		)
+	})
+
+	t.Run("rendered file without ?display=source", func(t *testing.T) {
+		testRender(
+			commitFileURL+"#L1-L2",
+			`<p></p>`+
+				`<div class="file-preview-box">`+
+				`<div class="header">`+
+				`<div>`+
+				`<a href="http://localhost:3000/gogits/gogs/src/commit/c9913120ed2c1e27c1d7752ecdb7a504dc7cf6be/path/to/file.md?display=source#L1-L2" class="muted" rel="nofollow">path/to/file.md</a>`+
+				`</div>`+
+				`<span class="text small grey">`+
+				`Lines 1 to 2 in <a href="http://localhost:3000/gogits/gogs/src/commit/c9913120ed2c1e27c1d7752ecdb7a504dc7cf6be" class="text black" rel="nofollow">c991312</a>`+
+				`</span>`+
+				`</div>`+
+				`<div class="ui table">`+
+				`<table class="file-preview">`+
+				`<tbody>`+
+				`<tr>`+
+				`<td class="lines-num"><span data-line-number="1"></span></td>`+
+				`<td class="lines-code chroma"><code class="code-inner"><span class="gh"># A`+"\n"+`</span></code></td>`+
+				`</tr>`+
+				`<tr>`+
+				`<td class="lines-num"><span data-line-number="2"></span></td>`+
+				`<td class="lines-code chroma"><code class="code-inner"><span class="gh"></span>B`+"\n"+`</code></td>`+
+				`</tr>`+
+				`</tbody>`+
+				`</table>`+
+				`</div>`+
+				`</div>`+
+				`<p></p>`,
+			localMetas,
+		)
+	})
+
+	commitFileURL = util.URLJoin(markup.TestRepoURL, "src", "commit", "190d9492934af498c3f669d6a2431dc5459e5b20", "path", "to", "file.go")
+
+	t.Run("normal file with ?display=source", func(t *testing.T) {
+		testRender(
+			commitFileURL+"?display=source"+"#L2-L3",
+			`<p></p>`+
+				`<div class="file-preview-box">`+
+				`<div class="header">`+
+				`<div>`+
+				`<a href="http://localhost:3000/gogits/gogs/src/commit/190d9492934af498c3f669d6a2431dc5459e5b20/path/to/file.go?display=source#L2-L3" class="muted" rel="nofollow">path/to/file.go</a>`+
+				`</div>`+
+				`<span class="text small grey">`+
+				`Lines 2 to 3 in <a href="http://localhost:3000/gogits/gogs/src/commit/190d9492934af498c3f669d6a2431dc5459e5b20" class="text black" rel="nofollow">190d949</a>`+
+				`</span>`+
+				`</div>`+
+				`<div class="ui table">`+
+				`<table class="file-preview">`+
+				`<tbody>`+
+				`<tr>`+
+				`<td class="lines-num"><span data-line-number="2"></span></td>`+
+				`<td class="lines-code chroma"><code class="code-inner"><span class="nx">B</span>`+"\n"+`</code></td>`+
+				`</tr>`+
+				`<tr>`+
+				`<td class="lines-num"><span data-line-number="3"></span></td>`+
+				`<td class="lines-code chroma"><code class="code-inner"><span class="nx">C</span>`+"\n"+`</code></td>`+
+				`</tr>`+
+				`</tbody>`+
+				`</table>`+
+				`</div>`+
+				`</div>`+
+				`<p></p>`,
+			localMetas,
+		)
+	})
 }
diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/0b/b53b56d70d253ce75c257d3cd6334a41ef2b6c b/modules/markup/tests/repo/repo1_filepreview/objects/0b/b53b56d70d253ce75c257d3cd6334a41ef2b6c
new file mode 100644
index 0000000000000000000000000000000000000000..1ab268b76c99e8c8617f0db6e89b040ef9510c65
GIT binary patch
literal 77
zcmV-T0J8sh0V^p=O;s>AU@$Z=Ff%bxNXyJg)l1K3Xi>VtFH~43w>Rd!is!cjbLGn;
jGm(|#rZ9A$xhkHc+Swg`OEvI8+4oFVKi)n7{P-Lc(|IE6

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/35/75ed7948fe86ab56b0a76f796f7995222bec65 b/modules/markup/tests/repo/repo1_filepreview/objects/35/75ed7948fe86ab56b0a76f796f7995222bec65
new file mode 100644
index 0000000000000000000000000000000000000000..1493caa3dfe2d9f627884805316bb754bc739b4c
GIT binary patch
literal 44
zcmb<m)YkO!4K>)5VqnO?)H<oAZSq^sgPX*S&Y77R>-??ybM8{~)M!?Q_e=RB0B$)E
A_y7O^

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/3c/95f14e5a0ab2c5ba9ee9a47ddc261af4968043 b/modules/markup/tests/repo/repo1_filepreview/objects/3c/95f14e5a0ab2c5ba9ee9a47ddc261af4968043
new file mode 100644
index 0000000000000000000000000000000000000000..3e9c0c0d8bf7f7aa61ae01ad1474dad2cb75d81e
GIT binary patch
literal 90
zcmV-g0HyzU0V^p=O;s>AVK6ZO0)>Lak_?8T2TS~xmdQ*Aof*5aLGnptc(%2=p@D&!
wiHSmSW?p(us%}nZUaDS6MF~SsT~u1Vbh(84zm5YkwvSze7j9Aj0FzA}xNOQLJOBUy

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/72/1f0ce13d83f93d431b849a554a62948b85f573 b/modules/markup/tests/repo/repo1_filepreview/objects/72/1f0ce13d83f93d431b849a554a62948b85f573
new file mode 100644
index 0000000000..d781d4d248
--- /dev/null
+++ b/modules/markup/tests/repo/repo1_filepreview/objects/72/1f0ce13d83f93d431b849a554a62948b85f573
@@ -0,0 +1 @@
+x
��K�1@]��$�J�a�z�JR�@w+��s��������۲�
����"@VL&J
3%f-�GD�q2>F�jBOEݹ�:�g�\1���ꦒk��EM6D�,Ÿ\��Ǹ�:\6��O�lmȩ�;ϭ|�!G�E��6Z��z�Y�β
�m�wٛ���i�.x-o��"���L�
\ No newline at end of file
diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/72/e0a44ea5761c9055995db18019e459576b3b27 b/modules/markup/tests/repo/repo1_filepreview/objects/72/e0a44ea5761c9055995db18019e459576b3b27
new file mode 100644
index 0000000000000000000000000000000000000000..7b926dc0d8324cfc92001c553b87fe03262fd3f0
GIT binary patch
literal 44
zcmV+{0Mq|?0V^p=O;s?mWH2!R0)>)%2JWraVb^(8ZJx)d*4kV%_Hul$odW>PCkzCG
C!V+Tu

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/72/e1c77b65c7baa0e848557089148833fb54705e b/modules/markup/tests/repo/repo1_filepreview/objects/72/e1c77b65c7baa0e848557089148833fb54705e
new file mode 100644
index 0000000000000000000000000000000000000000..0bbca73af27a469407e7241c2dad9e0a2504d531
GIT binary patch
literal 90
zcmV-g0HyzU0V^p=O;s>AVK6ZO0)>Lak_-mZ(zlf!|JqiEZCIXPnO`|oN&8Kzp@D&!
wiHSmSW?p(us%}nZUaDS6MF~SsT~u1Vbh(84zm5YkwvSze7j9Aj0M2b5?sYFEz5oCK

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/8b/ccd5176c25898b57da2551e076f769054e0d8e b/modules/markup/tests/repo/repo1_filepreview/objects/8b/ccd5176c25898b57da2551e076f769054e0d8e
new file mode 100644
index 0000000000000000000000000000000000000000..394a7bb50d7dcebdf407950c6e579b2a8ff18744
GIT binary patch
literal 21
ccmb<m^geacKgb|CAgtg?(IX}XiA78o09`%^XaE2J

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/c9/8762531dd068cd818300a5f5c7dca5da79b510 b/modules/markup/tests/repo/repo1_filepreview/objects/c9/8762531dd068cd818300a5f5c7dca5da79b510
new file mode 100644
index 0000000000000000000000000000000000000000..af5b784773873d0ae9ab512a62755487d1ffbd25
GIT binary patch
literal 80
zcmV-W0I&ae0V^p=O;s>AVlXr?Ff%bxNXyJgRZ!8(O=0Lhb5%S?wX-|?mTKUGvhSI!
me!P81iuBU+8CsOC@Cy~z$?c7Kuj2Xbz+CzA$V>nw>l|8&RVW<*

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/c9/913120ed2c1e27c1d7752ecdb7a504dc7cf6be b/modules/markup/tests/repo/repo1_filepreview/objects/c9/913120ed2c1e27c1d7752ecdb7a504dc7cf6be
new file mode 100644
index 0000000000000000000000000000000000000000..9fc2b7c3125937c08e184007dfd05822729a0e55
GIT binary patch
literal 170
zcmV;b09F5Z0gaAJ3PLdq0A2SK*$dJp{a6t35PE>TG{u5H`l?>v4<5kPz`(%B^?Ysv
zkZ>`&Dv;z*o!7vYCzLR8R?X~FDT2{)^*OGsCv)SjmjPZJa}9BlDObuxY7CVs2AeRh
zgJms_q(sB_alCdo%-S7n?jP*tHgwf44?eZB1(zr#au^aUt+Uq1_igAO6(RaxW%fD`
YsO_Y1>-uQ=g!gIDuH|dZ3;EhgOutoAssI20

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/refs/heads/master b/modules/markup/tests/repo/repo1_filepreview/refs/heads/master
index df25bf45f0..f3d5d39dd5 100644
--- a/modules/markup/tests/repo/repo1_filepreview/refs/heads/master
+++ b/modules/markup/tests/repo/repo1_filepreview/refs/heads/master
@@ -1 +1 @@
-4c1aaf56bcb9f39dcf65f3f250726850aed13cd6
+c9913120ed2c1e27c1d7752ecdb7a504dc7cf6be

From b3fe6dc4a1b9cea3021fe9d17b1d906316d2fc82 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Fri, 19 Aug 2022 02:49:18 -0400
Subject: [PATCH 019/125] git-annex tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes https://github.com/neuropoly/gitea/issues/11

Tests:

* `git annex init`
* `git annex copy --from origin`
* `git annex copy --to origin`

over:

* ssh

for:

* the owner
* a collaborator
* a read-only collaborator
* a stranger

in a

* public repo
* private repo

And then confirms:

* Deletion of the remote repo (to ensure lockdown isn't messing with us: https://git-annex.branchable.com/internals/lockdown/#comment-0cc5225dc5abe8eddeb843bfd2fdc382)

------

To support all this:

* Add util.FileCmp()
* Patch withKeyFile() so it can be nested in other copies of itself

-------

Many thanks to Mathieu for giving style tips and catching several bugs,
including a subtle one in util.filecmp() which neutered it.

Co-authored-by: Mathieu Guay-Paquet <mathieu.guay-paquet@polymtl.ca>
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
---
 Makefile                                      |   2 +-
 modules/util/filecmp.go                       |  87 ++
 modules/util/remove.go                        |  37 +-
 .../api_helper_for_declarative_test.go        |  25 +
 tests/integration/git_annex_test.go           | 760 ++++++++++++++++++
 .../git_helper_for_declarative_test.go        |  22 +
 6 files changed, 916 insertions(+), 17 deletions(-)
 create mode 100644 modules/util/filecmp.go
 create mode 100644 tests/integration/git_annex_test.go

diff --git a/Makefile b/Makefile
index a9de57e523..95658a7842 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ self := $(location)
 	@tmpdir=`mktemp --tmpdir -d` ; \
 	echo Using temporary directory $$tmpdir for test repositories ; \
 	USE_REPO_TEST_DIR= $(MAKE) -f $(self) --no-print-directory REPO_TEST_DIR=$$tmpdir/ $@ ; \
-	STATUS=$$? ; rm -r "$$tmpdir" ; exit $$STATUS
+	STATUS=$$? ; chmod -R +w "$$tmpdir" && rm -r "$$tmpdir" ; exit $$STATUS
 
 else
 
diff --git a/modules/util/filecmp.go b/modules/util/filecmp.go
new file mode 100644
index 0000000000..76e7705cc1
--- /dev/null
+++ b/modules/util/filecmp.go
@@ -0,0 +1,87 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package util
+
+import (
+	"bytes"
+	"io"
+	"os"
+)
+
+// Decide if two files have the same contents or not.
+// chunkSize is the size of the blocks to scan by; pass 0 to get a sensible default.
+// *Follows* symlinks.
+//
+// May return an error if something else goes wrong; in this case, you should ignore the value of 'same'.
+//
+// derived from https://stackoverflow.com/a/30038571
+// under CC-BY-SA-4.0 by several contributors
+func FileCmp(file1, file2 string, chunkSize int) (same bool, err error) {
+	if chunkSize == 0 {
+		chunkSize = 4 * 1024
+	}
+
+	// shortcuts: check file metadata
+	stat1, err := os.Stat(file1)
+	if err != nil {
+		return false, err
+	}
+
+	stat2, err := os.Stat(file2)
+	if err != nil {
+		return false, err
+	}
+
+	// are inputs are literally the same file?
+	if os.SameFile(stat1, stat2) {
+		return true, nil
+	}
+
+	// do inputs at least have the same size?
+	if stat1.Size() != stat2.Size() {
+		return false, nil
+	}
+
+	// long way: compare contents
+	f1, err := os.Open(file1)
+	if err != nil {
+		return false, err
+	}
+	defer f1.Close()
+
+	f2, err := os.Open(file2)
+	if err != nil {
+		return false, err
+	}
+	defer f2.Close()
+
+	b1 := make([]byte, chunkSize)
+	b2 := make([]byte, chunkSize)
+	for {
+		n1, err1 := io.ReadFull(f1, b1)
+		n2, err2 := io.ReadFull(f2, b2)
+
+		// https://pkg.go.dev/io#Reader
+		// > Callers should always process the n > 0 bytes returned
+		// > before considering the error err. Doing so correctly
+		// > handles I/O errors that happen after reading some bytes
+		// > and also both of the allowed EOF behaviors.
+
+		if !bytes.Equal(b1[:n1], b2[:n2]) {
+			return false, nil
+		}
+
+		if (err1 == io.EOF && err2 == io.EOF) || (err1 == io.ErrUnexpectedEOF && err2 == io.ErrUnexpectedEOF) {
+			return true, nil
+		}
+
+		// some other error, like a dropped network connection or a bad transfer
+		if err1 != nil {
+			return false, err1
+		}
+		if err2 != nil {
+			return false, err2
+		}
+	}
+}
diff --git a/modules/util/remove.go b/modules/util/remove.go
index 0f41471fcc..f2a61ae467 100644
--- a/modules/util/remove.go
+++ b/modules/util/remove.go
@@ -43,6 +43,26 @@ func Remove(name string) error {
 	return err
 }
 
+// MakeWritable recursively makes the named directory writable.
+func MakeWritable(name string) error {
+	return filepath.WalkDir(name, func(path string, d fs.DirEntry, err error) error {
+		// NB: this is called WalkDir but it works on a single file too
+		if err == nil {
+			info, err := d.Info()
+			if err != nil {
+				return err
+			}
+
+			// 0200 == u+w, in octal unix permission notation
+			err = os.Chmod(path, info.Mode()|0o200)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
 // RemoveAll removes the named file or directory with at most 5 attempts.
 func RemoveAll(name string) error {
 	var err error
@@ -55,22 +75,7 @@ func RemoveAll(name string) error {
 		// > (The only bad consequence of this is that rm -rf .git
 		// > doesn't work unless you first run chmod -R +w .git)
 
-		err = filepath.WalkDir(name, func(path string, d fs.DirEntry, err error) error {
-			// NB: this is called WalkDir but it works on a single file too
-			if err == nil {
-				info, err := d.Info()
-				if err != nil {
-					return err
-				}
-
-				// 0200 == u+w, in octal unix permission notation
-				err = os.Chmod(path, info.Mode()|0o200)
-				if err != nil {
-					return err
-				}
-			}
-			return nil
-		})
+		err = MakeWritable(name)
 		if err != nil {
 			// try again
 			<-time.After(100 * time.Millisecond)
diff --git a/tests/integration/api_helper_for_declarative_test.go b/tests/integration/api_helper_for_declarative_test.go
index dae71ca8ef..5bd8dc5567 100644
--- a/tests/integration/api_helper_for_declarative_test.go
+++ b/tests/integration/api_helper_for_declarative_test.go
@@ -22,6 +22,7 @@ import (
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/services/forms"
 
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -461,3 +462,27 @@ func doAPIAddRepoToOrganizationTeam(ctx APITestContext, teamID int64, orgName, r
 		ctx.Session.MakeRequest(t, req, http.StatusNoContent)
 	}
 }
+
+// generate and activate an ssh key for the user attached to the APITestContext
+// TODO: pick a better name; golang doesn't do method overriding.
+func withCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
+	// we need to have write:public_key to do this step
+	// the easiest way is to create a throwaway ctx that is identical but only has that permission
+	ctxKeyWriter := ctx
+	ctxKeyWriter.Token = getTokenForLoggedInUser(t, ctx.Session, auth.AccessTokenScopeWriteUser)
+
+	keyName := "One of " + ctx.Username + "'s keys: #" + uuid.New().String()
+	withKeyFile(t, keyName, func(keyFile string) {
+		var key api.PublicKey
+
+		doAPICreateUserKey(ctxKeyWriter, keyName, keyFile,
+			func(t *testing.T, _key api.PublicKey) {
+				// save the key ID so we can delete it at the end
+				key = _key
+			})(t)
+
+		defer doAPIDeleteUserKey(ctxKeyWriter, key.ID)(t)
+
+		callback()
+	})
+}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
new file mode 100644
index 0000000000..49f26924e3
--- /dev/null
+++ b/tests/integration/git_annex_test.go
@@ -0,0 +1,760 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package integration
+
+import (
+	"errors"
+	"fmt"
+	"math/rand"
+	"net/url"
+	"os"
+	"path"
+	"regexp"
+	"strings"
+	"testing"
+
+	auth_model "code.gitea.io/gitea/models/auth"
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/perm"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/setting"
+	api "code.gitea.io/gitea/modules/structs"
+	"code.gitea.io/gitea/modules/util"
+	"code.gitea.io/gitea/tests"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Some guidelines:
+//
+// * a APITestContext is an awkward union of session credential + username + target repo
+//   which is assumed to be owned by that username; if you want to target a different
+//   repo, you need to edit its .Reponame or just ignore it and write "username/reponame.git"
+
+func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext, private bool) (err error) {
+	// creating a repo counts as editing the user's profile (is done by POSTing
+	// to /api/v1/user/repos/) -- which means it needs a User-scoped token and
+	// both that and editing need a Repo-scoped token because they edit repositories.
+	rescopedCtx := ctx
+	rescopedCtx.Token = getTokenForLoggedInUser(t, ctx.Session, auth_model.AccessTokenScopeWriteUser, auth_model.AccessTokenScopeWriteRepository)
+	doAPICreateRepository(rescopedCtx, false)(t)
+	t.Cleanup(func() { util.MakeWritable(setting.RepoRootPath) })
+	doAPIEditRepository(rescopedCtx, &api.EditRepoOption{Private: &private})(t)
+
+	repoURL := createSSHUrl(ctx.GitPath(), u)
+
+	// Fill in fixture data
+	withAnnexCtxKeyFile(t, ctx, func() {
+		err = doInitRemoteAnnexRepository(t, repoURL)
+	})
+	if err != nil {
+		return fmt.Errorf("Unable to initialize remote repo with git-annex fixture: %w", err)
+	}
+	return nil
+}
+
+/*
+Test that permissions are enforced on git-annex-shell commands.
+
+	Along the way, test that uploading, downloading, and deleting all work.
+*/
+func TestGitAnnexPermissions(t *testing.T) {
+	/*
+		// TODO: look into how LFS did this
+		if !setting.Annex.Enabled {
+			t.Skip()
+		}
+	*/
+
+	// Each case below is split so that 'clone' is done as
+	// the repo owner, but 'copy' as the user under test.
+	//
+	// Otherwise, in cases where permissions block the
+	// initial 'clone', the test would simply end there
+	// and never verify if permissions apply properly to
+	// 'annex copy' -- potentially leaving a security gap.
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		t.Run("Public", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			ownerCtx := NewAPITestContext(t, "user2", "annex-public", auth_model.AccessTokenScopeWriteRepository)
+
+			// create a public repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, false))
+
+			// double-check it's public
+			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+			require.NoError(t, err)
+			require.False(t, repo.IsPrivate)
+
+			// Remote addresses of the repo
+			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+			// Different sessions, so we can test different permissions.
+			// We leave Reponame blank because we don't actually then later add it according to each case if needed
+			//
+			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+
+			// set up collaborators
+			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+			// tests
+			t.Run("Owner", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Writer", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, writerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Reader", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, readerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Outsider", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, outsiderCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Delete", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				// Delete the repo, make sure it's fully gone
+				doAPIDeleteRepository(ownerCtx)(t)
+				_, statErr := os.Stat(remoteRepoPath)
+				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+			})
+		})
+
+		t.Run("Private", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			ownerCtx := NewAPITestContext(t, "user2", "annex-private", auth_model.AccessTokenScopeWriteRepository)
+
+			// create a private repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, true))
+
+			// double-check it's private
+			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+			require.NoError(t, err)
+			require.True(t, repo.IsPrivate)
+
+			// Remote addresses of the repo
+			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+			// Different sessions, so we can test different permissions.
+			// We leave Reponame blank because we don't actually then later add it according to each case if needed
+			//
+			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+			// Note: there's also full anonymous access, which is only available for public HTTP repos;
+			// it should behave the same as 'outsider' but we (will) test it separately below anyway
+
+			// set up collaborators
+			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+			// tests
+			t.Run("Owner", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Writer", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, writerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Reader", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, readerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Outsider", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, outsiderCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Delete", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				// Delete the repo, make sure it's fully gone
+				doAPIDeleteRepository(ownerCtx)(t)
+				_, statErr := os.Stat(remoteRepoPath)
+				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+			})
+		})
+	})
+}
+
+/*
+Test that 'git annex init' works.
+
+	precondition: repoPath contains a pre-cloned repo set up by doInitAnnexRepository().
+*/
+func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "init", "cloned-repo").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't `git annex init`: %w", err)
+	}
+
+	// - method 0: 'git config remote.origin.annex-uuid'.
+	//   Demonstrates that 'git annex init' successfully contacted
+	//   the remote git-annex and was able to learn its ID number.
+	readAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "remote.origin.annex-uuid").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't read remote `git config remote.origin.annex-uuid`: %w", err)
+	}
+	readAnnexUUID = strings.TrimSpace(readAnnexUUID)
+
+	match := regexp.MustCompile("^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$").MatchString(readAnnexUUID)
+	if !match {
+		return fmt.Errorf("'git config remote.origin.annex-uuid' should have been able to download the remote's uuid; but instead read '%s'", readAnnexUUID)
+	}
+
+	remoteAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: remoteRepoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't read local `git config annex.uuid`: %w", err)
+	}
+
+	remoteAnnexUUID = strings.TrimSpace(remoteAnnexUUID)
+	match = regexp.MustCompile("^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$").MatchString(remoteAnnexUUID)
+	if !match {
+		return fmt.Errorf("'git annex init' should have been able to download the remote's uuid; but instead read '%s'", remoteAnnexUUID)
+	}
+
+	if readAnnexUUID != remoteAnnexUUID {
+		return fmt.Errorf("'git annex init' should have read the expected annex UUID '%s', but instead got '%s'", remoteAnnexUUID, readAnnexUUID)
+	}
+
+	// - method 1: 'git annex whereis'.
+	//   Demonstrates that git-annex understands the annexed file can be found in the remote annex.
+	annexWhereis, _, err := git.NewCommand(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't `git annex whereis large.bin`: %w", err)
+	}
+	// Note: this regex is unanchored because 'whereis' outputs multiple lines containing
+	//       headers and 1+ remotes and we just want to find one of them.
+	match = regexp.MustCompile(regexp.QuoteMeta(remoteAnnexUUID) + " -- .* \\[origin\\]\n").MatchString(annexWhereis)
+	if !match {
+		return errors.New("'git annex whereis' should report large.bin is known to be in [origin]")
+	}
+
+	return nil
+}
+
+func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
+	// NB: this test does something slightly different if run separately from "doAnnexInitTest()":
+	//     "git annex copy" will notice and run "git annex init", silently.
+	//     This shouldn't change any results, but be aware in case it does.
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// verify the file was downloaded
+	localObjectPath, err := annexObjectPath(repoPath, "large.bin")
+	if err != nil {
+		return err
+	}
+	// localObjectPath := path.Join(repoPath, "large.bin") // or, just compare against the checked-out file
+
+	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "large.bin")
+	if err != nil {
+		return err
+	}
+
+	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	if err != nil {
+		return err
+	}
+	if !match {
+		return errors.New("Annexed files should be the same")
+	}
+
+	return nil
+}
+
+func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
+	// NB: this test does something slightly different if run separately from "Init":
+	//     it first runs "git annex init" silently in the background.
+	//     This shouldn't change any results, but be aware in case it does.
+
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "contribution.bin"))
+	if err != nil {
+		return err
+	}
+
+	err = git.AddChanges(repoPath, false, ".")
+	if err != nil {
+		return err
+	}
+
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex another file"})
+	if err != nil {
+		return err
+	}
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--to", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// verify the file was uploaded
+	localObjectPath, err := annexObjectPath(repoPath, "contribution.bin")
+	if err != nil {
+		return err
+	}
+	// localObjectPath := path.Join(repoPath, "contribution.bin") // or, just compare against the checked-out file
+
+	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "contribution.bin")
+	if err != nil {
+		return err
+	}
+
+	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	if err != nil {
+		return err
+	}
+	if !match {
+		return errors.New("Annexed files should be the same")
+	}
+
+	return nil
+}
+
+// ---- Helpers ----
+
+func generateRandomFile(size int, path string) (err error) {
+	// Generate random file
+
+	// XXX TODO: maybe this should not be random, but instead a predictable pattern, so that the test is deterministic
+	bufSize := 4 * 1024
+	if bufSize > size {
+		bufSize = size
+	}
+
+	buffer := make([]byte, bufSize)
+
+	f, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	written := 0
+	for written < size {
+		n := size - written
+		if n > bufSize {
+			n = bufSize
+		}
+		_, err := rand.Read(buffer[:n])
+		if err != nil {
+			return err
+		}
+		n, err = f.Write(buffer[:n])
+		if err != nil {
+			return err
+		}
+		written += n
+	}
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// ---- Annex-specific helpers ----
+
+/*
+Initialize a repo with some baseline annexed and non-annexed files.
+
+	TODO: perhaps this generator could be replaced with a fixture (see
+	integrations/gitea-repositories-meta/ and models/fixtures/repository.yml).
+	However we reuse this template for -different- repos, so maybe not.
+*/
+func doInitAnnexRepository(repoPath string) error {
+	// set up what files should be annexed
+	// in this case, all *.bin  files will be annexed
+	// without this, git-annex's default config annexes every file larger than some number of megabytes
+	f, err := os.Create(path.Join(repoPath, ".gitattributes"))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	// set up git-annex to store certain filetypes via *annex* pointers
+	// (https://git-annex.branchable.com/internals/pointer_file/).
+	// but only when run via 'git add' (see git-annex-smudge(1))
+	_, err = f.WriteString("*                   annex.largefiles=anything\n")
+	if err != nil {
+		return err
+	}
+	_, err = f.WriteString("*.bin  filter=annex\n")
+	if err != nil {
+		return err
+	}
+	f.Close()
+
+	err = git.AddChanges(repoPath, false, ".")
+	if err != nil {
+		return err
+	}
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Configure git-annex settings"})
+	if err != nil {
+		return err
+	}
+
+	// 'git annex init'
+	err = git.NewCommand(git.DefaultContext, "annex", "init", "test-repo").Run(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// add a file to the annex
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "large.bin"))
+	if err != nil {
+		return err
+	}
+	err = git.AddChanges(repoPath, false, ".")
+	if err != nil {
+		return err
+	}
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex a file"})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+/*
+Initialize a remote repo with some baseline annexed and non-annexed files.
+*/
+func doInitRemoteAnnexRepository(t *testing.T, repoURL *url.URL) error {
+	repoPath := path.Join(t.TempDir(), path.Base(repoURL.Path))
+	// This clone is immediately thrown away, which
+	// helps force the tests to be end-to-end.
+	defer util.RemoveAll(repoPath)
+
+	doGitClone(repoPath, repoURL)(t) // TODO: this call is the only reason for the testing.T; can it be removed?
+
+	err := doInitAnnexRepository(repoPath)
+	if err != nil {
+		return err
+	}
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--content").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+/*
+Find the path in .git/annex/objects/ of the contents for a given annexed file.
+
+	repoPath: the git repository to examine
+	file: the path (in the repo's current HEAD) of the annex pointer
+
+	TODO: pass a parameter to allow examining non-HEAD branches
+*/
+func annexObjectPath(repoPath, file string) (string, error) {
+	// NB: `git annex lookupkey` is more reliable, but doesn't work in bare repos.
+	annexKey, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "show").AddDynamicArguments("HEAD:" + file).RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %w", repoPath, err) // the error from git prints the filename but not repo
+	}
+
+	// There are two formats an annexed file pointer might be:
+	// * a symlink to .git/annex/objects/$HASHDIR/$ANNEX_KEY/$ANNEX_KEY - used by files created with 'git annex add'
+	// * a text file containing /annex/objects/$ANNEX_KEY - used by files for which 'git add' was configured to run git-annex-smudge
+	// This recovers $ANNEX_KEY from either case:
+	annexKey = path.Base(strings.TrimSpace(annexKey))
+
+	contentPath, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(annexKey).RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %s does not seem to be annexed: %w", repoPath, file, err)
+	}
+	contentPath = strings.TrimSpace(contentPath)
+
+	return path.Join(repoPath, contentPath), nil
+}
+
+/* like withKeyFile(), but automatically sets it the account given in ctx for use by git-annex */
+func withAnnexCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
+	_gitAnnexUseGitSSH, gitAnnexUseGitSSHExists := os.LookupEnv("GIT_ANNEX_USE_GIT_SSH")
+	defer func() {
+		// reset
+		if gitAnnexUseGitSSHExists {
+			os.Setenv("GIT_ANNEX_USE_GIT_SSH", _gitAnnexUseGitSSH)
+		}
+	}()
+
+	os.Setenv("GIT_ANNEX_USE_GIT_SSH", "1") // withKeyFile works by setting GIT_SSH_COMMAND, but git-annex only respects that if this is set
+
+	withCtxKeyFile(t, ctx, callback)
+}
diff --git a/tests/integration/git_helper_for_declarative_test.go b/tests/integration/git_helper_for_declarative_test.go
index 83d8177460..1e39b988fd 100644
--- a/tests/integration/git_helper_for_declarative_test.go
+++ b/tests/integration/git_helper_for_declarative_test.go
@@ -42,6 +42,28 @@ func withKeyFile(t *testing.T, keyname string, callback func(string)) {
 		"ssh -o \"UserKnownHostsFile=/dev/null\" -o \"StrictHostKeyChecking=no\" -o \"IdentitiesOnly=yes\" -i \""+keyFile+"\" \"$@\""), 0o700)
 	require.NoError(t, err)
 
+	// reset ssh wrapper afterwards
+	_gitSSH, gitSSHExists := os.LookupEnv("GIT_SSH")
+	defer func() {
+		if gitSSHExists {
+			os.Setenv("GIT_SSH", _gitSSH)
+		}
+	}()
+
+	_gitSSHCommand, gitSSHCommandExists := os.LookupEnv("GIT_SSH_COMMAND")
+	defer func() {
+		if gitSSHCommandExists {
+			os.Setenv("GIT_SSH_COMMAND", _gitSSHCommand)
+		}
+	}()
+
+	_gitSSHVariant, gitSSHVariantExists := os.LookupEnv("GIT_SSH_VARIANT")
+	defer func() {
+		if gitSSHVariantExists {
+			os.Setenv("GIT_SSH_VARIANT", _gitSSHVariant)
+		}
+	}()
+
 	// Setup ssh wrapper
 	t.Setenv("GIT_SSH", path.Join(tmpDir, "ssh"))
 	t.Setenv("GIT_SSH_COMMAND",

From b5fc00042b44946d77e52c098ea15673761b2d05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 24 May 2024 12:57:45 +0200
Subject: [PATCH 020/125] Adapt patch to upstream changes

Repository creation now expects an objectFormat to be specified for git.
---
 tests/integration/git_annex_test.go | 522 ++++++++++++++--------------
 1 file changed, 262 insertions(+), 260 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 49f26924e3..e364e68852 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -34,13 +34,13 @@ import (
 //   which is assumed to be owned by that username; if you want to target a different
 //   repo, you need to edit its .Reponame or just ignore it and write "username/reponame.git"
 
-func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext, private bool) (err error) {
+func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext, private bool, objectFormat git.ObjectFormat) (err error) {
 	// creating a repo counts as editing the user's profile (is done by POSTing
 	// to /api/v1/user/repos/) -- which means it needs a User-scoped token and
 	// both that and editing need a Repo-scoped token because they edit repositories.
 	rescopedCtx := ctx
 	rescopedCtx.Token = getTokenForLoggedInUser(t, ctx.Session, auth_model.AccessTokenScopeWriteUser, auth_model.AccessTokenScopeWriteRepository)
-	doAPICreateRepository(rescopedCtx, false)(t)
+	doAPICreateRepository(rescopedCtx, false, objectFormat)(t)
 	t.Cleanup(func() { util.MakeWritable(setting.RepoRootPath) })
 	doAPIEditRepository(rescopedCtx, &api.EditRepoOption{Private: &private})(t)
 
@@ -78,365 +78,367 @@ func TestGitAnnexPermissions(t *testing.T) {
 	// 'annex copy' -- potentially leaving a security gap.
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		t.Run("Public", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-
-			ownerCtx := NewAPITestContext(t, "user2", "annex-public", auth_model.AccessTokenScopeWriteRepository)
-
-			// create a public repo
-			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, false))
-
-			// double-check it's public
-			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
-			require.NoError(t, err)
-			require.False(t, repo.IsPrivate)
-
-			// Remote addresses of the repo
-			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
-			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
-
-			// Different sessions, so we can test different permissions.
-			// We leave Reponame blank because we don't actually then later add it according to each case if needed
-			//
-			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
-			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
-			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
-			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
-
-			// set up collaborators
-			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
-			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
-
-			// tests
-			t.Run("Owner", func(t *testing.T) {
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			t.Run("Public", func(t *testing.T) {
 				defer tests.PrintCurrentTest(t)()
 
-				t.Run("SSH", func(t *testing.T) {
+				ownerCtx := NewAPITestContext(t, "user2", "annex-public"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
+
+				// create a public repo
+				require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, false, objectFormat))
+
+				// double-check it's public
+				repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+				require.NoError(t, err)
+				require.False(t, repo.IsPrivate)
+
+				// Remote addresses of the repo
+				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+				// Different sessions, so we can test different permissions.
+				// We leave Reponame blank because we don't actually then later add it according to each case if needed
+				//
+				// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+				writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+				readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+				outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+
+				// set up collaborators
+				doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+				doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+				// tests
+				t.Run("Owner", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Writer", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Writer", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, writerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Reader", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Reader", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, readerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Outsider", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Outsider", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, outsiderCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Delete", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				// Delete the repo, make sure it's fully gone
-				doAPIDeleteRepository(ownerCtx)(t)
-				_, statErr := os.Stat(remoteRepoPath)
-				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
-			})
-		})
-
-		t.Run("Private", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-
-			ownerCtx := NewAPITestContext(t, "user2", "annex-private", auth_model.AccessTokenScopeWriteRepository)
-
-			// create a private repo
-			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, true))
-
-			// double-check it's private
-			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
-			require.NoError(t, err)
-			require.True(t, repo.IsPrivate)
-
-			// Remote addresses of the repo
-			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
-			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
-
-			// Different sessions, so we can test different permissions.
-			// We leave Reponame blank because we don't actually then later add it according to each case if needed
-			//
-			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
-			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
-			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
-			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
-			// Note: there's also full anonymous access, which is only available for public HTTP repos;
-			// it should behave the same as 'outsider' but we (will) test it separately below anyway
-
-			// set up collaborators
-			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
-			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
-
-			// tests
-			t.Run("Owner", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Delete", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
-
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
-
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
-						})
-
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
-
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-						})
-					})
+					// Delete the repo, make sure it's fully gone
+					doAPIDeleteRepository(ownerCtx)(t)
+					_, statErr := os.Stat(remoteRepoPath)
+					require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
 				})
 			})
 
-			t.Run("Writer", func(t *testing.T) {
+			t.Run("Private", func(t *testing.T) {
 				defer tests.PrintCurrentTest(t)()
 
-				t.Run("SSH", func(t *testing.T) {
+				ownerCtx := NewAPITestContext(t, "user2", "annex-private"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
+
+				// create a private repo
+				require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, true, objectFormat))
+
+				// double-check it's private
+				repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+				require.NoError(t, err)
+				require.True(t, repo.IsPrivate)
+
+				// Remote addresses of the repo
+				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+				// Different sessions, so we can test different permissions.
+				// We leave Reponame blank because we don't actually then later add it according to each case if needed
+				//
+				// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+				writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+				readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+				outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+				// Note: there's also full anonymous access, which is only available for public HTTP repos;
+				// it should behave the same as 'outsider' but we (will) test it separately below anyway
+
+				// set up collaborators
+				doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+				doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+				// tests
+				t.Run("Owner", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, writerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Reader", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Writer", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, readerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Outsider", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Reader", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, outsiderCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Delete", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
+				t.Run("Outsider", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
 
-				// Delete the repo, make sure it's fully gone
-				doAPIDeleteRepository(ownerCtx)(t)
-				_, statErr := os.Stat(remoteRepoPath)
-				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxKeyFile(t, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+							})
+						})
+					})
+				})
+
+				t.Run("Delete", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					// Delete the repo, make sure it's fully gone
+					doAPIDeleteRepository(ownerCtx)(t)
+					_, statErr := os.Stat(remoteRepoPath)
+					require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+				})
 			})
 		})
 	})

From 90f53a4e7c67581e84e65505e495a2625197d904 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 30 Apr 2024 12:12:39 +0200
Subject: [PATCH 021/125] Adapt patch to upstream changes

A dead code check started to complain because FileCmp was only used in
tests. Moved the function to test_utils.
---
 modules/util/filecmp.go             | 87 -----------------------------
 tests/integration/git_annex_test.go |  4 +-
 tests/test_utils.go                 | 79 ++++++++++++++++++++++++++
 3 files changed, 81 insertions(+), 89 deletions(-)
 delete mode 100644 modules/util/filecmp.go

diff --git a/modules/util/filecmp.go b/modules/util/filecmp.go
deleted file mode 100644
index 76e7705cc1..0000000000
--- a/modules/util/filecmp.go
+++ /dev/null
@@ -1,87 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package util
-
-import (
-	"bytes"
-	"io"
-	"os"
-)
-
-// Decide if two files have the same contents or not.
-// chunkSize is the size of the blocks to scan by; pass 0 to get a sensible default.
-// *Follows* symlinks.
-//
-// May return an error if something else goes wrong; in this case, you should ignore the value of 'same'.
-//
-// derived from https://stackoverflow.com/a/30038571
-// under CC-BY-SA-4.0 by several contributors
-func FileCmp(file1, file2 string, chunkSize int) (same bool, err error) {
-	if chunkSize == 0 {
-		chunkSize = 4 * 1024
-	}
-
-	// shortcuts: check file metadata
-	stat1, err := os.Stat(file1)
-	if err != nil {
-		return false, err
-	}
-
-	stat2, err := os.Stat(file2)
-	if err != nil {
-		return false, err
-	}
-
-	// are inputs are literally the same file?
-	if os.SameFile(stat1, stat2) {
-		return true, nil
-	}
-
-	// do inputs at least have the same size?
-	if stat1.Size() != stat2.Size() {
-		return false, nil
-	}
-
-	// long way: compare contents
-	f1, err := os.Open(file1)
-	if err != nil {
-		return false, err
-	}
-	defer f1.Close()
-
-	f2, err := os.Open(file2)
-	if err != nil {
-		return false, err
-	}
-	defer f2.Close()
-
-	b1 := make([]byte, chunkSize)
-	b2 := make([]byte, chunkSize)
-	for {
-		n1, err1 := io.ReadFull(f1, b1)
-		n2, err2 := io.ReadFull(f2, b2)
-
-		// https://pkg.go.dev/io#Reader
-		// > Callers should always process the n > 0 bytes returned
-		// > before considering the error err. Doing so correctly
-		// > handles I/O errors that happen after reading some bytes
-		// > and also both of the allowed EOF behaviors.
-
-		if !bytes.Equal(b1[:n1], b2[:n2]) {
-			return false, nil
-		}
-
-		if (err1 == io.EOF && err2 == io.EOF) || (err1 == io.ErrUnexpectedEOF && err2 == io.ErrUnexpectedEOF) {
-			return true, nil
-		}
-
-		// some other error, like a dropped network connection or a bad transfer
-		if err1 != nil {
-			return false, err1
-		}
-		if err2 != nil {
-			return false, err2
-		}
-	}
-}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index e364e68852..667e57c499 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -522,7 +522,7 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
 	if err != nil {
 		return err
 	}
@@ -575,7 +575,7 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
 	if err != nil {
 		return err
 	}
diff --git a/tests/test_utils.go b/tests/test_utils.go
index b3c03a30a1..6e9374db25 100644
--- a/tests/test_utils.go
+++ b/tests/test_utils.go
@@ -5,9 +5,11 @@
 package tests
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"fmt"
+	"io"
 	"os"
 	"path"
 	"path/filepath"
@@ -488,3 +490,80 @@ func CreateDeclarativeRepo(t *testing.T, owner *user_model.User, name string, en
 
 	return CreateDeclarativeRepoWithOptions(t, owner, opts)
 }
+
+// Decide if two files have the same contents or not.
+// chunkSize is the size of the blocks to scan by; pass 0 to get a sensible default.
+// *Follows* symlinks.
+//
+// May return an error if something else goes wrong; in this case, you should ignore the value of 'same'.
+//
+// derived from https://stackoverflow.com/a/30038571
+// under CC-BY-SA-4.0 by several contributors
+func FileCmp(file1, file2 string, chunkSize int) (same bool, err error) {
+	if chunkSize == 0 {
+		chunkSize = 4 * 1024
+	}
+
+	// shortcuts: check file metadata
+	stat1, err := os.Stat(file1)
+	if err != nil {
+		return false, err
+	}
+
+	stat2, err := os.Stat(file2)
+	if err != nil {
+		return false, err
+	}
+
+	// are inputs are literally the same file?
+	if os.SameFile(stat1, stat2) {
+		return true, nil
+	}
+
+	// do inputs at least have the same size?
+	if stat1.Size() != stat2.Size() {
+		return false, nil
+	}
+
+	// long way: compare contents
+	f1, err := os.Open(file1)
+	if err != nil {
+		return false, err
+	}
+	defer f1.Close()
+
+	f2, err := os.Open(file2)
+	if err != nil {
+		return false, err
+	}
+	defer f2.Close()
+
+	b1 := make([]byte, chunkSize)
+	b2 := make([]byte, chunkSize)
+	for {
+		n1, err1 := io.ReadFull(f1, b1)
+		n2, err2 := io.ReadFull(f2, b2)
+
+		// https://pkg.go.dev/io#Reader
+		// > Callers should always process the n > 0 bytes returned
+		// > before considering the error err. Doing so correctly
+		// > handles I/O errors that happen after reading some bytes
+		// > and also both of the allowed EOF behaviors.
+
+		if !bytes.Equal(b1[:n1], b2[:n2]) {
+			return false, nil
+		}
+
+		if (err1 == io.EOF && err2 == io.EOF) || (err1 == io.ErrUnexpectedEOF && err2 == io.ErrUnexpectedEOF) {
+			return true, nil
+		}
+
+		// some other error, like a dropped network connection or a bad transfer
+		if err1 != nil {
+			return false, err1
+		}
+		if err2 != nil {
+			return false, err2
+		}
+	}
+}

From 8cd079ae15b792254621dc055ee39f35d753d9e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 12 Aug 2024 11:34:45 +0200
Subject: [PATCH 022/125] Adapt patch to upstream changes

---
 tests/integration/git_annex_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 667e57c499..f52f8759b1 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -752,11 +752,11 @@ func withAnnexCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
 	defer func() {
 		// reset
 		if gitAnnexUseGitSSHExists {
-			os.Setenv("GIT_ANNEX_USE_GIT_SSH", _gitAnnexUseGitSSH)
+			t.Setenv("GIT_ANNEX_USE_GIT_SSH", _gitAnnexUseGitSSH)
 		}
 	}()
 
-	os.Setenv("GIT_ANNEX_USE_GIT_SSH", "1") // withKeyFile works by setting GIT_SSH_COMMAND, but git-annex only respects that if this is set
+	t.Setenv("GIT_ANNEX_USE_GIT_SSH", "1") // withKeyFile works by setting GIT_SSH_COMMAND, but git-annex only respects that if this is set
 
 	withCtxKeyFile(t, ctx, callback)
 }

From 7b7c804ea4f938e581238d3c4ddf667b7ebac2dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 18 Apr 2024 17:25:32 +0200
Subject: [PATCH 023/125] Install git-annex in the testing workflow

---
 .forgejo/workflows/testing.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 3d8ad443da..fb5def2028 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -196,7 +196,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-lfs
+          packages: git git-annex git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-mysql-migration test-mysql'
@@ -232,7 +232,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-lfs
+          packages: git git-annex git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-pgsql-migration test-pgsql'
@@ -253,7 +253,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-lfs
+          packages: git git-annex git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-sqlite-migration test-sqlite'

From ca881e7e31310edf7ba1c5ee2d7e34f94ce9d1fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 25 Apr 2024 10:21:08 +0200
Subject: [PATCH 024/125] Fix failing tests

Multiple tests that worked fine on v1.20.4-1 started to fail after the
rebase onto v1.20.5-1. These tests are:
- TestGitAnnexPermissions/Private/Owner/HTTP/Init
- TestGitAnnexPermissions/Private/Owner/HTTP/Download
- TestGitAnnexPermissions/Private/Writer/HTTP/Init
- TestGitAnnexPermissions/Private/Writer/HTTP/Download
- TestGitAnnexPermissions/Private/Reader/HTTP/Init
- TestGitAnnexPermissions/Private/Reader/HTTP/Download

What these tests have in common is that they all operate on a private
repository via http with authentication.

They broke at some point between v1.20.4-1 and v1.20.5-1, so I did a
bisect between these two points running the offending tests. This
brought me to the conclusion that
ee48c0d5ea8f148c7f4a792b590d93eb51cbf67d introduced the issue.

The thing is, this commit does not change any code, it only changes the
test environment. Among other things that didn't look as suspicious, it
changes the container image from a bespoke test_env image based on
debian bullseye to a node image based on debian bookworm. Obviously,
this means that there are many version differences between the two.

The first one I looked at was git. The previous bullseye image used a
manually installed git version 2.40.0, while the bookworm image has
2.39.2 installed. Updating git in the new image did not fix the issue,
however.

The next thing I looked at was the git-annex version. Bullseye had
8.20210223 installed and worked, while bookworm used 10.20230126 when
the tests broke. So I tried my luck upgrading to a more recent version
via neurodebian (10.20240227-1~ndall+1). This still worked fine on
bullseye and now also works fine on bookworm.

I have no idea why this specific version of git-annex broke the tests,
but at least there was a commit to pinpoint this to, which isn't always
the case with docker images silently changing beneath you...

Below are the versions as they are reported by git and git-annex:

bullseye (works):

    git version 2.30.2
    git-annex version: 8.20210223
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22 bloomfilter-2.0.1.0 cryptonite-0.26 DAV-1.3.4 feed-1.3.0.1 ghc-8.8.4 http-client-0.6.4.1 persistent-sqlite-2.10.6.2 torrent-10000.1.1 uuid-1.3.13 yesod-1.6.1.0
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7

bullseye + git-annex from neurodebian (works):

    git version 2.30.2
    git-annex version: 10.20240227-1~ndall+1
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Benchmark Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22.1 bloomfilter-2.0.1.0 cryptonite-0.29 DAV-1.3.4 feed-1.3.2.1 ghc-9.0.2 http-client-0.7.13.1 persistent-sqlite-2.13.1.0 torrent-10000.1.1 uuid-1.3.15 yesod-1.6.2.1
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8 9 10
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7 8 9 10

bookworm (fails):

    git version 2.39.2
    git-annex version: 10.20230126
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Benchmark Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22.1 bloomfilter-2.0.1.0 cryptonite-0.29 DAV-1.3.4 feed-1.3.2.1 ghc-9.0.2 http-client-0.7.13.1 persistent-sqlite-2.13.1.0 torrent-10000.1.1 uuid-1.3.15 yesod-1.6.2.1
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8 9 10
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7 8 9 10

bookworm + git-annex from neurodebian (works):

    git version 2.39.2
    git-annex version: 10.20240227-1~ndall+1
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Benchmark Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22.1 bloomfilter-2.0.1.0 cryptonite-0.29 DAV-1.3.4 feed-1.3.2.1 ghc-9.0.2 http-client-0.7.13.1 persistent-sqlite-2.13.1.0 torrent-10000.1.1 uuid-1.3.15 yesod-1.6.2.1
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8 9 10
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7 8 9 10
---
 .forgejo/workflows-composite/apt-install-from/action.yaml | 3 +++
 .forgejo/workflows/testing.yml                            | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows-composite/apt-install-from/action.yaml b/.forgejo/workflows-composite/apt-install-from/action.yaml
index 615e7cb184..ab55883a11 100644
--- a/.forgejo/workflows-composite/apt-install-from/action.yaml
+++ b/.forgejo/workflows-composite/apt-install-from/action.yaml
@@ -13,6 +13,8 @@ runs:
       run: |
         export DEBIAN_FRONTEND=noninteractive
         echo "deb http://deb.debian.org/debian/ ${RELEASE} main" > "/etc/apt/sources.list.d/${RELEASE}.list"
+        wget -O- http://neuro.debian.net/lists/bookworm.de-fzj.libre | tee /etc/apt/sources.list.d/neurodebian.sources.list
+        apt-key adv --recv-keys --keyserver hkps://keyserver.ubuntu.com 0xA5D32F012649A5A9
       env:
         RELEASE: ${{inputs.release}}
     - name: install packages
@@ -24,6 +26,7 @@ runs:
     - name: remove temporary package list to prevent using it in other steps
       run: |
         rm "/etc/apt/sources.list.d/${RELEASE}.list"
+        rm "/etc/apt/sources.list.d/neurodebian.sources.list"
         apt-get update -qq
       env:
         RELEASE: ${{inputs.release}}
diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index fb5def2028..3d73df5066 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -196,7 +196,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-annex git-lfs
+          packages: git git-annex-standalone git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-mysql-migration test-mysql'
@@ -232,7 +232,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-annex git-lfs
+          packages: git git-annex-standalone git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-pgsql-migration test-pgsql'
@@ -253,7 +253,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-annex git-lfs
+          packages: git git-annex-standalone git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-sqlite-migration test-sqlite'

From ffae358704e389e36cc44e389dd1539515af0e76 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Mon, 19 Sep 2022 17:22:42 -0400
Subject: [PATCH 025/125] git-annex: add configuration setting [annex].ENABLED

Fixes https://github.com/neuropoly/gitea/issues/8

Co-authored-by: Mathieu Guay-Paquet <mathieu.guaypaquet@gmail.com>
---
 cmd/serv.go                         |  3 +--
 cmd/web.go                          |  4 ++++
 custom/conf/app.example.ini         |  9 +++++++++
 modules/setting/annex.go            | 20 ++++++++++++++++++++
 modules/setting/setting.go          |  1 +
 routers/private/serv.go             |  2 +-
 tests/integration/git_annex_test.go |  9 +++------
 tests/mysql.ini.tmpl                |  3 +++
 tests/pgsql.ini.tmpl                |  3 +++
 tests/sqlite.ini.tmpl               |  3 +++
 10 files changed, 48 insertions(+), 9 deletions(-)
 create mode 100644 modules/setting/annex.go

diff --git a/cmd/serv.go b/cmd/serv.go
index 7d16547053..ac4aa36599 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -215,8 +215,7 @@ func runServ(c *cli.Context) error {
 	}
 
 	if verb == gitAnnexShellVerb {
-		// if !setting.Annex.Enabled { // TODO: https://github.com/neuropoly/gitea/issues/8
-		if false {
+		if !setting.Annex.Enabled {
 			return fail(ctx, "Unknown git command", "git-annex request over SSH denied, git-annex support is disabled")
 		}
 
diff --git a/cmd/web.go b/cmd/web.go
index 44babd51c5..a817204aa6 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -311,6 +311,10 @@ func listen(m http.Handler, handleRedirector bool) error {
 		log.Info("LFS server enabled")
 	}
 
+	if setting.Annex.Enabled {
+		log.Info("git-annex enabled")
+	}
+
 	var err error
 	switch setting.Protocol {
 	case setting.HTTP:
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index ee8ad66668..486adc60a0 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -2678,6 +2678,15 @@ LEVEL = Info
 ;; Limit the number of concurrent upload/download operations within a batch
 ;BATCH_OPERATION_CONCURRENCY = 8
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[annex]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Whether git-annex is enabled; defaults to false
+;ENABLED = false
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; settings for packages, will override storage setting
diff --git a/modules/setting/annex.go b/modules/setting/annex.go
new file mode 100644
index 0000000000..a0eeac9bb8
--- /dev/null
+++ b/modules/setting/annex.go
@@ -0,0 +1,20 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package setting
+
+import (
+	"code.gitea.io/gitea/modules/log"
+)
+
+// Annex represents the configuration for git-annex
+var Annex = struct {
+	Enabled bool `ini:"ENABLED"`
+}{}
+
+func loadAnnexFrom(rootCfg ConfigProvider) {
+	sec := rootCfg.Section("annex")
+	if err := sec.MapTo(&Annex); err != nil {
+		log.Fatal("Failed to map Annex settings: %v", err)
+	}
+}
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index c9d30836ac..9710fb23d8 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -153,6 +153,7 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 	loadCamoFrom(cfg)
 	loadI18nFrom(cfg)
 	loadGitFrom(cfg)
+	loadAnnexFrom(cfg)
 	loadMirrorFrom(cfg)
 	loadMarkupFrom(cfg)
 	loadQuotaFrom(cfg)
diff --git a/routers/private/serv.go b/routers/private/serv.go
index b42fbc04f4..a3a0c6961a 100644
--- a/routers/private/serv.go
+++ b/routers/private/serv.go
@@ -289,7 +289,7 @@ func ServCommand(ctx *context.PrivateContext) {
 			repo.IsPrivate ||
 			owner.Visibility.IsPrivate() ||
 			(user != nil && user.IsRestricted) || // user will be nil if the key is a deploykey
-			( /*setting.Annex.Enabled && */ len(verbs) > 0 && verbs[0] == "git-annex-shell") || // git-annex has its own permission enforcement, for which we expose results.UserMode
+			(setting.Annex.Enabled && len(verbs) > 0 && verbs[0] == "git-annex-shell") || // git-annex has its own permission enforcement, for which we expose results.UserMode
 			setting.Service.RequireSignInView) {
 		if key.Type == asymkey_model.KeyTypeDeploy {
 			results.UserMode = deployKey.Mode
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index f52f8759b1..9b8c53ff59 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -62,12 +62,9 @@ Test that permissions are enforced on git-annex-shell commands.
 	Along the way, test that uploading, downloading, and deleting all work.
 */
 func TestGitAnnexPermissions(t *testing.T) {
-	/*
-		// TODO: look into how LFS did this
-		if !setting.Annex.Enabled {
-			t.Skip()
-		}
-	*/
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
 
 	// Each case below is split so that 'clone' is done as
 	// the repo owner, but 'copy' as the user under test.
diff --git a/tests/mysql.ini.tmpl b/tests/mysql.ini.tmpl
index e15e79952b..b8320265ab 100644
--- a/tests/mysql.ini.tmpl
+++ b/tests/mysql.ini.tmpl
@@ -97,6 +97,9 @@ DISABLE_QUERY_AUTH_TOKEN = true
 [lfs]
 PATH = tests/{{TEST_TYPE}}/gitea-{{TEST_TYPE}}-mysql/data/lfs
 
+[annex]
+ENABLED = true
+
 [packages]
 ENABLED = true
 
diff --git a/tests/pgsql.ini.tmpl b/tests/pgsql.ini.tmpl
index 340531fb38..781508a648 100644
--- a/tests/pgsql.ini.tmpl
+++ b/tests/pgsql.ini.tmpl
@@ -122,6 +122,9 @@ MINIO_LOCATION = us-east-1
 MINIO_USE_SSL = false
 MINIO_CHECKSUM_ALGORITHM = md5
 
+[annex]
+ENABLED = true
+
 [packages]
 ENABLED = true
 
diff --git a/tests/sqlite.ini.tmpl b/tests/sqlite.ini.tmpl
index 277916a539..231c0d19c2 100644
--- a/tests/sqlite.ini.tmpl
+++ b/tests/sqlite.ini.tmpl
@@ -102,6 +102,9 @@ JWT_SECRET = KZb_QLUd4fYVyxetjxC4eZkrBgWM2SndOOWDNtgUUko
 [lfs]
 PATH = tests/{{TEST_TYPE}}/gitea-{{TEST_TYPE}}-sqlite/data/lfs
 
+[annex]
+ENABLED = true
+
 [packages]
 ENABLED = true
 

From 48f21fd213e6ce2b3823714695591d5acf5d68ce Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Tue, 20 Sep 2022 16:17:56 -0400
Subject: [PATCH 026/125] git-annex: support downloading over HTTP

This makes HTTP symmetric with SSH clone URLs.

This gives us the fancy feature of _anonymous_ downloads,
so people can access datasets without having to set up an
account or manage ssh keys.

Previously, to access "open access" data shared this way,
users would need to:

  1. Create an account on gitea.example.com
  2. Create ssh keys
  3. Upload ssh keys (and make sure to find and upload the correct file)
  4. `git clone git@gitea.example.com:user/dataset.git`
  5. `cd dataset`
  6. `git annex get`

This cuts that down to just the last three steps:

  1. `git clone https://gitea.example.com/user/dataset.git`
  2. `cd dataset`
  3. `git annex get`

This is significantly simpler for downstream users, especially for those
unfamiliar with the command line.

Unfortunately there's no uploading. While git-annex supports uploading
over HTTP to S3 and some other special remotes, it seems to fail on a
_plain_ HTTP remote. See https://github.com/neuropoly/gitea/issues/7
and https://git-annex.branchable.com/forum/HTTP_uploads/#comment-ce28adc128fdefe4c4c49628174d9b92.

This is not a major loss since no one wants uploading to be anonymous anyway.

To support private repos, I had to hunt down and patch a secret extra security
corner that Gitea only applies to HTTP for some reason (services/auth/basic.go).

This was guided by https://git-annex.branchable.com/tips/setup_a_public_repository_on_a_web_site/

Fixes https://github.com/neuropoly/gitea/issues/3

Co-authored-by: Mathieu Guay-Paquet <mathieu.guaypaquet@polymtl.ca>
---
 modules/git/command.go                        |   3 +-
 routers/web/repo/githttp.go                   |  31 ++
 routers/web/web.go                            |  13 +
 services/auth/auth.go                         |  11 +
 services/auth/basic.go                        |   4 +-
 tests/integration/git_annex_test.go           | 360 +++++++++++++++++-
 .../git_helper_for_declarative_test.go        |   7 +
 7 files changed, 412 insertions(+), 17 deletions(-)

diff --git a/modules/git/command.go b/modules/git/command.go
index a3d43aaec6..d3e6b7b8bc 100644
--- a/modules/git/command.go
+++ b/modules/git/command.go
@@ -457,12 +457,13 @@ func (c *Command) RunStdBytes(opts *RunOpts) (stdout, stderr []byte, runErr RunS
 }
 
 // AllowLFSFiltersArgs return globalCommandArgs with lfs filter, it should only be used for tests
+// It also re-enables git-credential(1), which is used to test git-annex's HTTP support
 func AllowLFSFiltersArgs() TrustedCmdArgs {
 	// Now here we should explicitly allow lfs filters to run
 	filteredLFSGlobalArgs := make(TrustedCmdArgs, len(globalCommandArgs))
 	j := 0
 	for _, arg := range globalCommandArgs {
-		if strings.Contains(string(arg), "lfs") {
+		if strings.Contains(string(arg), "lfs") || strings.Contains(string(arg), "credential") {
 			j--
 		} else {
 			filteredLFSGlobalArgs[j] = arg
diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index c1adca174f..fc6864ed40 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -597,3 +597,34 @@ func GetIdxFile(ctx *context.Context) {
 		h.sendFile(ctx, "application/x-git-packed-objects-toc", "objects/pack/pack-"+ctx.Params("file")+".idx")
 	}
 }
+
+// GetAnnexObject implements git-annex dumb HTTP
+func GetAnnexObject(ctx *context.Context) {
+	h := httpBase(ctx)
+	if h != nil {
+		// git-annex objects are stored in .git/annex/objects/{hash1}/{hash2}/{key}/{key}
+		// where key is a string containing the size and (usually SHA256) checksum of the file,
+		// and hash1+hash2 are the first few bits of the md5sum of key itself.
+		// ({hash1}/{hash2}/ is just there to avoid putting too many files in one directory)
+		// ref: https://git-annex.branchable.com/internals/hashing/
+
+		// keyDir should = key, but we don't enforce that
+		object := path.Join(ctx.Params("hash1"), ctx.Params("hash2"), ctx.Params("keyDir"), ctx.Params("key"))
+
+		// Sanitize the input against directory traversals.
+		//
+		// This works because at the filesystem root, "/.." = "/";
+		// So if a path starts rooted ("/"), path.Clean(), which
+		// path.Join() calls internally, removes all '..' prefixes.
+		// After, this unroots the path unconditionally ([1:]), which
+		// works because we know the input is never supposed to be rooted.
+		//
+		// The router code probably also disallows "..", so this
+		// should be redundant, but it's defensive to keep it
+		// whenever touching filesystem paths with user input.
+		object = path.Join("/", object)[1:]
+
+		h.setHeaderCacheForever()
+		h.sendFile("application/octet-stream", "annex/objects/"+object)
+	}
+}
diff --git a/routers/web/web.go b/routers/web/web.go
index 4d8d280c89..bee637e76b 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -356,6 +356,13 @@ func registerRoutes(m *web.Route) {
 		}
 	}
 
+	annexEnabled := func(ctx *context.Context) {
+		if !setting.Annex.Enabled {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+	}
+
 	federationEnabled := func(ctx *context.Context) {
 		if !setting.Federation.Enabled {
 			ctx.Error(http.StatusNotFound)
@@ -1635,6 +1642,12 @@ func registerRoutes(m *web.Route) {
 				})
 			}, ignSignInAndCsrf, lfsServerEnabled)
 
+			m.Group("", func() {
+				// for git-annex
+				m.GetOptions("/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
+				m.GetOptions("/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
+			}, ignSignInAndCsrf, annexEnabled, context_service.UserAssignmentWeb())
+
 			gitHTTPRouters(m)
 		})
 	})
diff --git a/services/auth/auth.go b/services/auth/auth.go
index c10872313f..100e5b25a2 100644
--- a/services/auth/auth.go
+++ b/services/auth/auth.go
@@ -61,6 +61,17 @@ func isArchivePath(req *http.Request) bool {
 	return archivePathRe.MatchString(req.URL.Path)
 }
 
+var annexPathRe = regexp.MustCompile(`^/[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+/annex/`)
+
+func isAnnexPath(req *http.Request) bool {
+	if setting.Annex.Enabled {
+		// "/config" is git's config, not specifically git-annex's; but the only current
+		// user of it is when git-annex downloads the annex.uuid during 'git annex init'.
+		return strings.HasSuffix(req.URL.Path, "/config") || annexPathRe.MatchString(req.URL.Path)
+	}
+	return false
+}
+
 // handleSignIn clears existing session variables and stores new ones for the specified user object
 func handleSignIn(resp http.ResponseWriter, req *http.Request, sess SessionStore, user *user_model.User) {
 	// We need to regenerate the session...
diff --git a/services/auth/basic.go b/services/auth/basic.go
index d489164954..8e8fbfc9c7 100644
--- a/services/auth/basic.go
+++ b/services/auth/basic.go
@@ -43,8 +43,8 @@ func (b *Basic) Name() string {
 // name/token on successful validation.
 // Returns nil if header is empty or validation fails.
 func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
-	// Basic authentication should only fire on API, Download or on Git or LFSPaths
-	if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) {
+	// Basic authentication should only fire on API, Download or on Git, LFSPaths or Git-Annex paths
+	if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) && !isAnnexPath(req) {
 		return nil, nil
 	}
 
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 9b8c53ff59..89a5cb2389 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -59,7 +59,8 @@ func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext,
 /*
 Test that permissions are enforced on git-annex-shell commands.
 
-	Along the way, test that uploading, downloading, and deleting all work.
+	Along the way, this also tests that uploading, downloading, and deleting all work,
+	so we haven't written separate tests for those.
 */
 func TestGitAnnexPermissions(t *testing.T) {
 	if !setting.Annex.Enabled {
@@ -75,6 +76,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 	// 'annex copy' -- potentially leaving a security gap.
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		// Tell git-annex to allow http://127.0.0.1, http://localhost and http://::1. Without
+		// this, all `git annex` commands will silently fail when run against http:// remotes
+		// without explaining what's wrong.
+		//
+		// Note: onGiteaRun() sets up an alternate HOME so this actually edits
+		//       tests/integration/gitea-integration-*/data/home/.gitconfig and
+		//       if you're debugging you need to remember to match that.
+		_, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global").AddArguments("annex.security.allowed-ip-addresses", "all").RunStdString(&git.RunOpts{})
+		require.NoError(t, err)
+
 		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
 			t.Run("Public", func(t *testing.T) {
 				defer tests.PrintCurrentTest(t)()
@@ -89,8 +100,6 @@ func TestGitAnnexPermissions(t *testing.T) {
 				require.NoError(t, err)
 				require.False(t, repo.IsPrivate)
 
-				// Remote addresses of the repo
-				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
 				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
 
 				// Different sessions, so we can test different permissions.
@@ -112,6 +121,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -139,6 +150,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -147,6 +183,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -174,6 +212,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -182,6 +245,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -209,6 +274,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Outsider", func(t *testing.T) {
@@ -217,6 +307,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -244,6 +336,61 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
+				})
+
+				t.Run("Anonymous", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					// Only HTTP has an anonymous mode
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+					})
 				})
 
 				t.Run("Delete", func(t *testing.T) {
@@ -269,8 +416,6 @@ func TestGitAnnexPermissions(t *testing.T) {
 				require.NoError(t, err)
 				require.True(t, repo.IsPrivate)
 
-				// Remote addresses of the repo
-				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
 				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
 
 				// Different sessions, so we can test different permissions.
@@ -294,6 +439,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -321,6 +468,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -329,6 +501,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -356,6 +530,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -364,6 +563,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -391,6 +592,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Outsider", func(t *testing.T) {
@@ -399,6 +625,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -426,6 +654,61 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
+				})
+
+				t.Run("Anonymous", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					// Only HTTP has an anonymous mode
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+					})
 				})
 
 				t.Run("Delete", func(t *testing.T) {
@@ -447,7 +730,7 @@ Test that 'git annex init' works.
 	precondition: repoPath contains a pre-cloned repo set up by doInitAnnexRepository().
 */
 func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "init", "cloned-repo").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "init", "cloned-repo").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't `git annex init`: %w", err)
 	}
@@ -455,7 +738,7 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 	// - method 0: 'git config remote.origin.annex-uuid'.
 	//   Demonstrates that 'git annex init' successfully contacted
 	//   the remote git-annex and was able to learn its ID number.
-	readAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "remote.origin.annex-uuid").RunStdString(&git.RunOpts{Dir: repoPath})
+	readAnnexUUID, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config", "remote.origin.annex-uuid").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't read remote `git config remote.origin.annex-uuid`: %w", err)
 	}
@@ -466,7 +749,7 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 		return fmt.Errorf("'git config remote.origin.annex-uuid' should have been able to download the remote's uuid; but instead read '%s'", readAnnexUUID)
 	}
 
-	remoteAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: remoteRepoPath})
+	remoteAnnexUUID, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: remoteRepoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't read local `git config annex.uuid`: %w", err)
 	}
@@ -483,7 +766,7 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 
 	// - method 1: 'git annex whereis'.
 	//   Demonstrates that git-annex understands the annexed file can be found in the remote annex.
-	annexWhereis, _, err := git.NewCommand(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
+	annexWhereis, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't `git annex whereis large.bin`: %w", err)
 	}
@@ -502,7 +785,7 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	//     "git annex copy" will notice and run "git annex init", silently.
 	//     This shouldn't change any results, but be aware in case it does.
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "copy", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -550,12 +833,12 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--to", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "copy", "--to", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -667,7 +950,7 @@ func doInitAnnexRepository(repoPath string) error {
 	}
 
 	// 'git annex init'
-	err = git.NewCommand(git.DefaultContext, "annex", "init", "test-repo").Run(&git.RunOpts{Dir: repoPath})
+	err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "init", "test-repo").Run(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -705,7 +988,7 @@ func doInitRemoteAnnexRepository(t *testing.T, repoURL *url.URL) error {
 		return err
 	}
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--content").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "sync", "--content").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -757,3 +1040,52 @@ func withAnnexCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
 
 	withCtxKeyFile(t, ctx, callback)
 }
+
+/*
+Like withKeyFile(), but sets HTTP credentials instead of SSH credentials.
+
+	It does this by temporarily arranging through `git config --global`
+	to use git-credential-store(1) with the password written to a tempfile.
+
+	This is the only reliable way to pass HTTP credentials non-interactively
+	to git-annex.  See https://git-annex.branchable.com/bugs/http_remotes_ignore_annex.web-options_--netrc/#comment-b5a299e9826b322f2d85c96d4929a430
+	for joeyh's proclamation on the subject.
+
+	This **is only effective** when used around git.NewCommandContextNoGlobals() calls.
+	git.NewCommand() disables credential.helper as a precaution (see modules/git/git.go).
+
+	In contrast, the tests in git_test.go put the password in the remote's URL like
+	`git config remote.origin.url http://user2:password@localhost:3003/user2/repo-name.git`,
+	writing the password in repoPath+"/.git/config". That would be equally good, except
+	that git-annex ignores it!
+*/
+func withAnnexCtxHTTPPassword(t *testing.T, u *url.URL, ctx APITestContext, callback func()) {
+	credentialedURL := *u
+	credentialedURL.User = url.UserPassword(ctx.Username, userPassword) // NB: all test users use the same password
+
+	creds := path.Join(t.TempDir(), "creds")
+	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()), 0o600))
+
+	originalCredentialHelper, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper").RunStdString(&git.RunOpts{})
+	if err != nil && !err.IsExitCode(1) {
+		// ignore the 'error' thrown when credential.helper is unset (when git config returns 1)
+		// but catch all others
+		require.NoError(t, err)
+	}
+	hasOriginalCredentialHelper := (err == nil)
+
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper", fmt.Sprintf("store --file=%s", creds)).RunStdString(&git.RunOpts{})
+	require.NoError(t, err)
+
+	defer (func() {
+		// reset
+		if hasOriginalCredentialHelper {
+			_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global").AddArguments("credential.helper").AddDynamicArguments(originalCredentialHelper).RunStdString(&git.RunOpts{})
+		} else {
+			_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global").AddOptionValues("--unset").AddArguments("credential.helper").RunStdString(&git.RunOpts{})
+		}
+		require.NoError(t, err)
+	})()
+
+	callback()
+}
diff --git a/tests/integration/git_helper_for_declarative_test.go b/tests/integration/git_helper_for_declarative_test.go
index 1e39b988fd..575f01dcdb 100644
--- a/tests/integration/git_helper_for_declarative_test.go
+++ b/tests/integration/git_helper_for_declarative_test.go
@@ -73,6 +73,13 @@ func withKeyFile(t *testing.T, keyname string, callback func(string)) {
 	callback(keyFile)
 }
 
+func createHTTPUrl(gitPath string, u *url.URL) *url.URL {
+	// this assumes u contains the HTTP base URL that Gitea is running on
+	u2 := *u
+	u2.Path = gitPath
+	return &u2
+}
+
 func createSSHUrl(gitPath string, u *url.URL) *url.URL {
 	u2 := *u
 	u2.Scheme = "ssh"

From 0bdc572df99f1aea6f7ac068c3dabe3089ebbcc3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 1 Mar 2024 14:23:33 +0100
Subject: [PATCH 027/125] Replace m.GetOptions with m.Methods

This applies the same changes that were done in
265cd70bdb152291a13e520cff1da70b8c029432 to the git-annex specific
routes as well.
---
 routers/web/web.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/routers/web/web.go b/routers/web/web.go
index bee637e76b..4480be4498 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -1644,8 +1644,8 @@ func registerRoutes(m *web.Route) {
 
 			m.Group("", func() {
 				// for git-annex
-				m.GetOptions("/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
-				m.GetOptions("/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
+				m.Methods("GET,OPTIONS", "/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
+				m.Methods("GET,OPTIONS", "/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
 			}, ignSignInAndCsrf, annexEnabled, context_service.UserAssignmentWeb())
 
 			gitHTTPRouters(m)

From f863511a14a9180b666d0f60e135397d4cee079e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 29 Apr 2024 15:52:47 +0200
Subject: [PATCH 028/125] Fix exit code check for git command

The err.IsExitCode method was changed to a function IsErrorExitCode
taking err as its first argument in
1e7a6483b8322ad5e1183545a6283f137a0546ac.
---
 tests/integration/git_annex_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 89a5cb2389..5423d86d34 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -1067,7 +1067,7 @@ func withAnnexCtxHTTPPassword(t *testing.T, u *url.URL, ctx APITestContext, call
 	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()), 0o600))
 
 	originalCredentialHelper, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper").RunStdString(&git.RunOpts{})
-	if err != nil && !err.IsExitCode(1) {
+	if err != nil && !git.IsErrorExitCode(err, 1) {
 		// ignore the 'error' thrown when credential.helper is unset (when git config returns 1)
 		// but catch all others
 		require.NoError(t, err)

From 768a3a9c83576f5cc9dd4b6b7ef9f10a5d4041ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 29 Apr 2024 17:44:58 +0200
Subject: [PATCH 029/125] Adapt patch to upstream changes

Usage of `path` was replaced by `path/filepath` in upstream forgejo, and
it made sense to use that as well where `path` was previously used. The
`setHeaderCacheForever` function and the `sendFile` method had their
signature changed.
---
 routers/web/repo/githttp.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index fc6864ed40..d715b6bdf0 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -609,7 +609,7 @@ func GetAnnexObject(ctx *context.Context) {
 		// ref: https://git-annex.branchable.com/internals/hashing/
 
 		// keyDir should = key, but we don't enforce that
-		object := path.Join(ctx.Params("hash1"), ctx.Params("hash2"), ctx.Params("keyDir"), ctx.Params("key"))
+		object := filepath.Join(ctx.Params("hash1"), ctx.Params("hash2"), ctx.Params("keyDir"), ctx.Params("key"))
 
 		// Sanitize the input against directory traversals.
 		//
@@ -622,9 +622,9 @@ func GetAnnexObject(ctx *context.Context) {
 		// The router code probably also disallows "..", so this
 		// should be redundant, but it's defensive to keep it
 		// whenever touching filesystem paths with user input.
-		object = path.Join("/", object)[1:]
+		object = filepath.Join(string(filepath.Separator), object)[1:]
 
-		h.setHeaderCacheForever()
-		h.sendFile("application/octet-stream", "annex/objects/"+object)
+		setHeaderCacheForever(ctx)
+		h.sendFile(ctx, "application/octet-stream", "annex/objects/"+object)
 	}
 }

From 0371c78a77165a505c875746b63f4ad9d5157c22 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 30 Apr 2024 11:25:16 +0200
Subject: [PATCH 030/125] Adapt patch to upstream changes

The "context_service" import was changed to use the default name of just
"context". The patch set had to be adapted for that.
---
 routers/web/web.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routers/web/web.go b/routers/web/web.go
index 4480be4498..4cf4086aba 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -1646,7 +1646,7 @@ func registerRoutes(m *web.Route) {
 				// for git-annex
 				m.Methods("GET,OPTIONS", "/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
 				m.Methods("GET,OPTIONS", "/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
-			}, ignSignInAndCsrf, annexEnabled, context_service.UserAssignmentWeb())
+			}, ignSignInAndCsrf, annexEnabled, context.UserAssignmentWeb())
 
 			gitHTTPRouters(m)
 		})

From 5651c5a69dea5bdd9e766fc2a7ab34fe8c199d25 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Sun, 27 Nov 2022 00:28:55 -0500
Subject: [PATCH 031/125] git-annex: create modules/annex

This moves the `annexObjectPath()` helper out of the tests and into a
dedicated sub-package as `annex.ContentLocation()`, and expands it with
`.Pointer()` (which validates using `git annex examinekey`),
`.IsAnnexed()` and `.Content()` to make it a more useful module.

The tests retain their own wrapper version of `ContentLocation()`
because I tried to follow close to the API modules/lfs uses, which in
terms of abstract `git.Blob` and `git.TreeEntry` objects, not in terms
of `repoPath string`s which are more convenient for the tests.
---
 modules/annex/annex.go              | 154 ++++++++++++++++++++++++++++
 modules/git/blob.go                 |   4 +
 tests/integration/git_annex_test.go |  41 ++++----
 3 files changed, 181 insertions(+), 18 deletions(-)
 create mode 100644 modules/annex/annex.go

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
new file mode 100644
index 0000000000..bb049d77ed
--- /dev/null
+++ b/modules/annex/annex.go
@@ -0,0 +1,154 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Unlike modules/lfs, which operates mainly on git.Blobs, this operates on git.TreeEntrys.
+// The motivation for this is that TreeEntrys have an easy pointer to the on-disk repo path,
+// while blobs do not (in fact, if building with TAGS=gogit, blobs might exist only in a mock
+// filesystem, living only in process RAM). We must have the on-disk path to do anything
+// useful with git-annex because all of its interesting data is on-disk under .git/annex/.
+
+package annex
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+)
+
+const (
+	// > The maximum size of a pointer file is 32 kb.
+	// - https://git-annex.branchable.com/internals/pointer_file/
+	// It's unclear if that's kilobytes or kibibytes; assuming kibibytes:
+	blobSizeCutoff = 32 * 1024
+)
+
+// ErrInvalidPointer occurs if the pointer's value doesn't parse
+var ErrInvalidPointer = errors.New("Not a git-annex pointer")
+
+// Gets the content of the blob as raw text, up to n bytes.
+// (the pre-existing blob.GetBlobContent() has a hardcoded 1024-byte limit)
+func getBlobContent(b *git.Blob, n int) (string, error) {
+	dataRc, err := b.DataAsync()
+	if err != nil {
+		return "", err
+	}
+	defer dataRc.Close()
+	buf := make([]byte, n)
+	n, _ = util.ReadAtMost(dataRc, buf)
+	buf = buf[:n]
+	return string(buf), nil
+}
+
+func Pointer(blob *git.Blob) (string, error) {
+	// git-annex doesn't seem fully spec what its pointer are, but
+	// the fullest description is here:
+	// https://git-annex.branchable.com/internals/pointer_file/
+
+	// a pointer can be:
+	// the original format, generated by `git annex add`: a symlink to '.git/annex/objects/$HASHDIR/$HASHDIR2/$KEY/$KEY'
+	// the newer, git-lfs influenced, format, generated by `git annex smudge`: a text file containing '/annex/objects/$KEY'
+	//
+	// in either case we can extract the $KEY the same way, and we need not actually know if it's a symlink or not because
+	// git.Blob.DataAsync() works like open() + readlink(), handling both cases in one.
+
+	if blob.Size() > blobSizeCutoff {
+		// > The maximum size of a pointer file is 32 kb. If it is any longer, it is not considered to be a valid pointer file.
+		// https://git-annex.branchable.com/internals/pointer_file/
+
+		// It's unclear to me whether the same size limit applies to symlink-pointers, but it seems sensible to limit them too.
+		return "", ErrInvalidPointer
+	}
+
+	pointer, err := getBlobContent(blob, blobSizeCutoff)
+	if err != nil {
+		return "", fmt.Errorf("error reading %s: %w", blob.Name(), err)
+	}
+
+	// the spec says a pointer file can contain multiple lines each with a pointer in them
+	// but that makes no sense to me, so I'm just ignoring all but the first
+	lines := strings.Split(pointer, "\n")
+	if len(lines) < 1 {
+		return "", ErrInvalidPointer
+	}
+	pointer = lines[0]
+
+	// in both the symlink and pointer-file formats, the pointer must have "/annex/" somewhere in it
+	if !strings.Contains(pointer, "/annex/") {
+		return "", ErrInvalidPointer
+	}
+
+	// extract $KEY
+	pointer = path.Base(strings.TrimSpace(pointer))
+
+	// ask git-annex's opinion on $KEY
+	// XXX: this is probably a bit slow, especially if this operation gets run often
+	//      and examinekey is not that strict:
+	//      - it doesn't enforce that the "BACKEND" tag is one it knows,
+	//      - it doesn't enforce that the fields and their format fit the "BACKEND" tag
+	//      so maybe this is a wasteful step
+	_, examineStderr, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "examinekey").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
+	if err != nil {
+		// TODO: make ErrInvalidPointer into a type capable of wrapping err
+		if strings.TrimSpace(examineStderr) == "git-annex: bad key" {
+			return "", ErrInvalidPointer
+		}
+		return "", err
+	}
+
+	return pointer, nil
+}
+
+// return the absolute path of the content pointed to by the annex pointer stored in the git object
+// errors if the content is not found in this repo
+func ContentLocation(blob *git.Blob) (string, error) {
+	pointer, err := Pointer(blob)
+	if err != nil {
+		return "", err
+	}
+
+	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", blob.Repo().Path, pointer, err)
+	}
+	contentLocation = strings.TrimSpace(contentLocation)
+	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
+	contentLocation = path.Join(blob.Repo().Path, contentLocation)
+
+	return contentLocation, nil
+}
+
+// returns a stream open to the annex content
+func Content(blob *git.Blob) (*os.File, error) {
+	contentLocation, err := ContentLocation(blob)
+	if err != nil {
+		return nil, err
+	}
+
+	return os.Open(contentLocation)
+}
+
+// whether the object appears to be a valid annex pointer
+// does *not* verify if the content is actually in this repo;
+// for that, use ContentLocation()
+func IsAnnexed(blob *git.Blob) (bool, error) {
+	if !setting.Annex.Enabled {
+		return false, nil
+	}
+
+	// Pointer() is written to only return well-formed pointers
+	// so the test is just to see if it errors
+	_, err := Pointer(blob)
+	if err != nil {
+		if errors.Is(err, ErrInvalidPointer) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
diff --git a/modules/git/blob.go b/modules/git/blob.go
index 2f02693428..bbfab7d005 100644
--- a/modules/git/blob.go
+++ b/modules/git/blob.go
@@ -126,6 +126,10 @@ func (b *blobReader) Close() error {
 	return nil
 }
 
+func (b *Blob) Repo() *Repository {
+	return b.repo
+}
+
 // Name returns name of the tree entry this blob object was created from (or empty string)
 func (b *Blob) Name() string {
 	return b.name
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 5423d86d34..95693219f6 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -19,6 +19,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/perm"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
@@ -791,13 +792,13 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	}
 
 	// verify the file was downloaded
-	localObjectPath, err := annexObjectPath(repoPath, "large.bin")
+	localObjectPath, err := contentLocation(repoPath, "large.bin")
 	if err != nil {
 		return err
 	}
 	// localObjectPath := path.Join(repoPath, "large.bin") // or, just compare against the checked-out file
 
-	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "large.bin")
+	remoteObjectPath, err := contentLocation(remoteRepoPath, "large.bin")
 	if err != nil {
 		return err
 	}
@@ -844,13 +845,13 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	}
 
 	// verify the file was uploaded
-	localObjectPath, err := annexObjectPath(repoPath, "contribution.bin")
+	localObjectPath, err := contentLocation(repoPath, "contribution.bin")
 	if err != nil {
 		return err
 	}
 	// localObjectPath := path.Join(repoPath, "contribution.bin") // or, just compare against the checked-out file
 
-	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "contribution.bin")
+	remoteObjectPath, err := contentLocation(remoteRepoPath, "contribution.bin")
 	if err != nil {
 		return err
 	}
@@ -1004,26 +1005,30 @@ Find the path in .git/annex/objects/ of the contents for a given annexed file.
 
 	TODO: pass a parameter to allow examining non-HEAD branches
 */
-func annexObjectPath(repoPath, file string) (string, error) {
-	// NB: `git annex lookupkey` is more reliable, but doesn't work in bare repos.
-	annexKey, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "show").AddDynamicArguments("HEAD:" + file).RunStdString(&git.RunOpts{Dir: repoPath})
+func contentLocation(repoPath, file string) (path string, err error) {
+	path = ""
+
+	repo, err := git.OpenRepository(git.DefaultContext, repoPath)
 	if err != nil {
-		return "", fmt.Errorf("in %s: %w", repoPath, err) // the error from git prints the filename but not repo
+		return path, nil
 	}
 
-	// There are two formats an annexed file pointer might be:
-	// * a symlink to .git/annex/objects/$HASHDIR/$ANNEX_KEY/$ANNEX_KEY - used by files created with 'git annex add'
-	// * a text file containing /annex/objects/$ANNEX_KEY - used by files for which 'git add' was configured to run git-annex-smudge
-	// This recovers $ANNEX_KEY from either case:
-	annexKey = path.Base(strings.TrimSpace(annexKey))
-
-	contentPath, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(annexKey).RunStdString(&git.RunOpts{Dir: repoPath})
+	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
 	if err != nil {
-		return "", fmt.Errorf("in %s: %s does not seem to be annexed: %w", repoPath, file, err)
+		return path, nil
 	}
-	contentPath = strings.TrimSpace(contentPath)
 
-	return path.Join(repoPath, contentPath), nil
+	commit, err := repo.GetCommit(commitID)
+	if err != nil {
+		return path, nil
+	}
+
+	treeEntry, err := commit.GetTreeEntryByPath(file)
+	if err != nil {
+		return path, nil
+	}
+
+	return annex.ContentLocation(treeEntry.Blob())
 }
 
 /* like withKeyFile(), but automatically sets it the account given in ctx for use by git-annex */

From cb218de0d2f57aa003af3b3e61ed905c2d960552 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 14 May 2024 11:48:43 +0200
Subject: [PATCH 032/125] Adapt patch to upstream changes

The git repository must be closed after using it. Without this change
some tests started to fail due to the lingering repository running into
a timeout.
---
 tests/integration/git_annex_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 95693219f6..d8e1d49904 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -1012,6 +1012,7 @@ func contentLocation(repoPath, file string) (path string, err error) {
 	if err != nil {
 		return path, nil
 	}
+	defer repo.Close()
 
 	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
 	if err != nil {

From 7ed9add4c5d0d12923eca6253067b2b0bdddd66e Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Sun, 27 Nov 2022 00:40:06 -0500
Subject: [PATCH 033/125] git-annex: make /media/ download annexed content

Previously, Gitea's LFS support allowed direct-downloads of LFS content,
via http://$HOSTNAME:$PORT/$USER/$REPO/media/branch/$BRANCH/$FILE
Expand that grace to git-annex too. Now /media should provide the
relevant *content* from the .git/annex/objects/ folder.

This adds tests too. And expands the tests to try symlink-based annexing,
since /media implicitly supports both that and pointer-file-based annexing.
---
 routers/web/repo/download.go        |  21 ++++
 tests/integration/git_annex_test.go | 146 ++++++++++++++++++++++++----
 2 files changed, 148 insertions(+), 19 deletions(-)

diff --git a/routers/web/repo/download.go b/routers/web/repo/download.go
index 1e87bbf015..aefaa79521 100644
--- a/routers/web/repo/download.go
+++ b/routers/web/repo/download.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	git_model "code.gitea.io/gitea/models/git"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/httpcache"
 	"code.gitea.io/gitea/modules/lfs"
@@ -79,6 +80,26 @@ func ServeBlobOrLFS(ctx *context.Context, blob *git.Blob, lastModified *time.Tim
 	}
 	closed = true
 
+	// check for git-annex files
+	// (this code is weirdly redundant because I'm trying not to delete any lines in order to make merges easier)
+	isAnnexed, err := annex.IsAnnexed(blob)
+	if err != nil {
+		ctx.ServerError("annex.IsAnnexed", err)
+		return err
+	}
+	if isAnnexed {
+		content, err := annex.Content(blob)
+		if err != nil {
+			// XXX are there any other possible failure cases here?
+			// there are, there could be unrelated io errors; those should be ctx.ServerError()s
+			ctx.NotFound("annex.Content", err)
+			return err
+		}
+		defer content.Close()
+		common.ServeContentByReadSeeker(ctx.Base, ctx.Repo.TreePath, lastModified, content)
+		return nil
+	}
+
 	return common.ServeBlob(ctx.Base, ctx.Repo.TreePath, blob, lastModified)
 }
 
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index d8e1d49904..efdd65d617 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -7,7 +7,9 @@ package integration
 import (
 	"errors"
 	"fmt"
+	"io"
 	"math/rand"
+	"net/http"
 	"net/url"
 	"os"
 	"path"
@@ -57,6 +59,63 @@ func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext,
 	return nil
 }
 
+func TestGitAnnexMedia(t *testing.T) {
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		ctx := NewAPITestContext(t, "user2", "annex-media-test", auth_model.AccessTokenScopeWriteRepository)
+
+		// create a public repo
+		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+
+		// the filenames here correspond to specific cases defined in doInitAnnexRepository()
+		t.Run("AnnexSymlink", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			doAnnexMediaTest(t, ctx, "annexed.tiff")
+		})
+		t.Run("AnnexPointer", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			doAnnexMediaTest(t, ctx, "annexed.bin")
+		})
+	})
+}
+
+func doAnnexMediaTest(t *testing.T, ctx APITestContext, file string) {
+	// Make sure that downloading via /media on the website recognizes it should give the annexed content
+
+	// TODO:
+	// - [ ] roll this into TestGitAnnexPermissions to ensure that permission enforcement works correctly even on /media?
+
+	session := loginUser(t, ctx.Username) // logs in to the http:// site/API, storing a cookie;
+	// this is a different auth method than the git+ssh:// or git+http:// protocols TestGitAnnexPermissions uses!
+
+	// compute server-side path of the annexed file
+	remoteRepoPath := path.Join(setting.RepoRootPath, ctx.GitPath())
+	remoteObjectPath, err := contentLocation(remoteRepoPath, file)
+	require.NoError(t, err)
+
+	// download annexed file
+	localObjectPath := path.Join(t.TempDir(), file)
+	fd, err := os.OpenFile(localObjectPath, os.O_CREATE|os.O_WRONLY, 0o777)
+	defer fd.Close()
+	require.NoError(t, err)
+
+	mediaLink := path.Join("/", ctx.Username, ctx.Reponame, "/media/branch/master", file)
+	req := NewRequest(t, "GET", mediaLink)
+	resp := session.MakeRequest(t, req, http.StatusOK)
+
+	_, err = io.Copy(fd, resp.Body)
+	require.NoError(t, err)
+	fd.Close()
+
+	// verify the download
+	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	require.NoError(t, err)
+	require.True(t, match, "Annexed files should be the same")
+}
+
 /*
 Test that permissions are enforced on git-annex-shell commands.
 
@@ -766,16 +825,16 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 	}
 
 	// - method 1: 'git annex whereis'.
-	//   Demonstrates that git-annex understands the annexed file can be found in the remote annex.
-	annexWhereis, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
+	//   Demonstrates that git-annex understands annexed files can be found in the remote annex.
+	annexWhereis, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "whereis", "annexed.bin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
-		return fmt.Errorf("Couldn't `git annex whereis large.bin`: %w", err)
+		return fmt.Errorf("Couldn't `git annex whereis`: %w", err)
 	}
 	// Note: this regex is unanchored because 'whereis' outputs multiple lines containing
 	//       headers and 1+ remotes and we just want to find one of them.
 	match = regexp.MustCompile(regexp.QuoteMeta(remoteAnnexUUID) + " -- .* \\[origin\\]\n").MatchString(annexWhereis)
 	if !match {
-		return errors.New("'git annex whereis' should report large.bin is known to be in [origin]")
+		return errors.New("'git annex whereis' should report files are known to be in [origin]")
 	}
 
 	return nil
@@ -791,27 +850,56 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	// verify the file was downloaded
-	localObjectPath, err := contentLocation(repoPath, "large.bin")
-	if err != nil {
-		return err
-	}
-	// localObjectPath := path.Join(repoPath, "large.bin") // or, just compare against the checked-out file
+	// verify the files downloaded
 
-	remoteObjectPath, err := contentLocation(remoteRepoPath, "large.bin")
+	cmp := func(filename string) error {
+		localObjectPath, err := contentLocation(repoPath, filename)
+		if err != nil {
+			return err
+		}
+		// localObjectPath := path.Join(repoPath, filename) // or, just compare against the checked-out file
+
+		remoteObjectPath, err := contentLocation(remoteRepoPath, filename)
+		if err != nil {
+			return err
+		}
+
+		match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
+		if err != nil {
+			return err
+		}
+		if !match {
+			return errors.New("Annexed files should be the same")
+		}
+
+		return nil
+	}
+
+	// this is the annex-symlink file
+	stat, err := os.Lstat(path.Join(repoPath, "annexed.tiff"))
 	if err != nil {
+		return fmt.Errorf("Lstat: %w", err)
+	}
+	if !((stat.Mode() & os.ModeSymlink) != 0) {
+		// this line is really just double-checking that the text fixture is set up correctly
+		return errors.New("*.tiff should be a symlink")
+	}
+	if err = cmp("annexed.tiff"); err != nil {
 		return err
 	}
 
-	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
+	// this is the annex-pointer file
+	stat, err = os.Lstat(path.Join(repoPath, "annexed.bin"))
 	if err != nil {
-		return err
+		return fmt.Errorf("Lstat: %w", err)
 	}
-	if !match {
-		return errors.New("Annexed files should be the same")
+	if !((stat.Mode() & os.ModeSymlink) == 0) {
+		// this line is really just double-checking that the text fixture is set up correctly
+		return errors.New("*.bin should not be a symlink")
 	}
+	err = cmp("annexed.bin")
 
-	return nil
+	return err
 }
 
 func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
@@ -956,16 +1044,36 @@ func doInitAnnexRepository(repoPath string) error {
 		return err
 	}
 
-	// add a file to the annex
-	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "large.bin"))
+	// add files to the annex, stored via annex symlinks
+	// // a binary file
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "annexed.tiff"))
 	if err != nil {
 		return err
 	}
+
+	err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "add", ".").Run(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// add files to the annex, stored via git-annex-smudge
+	// // a binary file
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "annexed.bin"))
+	if err != nil {
+		return err
+	}
+
+	if err != nil {
+		return err
+	}
+
 	err = git.AddChanges(repoPath, false, ".")
 	if err != nil {
 		return err
 	}
-	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex a file"})
+
+	// save everything
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex files"})
 	if err != nil {
 		return err
 	}

From db5eaa1a240f28b20706c4182b23c652c7ca98c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 24 May 2024 13:21:20 +0200
Subject: [PATCH 034/125] Adapt patch to upstream changes

Test with different objectFormats.
---
 tests/integration/git_annex_test.go | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index efdd65d617..34dceefb9b 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -65,19 +65,21 @@ func TestGitAnnexMedia(t *testing.T) {
 	}
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		ctx := NewAPITestContext(t, "user2", "annex-media-test", auth_model.AccessTokenScopeWriteRepository)
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			ctx := NewAPITestContext(t, "user2", "annex-media-test"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
 
-		// create a public repo
-		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+			// create a public repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false, objectFormat))
 
-		// the filenames here correspond to specific cases defined in doInitAnnexRepository()
-		t.Run("AnnexSymlink", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-			doAnnexMediaTest(t, ctx, "annexed.tiff")
-		})
-		t.Run("AnnexPointer", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-			doAnnexMediaTest(t, ctx, "annexed.bin")
+			// the filenames here correspond to specific cases defined in doInitAnnexRepository()
+			t.Run("AnnexSymlink", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+				doAnnexMediaTest(t, ctx, "annexed.tiff")
+			})
+			t.Run("AnnexPointer", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+				doAnnexMediaTest(t, ctx, "annexed.bin")
+			})
 		})
 	})
 }

From ce1660d41bc620957f7365d7d6f290df95eccb4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 14 May 2024 14:34:44 +0200
Subject: [PATCH 035/125] Adapt patch to upstream changes

Use tests.FileCmp instead of util.FileCmp.
---
 tests/integration/git_annex_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 34dceefb9b..b3dc2b974d 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -113,7 +113,7 @@ func doAnnexMediaTest(t *testing.T, ctx APITestContext, file string) {
 	fd.Close()
 
 	// verify the download
-	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
 	require.NoError(t, err)
 	require.True(t, match, "Annexed files should be the same")
 }

From 9ffebb2f84e2c82d59e55bae4e6f8bec7227c42e Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Sun, 27 Nov 2022 02:13:46 -0500
Subject: [PATCH 036/125] git-annex: views for annex files

This updates the repo index/file view endpoints so annex files match the way
LFS files are rendered, making annexed files accessible via the web instead of
being black boxes only accessible by git clone.

This mostly just duplicates the existing LFS logic. It doesn't try to combine itself
with the existing logic, to make merging with upstream easier. If upstream ever
decides to accept, I would like to try to merge the redundant logic.

The one bit that doesn't directly copy LFS is my choice to hide annex-symlinks.
LFS files are always _pointer files_ and therefore always render with the "file"
icon and no special label, but annex files come in two flavours: symlinks or
pointer files. I've conflated both kinds to try to give a consistent experience.

The tests in here ensure the correct download link (/media, from the last PR)
renders in both the toolbar and, if a binary file (like most annexed files will be),
in the main pane, but it also adds quite a bit of code to make sure text files
that happen to be annexed are dug out and rendered inline like LFS files are.
---
 modules/base/tool.go                |   7 ++
 options/locale/locale_cs-CZ.ini     |   2 +
 options/locale/locale_de-DE.ini     |   2 +
 options/locale/locale_el-GR.ini     |   2 +
 options/locale/locale_en-US.ini     |   2 +
 options/locale/locale_es-ES.ini     |   2 +
 options/locale/locale_fa-IR.ini     |   2 +
 options/locale/locale_fr-FR.ini     |   2 +
 options/locale/locale_hu-HU.ini     |   2 +
 options/locale/locale_id-ID.ini     |   2 +
 options/locale/locale_is-IS.ini     |   1 +
 options/locale/locale_it-IT.ini     |   2 +
 options/locale/locale_ja-JP.ini     |   2 +
 options/locale/locale_ko-KR.ini     |   1 +
 options/locale/locale_lv-LV.ini     |   4 +-
 options/locale/locale_nl-NL.ini     |   2 +
 options/locale/locale_pl-PL.ini     |   2 +
 options/locale/locale_pt-BR.ini     |   2 +
 options/locale/locale_pt-PT.ini     |   2 +
 options/locale/locale_ru-RU.ini     |   2 +
 options/locale/locale_si-LK.ini     |   2 +
 options/locale/locale_sk-SK.ini     |   1 +
 options/locale/locale_sv-SE.ini     |   2 +
 options/locale/locale_tr-TR.ini     |   2 +
 options/locale/locale_uk-UA.ini     |   2 +
 options/locale/locale_zh-CN.ini     |   2 +
 options/locale/locale_zh-HK.ini     |   3 +-
 options/locale/locale_zh-TW.ini     |   2 +
 routers/web/repo/view.go            |  66 +++++++++++---
 templates/repo/file_info.tmpl       |   1 +
 tests/integration/git_annex_test.go | 133 ++++++++++++++++++++++++++++
 31 files changed, 248 insertions(+), 13 deletions(-)

diff --git a/modules/base/tool.go b/modules/base/tool.go
index 02f1db59d3..3d0fe73823 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -16,6 +16,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 
@@ -103,6 +104,12 @@ func Int64sToStrings(ints []int64) []string {
 func EntryIcon(entry *git.TreeEntry) string {
 	switch {
 	case entry.IsLink():
+		isAnnexed, _ := annex.IsAnnexed(entry.Blob())
+		if isAnnexed {
+			// git-annex files are sometimes stored as symlinks;
+			// short-circuit that so like LFS they are displayed as regular files
+			return "file"
+		}
 		te, _, err := entry.FollowLink()
 		if err != nil {
 			log.Debug(err.Error())
diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 7d8fdee165..e050e0db12 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -1315,6 +1315,7 @@ view_git_blame=Zobrazit git blame
 video_not_supported_in_browser=Váš prohlížeč nepodporuje značku HTML5 „video“.
 audio_not_supported_in_browser=Váš prohlížeč nepodporuje značku HTML5 „audio“.
 stored_lfs=Uloženo pomocí Git LFS
+stored_annex=Uloženo pomocí Git Annex
 symbolic_link=Symbolický odkaz
 executable_file=Spustitelný soubor
 vendored = Vendorováno
@@ -1340,6 +1341,7 @@ editor.upload_file=Nahrát soubor
 editor.edit_file=Upravit soubor
 editor.preview_changes=Náhled změn
 editor.cannot_edit_lfs_files=LFS soubory nemohou být upravovány přes webové rozhraní.
+editor.cannot_edit_annex_files=Annex soubory nemohou být upravovány přes webové rozhraní.
 editor.cannot_edit_non_text_files=Binární soubory nemohou být upravovány přes webové rozhraní.
 editor.edit_this_file=Upravit soubor
 editor.this_file_locked=Soubor je uzamčen
diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 6a479b7629..7a28d08e49 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -1315,6 +1315,7 @@ view_git_blame=„git blame“ ansehen
 video_not_supported_in_browser=Dein Browser unterstützt das HTML5-„video“-Tag nicht.
 audio_not_supported_in_browser=Dein Browser unterstützt das HTML5-„audio“-Tag nicht.
 stored_lfs=Gespeichert mit Git LFS
+stored_annex=Gespeichert mit Git Annex
 symbolic_link=Softlink
 executable_file=Ausführbare Datei
 commit_graph=Commit-Graph
@@ -1338,6 +1339,7 @@ editor.upload_file=Datei hochladen
 editor.edit_file=Datei bearbeiten
 editor.preview_changes=Vorschau der Änderungen
 editor.cannot_edit_lfs_files=LFS-Dateien können im Webinterface nicht bearbeitet werden.
+editor.cannot_edit_annex_files=Annex-Dateien können im Webinterface nicht bearbeitet werden.
 editor.cannot_edit_non_text_files=Binärdateien können nicht im Webinterface bearbeitet werden.
 editor.edit_this_file=Datei bearbeiten
 editor.this_file_locked=Datei ist gesperrt
diff --git a/options/locale/locale_el-GR.ini b/options/locale/locale_el-GR.ini
index cb99563034..3cbf24c3ff 100644
--- a/options/locale/locale_el-GR.ini
+++ b/options/locale/locale_el-GR.ini
@@ -1314,6 +1314,7 @@ view_git_blame=Προβολή git blame
 video_not_supported_in_browser=Το πρόγραμμα περιήγησής σας δεν υποστηρίζει την ετικέτα HTML5 «video».
 audio_not_supported_in_browser=Το πρόγραμμα περιήγησής σας δεν υποστηρίζει την ετικέτα HTML5 «audio».
 stored_lfs=Αποθηκεύτηκε με το Git LFS
+stored_annex=Αποθηκεύτηκε με το Git Annex
 symbolic_link=Symbolic link
 executable_file=Εκτελέσιμο αρχείο
 commit_graph=Γράφημα υποβολών
@@ -1337,6 +1338,7 @@ editor.upload_file=Ανέβασμα αρχείου
 editor.edit_file=Επεξεργασία αρχείου
 editor.preview_changes=Προεπισκόπηση αλλαγών
 editor.cannot_edit_lfs_files=Τα αρχεία LFS δεν μπορούν να επεξεργαστούν στη διεπαφή web.
+editor.cannot_edit_annex_files=Τα αρχεία Annex δεν μπορούν να επεξεργαστούν στη διεπαφή web.
 editor.cannot_edit_non_text_files=Τα δυαδικά αρχεία δεν μπορούν να επεξεργαστούν στη διεπαφή web.
 editor.edit_this_file=Επεξεργασία αρχείου
 editor.this_file_locked=Το αρχείο είναι κλειδωμένο
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index d2f47adab2..93c1eaa770 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -1336,6 +1336,7 @@ view_git_blame = View git blame
 video_not_supported_in_browser = Your browser does not support the HTML5 "video" tag.
 audio_not_supported_in_browser = Your browser does not support the HTML5 "audio" tag.
 stored_lfs = Stored with Git LFS
+stored_annex = Stored with Git Annex
 symbolic_link = Symbolic link
 executable_file = Executable file
 vendored = Vendored
@@ -1363,6 +1364,7 @@ editor.upload_file = Upload file
 editor.edit_file = Edit file
 editor.preview_changes = Preview changes
 editor.cannot_edit_lfs_files = LFS files cannot be edited in the web interface.
+editor.cannot_edit_annex_files = Annex files cannot be edited in the web interface.
 editor.cannot_edit_non_text_files = Binary files cannot be edited in the web interface.
 editor.edit_this_file = Edit file
 editor.this_file_locked = File is locked
diff --git a/options/locale/locale_es-ES.ini b/options/locale/locale_es-ES.ini
index 4f9d141423..b55ff3181c 100644
--- a/options/locale/locale_es-ES.ini
+++ b/options/locale/locale_es-ES.ini
@@ -1310,6 +1310,7 @@ view_git_blame=Ver Git blame
 video_not_supported_in_browser=Su navegador no soporta el tag "video" de HTML5.
 audio_not_supported_in_browser=Su navegador no soporta el tag "audio" de HTML5.
 stored_lfs=Almacenados con Git LFS
+stored_annex=Almacenados con Git Annex
 symbolic_link=Enlace simbólico
 executable_file=Archivo ejecutable
 commit_graph=Gráfico de commits
@@ -1333,6 +1334,7 @@ editor.upload_file=Subir archivo
 editor.edit_file=Editar archivo
 editor.preview_changes=Vista previa de los cambios
 editor.cannot_edit_lfs_files=Los archivos LFS no se pueden editar en la interfaz web.
+editor.cannot_edit_annex_files=Los archivos Annex no se pueden editar en la interfaz web.
 editor.cannot_edit_non_text_files=Los archivos binarios no se pueden editar en la interfaz web.
 editor.edit_this_file=Editar archivo
 editor.this_file_locked=El archivo está bloqueado
diff --git a/options/locale/locale_fa-IR.ini b/options/locale/locale_fa-IR.ini
index 8960be8bf4..3d5be270a4 100644
--- a/options/locale/locale_fa-IR.ini
+++ b/options/locale/locale_fa-IR.ini
@@ -951,6 +951,7 @@ file_copy_permalink=پرمالینک را کپی کنید
 video_not_supported_in_browser=مرورگر شما از تگ video که در HTML5 تعریف شده است، پشتیبانی نمی کند.
 audio_not_supported_in_browser=مرورگر شما از تگ audio که در HTML5 تعریف شده است، پشتیبانی نمی کند.
 stored_lfs=ذخیره شده با GIT LFS
+stored_annex=ذخیره شده با GIT Annex
 symbolic_link=پیوند نمادین
 commit_graph=نمودار کامیت
 commit_graph.select=انتخاب برنچها
@@ -968,6 +969,7 @@ editor.upload_file=بارگذاری پرونده
 editor.edit_file=ویرایش پرونده
 editor.preview_changes=پیش نمایش تغییرات
 editor.cannot_edit_lfs_files=پرونده های LFS در صحفه وب قابل تغییر نیست.
+editor.cannot_edit_annex_files=پرونده های Annex در صحفه وب قابل تغییر نیست.
 editor.cannot_edit_non_text_files=پرونده‎های دودویی در صفحه وب قابل تغییر نیست.
 editor.edit_this_file=ویرایش پرونده
 editor.this_file_locked=پرونده قفل شده است
diff --git a/options/locale/locale_fr-FR.ini b/options/locale/locale_fr-FR.ini
index 2585eb1616..06d594594a 100644
--- a/options/locale/locale_fr-FR.ini
+++ b/options/locale/locale_fr-FR.ini
@@ -1316,6 +1316,7 @@ view_git_blame=Voir Git blame
 video_not_supported_in_browser=Votre navigateur ne supporte pas la balise « vidéo » HTML5.
 audio_not_supported_in_browser=Votre navigateur ne supporte pas la balise « audio » HTML5.
 stored_lfs=Stocké avec Git LFS
+stored_annex=Stocké avec Git Annex
 symbolic_link=Lien symbolique
 executable_file=Fichier exécutable
 vendored = Vendored
@@ -1341,6 +1342,7 @@ editor.upload_file=Téléverser un fichier
 editor.edit_file=Modifier le fichier
 editor.preview_changes=Aperçu des modifications
 editor.cannot_edit_lfs_files=Les fichiers LFS ne peuvent pas être modifiés dans l'interface web.
+editor.cannot_edit_annex_files=Les fichiers Annex ne peuvent pas être modifiés dans l'interface web.
 editor.cannot_edit_non_text_files=Les fichiers binaires ne peuvent pas être édités dans l'interface web.
 editor.edit_this_file=Modifier le fichier
 editor.this_file_locked=Le fichier est verrouillé
diff --git a/options/locale/locale_hu-HU.ini b/options/locale/locale_hu-HU.ini
index 57555b90a2..ef94d2de0c 100644
--- a/options/locale/locale_hu-HU.ini
+++ b/options/locale/locale_hu-HU.ini
@@ -787,6 +787,7 @@ file_too_large=Ez a fájl túl nagy ahhoz, hogy megjelenítsük.
 video_not_supported_in_browser=A böngésző nem támogatja a HTML5 video tag-et.
 audio_not_supported_in_browser=A böngésző nem támogatja a HTML5 audio tag-et.
 stored_lfs=Git LFS-el eltárolva
+stored_annex=Git Annex-el eltárolva
 symbolic_link=Szimbolikus hivatkozás
 commit_graph=Commit gráf
 commit_graph.hide_pr_refs=Pull request-ek elrejtése
@@ -799,6 +800,7 @@ editor.upload_file=Fájl feltöltése
 editor.edit_file=Fájl szerkesztése
 editor.preview_changes=Változások előnézete
 editor.cannot_edit_lfs_files=LFS fájlok nem szerkeszthetőek a webes felületen.
+editor.cannot_edit_annex_files=Annex fájlok nem szerkeszthetőek a webes felületen.
 editor.cannot_edit_non_text_files=Bináris fájlok nem szerkeszthetőek a webes felületen.
 editor.edit_this_file=Fájl szerkesztése
 editor.this_file_locked=Zárolt állomány
diff --git a/options/locale/locale_id-ID.ini b/options/locale/locale_id-ID.ini
index 1e0044e4ce..8cf3457aae 100644
--- a/options/locale/locale_id-ID.ini
+++ b/options/locale/locale_id-ID.ini
@@ -596,6 +596,7 @@ file_permalink=Permalink
 file_too_large=Berkas terlalu besar untuk ditampilkan.
 
 stored_lfs=Tersimpan dengan GIT LFS
+stored_annex=Tersimpan dengan GIT Annex
 commit_graph=Grafik Komit
 blame=Salahkan
 normal_view=Pandangan Normal
@@ -607,6 +608,7 @@ editor.upload_file=Unggah Berkas
 editor.edit_file=Sunting Berkas
 editor.preview_changes=Tinjau Perubahan
 editor.cannot_edit_lfs_files=Berkas LFS tidak dapat disunting dalam antarmuka web.
+editor.cannot_edit_annex_files=Berkas Annex tidak dapat disunting dalam antarmuka web.
 editor.cannot_edit_non_text_files=Berkas biner tidak dapat disunting dalam antarmuka web.
 editor.edit_this_file=Sunting Berkas
 editor.this_file_locked=Berkas terkunci
diff --git a/options/locale/locale_is-IS.ini b/options/locale/locale_is-IS.ini
index 3a6e844de2..b3cf17fccc 100644
--- a/options/locale/locale_is-IS.ini
+++ b/options/locale/locale_is-IS.ini
@@ -680,6 +680,7 @@ file_view_rendered=Skoða Unnið
 
 file_copy_permalink=Afrita Varanlega Slóð
 stored_lfs=Geymt með Git LFS
+stored_annex=Geymt með Git Annex
 commit_graph.hide_pr_refs=Fela Sameiningarbeiðnir
 commit_graph.monochrome=Einlitað
 commit_graph.color=Litað
diff --git a/options/locale/locale_it-IT.ini b/options/locale/locale_it-IT.ini
index 2f5bf6f0c1..1e4aeab768 100644
--- a/options/locale/locale_it-IT.ini
+++ b/options/locale/locale_it-IT.ini
@@ -1267,6 +1267,7 @@ view_git_blame=Visualizza git incolpa
 video_not_supported_in_browser=Il tuo browser non supporta le etichette "video" di HTML5.
 audio_not_supported_in_browser=Il tuo browser non supporta le etichette "audio" di HTML5.
 stored_lfs=Memorizzati con Git LFS
+stored_annex=Memorizzati con Git Annex
 symbolic_link=Link Simbolico
 commit_graph=Grafico dei commit
 commit_graph.select=Seleziona rami
@@ -1285,6 +1286,7 @@ editor.upload_file=Carica file
 editor.edit_file=Modifica file
 editor.preview_changes=Anteprima modifiche
 editor.cannot_edit_lfs_files=I file LFS non possono essere modificati nell'interfaccia web.
+editor.cannot_edit_annex_files=I file Annex non possono essere modificati nell'interfaccia web.
 editor.cannot_edit_non_text_files=I file binari non possono essere modificati tramite interfaccia web.
 editor.edit_this_file=Modifica file
 editor.this_file_locked=Il file è bloccato
diff --git a/options/locale/locale_ja-JP.ini b/options/locale/locale_ja-JP.ini
index b0fc38d911..4ea433106e 100644
--- a/options/locale/locale_ja-JP.ini
+++ b/options/locale/locale_ja-JP.ini
@@ -1305,6 +1305,7 @@ view_git_blame=Git Blameを表示
 video_not_supported_in_browser=このブラウザはHTML5のvideoタグをサポートしていません。
 audio_not_supported_in_browser=このブラウザーはHTML5のaudioタグをサポートしていません。
 stored_lfs=Git LFSで保管されています
+stored_annex=Git Annexで保管されています
 symbolic_link=シンボリック リンク
 executable_file=実行ファイル
 commit_graph=コミットグラフ
@@ -1328,6 +1329,7 @@ editor.upload_file=ファイルをアップロード
 editor.edit_file=ファイルを編集
 editor.preview_changes=変更をプレビュー
 editor.cannot_edit_lfs_files=LFSのファイルはWebインターフェースで編集できません。
+editor.cannot_edit_annex_files=AnnexのファイルはWebインターフェースで編集できません。
 editor.cannot_edit_non_text_files=バイナリファイルはWebインターフェースで編集できません。
 editor.edit_this_file=ファイルを編集
 editor.this_file_locked=ファイルはロックされています
diff --git a/options/locale/locale_ko-KR.ini b/options/locale/locale_ko-KR.ini
index a2a50d7440..72b4ed3588 100644
--- a/options/locale/locale_ko-KR.ini
+++ b/options/locale/locale_ko-KR.ini
@@ -821,6 +821,7 @@ file_too_large=보여주기에는 파일이 너무 큽니다.
 video_not_supported_in_browser=당신의 브라우저가 HTML5의 "video" 태그를 지원하지 않습니다.
 audio_not_supported_in_browser=당신의 브라우저가 HTML5의 "audio" 태그를 지원하지 않습니다.
 stored_lfs=Git LFS에 저장되어 있습니다
+stored_annex=Git Annex에 저장되어 있습니다
 commit_graph=커밋 그래프
 
 editor.new_file=새 파일
diff --git a/options/locale/locale_lv-LV.ini b/options/locale/locale_lv-LV.ini
index c179158213..96108677fd 100644
--- a/options/locale/locale_lv-LV.ini
+++ b/options/locale/locale_lv-LV.ini
@@ -1314,6 +1314,7 @@ view_git_blame=Apskatīt Git izmaiņu veicējus
 video_not_supported_in_browser=Pārlūks neatbalsta HTML5 tagu "video".
 audio_not_supported_in_browser=Pārlūks neatbalsta HTML5 tagu "audio".
 stored_lfs=Saglabāts Git LFS
+stored_annex=Saglabāts Git Annex
 symbolic_link=Simboliska saite
 executable_file=Izpildāma datne
 commit_graph=Iesūtījumu karte
@@ -1337,6 +1338,7 @@ editor.upload_file=Augšupielādēt datni
 editor.edit_file=Labot datni
 editor.preview_changes=Priekšskatīt izmaiņas
 editor.cannot_edit_lfs_files=LFS datnes tīmekļa saskarnē nevar labot.
+editor.cannot_edit_annex_files=Annex datnes tīmekļa saskarnē nevar labot.
 editor.cannot_edit_non_text_files=Binārās datnes tīmekļa saskarnē nevar labot.
 editor.edit_this_file=Labot datni
 editor.this_file_locked=Datne ir slēgta
@@ -4023,4 +4025,4 @@ filepreview.lines = %[1]d. līdz %[2]d. rinda %[3]s
 filepreview.truncated = Priekšskatījums tika saīsināts
 
 [translation_meta]
-test = Šī ir pārbaudes virkne. Tā netiek attēlota Forgejo saskarnē, bet tiek izmantota pārbaudes nolūkiem. Droši var ievadīt "ok", lai ietaupītu laiku (vai kādu jautru faktu pēc izvēles), lai sasniegtu to saldo 100% pabeigšanas atzīmi.
\ No newline at end of file
+test = Šī ir pārbaudes virkne. Tā netiek attēlota Forgejo saskarnē, bet tiek izmantota pārbaudes nolūkiem. Droši var ievadīt "ok", lai ietaupītu laiku (vai kādu jautru faktu pēc izvēles), lai sasniegtu to saldo 100% pabeigšanas atzīmi.
diff --git a/options/locale/locale_nl-NL.ini b/options/locale/locale_nl-NL.ini
index c884160c56..3f89d43053 100644
--- a/options/locale/locale_nl-NL.ini
+++ b/options/locale/locale_nl-NL.ini
@@ -1283,6 +1283,7 @@ view_git_blame=Bekijk git blame
 video_not_supported_in_browser=Uw browser ondersteunt de HTML5 "video" element niet.
 audio_not_supported_in_browser=Uw browser ondersteunt de HTML5 "audio" element niet.
 stored_lfs=Opgeslagen met Git LFS
+stored_annex=Opgeslagen met Git Annex
 symbolic_link=Symbolische link
 commit_graph=Commit grafiek
 commit_graph.select=Selecteer branches
@@ -1301,6 +1302,7 @@ editor.upload_file=Upload bestand
 editor.edit_file=Bewerk bestand
 editor.preview_changes=Voorbeeld tonen
 editor.cannot_edit_lfs_files=LFS-bestanden kunnen niet worden bewerkt in de webinterface.
+editor.cannot_edit_annex_files=Annex-bestanden kunnen niet worden bewerkt in de webinterface.
 editor.cannot_edit_non_text_files=Binaire bestanden kunnen niet worden bewerkt in de webinterface.
 editor.edit_this_file=Bewerk bestand
 editor.this_file_locked=Bestand is vergrendeld
diff --git a/options/locale/locale_pl-PL.ini b/options/locale/locale_pl-PL.ini
index 2af7648f8d..51bdca6464 100644
--- a/options/locale/locale_pl-PL.ini
+++ b/options/locale/locale_pl-PL.ini
@@ -1148,6 +1148,7 @@ file_copy_permalink=Kopiuj bezpośredni odnośnik
 video_not_supported_in_browser=Twoja przeglądarka nie obsługuje znacznika HTML5 "video".
 audio_not_supported_in_browser=Twoja przeglądarka nie obsługuje znacznika HTML5 "audio".
 stored_lfs=Przechowane za pomocą Git LFS
+stored_annex=Przechowane za pomocą Git Annex
 symbolic_link=Dowiązanie symboliczne
 commit_graph=Wykres commitów
 commit_graph.select=Wybierz gałęzie
@@ -1165,6 +1166,7 @@ editor.upload_file=Wyślij plik
 editor.edit_file=Edytuj plik
 editor.preview_changes=Podgląd zmian
 editor.cannot_edit_lfs_files=Pliki LFS nie mogą być edytowane poprzez interfejs przeglądarkowy.
+editor.cannot_edit_annex_files=Pliki Annex nie mogą być edytowane poprzez interfejs przeglądarkowy.
 editor.cannot_edit_non_text_files=Pliki binarne nie mogą być edytowane poprzez interfejs przeglądarkowy.
 editor.edit_this_file=Edytuj plik
 editor.this_file_locked=Plik jest zablokowany
diff --git a/options/locale/locale_pt-BR.ini b/options/locale/locale_pt-BR.ini
index d826e60417..d85e00234b 100644
--- a/options/locale/locale_pt-BR.ini
+++ b/options/locale/locale_pt-BR.ini
@@ -1308,6 +1308,7 @@ view_git_blame=Ver git blame
 video_not_supported_in_browser=Seu navegador não tem suporte para a tag "video" do HTML5.
 audio_not_supported_in_browser=Seu navegador não tem suporte para a tag "audio" do HTML5.
 stored_lfs=Armazenado com Git LFS
+stored_annex=Armazenado com Git Annex
 symbolic_link=Link simbólico
 executable_file=Arquivo executável
 commit_graph=Gráfico de commits
@@ -1331,6 +1332,7 @@ editor.upload_file=Enviar arquivo
 editor.edit_file=Editar arquivo
 editor.preview_changes=Pré-visualizar alterações
 editor.cannot_edit_lfs_files=Arquivos LFS não podem ser editados na interface web.
+editor.cannot_edit_annex_files=Arquivos Annex não podem ser editados na interface web.
 editor.cannot_edit_non_text_files=Arquivos binários não podem ser editados na interface web.
 editor.edit_this_file=Editar arquivo
 editor.this_file_locked=Arquivo está bloqueado
diff --git a/options/locale/locale_pt-PT.ini b/options/locale/locale_pt-PT.ini
index 309fdbe54d..23158b8215 100644
--- a/options/locale/locale_pt-PT.ini
+++ b/options/locale/locale_pt-PT.ini
@@ -1319,6 +1319,7 @@ view_git_blame=Ver git blame
 video_not_supported_in_browser=O seu navegador não suporta a etiqueta "video" do HTML5.
 audio_not_supported_in_browser=O seu navegador não suporta a etiqueta "audio" do HTML5.
 stored_lfs=Armazenado com Git LFS
+stored_annex=Armazenado com Git Annex
 symbolic_link=Ligação simbólica
 executable_file=Ficheiro executável
 vendored=Externo
@@ -1344,6 +1345,7 @@ editor.upload_file=Carregar ficheiro
 editor.edit_file=Editar ficheiro
 editor.preview_changes=Pré-visualizar modificações
 editor.cannot_edit_lfs_files=Ficheiros LFS não podem ser editados na interface web.
+editor.cannot_edit_annex_files=Ficheiros Annex não podem ser editados na interface web.
 editor.cannot_edit_non_text_files=Ficheiros binários não podem ser editados na interface da web.
 editor.edit_this_file=Editar ficheiro
 editor.this_file_locked=Ficheiro bloqueado
diff --git a/options/locale/locale_ru-RU.ini b/options/locale/locale_ru-RU.ini
index ec844faea7..18c30e4dc7 100644
--- a/options/locale/locale_ru-RU.ini
+++ b/options/locale/locale_ru-RU.ini
@@ -1302,6 +1302,7 @@ view_git_blame=Показать git blame
 video_not_supported_in_browser=Ваш браузер не поддерживает тэг HTML5 «video».
 audio_not_supported_in_browser=Ваш браузер не поддерживает тэг HTML5 «audio».
 stored_lfs=Хранится Git LFS
+stored_annex=Хранится Git Annex
 symbolic_link=Символическая ссылка
 executable_file=Исполняемый файл
 commit_graph=Граф коммитов
@@ -1325,6 +1326,7 @@ editor.upload_file=Загрузить файл
 editor.edit_file=Редактировать файл
 editor.preview_changes=Просмотр изменений
 editor.cannot_edit_lfs_files=LFS файлы невозможно редактировать в веб-интерфейсе.
+editor.cannot_edit_annex_files=Annex файлы невозможно редактировать в веб-интерфейсе.
 editor.cannot_edit_non_text_files=Двоичные файлы нельзя редактировать в веб-интерфейсе.
 editor.edit_this_file=Редактировать файл
 editor.this_file_locked=Файл заблокирован
diff --git a/options/locale/locale_si-LK.ini b/options/locale/locale_si-LK.ini
index ac7627ca80..63c728c48b 100644
--- a/options/locale/locale_si-LK.ini
+++ b/options/locale/locale_si-LK.ini
@@ -889,6 +889,7 @@ file_copy_permalink=පිටපත් මාමලින්ක්
 video_not_supported_in_browser=ඔබගේ බ්රව්සරය HTML5 'වීඩියෝ' ටැගය සඳහා සහය නොදක්වයි.
 audio_not_supported_in_browser=ඔබගේ බ්රව්සරය HTML5 'ශ්රව්ය' ටැගය සඳහා සහය නොදක්වයි.
 stored_lfs=Git LFS සමඟ ගබඩා
+stored_annex=Git Annex සමඟ ගබඩා
 symbolic_link=සංකේතාත්මක සබැඳිය
 commit_graph=ප්රස්තාරය කැප
 commit_graph.select=ශාඛා තෝරන්න
@@ -906,6 +907,7 @@ editor.upload_file=ගොනුව උඩුගත කරන්න
 editor.edit_file=ගොනුව සංස්කරණය
 editor.preview_changes=වෙනස්කම් පෙරදසුන
 editor.cannot_edit_lfs_files=LFS ගොනු වෙබ් අතුරු මුහුණත තුළ සංස්කරණය කළ නොහැක.
+editor.cannot_edit_annex_files=Annex ගොනු වෙබ් අතුරු මුහුණත තුළ සංස්කරණය කළ නොහැක.
 editor.cannot_edit_non_text_files=ද්විමය ගොනු වෙබ් අතුරු මුහුණත තුළ සංස්කරණය කළ නොහැක.
 editor.edit_this_file=ගොනුව සංස්කරණය
 editor.this_file_locked=ගොනුවට අගුළු ලා ඇත
diff --git a/options/locale/locale_sk-SK.ini b/options/locale/locale_sk-SK.ini
index bd2ce203dd..cfb3d76a38 100644
--- a/options/locale/locale_sk-SK.ini
+++ b/options/locale/locale_sk-SK.ini
@@ -1010,6 +1010,7 @@ view_git_blame=Zobraziť Git Blame
 video_not_supported_in_browser=Váš prehliadač nepodporuje HTML5 tag 'video'.
 audio_not_supported_in_browser=Váš prehliadač nepodporuje HTML5 tag 'audio'.
 stored_lfs=Uložené pomocou Git LFS
+stored_annex=Uložené pomocou Git Annex
 symbolic_link=Symbolický odkaz
 commit_graph=Graf commitov
 line=riadok
diff --git a/options/locale/locale_sv-SE.ini b/options/locale/locale_sv-SE.ini
index 928d4a3f1e..7358e5a47e 100644
--- a/options/locale/locale_sv-SE.ini
+++ b/options/locale/locale_sv-SE.ini
@@ -891,6 +891,7 @@ file_too_large=Filen är för stor för att visas.
 video_not_supported_in_browser=Din webbläsare stödjer ej HTML5-taggen "video".
 audio_not_supported_in_browser=Din webbläsare stödjer ej HTML5-taggen "audio".
 stored_lfs=Sparad med Git LFS
+stored_annex=Sparad med Git Annex
 symbolic_link=Symbolisk länk
 commit_graph=Commitgraf
 commit_graph.monochrome=Mono
@@ -904,6 +905,7 @@ editor.upload_file=Ladda upp fil
 editor.edit_file=Redigera fil
 editor.preview_changes=Förhandsgranska ändringar
 editor.cannot_edit_lfs_files=LFS-filer kan inte redigeras i webbgränssnittet.
+editor.cannot_edit_annex_files=Annex-filer kan inte redigeras i webbgränssnittet.
 editor.cannot_edit_non_text_files=Binära filer kan inte redigeras genom webbgränssnittet.
 editor.edit_this_file=Redigera fil
 editor.this_file_locked=Filen är låst
diff --git a/options/locale/locale_tr-TR.ini b/options/locale/locale_tr-TR.ini
index 82476d4ae8..8890f6df95 100644
--- a/options/locale/locale_tr-TR.ini
+++ b/options/locale/locale_tr-TR.ini
@@ -1290,6 +1290,7 @@ view_git_blame=Git Suç Görüntüle
 video_not_supported_in_browser=Tarayıcınız HTML5 'video' etiketini desteklemiyor.
 audio_not_supported_in_browser=Tarayıcınız HTML5 'audio' etiketini desteklemiyor.
 stored_lfs=Git LFS ile depolandı
+stored_annex=Git Annex ile depolandı
 symbolic_link=Sembolik Bağlantı
 executable_file=Çalıştırılabilir Dosya
 commit_graph=İşleme Grafiği
@@ -1313,6 +1314,7 @@ editor.upload_file=Dosya Yükle
 editor.edit_file=Dosyayı Düzenle
 editor.preview_changes=Değişiklikleri Önizle
 editor.cannot_edit_lfs_files=LFS dosyaları web arayüzünde düzenlenemez.
+editor.cannot_edit_annex_files=Annex dosyaları web arayüzünde düzenlenemez.
 editor.cannot_edit_non_text_files=Bu tür dosyalar web arayüzünden düzenlenemez.
 editor.edit_this_file=Dosyayı Düzenle
 editor.this_file_locked=Dosya kilitlendi
diff --git a/options/locale/locale_uk-UA.ini b/options/locale/locale_uk-UA.ini
index 2186f44719..c92ac9dcc7 100644
--- a/options/locale/locale_uk-UA.ini
+++ b/options/locale/locale_uk-UA.ini
@@ -1218,6 +1218,7 @@ file_copy_permalink=Копіювати постійне посилання
 video_not_supported_in_browser=Ваш браузер не підтримує тег HTML5 «video».
 audio_not_supported_in_browser=Ваш браузер не підтримує тег HTML5 «audio».
 stored_lfs=Збережено з Git LFS
+stored_annex=Збережено з Git Annex
 symbolic_link=Символічне посилання
 commit_graph=Графік комітів
 commit_graph.select=Виберіть гілки
@@ -1235,6 +1236,7 @@ editor.upload_file=Завантажити файл
 editor.edit_file=Редагувати файл
 editor.preview_changes=Попередній перегляд змін
 editor.cannot_edit_lfs_files=Файли LFS не можна редагувати в веб-інтерфейсі.
+editor.cannot_edit_annex_files=Файли Annex не можна редагувати в веб-інтерфейсі.
 editor.cannot_edit_non_text_files=Бінарні файли не можливо редагувати у веб-інтерфейсі.
 editor.edit_this_file=Редагувати файл
 editor.this_file_locked=Файл заблоковано
diff --git a/options/locale/locale_zh-CN.ini b/options/locale/locale_zh-CN.ini
index 7354a4d02b..62021be9fe 100644
--- a/options/locale/locale_zh-CN.ini
+++ b/options/locale/locale_zh-CN.ini
@@ -1317,6 +1317,7 @@ view_git_blame=查看 Git Blame
 video_not_supported_in_browser=您的浏览器不支持 HTML5 “video” 标签。
 audio_not_supported_in_browser=您的浏览器不支持 HTML5 “audio” 标签。
 stored_lfs=存储到Git LFS
+stored_annex=存储到Git Annex
 symbolic_link=符号链接
 executable_file=可执行文件
 vendored = Vendored
@@ -1342,6 +1343,7 @@ editor.upload_file=上传文件
 editor.edit_file=编辑文件
 editor.preview_changes=预览变更
 editor.cannot_edit_lfs_files=无法在 web 界面中编辑 lfs 文件。
+editor.cannot_edit_annex_files=无法在 web 界面中编辑 lfs 文件。
 editor.cannot_edit_non_text_files=网页不能编辑二进制文件。
 editor.edit_this_file=编辑文件
 editor.this_file_locked=文件已锁定
diff --git a/options/locale/locale_zh-HK.ini b/options/locale/locale_zh-HK.ini
index e5080e65bb..25dfcdf913 100644
--- a/options/locale/locale_zh-HK.ini
+++ b/options/locale/locale_zh-HK.ini
@@ -472,6 +472,7 @@ file_view_raw=查看原始文件
 file_permalink=永久連結
 
 stored_lfs=儲存到到 Git LFS
+stored_annex=儲存到到 Git Annex
 
 editor.preview_changes=預覽更改
 editor.or=或
@@ -1132,4 +1133,4 @@ runners.labels = 標籤
 
 [projects]
 
-[git.filemode]
\ No newline at end of file
+[git.filemode]
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index 5caafacce1..3dcce0bedd 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -1263,6 +1263,7 @@ view_git_blame=檢視 Git Blame
 video_not_supported_in_browser=您的瀏覽器不支援 HTML5 的「video」標籤。
 audio_not_supported_in_browser=您的瀏覽器不支援 HTML5 的「audio」標籤。
 stored_lfs=已使用 Git LFS 儲存
+stored_annex=已使用 Git Annex 儲存
 symbolic_link=符號連結
 commit_graph=提交線圖
 commit_graph.select=選擇分支
@@ -1282,6 +1283,7 @@ editor.upload_file=上傳檔案
 editor.edit_file=編輯檔案
 editor.preview_changes=預覽變更
 editor.cannot_edit_lfs_files=無法在 web 介面中編輯 LFS 檔。
+editor.cannot_edit_annex_files=無法在 web 介面中編輯 Annex 檔。
 editor.cannot_edit_non_text_files=網站介面不能編輯二進位檔案。
 editor.edit_this_file=編輯檔案
 editor.this_file_locked=檔案已被鎖定
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index fd8c1da058..59efa4334f 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -34,6 +34,7 @@ import (
 	unit_model "code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/actions"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/charset"
 	"code.gitea.io/gitea/modules/git"
@@ -209,14 +210,47 @@ func localizedExtensions(ext, languageCode string) (localizedExts []string) {
 }
 
 type fileInfo struct {
-	isTextFile bool
-	isLFSFile  bool
-	fileSize   int64
-	lfsMeta    *lfs.Pointer
-	st         typesniffer.SniffedType
+	isTextFile  bool
+	isLFSFile   bool
+	isAnnexFile bool
+	fileSize    int64
+	lfsMeta     *lfs.Pointer
+	st          typesniffer.SniffedType
 }
 
 func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte, io.ReadCloser, *fileInfo, error) {
+	isAnnexed, err := annex.IsAnnexed(blob)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	if isAnnexed {
+		// TODO: this code could be merged with the LFS case, especially the redundant type sniffer,
+		//       but it is *currently* written this way to make merging with the non-annex upstream easier:
+		//       this way, the git-annex patch is (mostly) pure additions.
+
+		annexContent, err := annex.Content(blob)
+		if err != nil {
+			// in the case where annex content is missing, what should happen?
+			// do we render the page with an error message?
+			// actually that's not a bad idea, there's some sort of error message situation
+			// TODO: display an error to the user explaining that their data is missing
+			return nil, nil, nil, err
+		}
+
+		stat, err := annexContent.Stat()
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		buf := make([]byte, 1024)
+		n, _ := util.ReadAtMost(annexContent, buf)
+		buf = buf[:n]
+
+		st := typesniffer.DetectContentType(buf)
+
+		return buf, annexContent, &fileInfo{st.IsText(), false, true, stat.Size(), nil, st}, nil
+	}
+
 	dataRc, err := blob.DataAsync()
 	if err != nil {
 		return nil, nil, nil, err
@@ -231,18 +265,18 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	// FIXME: what happens when README file is an image?
 	if !isTextFile || !setting.LFS.StartServer {
-		return buf, dataRc, &fileInfo{isTextFile, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
 	}
 
 	pointer, _ := lfs.ReadPointerFromBuffer(buf)
 	if !pointer.IsValid() { // fallback to plain file
-		return buf, dataRc, &fileInfo{isTextFile, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
 	}
 
 	meta, err := git_model.GetLFSMetaObjectByOid(ctx, repoID, pointer.Oid)
 	if err != nil { // fallback to plain file
 		log.Warn("Unable to access LFS pointer %s in repo %d: %v", pointer.Oid, repoID, err)
-		return buf, dataRc, &fileInfo{isTextFile, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
 	}
 
 	dataRc.Close()
@@ -262,7 +296,7 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	st = typesniffer.DetectContentType(buf)
 
-	return buf, dataRc, &fileInfo{st.IsText(), true, meta.Size, &meta.Pointer, st}, nil
+	return buf, dataRc, &fileInfo{st.IsText(), true, false, meta.Size, &meta.Pointer, st}, nil
 }
 
 func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.TreeEntry) {
@@ -447,10 +481,17 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 	isDisplayingSource := ctx.FormString("display") == "source"
 	isDisplayingRendered := !isDisplayingSource
 
-	if fInfo.isLFSFile {
+	if fInfo.isLFSFile || fInfo.isAnnexFile {
 		ctx.Data["RawFileLink"] = ctx.Repo.RepoLink + "/media/" + ctx.Repo.BranchNameSubURL() + "/" + util.PathEscapeSegments(ctx.Repo.TreePath)
 	}
 
+	if fInfo.isAnnexFile {
+		// pre-git-annex v7, all annexed files were represented in-repo as symlinks;
+		// but we pretend they aren't, since that's a distracting quirk of git-annex
+		// and not a meaningful choice on the user's part
+		ctx.Data["FileIsSymlink"] = false
+	}
+
 	isRepresentableAsText := fInfo.st.IsRepresentableAsText()
 	if !isRepresentableAsText {
 		// If we can't show plain text, always try to render.
@@ -458,6 +499,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 		isDisplayingRendered = true
 	}
 	ctx.Data["IsLFSFile"] = fInfo.isLFSFile
+	ctx.Data["IsAnnexFile"] = fInfo.isAnnexFile
 	ctx.Data["FileSize"] = fInfo.fileSize
 	ctx.Data["IsTextFile"] = fInfo.isTextFile
 	ctx.Data["IsRepresentableAsText"] = isRepresentableAsText
@@ -492,6 +534,8 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 	// Assume file is not editable first.
 	if fInfo.isLFSFile {
 		ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.cannot_edit_lfs_files")
+	} else if fInfo.isAnnexFile {
+		ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.cannot_edit_annex_files")
 	} else if !isRepresentableAsText {
 		ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.cannot_edit_non_text_files")
 	}
@@ -599,7 +643,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 			ctx.Data["FileContent"] = fileContent
 			ctx.Data["LineEscapeStatus"] = statuses
 		}
-		if !fInfo.isLFSFile {
+		if !fInfo.isLFSFile && !fInfo.isAnnexFile {
 			if ctx.Repo.CanEnableEditor(ctx, ctx.Doer) {
 				if lfsLock != nil && lfsLock.OwnerID != ctx.Doer.ID {
 					ctx.Data["CanEditFile"] = false
diff --git a/templates/repo/file_info.tmpl b/templates/repo/file_info.tmpl
index 6ae7c15a26..05d9825cfb 100644
--- a/templates/repo/file_info.tmpl
+++ b/templates/repo/file_info.tmpl
@@ -17,6 +17,7 @@
 	{{if .FileSize}}
 		<div class="file-info-entry">
 			{{ctx.Locale.TrSize .FileSize}}{{if .IsLFSFile}} ({{ctx.Locale.Tr "repo.stored_lfs"}}){{end}}
+			{{if .IsAnnexFile}} ({{ctx.Locale.Tr "repo.stored_annex"}}){{end}}
 		</div>
 	{{end}}
 	{{if .LFSLock}}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index b3dc2b974d..bc52d2ae1d 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -118,6 +118,111 @@ func doAnnexMediaTest(t *testing.T, ctx APITestContext, file string) {
 	require.True(t, match, "Annexed files should be the same")
 }
 
+func TestGitAnnexViews(t *testing.T) {
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		ctx := NewAPITestContext(t, "user2", "annex-template-render-test", auth_model.AccessTokenScopeWriteRepository)
+
+		// create a public repo
+		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+
+		session := loginUser(t, ctx.Username)
+
+		t.Run("Index", func(t *testing.T) {
+			// test that annex symlinks renders with the _file icon_ on the main list
+			defer tests.PrintCurrentTest(t)()
+
+			repoLink := path.Join("/", ctx.Username, ctx.Reponame)
+			req := NewRequest(t, "GET", repoLink)
+			resp := session.MakeRequest(t, req, http.StatusOK)
+
+			htmlDoc := NewHTMLParser(t, resp.Body)
+			isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
+			require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
+		})
+
+		t.Run("View", func(t *testing.T) {
+			// test how routers/web/repo/view.go + templates/repo/view_file.tmpl handle annexed files
+			defer tests.PrintCurrentTest(t)()
+
+			doViewTest := func(file string) (htmlDoc *HTMLDoc, viewLink, mediaLink string) {
+				viewLink = path.Join("/", ctx.Username, ctx.Reponame, "/src/branch/master", file)
+				// rawLink := strings.Replace(viewLink, "/src/", "/raw/", 1) // TODO: do something with this?
+				mediaLink = strings.Replace(viewLink, "/src/", "/media/", 1)
+
+				req := NewRequest(t, "GET", viewLink)
+				resp := session.MakeRequest(t, req, http.StatusOK)
+
+				htmlDoc = NewHTMLParser(t, resp.Body)
+				// the first button on the toolbar on the view template is the "Raw" button
+				// this CSS selector is the most precise I can think to use
+				buttonLink, exists := htmlDoc.Find(".file-header").Find("a[download]").Attr("href")
+				require.True(t, exists, "Download button should exist on the file header")
+				require.EqualValues(t, mediaLink, buttonLink, "Download link should use /media URL for annex files")
+
+				return htmlDoc, viewLink, mediaLink
+			}
+
+			t.Run("Binary", func(t *testing.T) {
+				// test that annexing a file renders the /media link in /src and NOT the /raw link
+				defer tests.PrintCurrentTest(t)()
+
+				doBinaryViewTest := func(file string) {
+					htmlDoc, _, mediaLink := doViewTest(file)
+
+					rawLink, exists := htmlDoc.Find("div.file-view > div.view-raw > a").Attr("href")
+					require.True(t, exists, "Download link should render instead of content because this is a binary file")
+					require.EqualValues(t, mediaLink, rawLink)
+				}
+
+				t.Run("AnnexSymlink", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doBinaryViewTest("annexed.tiff")
+				})
+				t.Run("AnnexPointer", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doBinaryViewTest("annexed.bin")
+				})
+			})
+
+			t.Run("Text", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				doTextViewTest := func(file string) {
+					htmlDoc, _, _ := doViewTest(file)
+					require.True(t, htmlDoc.Find("div.file-view").Is(".code-view"), "should render as code")
+				}
+
+				t.Run("AnnexSymlink", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doTextViewTest("annexed.txt")
+
+					t.Run("Markdown", func(t *testing.T) {
+						// special case: check that markdown can be pulled out of the annex and rendered, too
+						defer tests.PrintCurrentTest(t)()
+						htmlDoc, _, _ := doViewTest("annexed.md")
+						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+					})
+				})
+				t.Run("AnnexPointer", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doTextViewTest("annexed.rst")
+
+					t.Run("Markdown", func(t *testing.T) {
+						// special case: check that markdown can be pulled out of the annex and rendered, too
+						defer tests.PrintCurrentTest(t)()
+						htmlDoc, _, _ := doViewTest("annexed.markdown")
+						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+					})
+				})
+			})
+		})
+	})
+}
+
 /*
 Test that permissions are enforced on git-annex-shell commands.
 
@@ -1029,6 +1134,14 @@ func doInitAnnexRepository(repoPath string) error {
 	if err != nil {
 		return err
 	}
+	_, err = f.WriteString("*.rst  filter=annex\n")
+	if err != nil {
+		return err
+	}
+	_, err = f.WriteString("*.markdown  filter=annex\n")
+	if err != nil {
+		return err
+	}
 	f.Close()
 
 	err = git.AddChanges(repoPath, false, ".")
@@ -1053,6 +1166,18 @@ func doInitAnnexRepository(repoPath string) error {
 		return err
 	}
 
+	// // a text file
+	err = os.WriteFile(path.Join(repoPath, "annexed.md"), []byte("Overview\n=====\n\n1. Profit\n2. ???\n3. Review Life Activations\n"), 0o777)
+	if err != nil {
+		return err
+	}
+
+	// // a markdown file
+	err = os.WriteFile(path.Join(repoPath, "annexed.txt"), []byte("We're going to see the wizard\nThe wonderful\nMonkey of\nBoz\n"), 0o777)
+	if err != nil {
+		return err
+	}
+
 	err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "add", ".").Run(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
@@ -1065,6 +1190,14 @@ func doInitAnnexRepository(repoPath string) error {
 		return err
 	}
 
+	// // a text file
+	err = os.WriteFile(path.Join(repoPath, "annexed.rst"), []byte("Title\n=====\n\n- this is to test annexing a text file\n- lists are fun\n"), 0o777)
+	if err != nil {
+		return err
+	}
+
+	// // a markdown file
+	err = os.WriteFile(path.Join(repoPath, "annexed.markdown"), []byte("Overview\n=====\n\n1. Profit\n2. ???\n3. Review Life Activations\n"), 0o777)
 	if err != nil {
 		return err
 	}

From 4c12a2ecee0c496a49b658b08b80f90dfcb10a76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 24 May 2024 13:21:42 +0200
Subject: [PATCH 037/125] Adapt patch to upstream changes

Test with different objectFormats.
---
 tests/integration/git_annex_test.go | 148 ++++++++++++++--------------
 1 file changed, 75 insertions(+), 73 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index bc52d2ae1d..4d4a0da88e 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -124,98 +124,100 @@ func TestGitAnnexViews(t *testing.T) {
 	}
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		ctx := NewAPITestContext(t, "user2", "annex-template-render-test", auth_model.AccessTokenScopeWriteRepository)
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			ctx := NewAPITestContext(t, "user2", "annex-template-render-test"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
 
-		// create a public repo
-		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+			// create a public repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false, objectFormat))
 
-		session := loginUser(t, ctx.Username)
+			session := loginUser(t, ctx.Username)
 
-		t.Run("Index", func(t *testing.T) {
-			// test that annex symlinks renders with the _file icon_ on the main list
-			defer tests.PrintCurrentTest(t)()
+			t.Run("Index", func(t *testing.T) {
+				// test that annex symlinks renders with the _file icon_ on the main list
+				defer tests.PrintCurrentTest(t)()
 
-			repoLink := path.Join("/", ctx.Username, ctx.Reponame)
-			req := NewRequest(t, "GET", repoLink)
-			resp := session.MakeRequest(t, req, http.StatusOK)
-
-			htmlDoc := NewHTMLParser(t, resp.Body)
-			isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
-			require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
-		})
-
-		t.Run("View", func(t *testing.T) {
-			// test how routers/web/repo/view.go + templates/repo/view_file.tmpl handle annexed files
-			defer tests.PrintCurrentTest(t)()
-
-			doViewTest := func(file string) (htmlDoc *HTMLDoc, viewLink, mediaLink string) {
-				viewLink = path.Join("/", ctx.Username, ctx.Reponame, "/src/branch/master", file)
-				// rawLink := strings.Replace(viewLink, "/src/", "/raw/", 1) // TODO: do something with this?
-				mediaLink = strings.Replace(viewLink, "/src/", "/media/", 1)
-
-				req := NewRequest(t, "GET", viewLink)
+				repoLink := path.Join("/", ctx.Username, ctx.Reponame)
+				req := NewRequest(t, "GET", repoLink)
 				resp := session.MakeRequest(t, req, http.StatusOK)
 
-				htmlDoc = NewHTMLParser(t, resp.Body)
-				// the first button on the toolbar on the view template is the "Raw" button
-				// this CSS selector is the most precise I can think to use
-				buttonLink, exists := htmlDoc.Find(".file-header").Find("a[download]").Attr("href")
-				require.True(t, exists, "Download button should exist on the file header")
-				require.EqualValues(t, mediaLink, buttonLink, "Download link should use /media URL for annex files")
-
-				return htmlDoc, viewLink, mediaLink
-			}
-
-			t.Run("Binary", func(t *testing.T) {
-				// test that annexing a file renders the /media link in /src and NOT the /raw link
-				defer tests.PrintCurrentTest(t)()
-
-				doBinaryViewTest := func(file string) {
-					htmlDoc, _, mediaLink := doViewTest(file)
-
-					rawLink, exists := htmlDoc.Find("div.file-view > div.view-raw > a").Attr("href")
-					require.True(t, exists, "Download link should render instead of content because this is a binary file")
-					require.EqualValues(t, mediaLink, rawLink)
-				}
-
-				t.Run("AnnexSymlink", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-					doBinaryViewTest("annexed.tiff")
-				})
-				t.Run("AnnexPointer", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-					doBinaryViewTest("annexed.bin")
-				})
+				htmlDoc := NewHTMLParser(t, resp.Body)
+				isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
+				require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
 			})
 
-			t.Run("Text", func(t *testing.T) {
+			t.Run("View", func(t *testing.T) {
+				// test how routers/web/repo/view.go + templates/repo/view_file.tmpl handle annexed files
 				defer tests.PrintCurrentTest(t)()
 
-				doTextViewTest := func(file string) {
-					htmlDoc, _, _ := doViewTest(file)
-					require.True(t, htmlDoc.Find("div.file-view").Is(".code-view"), "should render as code")
+				doViewTest := func(file string) (htmlDoc *HTMLDoc, viewLink, mediaLink string) {
+					viewLink = path.Join("/", ctx.Username, ctx.Reponame, "/src/branch/master", file)
+					// rawLink := strings.Replace(viewLink, "/src/", "/raw/", 1) // TODO: do something with this?
+					mediaLink = strings.Replace(viewLink, "/src/", "/media/", 1)
+
+					req := NewRequest(t, "GET", viewLink)
+					resp := session.MakeRequest(t, req, http.StatusOK)
+
+					htmlDoc = NewHTMLParser(t, resp.Body)
+					// the first button on the toolbar on the view template is the "Raw" button
+					// this CSS selector is the most precise I can think to use
+					buttonLink, exists := htmlDoc.Find(".file-header").Find("a[download]").Attr("href")
+					require.True(t, exists, "Download button should exist on the file header")
+					require.EqualValues(t, mediaLink, buttonLink, "Download link should use /media URL for annex files")
+
+					return htmlDoc, viewLink, mediaLink
 				}
 
-				t.Run("AnnexSymlink", func(t *testing.T) {
+				t.Run("Binary", func(t *testing.T) {
+					// test that annexing a file renders the /media link in /src and NOT the /raw link
 					defer tests.PrintCurrentTest(t)()
-					doTextViewTest("annexed.txt")
 
-					t.Run("Markdown", func(t *testing.T) {
-						// special case: check that markdown can be pulled out of the annex and rendered, too
+					doBinaryViewTest := func(file string) {
+						htmlDoc, _, mediaLink := doViewTest(file)
+
+						rawLink, exists := htmlDoc.Find("div.file-view > div.view-raw > a").Attr("href")
+						require.True(t, exists, "Download link should render instead of content because this is a binary file")
+						require.EqualValues(t, mediaLink, rawLink)
+					}
+
+					t.Run("AnnexSymlink", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
-						htmlDoc, _, _ := doViewTest("annexed.md")
-						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						doBinaryViewTest("annexed.tiff")
+					})
+					t.Run("AnnexPointer", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+						doBinaryViewTest("annexed.bin")
 					})
 				})
-				t.Run("AnnexPointer", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-					doTextViewTest("annexed.rst")
 
-					t.Run("Markdown", func(t *testing.T) {
-						// special case: check that markdown can be pulled out of the annex and rendered, too
+				t.Run("Text", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					doTextViewTest := func(file string) {
+						htmlDoc, _, _ := doViewTest(file)
+						require.True(t, htmlDoc.Find("div.file-view").Is(".code-view"), "should render as code")
+					}
+
+					t.Run("AnnexSymlink", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
-						htmlDoc, _, _ := doViewTest("annexed.markdown")
-						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						doTextViewTest("annexed.txt")
+
+						t.Run("Markdown", func(t *testing.T) {
+							// special case: check that markdown can be pulled out of the annex and rendered, too
+							defer tests.PrintCurrentTest(t)()
+							htmlDoc, _, _ := doViewTest("annexed.md")
+							require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						})
+					})
+					t.Run("AnnexPointer", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+						doTextViewTest("annexed.rst")
+
+						t.Run("Markdown", func(t *testing.T) {
+							// special case: check that markdown can be pulled out of the annex and rendered, too
+							defer tests.PrintCurrentTest(t)()
+							htmlDoc, _, _ := doViewTest("annexed.markdown")
+							require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						})
 					})
 				})
 			})

From a5e712f002eea4401b28f9c1141519133026c87b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 15 May 2024 10:55:12 +0200
Subject: [PATCH 038/125] Add git-annex to docker image

---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index ae21a0821e..d39de78bf9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -78,6 +78,7 @@ RUN apk --no-cache add \
     sqlite \
     su-exec \
     gnupg \
+    git-annex \
     && rm -rf /var/cache/apk/*
 
 RUN addgroup \

From 83f8fdb142d18967a33fcfe49071c0d2bdb8b6cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 18 Jul 2024 16:43:42 +0000
Subject: [PATCH 039/125] Error if git-annex is enabled but missing (#16)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Copied from https://github.com/neuropoly/gitea/pull/47

This adds a check so that if `setting.Annex.Enabled` is true and git-annex is not in the PATH Forgejo will abort on startup with a reasonable error message.

Fixes #15.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/16
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 cmd/web.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/cmd/web.go b/cmd/web.go
index a817204aa6..661e6d158e 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -9,6 +9,7 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -247,6 +248,12 @@ func runWeb(ctx *cli.Context) error {
 		createPIDFile(ctx.String("pid"))
 	}
 
+	if setting.Annex.Enabled {
+		if _, err := exec.LookPath("git-annex"); err != nil {
+			log.Fatal("You have enabled git-annex support but git-annex is not installed. Please make sure that Forgejo's PATH contains the git-annex executable.")
+		}
+	}
+
 	if !setting.InstallLock {
 		if err := serveInstall(ctx); err != nil {
 			return err

From 5fdcb8a7a1b17e927eccac7e5de7508149226a9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 18 Jul 2024 18:18:06 +0000
Subject: [PATCH 040/125] Git-annex web uploads (#21)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements support for uploading files into the annex using the web
interface.

If a repository is a git-annex-enabled repository all files will be
added to it using git annex add. This means that the repository's
configuration for what to put into the annex (annex.largefiles in
gitattributes) will be respected.

Plain git repositories without git-annex will work as before, directly
uploading to git.

Fixes #5.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/21
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go                 |  6 ++
 modules/util/remove.go                 | 11 ++--
 services/repository/files/temp_repo.go | 20 +++++++
 services/repository/files/upload.go    | 83 +++++++++++++++++++++++++-
 tests/integration/git_annex_test.go    | 81 +++++++++++++++++++++++++
 5 files changed, 194 insertions(+), 7 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index bb049d77ed..bab5a7e0b2 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -152,3 +152,9 @@ func IsAnnexed(blob *git.Blob) (bool, error) {
 	}
 	return true, nil
 }
+
+// IsAnnexRepo determines if repo is a git-annex enabled repository
+func IsAnnexRepo(repo *git.Repository) bool {
+	_, _, err := git.NewCommand(repo.Ctx, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: repo.Path})
+	return err == nil
+}
diff --git a/modules/util/remove.go b/modules/util/remove.go
index f2a61ae467..39556e5e0b 100644
--- a/modules/util/remove.go
+++ b/modules/util/remove.go
@@ -53,10 +53,13 @@ func MakeWritable(name string) error {
 				return err
 			}
 
-			// 0200 == u+w, in octal unix permission notation
-			err = os.Chmod(path, info.Mode()|0o200)
-			if err != nil {
-				return err
+			// Don't try chmod'ing symlinks (will fail with broken symlinks)
+			if info.Mode()&os.ModeSymlink != os.ModeSymlink {
+				// 0200 == u+w, in octal unix permission notation
+				err = os.Chmod(path, info.Mode()|0o200)
+				if err != nil {
+					return err
+				}
 			}
 		}
 		return nil
diff --git a/services/repository/files/temp_repo.go b/services/repository/files/temp_repo.go
index 6e7570b82c..566ae5ff8f 100644
--- a/services/repository/files/temp_repo.go
+++ b/services/repository/files/temp_repo.go
@@ -202,6 +202,26 @@ func (t *TemporaryUploadRepository) AddObjectToIndex(mode, objectHash, objectPat
 	return nil
 }
 
+// InitPrivateAnnex initializes a private annex in the repository
+func (t *TemporaryUploadRepository) InitPrivateAnnex() error {
+	if _, _, err := git.NewCommand(t.ctx, "config", "annex.private", "true").RunStdString(&git.RunOpts{Dir: t.basePath}); err != nil {
+		return err
+	}
+	if _, _, err := git.NewCommand(t.ctx, "annex", "init").RunStdString(&git.RunOpts{Dir: t.basePath}); err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddAnnex adds the file at path to the repository using git annex add
+// This requires a non-bare repository
+func (t *TemporaryUploadRepository) AddAnnex(path string) error {
+	if _, _, err := git.NewCommand(t.ctx, "annex", "add").AddDynamicArguments(path).RunStdString(&git.RunOpts{Dir: t.basePath}); err != nil {
+		return err
+	}
+	return nil
+}
+
 // WriteTree writes the current index as a tree to the object db and returns its hash
 func (t *TemporaryUploadRepository) WriteTree() (string, error) {
 	stdout, _, err := git.NewCommand(t.ctx, "write-tree").RunStdString(&git.RunOpts{Dir: t.basePath})
diff --git a/services/repository/files/upload.go b/services/repository/files/upload.go
index 1330116889..21cd5a8344 100644
--- a/services/repository/files/upload.go
+++ b/services/repository/files/upload.go
@@ -6,13 +6,16 @@ package files
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"path"
+	"path/filepath"
 	"strings"
 
 	git_model "code.gitea.io/gitea/models/git"
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/setting"
@@ -89,7 +92,7 @@ func UploadRepoFiles(ctx context.Context, repo *repo_model.Repository, doer *use
 	defer t.Close()
 
 	hasOldBranch := true
-	if err = t.Clone(opts.OldBranch, true); err != nil {
+	if err = t.Clone(opts.OldBranch, false); err != nil {
 		if !git.IsErrBranchNotExist(err) || !repo.IsEmpty {
 			return err
 		}
@@ -105,10 +108,30 @@ func UploadRepoFiles(ctx context.Context, repo *repo_model.Repository, doer *use
 		}
 	}
 
-	// Copy uploaded files into repository.
-	if err := copyUploadedLFSFilesIntoRepository(infos, t, opts.TreePath); err != nil {
+	r, err := git.OpenRepository(ctx, repo.RepoPath())
+	if err != nil {
 		return err
 	}
+	if annex.IsAnnexRepo(r) {
+		// Initialize annex privately in temporary clone
+		if err := t.InitPrivateAnnex(); err != nil {
+			return err
+		}
+		// Copy uploaded files into git-annex repository
+		if err := copyUploadedFilesIntoAnnexRepository(infos, t, opts.TreePath); err != nil {
+			return err
+		}
+		// Move all annexed content in the temporary repository, i.e. everything we have just added, to the origin
+		author, committer := GetAuthorAndCommitterUsers(opts.Author, opts.Committer, doer)
+		if err := moveAnnexedFilesToOrigin(t, author, committer); err != nil {
+			return err
+		}
+	} else {
+		// Copy uploaded files into repository.
+		if err := copyUploadedLFSFilesIntoRepository(infos, t, opts.TreePath); err != nil {
+			return err
+		}
+	}
 
 	// Now write the tree
 	treeHash, err := t.WriteTree()
@@ -246,3 +269,57 @@ func uploadToLFSContentStore(info uploadInfo, contentStore *lfs.ContentStore) er
 	}
 	return nil
 }
+
+func copyUploadedFilesIntoAnnexRepository(infos []uploadInfo, t *TemporaryUploadRepository, treePath string) error {
+	for i := range len(infos) {
+		if err := copyUploadedFileIntoAnnexRepository(&infos[i], t, treePath); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func copyUploadedFileIntoAnnexRepository(info *uploadInfo, t *TemporaryUploadRepository, treePath string) error {
+	pathInRepo := path.Join(t.basePath, treePath, info.upload.Name)
+	if err := os.MkdirAll(filepath.Dir(pathInRepo), 0o700); err != nil {
+		return err
+	}
+	if err := os.Rename(info.upload.LocalPath(), pathInRepo); err != nil {
+		// Rename didn't work, try copy and remove
+		inputFile, err := os.Open(info.upload.LocalPath())
+		if err != nil {
+			return fmt.Errorf("could not open source file: %v", err)
+		}
+		defer inputFile.Close()
+		outputFile, err := os.Create(pathInRepo)
+		if err != nil {
+			return fmt.Errorf("could not open dest file: %v", err)
+		}
+		defer outputFile.Close()
+		_, err = io.Copy(outputFile, inputFile)
+		if err != nil {
+			return fmt.Errorf("could not copy to dest from source: %v", err)
+		}
+		inputFile.Close()
+		err = os.Remove(info.upload.LocalPath())
+		if err != nil {
+			return fmt.Errorf("could not remove source file: %v", err)
+		}
+	}
+	return t.AddAnnex(pathInRepo)
+}
+
+func moveAnnexedFilesToOrigin(t *TemporaryUploadRepository, author, committer *user_model.User) error {
+	authorSig := author.NewGitSig()
+	committerSig := committer.NewGitSig()
+	env := append(os.Environ(),
+		"GIT_AUTHOR_NAME="+authorSig.Name,
+		"GIT_AUTHOR_EMAIL="+authorSig.Email,
+		"GIT_COMMITTER_NAME="+committerSig.Name,
+		"GIT_COMMITTER_EMAIL="+committerSig.Email,
+	)
+	if _, _, err := git.NewCommand(t.ctx, "annex", "move", "--to", "origin").RunStdString(&git.RunOpts{Dir: t.basePath, Env: env}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 4d4a0da88e..ff840c8b68 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -5,14 +5,17 @@
 package integration
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"io"
 	"math/rand"
+	"mime/multipart"
 	"net/http"
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
@@ -59,6 +62,84 @@ func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext,
 	return nil
 }
 
+func TestGitAnnexWebUpload(t *testing.T) {
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			ctx := NewAPITestContext(t, "user2", "annex-web-upload-test"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false, objectFormat))
+
+			uploadFile := func(t *testing.T, path string) string {
+				t.Helper()
+
+				body := &bytes.Buffer{}
+				mpForm := multipart.NewWriter(body)
+				err := mpForm.WriteField("_csrf", GetCSRF(t, ctx.Session, ctx.Username+"/"+ctx.Reponame+"/_upload/"+setting.Repository.DefaultBranch))
+				require.NoError(t, err)
+
+				file, err := mpForm.CreateFormFile("file", filepath.Base(path))
+				require.NoError(t, err)
+
+				srcFile, err := os.Open(path)
+				require.NoError(t, err)
+
+				io.Copy(file, srcFile)
+				require.NoError(t, mpForm.Close())
+
+				req := NewRequestWithBody(t, "POST", "/"+ctx.Username+"/"+ctx.Reponame+"/upload-file", body)
+				req.Header.Add("Content-Type", mpForm.FormDataContentType())
+				resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+
+				respMap := map[string]string{}
+				DecodeJSON(t, resp, &respMap)
+				return respMap["uuid"]
+			}
+
+			// Generate random file
+			tmpFile := path.Join(t.TempDir(), "web-upload-test-file.bin")
+			require.NoError(t, generateRandomFile(1024*1024/4, tmpFile))
+			expectedContent, err := os.ReadFile(tmpFile)
+			require.NoError(t, err)
+
+			// Upload generated file
+			fileUUID := uploadFile(t, tmpFile)
+			req := NewRequestWithValues(t, "POST", ctx.Username+"/"+ctx.Reponame+"/_upload/"+setting.Repository.DefaultBranch, map[string]string{
+				"commit_choice":  "direct",
+				"files":          fileUUID,
+				"_csrf":          GetCSRF(t, ctx.Session, ctx.Username+"/"+ctx.Reponame+"/_upload/"+setting.Repository.DefaultBranch),
+				"commit_mail_id": "-1",
+			})
+			ctx.Session.MakeRequest(t, req, http.StatusSeeOther)
+
+			// Get some handles on the target repository and file
+			remoteRepoPath := path.Join(setting.RepoRootPath, ctx.GitPath())
+			repo, err := git.OpenRepository(git.DefaultContext, remoteRepoPath)
+			require.NoError(t, err)
+			defer repo.Close()
+			tree, err := repo.GetTree(setting.Repository.DefaultBranch)
+			require.NoError(t, err)
+			treeEntry, err := tree.GetTreeEntryByPath(filepath.Base(tmpFile))
+			require.NoError(t, err)
+			blob := treeEntry.Blob()
+
+			// Check that the uploaded file is annexed
+			isAnnexed, err := annex.IsAnnexed(blob)
+			require.NoError(t, err)
+			require.True(t, isAnnexed)
+
+			// Check that the uploaded file has the correct content
+			annexedFile, err := annex.Content(blob)
+			require.NoError(t, err)
+			actualContent, err := io.ReadAll(annexedFile)
+			require.NoError(t, err)
+			require.Equal(t, expectedContent, actualContent)
+		})
+	})
+}
+
 func TestGitAnnexMedia(t *testing.T) {
 	if !setting.Annex.Enabled {
 		t.Skip("Skipping since annex support is disabled.")

From 6a3858160f8c500c1cf0ebf69e2332c352474afa Mon Sep 17 00:00:00 2001
From: Michael Hanke <michael.hanke@gmail.com>
Date: Tue, 30 Jul 2024 13:15:26 +0000
Subject: [PATCH 041/125] Add git-annex also to the rootless container (#24)

Same as https://codeberg.org/matrss/forgejo-aneksajo/commit/89f8aa0bf5134f7c986ea25856fa9ea32a0e0e8c, but for the rootless container.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/24
Reviewed-by: matrss <matrss@noreply.codeberg.org>
Co-authored-by: Michael Hanke <michael.hanke@gmail.com>
Co-committed-by: Michael Hanke <michael.hanke@gmail.com>
---
 Dockerfile.rootless | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile.rootless b/Dockerfile.rootless
index c5d6a13f35..d636e10168 100644
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -71,6 +71,7 @@ RUN apk --no-cache add \
     git \
     curl \
     gnupg \
+    git-annex \
     && rm -rf /var/cache/apk/*
 
 RUN addgroup \

From 5891313b0bac14a1c32b7435bc0e735eaba2efb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 9 Aug 2024 11:51:11 +0000
Subject: [PATCH 042/125] Improve views for annexed but missing files (#28)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, trying to view files that were annexed, but missing, just
led to an uninformative error 500. This was rather confusing.

With these changes it now shows the pointer target instead of the
(missing) content of the file, and also indicates this situation in the
"stored with git-annex" message. For semantic correctness views for
missing files return a 404 instead of a 200, as they would with the
content present.

Fixes #7, fixes #13.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/28
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 options/locale/locale_de-DE.ini |  1 +
 options/locale/locale_en-US.ini |  1 +
 routers/web/repo/view.go        | 54 +++++++++++++++++++++++----------
 templates/repo/file_info.tmpl   |  2 +-
 4 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 7a28d08e49..22dd5f3eb7 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -1316,6 +1316,7 @@ video_not_supported_in_browser=Dein Browser unterstützt das HTML5-„video“-T
 audio_not_supported_in_browser=Dein Browser unterstützt das HTML5-„audio“-Tag nicht.
 stored_lfs=Gespeichert mit Git LFS
 stored_annex=Gespeichert mit Git Annex
+stored_annex_not_present = hier nicht vorhanden, versuche git annex whereis
 symbolic_link=Softlink
 executable_file=Ausführbare Datei
 commit_graph=Commit-Graph
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 93c1eaa770..45188feb6c 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -1337,6 +1337,7 @@ video_not_supported_in_browser = Your browser does not support the HTML5 "video"
 audio_not_supported_in_browser = Your browser does not support the HTML5 "audio" tag.
 stored_lfs = Stored with Git LFS
 stored_annex = Stored with Git Annex
+stored_annex_not_present = not present here, try using git annex whereis
 symbolic_link = Symbolic link
 executable_file = Executable file
 vendored = Vendored
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 59efa4334f..23177a2a09 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -210,12 +210,13 @@ func localizedExtensions(ext, languageCode string) (localizedExts []string) {
 }
 
 type fileInfo struct {
-	isTextFile  bool
-	isLFSFile   bool
-	isAnnexFile bool
-	fileSize    int64
-	lfsMeta     *lfs.Pointer
-	st          typesniffer.SniffedType
+	isTextFile         bool
+	isLFSFile          bool
+	isAnnexFile        bool
+	isAnnexFilePresent bool
+	fileSize           int64
+	lfsMeta            *lfs.Pointer
+	st                 typesniffer.SniffedType
 }
 
 func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte, io.ReadCloser, *fileInfo, error) {
@@ -230,11 +231,22 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 		annexContent, err := annex.Content(blob)
 		if err != nil {
-			// in the case where annex content is missing, what should happen?
-			// do we render the page with an error message?
-			// actually that's not a bad idea, there's some sort of error message situation
-			// TODO: display an error to the user explaining that their data is missing
-			return nil, nil, nil, err
+			// If annex.Content returns an error it can mean that the blob does not
+			// refer to an annexed file or that it is not present here. Since we already
+			// checked that it is annexed the latter must be the case. So we return the
+			// content of the blob instead and indicate that the file is indeed annexed,
+			// but not present here. The template can then communicate the situation.
+			dataRc, err := blob.DataAsync()
+			if err != nil {
+				return nil, nil, nil, err
+			}
+
+			buf := make([]byte, 1024)
+			n, _ := util.ReadAtMost(dataRc, buf)
+			buf = buf[:n]
+
+			st := typesniffer.DetectContentType(buf)
+			return buf, dataRc, &fileInfo{st.IsText(), false, true, false, blob.Size(), nil, st}, nil
 		}
 
 		stat, err := annexContent.Stat()
@@ -248,7 +260,7 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 		st := typesniffer.DetectContentType(buf)
 
-		return buf, annexContent, &fileInfo{st.IsText(), false, true, stat.Size(), nil, st}, nil
+		return buf, annexContent, &fileInfo{st.IsText(), false, true, true, stat.Size(), nil, st}, nil
 	}
 
 	dataRc, err := blob.DataAsync()
@@ -265,18 +277,18 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	// FIXME: what happens when README file is an image?
 	if !isTextFile || !setting.LFS.StartServer {
-		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, false, blob.Size(), nil, st}, nil
 	}
 
 	pointer, _ := lfs.ReadPointerFromBuffer(buf)
 	if !pointer.IsValid() { // fallback to plain file
-		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, false, blob.Size(), nil, st}, nil
 	}
 
 	meta, err := git_model.GetLFSMetaObjectByOid(ctx, repoID, pointer.Oid)
 	if err != nil { // fallback to plain file
 		log.Warn("Unable to access LFS pointer %s in repo %d: %v", pointer.Oid, repoID, err)
-		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, false, blob.Size(), nil, st}, nil
 	}
 
 	dataRc.Close()
@@ -296,7 +308,7 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	st = typesniffer.DetectContentType(buf)
 
-	return buf, dataRc, &fileInfo{st.IsText(), true, false, meta.Size, &meta.Pointer, st}, nil
+	return buf, dataRc, &fileInfo{st.IsText(), true, false, false, meta.Size, &meta.Pointer, st}, nil
 }
 
 func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.TreeEntry) {
@@ -500,6 +512,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 	}
 	ctx.Data["IsLFSFile"] = fInfo.isLFSFile
 	ctx.Data["IsAnnexFile"] = fInfo.isAnnexFile
+	ctx.Data["IsAnnexFilePresent"] = fInfo.isAnnexFilePresent
 	ctx.Data["FileSize"] = fInfo.fileSize
 	ctx.Data["IsTextFile"] = fInfo.isTextFile
 	ctx.Data["IsRepresentableAsText"] = isRepresentableAsText
@@ -1203,6 +1216,15 @@ PostRecentBranchCheck:
 	} else {
 		ctx.Data["CodeSearchOptions"] = git.GrepSearchOptions
 	}
+	isAnnexFile, okAnnexFile := ctx.Data["IsAnnexFile"]
+	isAnnexFilePresent, okAnnexFilePresent := ctx.Data["IsAnnexFilePresent"]
+	if okAnnexFile && okAnnexFilePresent && isAnnexFile.(bool) && !isAnnexFilePresent.(bool) {
+		// If the file to be viewed is annexed but not present then render it normally
+		// (which will show the plain git blob content, i.e. the symlink or pointer target)
+		// but make the status code a 404.
+		ctx.HTML(http.StatusNotFound, tplRepoHome)
+		return
+	}
 	ctx.HTML(http.StatusOK, tplRepoHome)
 }
 
diff --git a/templates/repo/file_info.tmpl b/templates/repo/file_info.tmpl
index 05d9825cfb..8655404394 100644
--- a/templates/repo/file_info.tmpl
+++ b/templates/repo/file_info.tmpl
@@ -17,7 +17,7 @@
 	{{if .FileSize}}
 		<div class="file-info-entry">
 			{{ctx.Locale.TrSize .FileSize}}{{if .IsLFSFile}} ({{ctx.Locale.Tr "repo.stored_lfs"}}){{end}}
-			{{if .IsAnnexFile}} ({{ctx.Locale.Tr "repo.stored_annex"}}){{end}}
+			{{if .IsAnnexFile}} ({{ctx.Locale.Tr "repo.stored_annex"}}{{if not .IsAnnexFilePresent}} - {{ctx.Locale.Tr "repo.stored_annex_not_present"}}{{end}}){{end}}
 		</div>
 	{{end}}
 	{{if .LFSLock}}

From b643725cb625d3abb2381612cce1560fbb9bb399 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 9 Aug 2024 17:17:02 +0000
Subject: [PATCH 043/125] Change the icon for annexed files to file-binary
 (#29)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #26.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/29
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/base/tool.go                | 12 ++++++------
 tests/integration/git_annex_test.go |  8 +++++---
 web_src/css/repo.css                |  1 +
 3 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/modules/base/tool.go b/modules/base/tool.go
index 3d0fe73823..a885546fde 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -102,14 +102,14 @@ func Int64sToStrings(ints []int64) []string {
 
 // EntryIcon returns the octicon class for displaying files/directories
 func EntryIcon(entry *git.TreeEntry) string {
+	isAnnexed, _ := annex.IsAnnexed(entry.Blob())
+	if isAnnexed {
+		// Show git-annex files as binary files to differentiate them from non-annexed files
+		// TODO: find a more suitable icon, maybe something related to git-annex
+		return "file-binary"
+	}
 	switch {
 	case entry.IsLink():
-		isAnnexed, _ := annex.IsAnnexed(entry.Blob())
-		if isAnnexed {
-			// git-annex files are sometimes stored as symlinks;
-			// short-circuit that so like LFS they are displayed as regular files
-			return "file"
-		}
 		te, _, err := entry.FollowLink()
 		if err != nil {
 			log.Debug(err.Error())
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index ff840c8b68..11d709ca80 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -214,7 +214,7 @@ func TestGitAnnexViews(t *testing.T) {
 			session := loginUser(t, ctx.Username)
 
 			t.Run("Index", func(t *testing.T) {
-				// test that annex symlinks renders with the _file icon_ on the main list
+				// test that annexed files render with the binary file icon on the main list
 				defer tests.PrintCurrentTest(t)()
 
 				repoLink := path.Join("/", ctx.Username, ctx.Reponame)
@@ -222,8 +222,10 @@ func TestGitAnnexViews(t *testing.T) {
 				resp := session.MakeRequest(t, req, http.StatusOK)
 
 				htmlDoc := NewHTMLParser(t, resp.Body)
-				isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
-				require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
+				isFileBinaryIconLocked := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file-binary")
+				require.True(t, isFileBinaryIconLocked, "locked annexed files should render a binary file icon")
+				isFileBinaryIconUnlocked := htmlDoc.Find("tr[data-entryname='annexed.bin'] > td.name svg").HasClass("octicon-file-binary")
+				require.True(t, isFileBinaryIconUnlocked, "unlocked annexed files should render a binary file icon")
 			})
 
 			t.Run("View", func(t *testing.T) {
diff --git a/web_src/css/repo.css b/web_src/css/repo.css
index e9cfc1ddde..651c69c703 100644
--- a/web_src/css/repo.css
+++ b/web_src/css/repo.css
@@ -244,6 +244,7 @@ td .commit-summary {
 }
 
 .repository.file.list #repo-files-table tbody .svg.octicon-file,
+.repository.file.list #repo-files-table tbody .svg.octicon-file-binary,
 .repository.file.list #repo-files-table tbody .svg.octicon-file-symlink-file,
 .repository.file.list #repo-files-table tbody .svg.octicon-file-directory-symlink {
   color: var(--color-secondary-dark-7);

From 7a03796fe550e31a821bf83c295ca33dba826ae7 Mon Sep 17 00:00:00 2001
From: Michael Hanke <michael.hanke@gmail.com>
Date: Wed, 4 Sep 2024 09:32:40 +0000
Subject: [PATCH 044/125] Elevate external markup renderer interface for
 annexed file content (#36)

Previously, an external renderer that matched on an annexed file would
only see its content streamed via `STDIN`, or a temporary file with a copy
of its content would be generated and passed-by-filepath (with
`IS_INPUT_FILE=true`). Whether that happens, is also subject to
`MAX_DISPLAY_FILE_SIZE` (which defaults to 8MB).

This was problematic, because annexed files tend to be large. Moreover,
if present, they already exist as write-protected files on the
file-system. Creating a copy is both expensive and serves no particular
purpose.

This commit changes how external renderers are called.

1) With `IS_INPUT_FILE=true`, the renderer is passed the true location
   of an annex key, if present, and an empty path, if not.
2) The original, repository-relative path of the rendering target is
   made available to the renderer via the `GITEA_RELATIVE_PATH`
   environment variable.

To achieve a lean implementation, the `Blob` of the rendering target
is passed on to the `RenderContext` (because the implementation of
the annex-related functionality is centered on this dtype.

This change makes it less costly to increase `MAX_DISPLAY_FILE_SIZE`,
in order to make large, annexed files eligible for markup rendering,
because no content copies will be made any longer.

External renderers can now use the original file path, with the full
original filename, including extensions, for decision making. For
example, to detect particular compression formats based in a file name
extension, or to alter the rendering based on contextual information
encoded in the file path (e.g., a multi-file data structure with a
particular organization pattern).

Apart from the additional environment variable, there is no change to
the handling of renderers that take their input via `STDIN` (i.e.,
`IS_INPUT_FILE=false`).

Fixes #35.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/36
Reviewed-by: matrss <matrss@noreply.codeberg.org>
Co-authored-by: Michael Hanke <michael.hanke@gmail.com>
Co-committed-by: Michael Hanke <michael.hanke@gmail.com>
---
 modules/markup/external/external.go | 25 +++++++++++++++++++++++--
 modules/markup/renderer.go          | 20 ++++++++++++--------
 routers/web/repo/view.go            |  3 +++
 3 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/modules/markup/external/external.go b/modules/markup/external/external.go
index 122517ed11..b9760772a1 100644
--- a/modules/markup/external/external.go
+++ b/modules/markup/external/external.go
@@ -12,6 +12,7 @@ import (
 	"runtime"
 	"strings"
 
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/markup"
@@ -86,8 +87,22 @@ func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.
 		commands = strings.Fields(command)
 		args     = commands[1:]
 	)
-
-	if p.IsInputFile {
+	isAnnexed, _ := annex.IsAnnexed(ctx.Blob)
+	// if a renderer wants to read a file, and we have annexed content, we can
+	// provide the annex key file location directly to the renderer. git-annex
+	// takes care of having that location be read-only, so no critical
+	// protection layer is needed. Moreover, the file readily exists, and
+	// expensive temporary files can be avoided, also allowing an operator
+	// to raise MAX_DISPLAY_FILE_SIZE without much negative impact.
+	if p.IsInputFile && isAnnexed {
+		// look for annexed content, will be empty, if there is none
+		annexContentLocation, _ := annex.ContentLocation(ctx.Blob)
+		// we call the renderer, even if there is no annex content present.
+		// showing the pointer file content is not much use, and a topical
+		// renderer might be able to produce something useful from the
+		// filename alone (present in ENV)
+		args = append(args, annexContentLocation)
+	} else if p.IsInputFile {
 		// write to temp file
 		f, err := os.CreateTemp("", "gitea_input")
 		if err != nil {
@@ -130,6 +145,12 @@ func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.
 		os.Environ(),
 		"GITEA_PREFIX_SRC="+ctx.Links.SrcLink(),
 		"GITEA_PREFIX_RAW="+ctx.Links.RawLink(),
+		// also communicate the relative path of the to-be-rendered item.
+		// this enables the renderer to make use of the original file name
+		// and path, e.g., to make rendering or dtype-detection decisions
+		// that go beyond the originally matched extension. Even if the
+		// content is directly streamed to STDIN
+		"GITEA_RELATIVE_PATH="+ctx.RelativePath,
 	)
 	if !p.IsInputFile {
 		cmd.Stdin = input
diff --git a/modules/markup/renderer.go b/modules/markup/renderer.go
index 2137302f43..c00bd2b56e 100644
--- a/modules/markup/renderer.go
+++ b/modules/markup/renderer.go
@@ -67,14 +67,18 @@ type Header struct {
 
 // RenderContext represents a render context
 type RenderContext struct {
-	Ctx              context.Context
-	RelativePath     string // relative path from tree root of the branch
-	Type             string
-	IsWiki           bool
-	Links            Links
-	Metas            map[string]string
-	DefaultLink      string
-	GitRepo          *git.Repository
+	Ctx          context.Context
+	RelativePath string // relative path from tree root of the branch
+	Type         string
+	IsWiki       bool
+	Links        Links
+	Metas        map[string]string
+	DefaultLink  string
+	GitRepo      *git.Repository
+	// reporting the target blob that is to-be-rendered enables
+	// deeper inspection in the handler for external renderer
+	// (i.e., more targeted handling of annexed files)
+	Blob             *git.Blob
 	ShaExistCache    map[string]bool
 	cancelFn         func()
 	SidebarTocNode   ast.Node
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 23177a2a09..6329f5d714 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -371,6 +371,7 @@ func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.Tr
 			},
 			Metas:   ctx.Repo.Repository.ComposeDocumentMetas(ctx),
 			GitRepo: ctx.Repo.GitRepo,
+			Blob:    target.Blob(),
 		}, rd)
 		if err != nil {
 			log.Error("Render failed for %s in %-v: %v Falling back to rendering source", readmeFile.Name(), ctx.Repo.Repository, err)
@@ -603,6 +604,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 				},
 				Metas:   metas,
 				GitRepo: ctx.Repo.GitRepo,
+				Blob:    entry.Blob(),
 			}, rd)
 			if err != nil {
 				ctx.ServerError("Render", err)
@@ -701,6 +703,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 				},
 				Metas:   ctx.Repo.Repository.ComposeDocumentMetas(ctx),
 				GitRepo: ctx.Repo.GitRepo,
+				Blob:    entry.Blob(),
 			}, rd)
 			if err != nil {
 				ctx.ServerError("Render", err)

From ad7e1e7a9f11d4a151f0cca55cc6ee9c1f420549 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 30 Sep 2024 14:56:03 +0000
Subject: [PATCH 045/125] Allow anonymous HEAD requests to annex/objects (#41)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Git-annex emits HEAD requests for keys while trying to drop them from a
repository that was cloned via http. Forgejo asked for authentication
for these HEAD requests. This meant that cloning and getting files was
possible without authentication, but dropping was not.

Since the response to a HEAD request is a subset of the response to a
GET request it is safe to make those unauthenticated as well. That is
what this change does, although limited to the
:username/:reponame/annex/objects endpoint.

Fixes #40.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/41
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 routers/web/repo/githttp.go | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index d715b6bdf0..dfdedb04f3 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -78,7 +78,24 @@ func httpBase(ctx *context.Context) *serviceHandler {
 		strings.HasSuffix(ctx.Req.URL.Path, "git-upload-archive") {
 		isPull = true
 	} else {
-		isPull = ctx.Req.Method == "GET"
+		// In addition to GET requests, HEAD requests are also "pull"
+		// operations (reads), so they should also not require
+		// authentication. This is necessary for git-annex to operate
+		// properly, as it emits HEAD requests to check for the
+		// existence of keys, e.g. before dropping locally, and asking
+		// for authentication would break unauthenticated http usage in
+		// this situation.
+		// It should be safe to make all HEAD requests require no
+		// authentication, but as it is only necessary for the
+		// annex/objects endpoints to fix git-annex' drop operations it
+		// is limited to those for now.
+		r, err := regexp.Compile("^/?" + username + "/" + reponame + "(.git)?/annex/objects")
+		if err != nil {
+			ctx.ServerError("failed to create URL path regex", err)
+			return nil
+		}
+		isPull = ctx.Req.Method == "GET" ||
+			r.MatchString(ctx.Req.URL.Path) && ctx.Req.Method == "HEAD"
 	}
 
 	var accessMode perm.AccessMode

From 8af2afa30f2e934e06277d598e3d87ff3fd73e69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 9 Oct 2024 14:44:18 +0000
Subject: [PATCH 046/125] Use PATH when looking for git commands (#44)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes some issues when using a git-annex that is installed in a
different location than where git is installed, e.g. when using the
git-annex-standalone release or one installed with nix.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/44
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 cmd/serv.go | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/cmd/serv.go b/cmd/serv.go
index ac4aa36599..57804034e2 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -339,9 +339,8 @@ func runServ(c *cli.Context) error {
 		return nil
 	}
 
-	gitBinPath := filepath.Dir(git.GitExecutable) // e.g. /usr/bin
-	gitBinVerb := filepath.Join(gitBinPath, verb) // e.g. /usr/bin/git-upload-pack
-	if _, err := os.Stat(gitBinVerb); err != nil {
+	gitBinVerb, err := exec.LookPath(verb)
+	if err != nil {
 		// if the command "git-upload-pack" doesn't exist, try to split "git-upload-pack" to use the sub-command with git
 		// ps: Windows only has "git.exe" in the bin path, so Windows always uses this way
 		// ps: git-annex-shell and other extensions may not necessarily be in gitBinPath,

From 989949b5cc4f60d46856e765003643b4e590889a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 9 Oct 2024 19:33:05 +0000
Subject: [PATCH 047/125] Only upload to annex in doAnnexUploadTest (#46)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous implementation both uploaded to the annex and pushed to the
git repository. This meant that the tests checking that uploads without
permission fail actually could pass when the git push failed but the
git-annex upload didn't. The tests didn't catch the situation where
unauthorized users could modify the annex.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/46
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go              | 23 +++++-----
 tests/integration/git_annex_test.go | 68 ++++++++++++++++-------------
 2 files changed, 51 insertions(+), 40 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index bab5a7e0b2..ee0843926f 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -104,6 +104,18 @@ func Pointer(blob *git.Blob) (string, error) {
 	return pointer, nil
 }
 
+func ContentLocationFromPointer(repoPath, pointer string) (string, error) {
+	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", repoPath, pointer, err)
+	}
+	contentLocation = strings.TrimSpace(contentLocation)
+	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
+	contentLocation = path.Join(repoPath, contentLocation)
+
+	return contentLocation, nil
+}
+
 // return the absolute path of the content pointed to by the annex pointer stored in the git object
 // errors if the content is not found in this repo
 func ContentLocation(blob *git.Blob) (string, error) {
@@ -111,16 +123,7 @@ func ContentLocation(blob *git.Blob) (string, error) {
 	if err != nil {
 		return "", err
 	}
-
-	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
-	if err != nil {
-		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", blob.Repo().Path, pointer, err)
-	}
-	contentLocation = strings.TrimSpace(contentLocation)
-	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
-	contentLocation = path.Join(blob.Repo().Path, contentLocation)
-
-	return contentLocation, nil
+	return ContentLocationFromPointer(blob.Repo().Path, pointer)
 }
 
 // returns a stream open to the annex content
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 11d709ca80..44bc8376d7 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -1119,19 +1119,21 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
-	if err != nil {
-		return err
-	}
-
 	// verify the file was uploaded
-	localObjectPath, err := contentLocation(repoPath, "contribution.bin")
+	blob, err := blobForFile(repoPath, "contribution.bin")
+	if err != nil {
+		return err
+	}
+	key, err := annex.Pointer(blob)
+	if err != nil {
+		return err
+	}
+	localObjectPath, err := annex.ContentLocationFromPointer(repoPath, key)
 	if err != nil {
 		return err
 	}
-	// localObjectPath := path.Join(repoPath, "contribution.bin") // or, just compare against the checked-out file
 
-	remoteObjectPath, err := contentLocation(remoteRepoPath, "contribution.bin")
+	remoteObjectPath, err := annex.ContentLocationFromPointer(remoteRepoPath, key)
 	if err != nil {
 		return err
 	}
@@ -1325,6 +1327,31 @@ func doInitRemoteAnnexRepository(t *testing.T, repoURL *url.URL) error {
 	return nil
 }
 
+func blobForFile(repoPath, file string) (*git.Blob, error) {
+	repo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	if err != nil {
+		return nil, err
+	}
+	defer repo.Close()
+
+	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
+	if err != nil {
+		return nil, err
+	}
+
+	commit, err := repo.GetCommit(commitID)
+	if err != nil {
+		return nil, err
+	}
+
+	treeEntry, err := commit.GetTreeEntryByPath(file)
+	if err != nil {
+		return nil, err
+	}
+
+	return treeEntry.Blob(), nil
+}
+
 /*
 Find the path in .git/annex/objects/ of the contents for a given annexed file.
 
@@ -1334,30 +1361,11 @@ Find the path in .git/annex/objects/ of the contents for a given annexed file.
 	TODO: pass a parameter to allow examining non-HEAD branches
 */
 func contentLocation(repoPath, file string) (path string, err error) {
-	path = ""
-
-	repo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	blob, err := blobForFile(repoPath, file)
 	if err != nil {
-		return path, nil
+		return "", err
 	}
-	defer repo.Close()
-
-	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
-	if err != nil {
-		return path, nil
-	}
-
-	commit, err := repo.GetCommit(commitID)
-	if err != nil {
-		return path, nil
-	}
-
-	treeEntry, err := commit.GetTreeEntryByPath(file)
-	if err != nil {
-		return path, nil
-	}
-
-	return annex.ContentLocation(treeEntry.Blob())
+	return annex.ContentLocation(blob)
 }
 
 /* like withKeyFile(), but automatically sets it the account given in ctx for use by git-annex */

From 790fc7c792f15c868f37e0d3bf8f608acbccbb10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 14 Oct 2024 15:59:21 +0000
Subject: [PATCH 048/125] Add git-annex' testremote to the test suite (#48)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `git annex testremote` command runs a built-in set of tests against
a remote. It cannot hurt to check our implementation of a git-annex
remote against it too.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/48
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 tests/integration/git_annex_test.go | 196 ++++++++++++++++++++++++++++
 1 file changed, 196 insertions(+)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 44bc8376d7..03c8802918 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -395,6 +395,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -425,6 +435,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -457,6 +477,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -487,6 +517,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -519,6 +559,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -549,6 +599,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -581,6 +641,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -611,6 +681,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -642,6 +722,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
 					})
 				})
 
@@ -713,6 +803,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -743,6 +843,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -775,6 +885,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -805,6 +925,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -837,6 +967,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -867,6 +1007,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -899,6 +1049,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -929,6 +1089,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -960,6 +1130,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
 					})
 				})
 
@@ -1032,6 +1212,22 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 	return nil
 }
 
+func doAnnexTestremoteReadWriteTest(repoPath string) (err error) {
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "testremote", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func doAnnexTestremoteReadOnlyTest(repoPath string) (err error) {
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "testremote", "origin", "--test-readonly", "annexed.tiff").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	// NB: this test does something slightly different if run separately from "doAnnexInitTest()":
 	//     "git annex copy" will notice and run "git annex init", silently.

From 319b4fc997c3d4f9a9f6fecd2486eed26cad3f7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 22 Oct 2024 18:33:26 +0000
Subject: [PATCH 049/125] Add tests for git annex drop (#47)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds some rudimentary tests that drop files in a repository's clone
as well as from a repository on Forgejo.

Fixes #4.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/47
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 tests/integration/git_annex_test.go | 1004 +++++++++++++++++++++------
 1 file changed, 796 insertions(+), 208 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 03c8802918..68e521397e 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -382,34 +382,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -425,24 +451,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -464,34 +524,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -507,24 +593,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -546,34 +666,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
-							})
 						})
 					})
 
@@ -589,24 +735,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -628,34 +808,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
-							})
 						})
 					})
 
@@ -671,24 +877,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -723,6 +963,26 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
 
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("TestremoteReadOnly", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
@@ -790,34 +1050,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -833,24 +1119,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -872,34 +1192,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -915,24 +1261,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -954,34 +1334,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
-							})
 						})
 					})
 
@@ -997,24 +1403,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -1036,34 +1476,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
-							})
 						})
 					})
 
@@ -1079,24 +1545,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -1131,6 +1631,26 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
 
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("TestremoteReadOnly", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
@@ -1290,6 +1810,40 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	return err
 }
 
+func doAnnexLocalDropTest(repoPath string) (err error) {
+	// This test assumes that files are present in repoPath, i.e. it is run after doAnnexDownloadTest.
+	// This test drops all files from the repository clone.
+	binPath, err := contentLocation(repoPath, "annexed.bin")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if err != nil {
+		return err
+	}
+	tiffPath, err := contentLocation(repoPath, "annexed.tiff")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(tiffPath)
+	if err != nil {
+		return err
+	}
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "drop").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.bin wasn't dropped properly: %w", err)
+	}
+	_, err = os.Stat(tiffPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.tiff wasn't dropped properly: %w", err)
+	}
+	return nil
+}
+
 func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	// NB: this test does something slightly different if run separately from "Init":
 	//     it first runs "git annex init" silently in the background.
@@ -1345,6 +1899,40 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	return nil
 }
 
+func doAnnexRemoteDropTest(remoteRepoPath, repoPath string) (err error) {
+	// This test assumes that files are present in repoPath, i.e. it is run after doAnnexDownloadTest.
+	// This test drops all files from the remote repository.
+	binPath, err := contentLocation(remoteRepoPath, "annexed.bin")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if err != nil {
+		return err
+	}
+	tiffPath, err := contentLocation(remoteRepoPath, "annexed.tiff")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(tiffPath)
+	if err != nil {
+		return err
+	}
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "drop", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.bin wasn't dropped properly: %w", err)
+	}
+	_, err = os.Stat(tiffPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.tiff wasn't dropped properly: %w", err)
+	}
+	return nil
+}
+
 // ---- Helpers ----
 
 func generateRandomFile(size int, path string) (err error) {

From fa7d976b2ee0e0001057a2711620f59325924a44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 25 Oct 2024 09:55:56 +0000
Subject: [PATCH 050/125] Add git-annex p2phttp support (#42)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds a new endpoint under `/git-annex-p2phttp` which acts as an
authenticating proxy to git-annex' p2phttp server. This makes it
possible to set `annex+<server-url>/git-annex-p2phttp` as
`remote.<name>.annexurl` and use git-annex fully over http(s) with the
normal credentials and access tokens provided by Forgejo.

Fixes #25.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/42
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 .forgejo/workflows/testing.yml      |   3 -
 custom/conf/app.example.ini         |   2 +
 modules/annex/annex.go              |  28 +
 modules/setting/annex.go            |   7 +-
 routers/web/repo/annex.go           | 146 +++++
 routers/web/repo/githttp.go         |  20 +
 routers/web/web.go                  |  12 +-
 services/auth/auth.go               |   2 +-
 tests/integration/git_annex_test.go | 888 +++++++++++++++++++++++++---
 9 files changed, 1012 insertions(+), 96 deletions(-)
 create mode 100644 routers/web/repo/annex.go

diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 3d73df5066..c4972c96c9 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -200,7 +200,6 @@ jobs:
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-mysql-migration test-mysql'
-        timeout-minutes: 120
         env:
           USE_REPO_TEST_DIR: 1
   test-pgsql:
@@ -236,7 +235,6 @@ jobs:
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-pgsql-migration test-pgsql'
-        timeout-minutes: 120
         env:
           RACE_ENABLED: true
           USE_REPO_TEST_DIR: 1
@@ -257,7 +255,6 @@ jobs:
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-sqlite-migration test-sqlite'
-        timeout-minutes: 120
         env:
           TAGS: sqlite sqlite_unlock_notify
           RACE_ENABLED: true
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index 486adc60a0..3c723fa4c7 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -2686,6 +2686,8 @@ LEVEL = Info
 ;;
 ;; Whether git-annex is enabled; defaults to false
 ;ENABLED = false
+;; Whether to disable p2phttp support; default is the same as repository.DISABLE_HTTP_GIT
+;DISABLE_P2PHTTP = false
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index ee0843926f..7deb8ec2fa 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -12,8 +12,11 @@ package annex
 import (
 	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path"
+	"path/filepath"
+	"regexp"
 	"strings"
 
 	"code.gitea.io/gitea/modules/git"
@@ -161,3 +164,28 @@ func IsAnnexRepo(repo *git.Repository) bool {
 	_, _, err := git.NewCommand(repo.Ctx, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: repo.Path})
 	return err == nil
 }
+
+var repoConfigFileRe = regexp.MustCompile("[^/]+/[^/]+.git/config$")
+
+func UUID2RepoPath(uuid string) (string, error) {
+	var repoPath string
+	err := filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
+		if err == nil && repoConfigFileRe.MatchString(path) {
+			thisRepoPath := strings.TrimSuffix(path, "/config")
+			stdout, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: thisRepoPath})
+			if err != nil {
+				return nil
+			}
+			repoUUID := strings.TrimSpace(stdout)
+			if repoUUID == uuid {
+				repoPath = thisRepoPath
+				return fs.SkipAll
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return "", err
+	}
+	return repoPath, nil
+}
diff --git a/modules/setting/annex.go b/modules/setting/annex.go
index a0eeac9bb8..35e9e55c0e 100644
--- a/modules/setting/annex.go
+++ b/modules/setting/annex.go
@@ -9,7 +9,8 @@ import (
 
 // Annex represents the configuration for git-annex
 var Annex = struct {
-	Enabled bool `ini:"ENABLED"`
+	Enabled        bool `ini:"ENABLED"`
+	DisableP2PHTTP bool `ini:"DISABLE_P2PHTTP"`
 }{}
 
 func loadAnnexFrom(rootCfg ConfigProvider) {
@@ -17,4 +18,8 @@ func loadAnnexFrom(rootCfg ConfigProvider) {
 	if err := sec.MapTo(&Annex); err != nil {
 		log.Fatal("Failed to map Annex settings: %v", err)
 	}
+	if !sec.HasKey("DISABLE_P2PHTTP") {
+		// If DisableP2PHTTP is not explicitly set then use DisableHTTPGit as its default
+		Annex.DisableP2PHTTP = Repository.DisableHTTPGit
+	}
 }
diff --git a/routers/web/repo/annex.go b/routers/web/repo/annex.go
new file mode 100644
index 0000000000..852b5a11cc
--- /dev/null
+++ b/routers/web/repo/annex.go
@@ -0,0 +1,146 @@
+package repo
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+
+	"code.gitea.io/gitea/models/perm"
+	access_model "code.gitea.io/gitea/models/perm/access"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
+	"code.gitea.io/gitea/modules/annex"
+	"code.gitea.io/gitea/modules/graceful"
+	"code.gitea.io/gitea/modules/log"
+	services_context "code.gitea.io/gitea/services/context"
+)
+
+type p2phttpRecordType struct {
+	CancelFunc func()
+	LastUsed   time.Time
+	Port       string
+}
+
+var p2phttpRecords = make(map[string]*p2phttpRecordType)
+
+// AnnexP2PHTTP implements git-annex smart HTTP support by delegating to git annex p2phttp
+func AnnexP2PHTTP(ctx *services_context.Context) {
+	uuid := ctx.Params(":uuid")
+	repoPath, err := annex.UUID2RepoPath(uuid)
+	if err != nil {
+		ctx.PlainText(http.StatusNotFound, "Repository not found")
+		return
+	}
+
+	parts := strings.Split(repoPath, "/")
+	repoName := strings.TrimSuffix(parts[len(parts)-1], ".git")
+	owner := parts[len(parts)-2]
+	repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, owner, repoName)
+	if err != nil {
+		ctx.PlainText(http.StatusNotFound, "Repository not found")
+		return
+	}
+
+	p, err := access_model.GetUserRepoPermission(ctx, repo, ctx.Doer)
+	if err != nil {
+		ctx.ServerError("GetUserRepoPermission", err)
+		return
+	}
+
+	if !(ctx.Req.Method == "GET" && p.CanAccess(perm.AccessModeRead, unit.TypeCode) ||
+		ctx.Req.Method == "POST" && p.CanAccess(perm.AccessModeWrite, unit.TypeCode) ||
+		ctx.Req.Method == "POST" && strings.HasSuffix(ctx.Req.URL.Path, "/checkpresent") && p.CanAccess(perm.AccessModeRead, unit.TypeCode) ||
+		ctx.Req.Method == "POST" && strings.HasSuffix(ctx.Req.URL.Path, "/keeplocked") ||
+		ctx.Req.Method == "POST" && strings.HasSuffix(ctx.Req.URL.Path, "/lockcontent")) {
+		// GET requests require at least read access; POST requests for
+		// anything but checkpresent, lockcontent, and keeplocked
+		// require write permissions; POST requests for checkpresent
+		// only require read permissions, as it really is just a read.
+		// POST requests for lockcontent and keeplocked require no
+		// authentication at all, as is also the case for the
+		// authentication in the git-annex-p2phttp server. See
+		// https://git-annex.branchable.com/bugs/p2phttp__58___drop_difference_wideopen_unauth-readonly/
+		// for reasoning.
+		ctx.Resp.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
+	p2phttpRecord, p2phttpProcessExists := p2phttpRecords[uuid]
+	if p2phttpProcessExists {
+		p2phttpRecord.LastUsed = time.Now()
+	} else {
+		// Start a new p2phttp process for the requested repository
+		// There is a race condition here with the port selection, ideally git annex p2phttp could just listen on a unix socket...
+		lis, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			log.Error("Failed to listen on a free port: %v", err)
+			ctx.Resp.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		hopefullyFreePort := strings.SplitN(lis.Addr().String(), ":", 2)[1]
+		lis.Close()
+		p2phttpCtx, p2phttpCtxCancel := context.WithCancel(context.Background())
+		go func(ctx context.Context) {
+			cmd := exec.CommandContext(ctx, "git", "-C", repoPath, "annex", "p2phttp", "-J2", "--bind", "127.0.0.1", "--wideopen", "--port", hopefullyFreePort)
+			cmd.SysProcAttr = &syscall.SysProcAttr{
+				Pdeathsig: syscall.SIGINT,
+			}
+			cmd.Cancel = func() error { return cmd.Process.Signal(os.Interrupt) }
+			_ = cmd.Run()
+		}(p2phttpCtx)
+		graceful.GetManager().RunAtTerminate(p2phttpCtxCancel)
+
+		// Wait for the p2phttp server to get ready
+		start := time.Now()
+		sleepDuration := 1 * time.Millisecond
+		for {
+			if time.Since(start) > 5*time.Second {
+				p2phttpCtxCancel()
+				log.Error("Failed to start the p2phttp server in a reasonable amount of time")
+				ctx.Resp.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+			conn, err := net.Dial("tcp", "127.0.0.1:"+hopefullyFreePort)
+			if err == nil {
+				conn.Close()
+				break
+			}
+			time.Sleep(sleepDuration)
+			sleepDuration *= 2
+			if sleepDuration > 1*time.Second {
+				sleepDuration = 1 * time.Second
+			}
+		}
+
+		p2phttpRecord = &p2phttpRecordType{CancelFunc: p2phttpCtxCancel, LastUsed: time.Now(), Port: hopefullyFreePort}
+		p2phttpRecords[uuid] = p2phttpRecord
+	}
+
+	// Cleanup p2phttp processes that haven't been used for a while
+	for uuid, record := range p2phttpRecords {
+		if time.Since(record.LastUsed) > 5*time.Minute {
+			record.CancelFunc()
+			delete(p2phttpRecords, uuid)
+		}
+	}
+
+	url, err := url.Parse("http://127.0.0.1:" + p2phttpRecord.Port + strings.TrimPrefix(ctx.Req.RequestURI, "/git-annex-p2phttp"))
+	if err != nil {
+		log.Error("Failed to parse URL: %v", err)
+		ctx.Resp.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	proxy := httputil.ReverseProxy{
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.Out.URL = url
+		},
+	}
+	proxy.ServeHTTP(ctx.Resp, ctx.Req)
+}
diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index dfdedb04f3..b9354dd45a 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -562,6 +562,26 @@ func GetInfoRefs(ctx *context.Context) {
 	}
 }
 
+// GetConfig implements fetching the git config of a repository
+func GetConfig(ctx *context.Context) {
+	h := httpBase(ctx)
+	if h != nil {
+		setHeaderNoCache(ctx)
+		config, err := os.ReadFile(filepath.Join(h.getRepoDir(), "config"))
+		if err != nil {
+			log.Error("Failed to read git config file: %v", err)
+			ctx.Resp.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		if !setting.Annex.DisableP2PHTTP {
+			config = append(config, []byte("[annex]\n\turl = annex+"+setting.AppURL+"git-annex-p2phttp\n")...)
+		}
+		ctx.Resp.Header().Set("Content-Type", "text/plain")
+		ctx.Resp.Header().Set("Content-Length", fmt.Sprintf("%d", len(config)))
+		http.ServeContent(ctx.Resp, ctx.Req, "config", time.Now(), bytes.NewReader(config))
+	}
+}
+
 // GetTextFile implements Git dumb HTTP
 func GetTextFile(p string) func(*context.Context) {
 	return func(ctx *context.Context) {
diff --git a/routers/web/web.go b/routers/web/web.go
index 4cf4086aba..db0015fb6a 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -363,6 +363,13 @@ func registerRoutes(m *web.Route) {
 		}
 	}
 
+	annexP2PHTTPEnabled := func(ctx *context.Context) {
+		if setting.Annex.DisableP2PHTTP {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+	}
+
 	federationEnabled := func(ctx *context.Context) {
 		if !setting.Federation.Enabled {
 			ctx.Error(http.StatusNotFound)
@@ -962,6 +969,9 @@ func registerRoutes(m *web.Route) {
 	// ***** END: Organization *****
 
 	// ***** START: Repository *****
+	m.Group("", func() {
+		m.Methods("GET,POST", "/git-annex-p2phttp/git-annex/{uuid}/*", repo.AnnexP2PHTTP)
+	}, ignSignInAndCsrf, annexEnabled, annexP2PHTTPEnabled)
 	m.Group("/repo", func() {
 		m.Get("/create", repo.Create)
 		m.Post("/create", web.Bind(forms.CreateRepoForm{}), repo.CreatePost)
@@ -1644,7 +1654,7 @@ func registerRoutes(m *web.Route) {
 
 			m.Group("", func() {
 				// for git-annex
-				m.Methods("GET,OPTIONS", "/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
+				m.Methods("GET,OPTIONS", "/config", repo.GetConfig) // needed by clients reading annex.uuid during `git annex initremote`
 				m.Methods("GET,OPTIONS", "/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
 			}, ignSignInAndCsrf, annexEnabled, context.UserAssignmentWeb())
 
diff --git a/services/auth/auth.go b/services/auth/auth.go
index 100e5b25a2..ddd31917e2 100644
--- a/services/auth/auth.go
+++ b/services/auth/auth.go
@@ -61,7 +61,7 @@ func isArchivePath(req *http.Request) bool {
 	return archivePathRe.MatchString(req.URL.Path)
 }
 
-var annexPathRe = regexp.MustCompile(`^/[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+/annex/`)
+var annexPathRe = regexp.MustCompile(`^(/git-annex-p2phttp/|/[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+/annex/)`)
 
 func isAnnexPath(req *http.Request) bool {
 	if setting.Annex.Enabled {
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 68e521397e..89e86cf932 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -458,6 +458,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
@@ -507,6 +511,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -600,6 +673,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
@@ -649,6 +726,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -742,6 +888,79 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
@@ -884,6 +1103,79 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err = git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
@@ -938,7 +1230,7 @@ func TestGitAnnexPermissions(t *testing.T) {
 				t.Run("Anonymous", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					// Only HTTP has an anonymous mode
+					// Only HTTP and P2PHTTP have an anonymous mode
 					t.Run("HTTP", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
@@ -958,6 +1250,65 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
@@ -1126,6 +1477,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
@@ -1175,6 +1530,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -1268,6 +1692,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
@@ -1317,6 +1745,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -1410,6 +1907,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
@@ -1459,81 +1960,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
-				})
 
-				t.Run("Outsider", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-
-					t.Run("SSH", func(t *testing.T) {
-						defer tests.PrintCurrentTest(t)()
-
-						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
-
-						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
-
-						withAnnexCtxKeyFile(t, ownerCtx, func() {
-							doGitClone(repoPath, repoURL)(t)
-						})
-
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
-							})
-						})
-
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
-							})
-						})
-
-						t.Run("LocalDrop", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexLocalDropTest(repoPath))
-							})
-						})
-
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-							})
-						})
-
-						t.Run("RemoteDrop", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
-							})
-						})
-
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
-							})
-						})
-
-						t.Run("TestremoteReadOnly", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
-							})
-						})
-
-						t.Run("TestremoteReadWrite", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
-							})
-						})
-					})
-
-					t.Run("HTTP", func(t *testing.T) {
+					t.Run("P2PHTTP", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
 						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
@@ -1547,66 +1975,281 @@ func TestGitAnnexPermissions(t *testing.T) {
 
 						t.Run("Init", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("LocalDrop", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexLocalDropTest(repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
 							})
 						})
 
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("RemoteDrop", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("Upload", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("TestremoteReadOnly", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
 						})
 
 						t.Run("TestremoteReadWrite", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
 					})
+
+					t.Run("Outsider", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						t.Run("SSH", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
+							repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+							defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								doGitClone(repoPath, repoURL)(t)
+							})
+
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
+								})
+							})
+
+							t.Run("LocalDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexLocalDropTest(repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("RemoteDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+								})
+							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+								})
+							})
+						})
+
+						t.Run("HTTP", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+							repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+							defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								doGitClone(repoPath, repoURL)(t)
+							})
+
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							// Try unsetting annexurl
+							_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+							require.Error(t, err)
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("LocalDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexLocalDropTest(repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("RemoteDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+								})
+							})
+						})
+
+						t.Run("P2PHTTP", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+							repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+							defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								doGitClone(repoPath, repoURL)(t)
+							})
+
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("LocalDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexLocalDropTest(repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("RemoteDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+								})
+							})
+						})
+					})
 				})
 
 				t.Run("Anonymous", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					// Only HTTP has an anonymous mode
+					// Only HTTP and P2PHTTP have an anonymous mode
 					t.Run("HTTP", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
@@ -1626,6 +2269,65 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
 						})
 
+						// Try unsetting annexurl
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.Error(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
@@ -2189,8 +2891,14 @@ func withAnnexCtxHTTPPassword(t *testing.T, u *url.URL, ctx APITestContext, call
 	credentialedURL := *u
 	credentialedURL.User = url.UserPassword(ctx.Username, userPassword) // NB: all test users use the same password
 
+	credentialedAnnexURL := *u
+	credentialedAnnexURL.Host = strings.ReplaceAll(credentialedAnnexURL.Host, "127.0.0.1", "localhost")
+	credentialedAnnexURL.Scheme = "annex+" + credentialedAnnexURL.Scheme
+	credentialedAnnexURL.Path += "git-annex-p2phttp"
+	credentialedAnnexURL.User = url.UserPassword(ctx.Username, userPassword) // NB: all test users use the same password
+
 	creds := path.Join(t.TempDir(), "creds")
-	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()), 0o600))
+	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()+"\n"+credentialedAnnexURL.String()+"\n"), 0o600))
 
 	originalCredentialHelper, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper").RunStdString(&git.RunOpts{})
 	if err != nil && !git.IsErrorExitCode(err, 1) {

From 4bc7f3df34da3f076a2222da714fd77f01e7f7db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 25 Oct 2024 09:56:36 +0000
Subject: [PATCH 051/125] Simplify git blob to annex key lookup (#43)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #27.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/43
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go              | 102 ++++------------------------
 tests/integration/git_annex_test.go |   6 +-
 2 files changed, 18 insertions(+), 90 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 7deb8ec2fa..3f998f06cc 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -21,96 +21,24 @@ import (
 
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
 )
 
-const (
-	// > The maximum size of a pointer file is 32 kb.
-	// - https://git-annex.branchable.com/internals/pointer_file/
-	// It's unclear if that's kilobytes or kibibytes; assuming kibibytes:
-	blobSizeCutoff = 32 * 1024
-)
+// ErrBlobIsNotAnnexed occurs if a blob does not contain a valid annex key
+var ErrBlobIsNotAnnexed = errors.New("not a git-annex pointer")
 
-// ErrInvalidPointer occurs if the pointer's value doesn't parse
-var ErrInvalidPointer = errors.New("Not a git-annex pointer")
-
-// Gets the content of the blob as raw text, up to n bytes.
-// (the pre-existing blob.GetBlobContent() has a hardcoded 1024-byte limit)
-func getBlobContent(b *git.Blob, n int) (string, error) {
-	dataRc, err := b.DataAsync()
+func LookupKey(blob *git.Blob) (string, error) {
+	stdout, _, err := git.NewCommand(git.DefaultContext, "annex", "lookupkey", "--ref").AddDynamicArguments(blob.ID.String()).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
 	if err != nil {
-		return "", err
+		return "", ErrBlobIsNotAnnexed
 	}
-	defer dataRc.Close()
-	buf := make([]byte, n)
-	n, _ = util.ReadAtMost(dataRc, buf)
-	buf = buf[:n]
-	return string(buf), nil
+	key := strings.TrimSpace(stdout)
+	return key, nil
 }
 
-func Pointer(blob *git.Blob) (string, error) {
-	// git-annex doesn't seem fully spec what its pointer are, but
-	// the fullest description is here:
-	// https://git-annex.branchable.com/internals/pointer_file/
-
-	// a pointer can be:
-	// the original format, generated by `git annex add`: a symlink to '.git/annex/objects/$HASHDIR/$HASHDIR2/$KEY/$KEY'
-	// the newer, git-lfs influenced, format, generated by `git annex smudge`: a text file containing '/annex/objects/$KEY'
-	//
-	// in either case we can extract the $KEY the same way, and we need not actually know if it's a symlink or not because
-	// git.Blob.DataAsync() works like open() + readlink(), handling both cases in one.
-
-	if blob.Size() > blobSizeCutoff {
-		// > The maximum size of a pointer file is 32 kb. If it is any longer, it is not considered to be a valid pointer file.
-		// https://git-annex.branchable.com/internals/pointer_file/
-
-		// It's unclear to me whether the same size limit applies to symlink-pointers, but it seems sensible to limit them too.
-		return "", ErrInvalidPointer
-	}
-
-	pointer, err := getBlobContent(blob, blobSizeCutoff)
+func ContentLocationFromKey(repoPath, key string) (string, error) {
+	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(key).RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
-		return "", fmt.Errorf("error reading %s: %w", blob.Name(), err)
-	}
-
-	// the spec says a pointer file can contain multiple lines each with a pointer in them
-	// but that makes no sense to me, so I'm just ignoring all but the first
-	lines := strings.Split(pointer, "\n")
-	if len(lines) < 1 {
-		return "", ErrInvalidPointer
-	}
-	pointer = lines[0]
-
-	// in both the symlink and pointer-file formats, the pointer must have "/annex/" somewhere in it
-	if !strings.Contains(pointer, "/annex/") {
-		return "", ErrInvalidPointer
-	}
-
-	// extract $KEY
-	pointer = path.Base(strings.TrimSpace(pointer))
-
-	// ask git-annex's opinion on $KEY
-	// XXX: this is probably a bit slow, especially if this operation gets run often
-	//      and examinekey is not that strict:
-	//      - it doesn't enforce that the "BACKEND" tag is one it knows,
-	//      - it doesn't enforce that the fields and their format fit the "BACKEND" tag
-	//      so maybe this is a wasteful step
-	_, examineStderr, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "examinekey").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
-	if err != nil {
-		// TODO: make ErrInvalidPointer into a type capable of wrapping err
-		if strings.TrimSpace(examineStderr) == "git-annex: bad key" {
-			return "", ErrInvalidPointer
-		}
-		return "", err
-	}
-
-	return pointer, nil
-}
-
-func ContentLocationFromPointer(repoPath, pointer string) (string, error) {
-	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: repoPath})
-	if err != nil {
-		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", repoPath, pointer, err)
+		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", repoPath, key, err)
 	}
 	contentLocation = strings.TrimSpace(contentLocation)
 	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
@@ -122,11 +50,11 @@ func ContentLocationFromPointer(repoPath, pointer string) (string, error) {
 // return the absolute path of the content pointed to by the annex pointer stored in the git object
 // errors if the content is not found in this repo
 func ContentLocation(blob *git.Blob) (string, error) {
-	pointer, err := Pointer(blob)
+	key, err := LookupKey(blob)
 	if err != nil {
 		return "", err
 	}
-	return ContentLocationFromPointer(blob.Repo().Path, pointer)
+	return ContentLocationFromKey(blob.Repo().Path, key)
 }
 
 // returns a stream open to the annex content
@@ -147,11 +75,11 @@ func IsAnnexed(blob *git.Blob) (bool, error) {
 		return false, nil
 	}
 
-	// Pointer() is written to only return well-formed pointers
+	// LookupKey is written to only return well-formed keys
 	// so the test is just to see if it errors
-	_, err := Pointer(blob)
+	_, err := LookupKey(blob)
 	if err != nil {
-		if errors.Is(err, ErrInvalidPointer) {
+		if errors.Is(err, ErrBlobIsNotAnnexed) {
 			return false, nil
 		}
 		return false, err
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 89e86cf932..efcb571aa2 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -2576,16 +2576,16 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	if err != nil {
 		return err
 	}
-	key, err := annex.Pointer(blob)
+	key, err := annex.LookupKey(blob)
 	if err != nil {
 		return err
 	}
-	localObjectPath, err := annex.ContentLocationFromPointer(repoPath, key)
+	localObjectPath, err := annex.ContentLocationFromKey(repoPath, key)
 	if err != nil {
 		return err
 	}
 
-	remoteObjectPath, err := annex.ContentLocationFromPointer(remoteRepoPath, key)
+	remoteObjectPath, err := annex.ContentLocationFromKey(remoteRepoPath, key)
 	if err != nil {
 		return err
 	}

From 525eadc70eb2a708a2db8c46f379dac7e9520ce9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 29 Oct 2024 11:45:40 +0000
Subject: [PATCH 052/125] Add an OCI image build and publish workflow (#50)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #49.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/50
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 .forgejo/workflows/build-oci-image.yml | 37 ++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .forgejo/workflows/build-oci-image.yml

diff --git a/.forgejo/workflows/build-oci-image.yml b/.forgejo/workflows/build-oci-image.yml
new file mode 100644
index 0000000000..9eabdf3eab
--- /dev/null
+++ b/.forgejo/workflows/build-oci-image.yml
@@ -0,0 +1,37 @@
+on:
+  push:
+    branches:
+      - 'forgejo'
+    tags:
+      - '*-git-annex*'
+
+jobs:
+  build-oci-image:
+    runs-on: docker
+    strategy:
+      matrix:
+        type: ["rootful", "rootless"]
+    steps:
+      - name: Determine registry and username
+        id: determine-registry-and-username
+        run: |
+          echo "registry=${GITHUB_SERVER_URL#https://}" >> "$GITHUB_OUTPUT"
+          echo "username=${GITHUB_REPOSITORY%/*}" >> "$GITHUB_OUTPUT"
+      - name: Install Docker
+        run: curl -fsSL https://get.docker.com | sh
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ steps.determine-registry-and-username.outputs.registry }}
+          username: ${{ steps.determine-registry-and-username.outputs.username }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          file: ${{ (matrix.type == 'rootful' && 'Dockerfile') || (matrix.type == 'rootless' && 'Dockerfile.rootless') }}
+          push: true
+          tags: ${{ steps.determine-registry-and-username.outputs.registry }}/${{ github.repository }}:${{ github.ref_name }}${{ (matrix.type == 'rootful' && ' ') || (matrix.type == 'rootless' && '-rootless') }}

From ede91562dfda2e87e00743a70c0c430402ee9188 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Sat, 2 Nov 2024 15:00:59 +0000
Subject: [PATCH 053/125] Fix Forgejo version in published OCI images (#51)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Forgejo version is derived from the git history, so the image build
needs to happen in the context of a full repository clone.

Also, the post-processing of the version string needs to remove the
second occurrence of "-g", as the first one is now part of the added
"-git-annex" part.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/51
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 .forgejo/workflows/build-oci-image.yml | 4 ++++
 Makefile                               | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/build-oci-image.yml b/.forgejo/workflows/build-oci-image.yml
index 9eabdf3eab..8e843b41ee 100644
--- a/.forgejo/workflows/build-oci-image.yml
+++ b/.forgejo/workflows/build-oci-image.yml
@@ -12,6 +12,9 @@ jobs:
       matrix:
         type: ["rootful", "rootless"]
     steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # fetch the full history so that the Forgejo version is determined properly
       - name: Determine registry and username
         id: determine-registry-and-username
         run: |
@@ -32,6 +35,7 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
+          context: .
           file: ${{ (matrix.type == 'rootful' && 'Dockerfile') || (matrix.type == 'rootless' && 'Dockerfile.rootless') }}
           push: true
           tags: ${{ steps.determine-registry-and-username.outputs.registry }}/${{ github.repository }}:${{ github.ref_name }}${{ (matrix.type == 'rootful' && ' ') || (matrix.type == 'rootless' && '-rootless') }}
diff --git a/Makefile b/Makefile
index 95658a7842..561d674198 100644
--- a/Makefile
+++ b/Makefile
@@ -104,7 +104,7 @@ else
     FORGEJO_VERSION_API ?= $(GITEA_VERSION)+${GITEA_COMPATIBILITY}
   else
     # drop the "g" prefix prepended by git describe to the commit hash
-    FORGEJO_VERSION ?= $(shell git describe --exclude '*-test' --tags --always | sed 's/^v//' | sed 's/\-g/-/')+${GITEA_COMPATIBILITY}
+    FORGEJO_VERSION ?= $(shell git describe --exclude '*-test' --tags --always | sed 's/^v//' | sed 's/\-g/-/2')+${GITEA_COMPATIBILITY}
   endif
 endif
 FORGEJO_VERSION_MAJOR=$(shell echo $(FORGEJO_VERSION) | sed -e 's/\..*//')

From fa5b158a5a5d743b247cece17c4ca8e09034ecb0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 6 Nov 2024 14:29:39 +0000
Subject: [PATCH 054/125] Explicitly set http(s) default ports in annex.url
 (#55)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise, git-annex tries to use its own default port (9417) and fails.

Fixes #52.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/55
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 routers/web/repo/githttp.go | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index b9354dd45a..53f18f9617 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -10,6 +10,7 @@ import (
 	gocontext "context"
 	"fmt"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -574,7 +575,23 @@ func GetConfig(ctx *context.Context) {
 			return
 		}
 		if !setting.Annex.DisableP2PHTTP {
-			config = append(config, []byte("[annex]\n\turl = annex+"+setting.AppURL+"git-annex-p2phttp\n")...)
+			appURL, err := url.Parse(setting.AppURL)
+			if err != nil {
+				log.Error("Could not parse 'setting.AppURL': %v", err)
+				ctx.Resp.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+			if appURL.Port() == "" {
+				// If there is no port set then set the http(s) default ports.
+				// Without this, git-annex would try its own default port (9417) and fail.
+				if appURL.Scheme == "http" {
+					appURL.Host += ":80"
+				}
+				if appURL.Scheme == "https" {
+					appURL.Host += ":443"
+				}
+			}
+			config = append(config, []byte("[annex]\n\turl = annex+"+appURL.String()+"git-annex-p2phttp\n")...)
 		}
 		ctx.Resp.Header().Set("Content-Type", "text/plain")
 		ctx.Resp.Header().Set("Content-Length", fmt.Sprintf("%d", len(config)))

From 05daede0efa3e02dd25b6b174b72ce6939586bd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 6 Nov 2024 16:22:29 +0000
Subject: [PATCH 055/125] Cache git-annex UUID to repository path mappings
 (#54)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Always walking the filesystem and searching for UUIDs slowed p2phttp
operations down significantly on a production server with more than a
handful of repositories. This caching strategy ensures that only the
first call is rather slow, and subsequent ones should be much faster.

This should better be implemented as a background job, but for now this
is a simple solution to the problem.

Fixes #53.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/54
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 3f998f06cc..7b499fe3f1 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -95,25 +95,43 @@ func IsAnnexRepo(repo *git.Repository) bool {
 
 var repoConfigFileRe = regexp.MustCompile("[^/]+/[^/]+.git/config$")
 
-func UUID2RepoPath(uuid string) (string, error) {
-	var repoPath string
-	err := filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
+var (
+	uuid2repoPathCache = make(map[string]string)
+	repoPath2uuidCache = make(map[string]string)
+)
+
+func updateUUID2RepoPathCache() error {
+	return filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
 		if err == nil && repoConfigFileRe.MatchString(path) {
 			thisRepoPath := strings.TrimSuffix(path, "/config")
+			_, ok := repoPath2uuidCache[thisRepoPath]
+			if ok {
+				return nil
+			}
 			stdout, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: thisRepoPath})
 			if err != nil {
 				return nil
 			}
 			repoUUID := strings.TrimSpace(stdout)
-			if repoUUID == uuid {
-				repoPath = thisRepoPath
-				return fs.SkipAll
+			if repoUUID != "" {
+				uuid2repoPathCache[repoUUID] = thisRepoPath
+				repoPath2uuidCache[thisRepoPath] = repoUUID
 			}
 		}
 		return nil
 	})
-	if err != nil {
+}
+
+func UUID2RepoPath(uuid string) (string, error) {
+	if repoPath, ok := uuid2repoPathCache[uuid]; ok {
+		return repoPath, nil
+	}
+	// If the cache didn't contain an entry for the UUID then update the cache and try again
+	if err := updateUUID2RepoPathCache(); err != nil {
 		return "", err
 	}
-	return repoPath, nil
+	if repoPath, ok := uuid2repoPathCache[uuid]; ok {
+		return repoPath, nil
+	}
+	return "", fmt.Errorf("no repository known for UUID '%s'", uuid)
 }

From b0a9f5650863be573835617feb52d00fe0120694 Mon Sep 17 00:00:00 2001
From: Michael Kriese <michael.kriese@gmx.de>
Date: Tue, 21 Jan 2025 14:42:04 +0000
Subject: [PATCH 056/125] ci: fix go version check (#6646)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6646
---
 .forgejo/workflows-composite/setup-env/action.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows-composite/setup-env/action.yaml b/.forgejo/workflows-composite/setup-env/action.yaml
index 28216e9b8d..f19569a137 100644
--- a/.forgejo/workflows-composite/setup-env/action.yaml
+++ b/.forgejo/workflows-composite/setup-env/action.yaml
@@ -19,7 +19,7 @@ runs:
         set -ex
         toolchain=$(grep -oP '(?<=toolchain ).+' go.mod)
         version=$(go version | cut -d' ' -f3)
-        if [ "$toolchain" != "$version" ]; then
-          echo "go version mismatch: $toolchain <> $version"
+        if dpkg --compare-versions ${version#go} lt ${toolchain#go}; then
+          echo "go version too low: $toolchain >= $version"
           exit 1
         fi

From faa263d54a698fb6c61c0b32e2715ecbb1387170 Mon Sep 17 00:00:00 2001
From: Renovate Bot <forgejo-renovate-action@forgejo.org>
Date: Tue, 28 Jan 2025 11:34:32 +0000
Subject: [PATCH 057/125] Update dependency katex to v0.16.21 [SECURITY]
 (v10.0/forgejo) (#6694)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [katex](https://katex.org) ([source](https://github.com/KaTeX/KaTeX)) | dependencies | patch | [`0.16.18` -> `0.16.21`](https://renovatebot.com/diffs/npm/katex/0.16.18/0.16.21) |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

### KaTeX \htmlData does not validate attribute names
[CVE-2025-23207](https://nvd.nist.gov/vuln/detail/CVE-2025-23207) / [GHSA-cg87-wmx4-v546](https://github.com/advisories/GHSA-cg87-wmx4-v546)

<details>
<summary>More information</summary>

#### Details
##### Impact
KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML.

##### Patches
Upgrade to KaTeX v0.16.21 to remove this vulnerability.

##### Workarounds
- Avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands.
- Forbid inputs containing the substring `"\\htmlData"`.
- Sanitize HTML output from KaTeX.

##### Details
`\htmlData` did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.

##### For more information
If you have any questions or comments about this advisory:

- Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)
- Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`

#### References
- [https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546](https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546)
- [https://nvd.nist.gov/vuln/detail/CVE-2025-23207](https://nvd.nist.gov/vuln/detail/CVE-2025-23207)
- [https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c](https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c)
- [https://github.com/KaTeX/KaTeX](https://github.com/KaTeX/KaTeX)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-cg87-wmx4-v546) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>KaTeX/KaTeX (katex)</summary>

### [`v0.16.21`](https://github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#01621-2025-01-17)

[Compare Source](https://github.com/KaTeX/KaTeX/compare/v0.16.20...v0.16.21)

##### Bug Fixes

-   escape \htmlData attribute name ([57914ad](https://github.com/KaTeX/KaTeX/commit/57914ad91eff401357f44bf364b136d37eba04f8))

### [`v0.16.20`](https://github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#01620-2025-01-12)

[Compare Source](https://github.com/KaTeX/KaTeX/compare/v0.16.19...v0.16.20)

##### Bug Fixes

-   \providecommand does not overwrite existing macro ([#&#8203;4000](https://github.com/KaTeX/KaTeX/issues/4000)) ([6d30fe4](https://github.com/KaTeX/KaTeX/commit/6d30fe47b06f9da9b836fe518d5cbbecf6a6a3a1)), closes [#&#8203;3928](https://github.com/KaTeX/KaTeX/issues/3928)

### [`v0.16.19`](https://github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#01619-2024-12-29)

[Compare Source](https://github.com/KaTeX/KaTeX/compare/v0.16.18...v0.16.19)

##### Bug Fixes

-   **types:** improve `strict` function type ([#&#8203;4009](https://github.com/KaTeX/KaTeX/issues/4009)) ([4228b4e](https://github.com/KaTeX/KaTeX/commit/4228b4eb529b8e35def66cc6e4fa467383b98c86))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - "* 0-3 * * *" (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xMzYuMCIsInVwZGF0ZWRJblZlciI6IjM5LjEzNi4xIiwidGFyZ2V0QnJhbmNoIjoidjEwLjAvZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6694
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e081796a52..7b1c1ce6b3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -30,7 +30,7 @@
         "htmx.org": "1.9.12",
         "idiomorph": "0.3.0",
         "jquery": "3.7.1",
-        "katex": "0.16.18",
+        "katex": "0.16.21",
         "mermaid": "11.4.1",
         "mini-css-extract-plugin": "2.9.2",
         "minimatch": "10.0.1",
@@ -10368,9 +10368,9 @@
       "license": "MIT"
     },
     "node_modules/katex": {
-      "version": "0.16.18",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.18.tgz",
-      "integrity": "sha512-LRuk0rPdXrecAFwQucYjMiIs0JFefk6N1q/04mlw14aVIVgxq1FO0MA9RiIIGVaKOB5GIP5GH4aBBNraZERmaQ==",
+      "version": "0.16.21",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.21.tgz",
+      "integrity": "sha512-XvqR7FgOHtWupfMiigNzmh+MgUVmDGU2kXZm899ZkPfcuoPuFxyHmXsgATDpFZDAXCI8tvinaVcDo8PIIJSo4A==",
       "funding": [
         "https://opencollective.com/katex",
         "https://github.com/sponsors/katex"
diff --git a/package.json b/package.json
index fe7c30471b..dbd21f89f0 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "htmx.org": "1.9.12",
     "idiomorph": "0.3.0",
     "jquery": "3.7.1",
-    "katex": "0.16.18",
+    "katex": "0.16.21",
     "mermaid": "11.4.1",
     "mini-css-extract-plugin": "2.9.2",
     "minimatch": "10.0.1",

From 7ee19b4c6c1a879e3a0f2b32642834ec93b8b20b Mon Sep 17 00:00:00 2001
From: Michael Kriese <michael.kriese@visualon.de>
Date: Tue, 28 Jan 2025 15:46:07 +0000
Subject: [PATCH 058/125] chore: consistent docker image and action references
 (#6704)

backport of #6703
- replace `code.forgejo.org` ->`data.forgejo.org` on docker images
- add `https://data.forgejo.org/` to actions where missing

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6704
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-committed-by: Michael Kriese <michael.kriese@visualon.de>
---
 .forgejo/workflows-composite/build-backend/action.yaml  | 2 +-
 .forgejo/workflows-composite/setup-cache-go/action.yaml | 2 +-
 .forgejo/workflows/build-release-integration.yml        | 2 +-
 .forgejo/workflows/build-release.yml                    | 2 +-
 .forgejo/workflows/cascade-setup-end-to-end.yml         | 4 ++--
 .forgejo/workflows/publish-release.yml                  | 2 +-
 .forgejo/workflows/testing.yml                          | 4 ++--
 Dockerfile                                              | 6 +++---
 Dockerfile.rootless                                     | 6 +++---
 9 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.forgejo/workflows-composite/build-backend/action.yaml b/.forgejo/workflows-composite/build-backend/action.yaml
index ada372b834..68a99ffaf9 100644
--- a/.forgejo/workflows-composite/build-backend/action.yaml
+++ b/.forgejo/workflows-composite/build-backend/action.yaml
@@ -3,7 +3,7 @@ runs:
   steps:
     - run: |
         su forgejo -c 'make deps-backend'
-    - uses: actions/cache@v4
+    - uses: https://data.forgejo.org/actions/cache@v4
       id: cache-backend
       with:
         path: ${{github.workspace}}/gitea
diff --git a/.forgejo/workflows-composite/setup-cache-go/action.yaml b/.forgejo/workflows-composite/setup-cache-go/action.yaml
index 67372d9f36..1e0425fd0e 100644
--- a/.forgejo/workflows-composite/setup-cache-go/action.yaml
+++ b/.forgejo/workflows-composite/setup-cache-go/action.yaml
@@ -48,7 +48,7 @@ runs:
 
     - name: "Restore Go dependencies from cache or mark for later caching"
       id: cache-deps
-      uses: actions/cache@v4
+      uses: https://data.forgejo.org/actions/cache@v4
       with:
         key: setup-cache-go-deps-${{ runner.os }}-${{ inputs.username }}-${{ steps.go-version.outputs.go_version }}-${{ hashFiles('go.sum', 'go.mod') }}
         restore-keys: |
diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml
index 6410915644..1af6d567dd 100644
--- a/.forgejo/workflows/build-release-integration.yml
+++ b/.forgejo/workflows/build-release-integration.yml
@@ -25,7 +25,7 @@ jobs:
     if: vars.ROLE == 'forgejo-coding'
     runs-on: lxc-bookworm
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
 
       - id: forgejo
         uses: https://data.forgejo.org/actions/setup-forgejo@v2.0.4
diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
index 9d88cb43dd..0d7f94c5a6 100644
--- a/.forgejo/workflows/build-release.yml
+++ b/.forgejo/workflows/build-release.yml
@@ -33,7 +33,7 @@ jobs:
     # root is used for testing, allow it
     if: vars.ROLE == 'forgejo-integration' || github.repository_owner == 'root'
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
         with:
           fetch-depth: 0
 
diff --git a/.forgejo/workflows/cascade-setup-end-to-end.yml b/.forgejo/workflows/cascade-setup-end-to-end.yml
index 710cd27ba4..bcc7821f4f 100644
--- a/.forgejo/workflows/cascade-setup-end-to-end.yml
+++ b/.forgejo/workflows/cascade-setup-end-to-end.yml
@@ -37,11 +37,11 @@ jobs:
     container:
       image: data.forgejo.org/oci/node:20-bookworm
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
         with:
           fetch-depth: '0'
           show-progress: 'false'
-      - uses: https://code.forgejo.org/actions/cascading-pr@v2.2.0
+      - uses: https://data.forgejo.org/actions/cascading-pr@v2.2.0
         with:
           origin-url: ${{ env.GITHUB_SERVER_URL }}
           origin-repo: ${{ github.repository }}
diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml
index a3ff48c718..93ad54de1c 100644
--- a/.forgejo/workflows/publish-release.yml
+++ b/.forgejo/workflows/publish-release.yml
@@ -39,7 +39,7 @@ jobs:
     runs-on: lxc-bookworm
     if: vars.DOER != '' && vars.FORGEJO != '' && vars.TO_OWNER != '' && vars.FROM_OWNER != '' && secrets.TOKEN != ''
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
 
       - name: copy & sign
         uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@v5.3.1
diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index eb3163d3ae..784bc45736 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -46,7 +46,7 @@ jobs:
           apt-get update -qq
           apt-get -q install -qq -y zstd
       - name: "Cache frontend build for playwright testing"
-        uses: actions/cache/save@v4
+        uses: https://data.forgejo.org/actions/cache/save@v4
         with:
           path: ${{github.workspace}}/public/assets
           key: frontend-build-${{ github.sha }}
@@ -104,7 +104,7 @@ jobs:
           fetch-depth: 20
       - uses: ./.forgejo/workflows-composite/setup-env
       - name: "Restore frontend build"
-        uses: actions/cache/restore@v4
+        uses: https://data.forgejo.org/actions/cache/restore@v4
         id: cache-frontend
         with:
           path: ${{github.workspace}}/public/assets
diff --git a/Dockerfile b/Dockerfile
index ae21a0821e..af9269a6ce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
-FROM --platform=$BUILDPLATFORM code.forgejo.org/oci/xx AS xx
+FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/xx AS xx
 
-FROM --platform=$BUILDPLATFORM code.forgejo.org/oci/golang:1.23-alpine3.20 as build-env
+FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.23-alpine3.20 as build-env
 
 ARG GOPROXY
 ENV GOPROXY=${GOPROXY:-direct}
@@ -51,7 +51,7 @@ RUN chmod 755 /tmp/local/usr/bin/entrypoint \
               /go/src/code.gitea.io/gitea/environment-to-ini
 RUN chmod 644 /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete
 
-FROM code.forgejo.org/oci/alpine:3.20
+FROM data.forgejo.org/oci/alpine:3.20
 ARG RELEASE_VERSION
 LABEL maintainer="contact@forgejo.org" \
       org.opencontainers.image.authors="Forgejo" \
diff --git a/Dockerfile.rootless b/Dockerfile.rootless
index c5d6a13f35..82d15e8eac 100644
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -1,6 +1,6 @@
-FROM --platform=$BUILDPLATFORM code.forgejo.org/oci/xx AS xx
+FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/xx AS xx
 
-FROM --platform=$BUILDPLATFORM code.forgejo.org/oci/golang:1.23-alpine3.20 as build-env
+FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.23-alpine3.20 as build-env
 
 ARG GOPROXY
 ENV GOPROXY=${GOPROXY:-direct}
@@ -49,7 +49,7 @@ RUN chmod 755 /tmp/local/usr/local/bin/docker-entrypoint.sh \
               /go/src/code.gitea.io/gitea/environment-to-ini
 RUN chmod 644 /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete
 
-FROM code.forgejo.org/oci/alpine:3.20
+FROM data.forgejo.org/oci/alpine:3.20
 LABEL maintainer="contact@forgejo.org" \
       org.opencontainers.image.authors="Forgejo" \
       org.opencontainers.image.url="https://forgejo.org" \

From 114d8975b55513c02ab06b13a7cc2bae63fec39a Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Wed, 29 Jan 2025 08:24:37 +0000
Subject: [PATCH 059/125] [v10.0/forgejo] fix: render issue titles consistently
 (#6717)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6715

- Render the issue titles in dashboard feed in consistent manner, by using the existing `RenderIssueTitle`.
- Added integration tests (not exhaustive for all comment types, but exhaustive enough for the current code where some comment types are grouped together).
- Resolves forgejo/forgejo#6705

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6717
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 templates/user/dashboard/feeds.tmpl      |  8 ++--
 tests/integration/pull_icon_test.go      | 15 +++----
 tests/integration/pull_review_test.go    | 10 +++--
 tests/integration/user_dashboard_test.go | 51 ++++++++++++++++++++++++
 4 files changed, 68 insertions(+), 16 deletions(-)

diff --git a/templates/user/dashboard/feeds.tmpl b/templates/user/dashboard/feeds.tmpl
index bd2a3800a2..85ae7266d9 100644
--- a/templates/user/dashboard/feeds.tmpl
+++ b/templates/user/dashboard/feeds.tmpl
@@ -103,11 +103,11 @@
 						<a href="{{AppSubUrl}}/{{$push.CompareURL}}">{{ctx.Locale.Tr "action.compare_commits" $push.Len}} »</a>
 					{{end}}
 				{{else if .GetOpType.InActions "create_issue"}}
-					<span class="text truncate issue title">{{index .GetIssueInfos 1 | RenderEmoji $.Context | RenderCodeBlock}}</span>
+					<span class="text truncate issue title">{{RenderIssueTitle ctx (index .GetIssueInfos 1) (.Repo.ComposeMetas ctx)}}</span>
 				{{else if .GetOpType.InActions "create_pull_request"}}
-					<span class="text truncate issue title">{{index .GetIssueInfos 1 | RenderEmoji $.Context | RenderCodeBlock}}</span>
+					<span class="text truncate issue title">{{RenderIssueTitle ctx (index .GetIssueInfos 1) (.Repo.ComposeMetas ctx)}}</span>
 				{{else if .GetOpType.InActions "comment_issue" "approve_pull_request" "reject_pull_request" "comment_pull"}}
-					<a href="{{.GetCommentLink ctx}}" class="text truncate issue title">{{(.GetIssueTitle ctx) | RenderEmoji $.Context | RenderCodeBlock}}</a>
+					<a href="{{.GetCommentLink ctx}}" class="text truncate issue title">{{RenderIssueTitle ctx (.GetIssueTitle ctx) (.Repo.ComposeMetas ctx)}}</a>
 					{{$comment := index .GetIssueInfos 1}}
 					{{if $comment}}
 						<div class="markup tw-text-14">{{RenderMarkdownToHtml ctx $comment}}</div>
@@ -115,7 +115,7 @@
 				{{else if .GetOpType.InActions "merge_pull_request"}}
 					<div class="flex-item-body text black">{{index .GetIssueInfos 1}}</div>
 				{{else if .GetOpType.InActions "close_issue" "reopen_issue" "close_pull_request" "reopen_pull_request"}}
-					<span class="text truncate issue title">{{(.GetIssueTitle ctx) | RenderEmoji $.Context | RenderCodeBlock}}</span>
+					<span class="text truncate issue title">{{RenderIssueTitle ctx (.GetIssueTitle ctx) (.Repo.ComposeMetas ctx)}}</span>
 				{{else if .GetOpType.InActions "pull_review_dismissed"}}
 				<div class="flex-item-body text black">{{ctx.Locale.Tr "action.review_dismissed_reason"}}</div>
 				<div class="flex-item-body text black">{{index .GetIssueInfos 2 | RenderEmoji $.Context}}</div>
diff --git a/tests/integration/pull_icon_test.go b/tests/integration/pull_icon_test.go
index 8fde547ce9..b678550c30 100644
--- a/tests/integration/pull_icon_test.go
+++ b/tests/integration/pull_icon_test.go
@@ -133,7 +133,7 @@ func testPullRequestListIcon(t *testing.T, doc *HTMLDoc, name, expectedColor, ex
 }
 
 func createOpenPullRequest(ctx context.Context, t *testing.T, user *user_model.User, repo *repo_model.Repository) *issues_model.PullRequest {
-	pull := createPullRequest(t, user, repo, "open")
+	pull := createPullRequest(t, user, repo, "branch-open", "open")
 
 	assert.False(t, pull.Issue.IsClosed)
 	assert.False(t, pull.HasMerged)
@@ -143,7 +143,7 @@ func createOpenPullRequest(ctx context.Context, t *testing.T, user *user_model.U
 }
 
 func createOpenWipPullRequest(ctx context.Context, t *testing.T, user *user_model.User, repo *repo_model.Repository) *issues_model.PullRequest {
-	pull := createPullRequest(t, user, repo, "open-wip")
+	pull := createPullRequest(t, user, repo, "branch-open-wip", "open-wip")
 
 	err := issue_service.ChangeTitle(ctx, pull.Issue, user, "WIP: "+pull.Issue.Title)
 	require.NoError(t, err)
@@ -156,7 +156,7 @@ func createOpenWipPullRequest(ctx context.Context, t *testing.T, user *user_mode
 }
 
 func createClosedPullRequest(ctx context.Context, t *testing.T, user *user_model.User, repo *repo_model.Repository) *issues_model.PullRequest {
-	pull := createPullRequest(t, user, repo, "closed")
+	pull := createPullRequest(t, user, repo, "branch-closed", "closed")
 
 	err := issue_service.ChangeStatus(ctx, pull.Issue, user, "", true)
 	require.NoError(t, err)
@@ -169,7 +169,7 @@ func createClosedPullRequest(ctx context.Context, t *testing.T, user *user_model
 }
 
 func createClosedWipPullRequest(ctx context.Context, t *testing.T, user *user_model.User, repo *repo_model.Repository) *issues_model.PullRequest {
-	pull := createPullRequest(t, user, repo, "closed-wip")
+	pull := createPullRequest(t, user, repo, "branch-closed-wip", "closed-wip")
 
 	err := issue_service.ChangeTitle(ctx, pull.Issue, user, "WIP: "+pull.Issue.Title)
 	require.NoError(t, err)
@@ -185,7 +185,7 @@ func createClosedWipPullRequest(ctx context.Context, t *testing.T, user *user_mo
 }
 
 func createMergedPullRequest(ctx context.Context, t *testing.T, user *user_model.User, repo *repo_model.Repository) *issues_model.PullRequest {
-	pull := createPullRequest(t, user, repo, "merged")
+	pull := createPullRequest(t, user, repo, "branch-merged", "merged")
 
 	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
 	defer gitRepo.Close()
@@ -202,10 +202,7 @@ func createMergedPullRequest(ctx context.Context, t *testing.T, user *user_model
 	return pull
 }
 
-func createPullRequest(t *testing.T, user *user_model.User, repo *repo_model.Repository, name string) *issues_model.PullRequest {
-	branch := "branch-" + name
-	title := "Testing " + name
-
+func createPullRequest(t *testing.T, user *user_model.User, repo *repo_model.Repository, branch, title string) *issues_model.PullRequest {
 	_, err := files_service.ChangeRepoFiles(git.DefaultContext, repo, user, &files_service.ChangeRepoFilesOptions{
 		Files: []*files_service.ChangeRepoFile{
 			{
diff --git a/tests/integration/pull_review_test.go b/tests/integration/pull_review_test.go
index 1319db29bf..e1db171f16 100644
--- a/tests/integration/pull_review_test.go
+++ b/tests/integration/pull_review_test.go
@@ -518,7 +518,7 @@ func TestPullView_GivenApproveOrRejectReviewOnClosedPR(t *testing.T) {
 			resp := testPullCreate(t, user1Session, "user1", "repo1", false, "master", "a-test-branch", "This is a pull title")
 			elem := strings.Split(test.RedirectURL(resp), "/")
 			assert.EqualValues(t, "pulls", elem[3])
-			testIssueClose(t, user1Session, elem[1], elem[2], elem[4])
+			testIssueClose(t, user1Session, elem[1], elem[2], elem[4], true)
 
 			// Get the commit SHA
 			pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{
@@ -579,8 +579,12 @@ func testSubmitReview(t *testing.T, session *TestSession, csrf, owner, repo, pul
 	return session.MakeRequest(t, req, expectedSubmitStatus)
 }
 
-func testIssueClose(t *testing.T, session *TestSession, owner, repo, issueNumber string) *httptest.ResponseRecorder {
-	req := NewRequest(t, "GET", path.Join(owner, repo, "pulls", issueNumber))
+func testIssueClose(t *testing.T, session *TestSession, owner, repo, issueNumber string, isPull bool) *httptest.ResponseRecorder {
+	issueType := "issues"
+	if isPull {
+		issueType = "pulls"
+	}
+	req := NewRequest(t, "GET", path.Join(owner, repo, issueType, issueNumber))
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	htmlDoc := NewHTMLParser(t, resp.Body)
diff --git a/tests/integration/user_dashboard_test.go b/tests/integration/user_dashboard_test.go
index abc3e065d9..0ed5193c48 100644
--- a/tests/integration/user_dashboard_test.go
+++ b/tests/integration/user_dashboard_test.go
@@ -5,12 +5,21 @@ package integration
 
 import (
 	"net/http"
+	"net/url"
+	"strconv"
 	"strings"
 	"testing"
 
+	"code.gitea.io/gitea/models/db"
+	unit_model "code.gitea.io/gitea/models/unit"
 	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/translation"
+	issue_service "code.gitea.io/gitea/services/issue"
+	files_service "code.gitea.io/gitea/services/repository/files"
+	"code.gitea.io/gitea/tests"
 
+	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -28,3 +37,45 @@ func TestUserDashboardActionLinks(t *testing.T) {
 	assert.EqualValues(t, locale.TrString("new_migrate.link"), strings.TrimSpace(links.Find("a[href='/repo/migrate']").Text()))
 	assert.EqualValues(t, locale.TrString("new_org.link"), strings.TrimSpace(links.Find("a[href='/org/create']").Text()))
 }
+
+func TestDashboardTitleRendering(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+		sess := loginUser(t, user4.Name)
+
+		repo, _, f := tests.CreateDeclarativeRepo(t, user4, "",
+			[]unit_model.Type{unit_model.TypePullRequests, unit_model.TypeIssues}, nil,
+			[]*files_service.ChangeRepoFile{
+				{
+					Operation:     "create",
+					TreePath:      "test.txt",
+					ContentReader: strings.NewReader("Just some text here"),
+				},
+			},
+		)
+		defer f()
+
+		issue := createIssue(t, user4, repo, "`:exclamation:` not rendered", "Hi there!")
+		pr := createPullRequest(t, user4, repo, "testing", "`:exclamation:` not rendered")
+
+		_, err := issue_service.CreateIssueComment(db.DefaultContext, user4, repo, issue, "hi", nil)
+		require.NoError(t, err)
+
+		_, err = issue_service.CreateIssueComment(db.DefaultContext, user4, repo, pr.Issue, "hi", nil)
+		require.NoError(t, err)
+
+		testIssueClose(t, sess, repo.OwnerName, repo.Name, strconv.Itoa(int(issue.Index)), false)
+		testIssueClose(t, sess, repo.OwnerName, repo.Name, strconv.Itoa(int(pr.Issue.Index)), true)
+
+		response := sess.MakeRequest(t, NewRequest(t, "GET", "/"), http.StatusOK)
+		htmlDoc := NewHTMLParser(t, response.Body)
+
+		count := 0
+		htmlDoc.doc.Find("#activity-feed .flex-item-main .title").Each(func(i int, s *goquery.Selection) {
+			count++
+			assert.EqualValues(t, ":exclamation: not rendered", s.Text())
+		})
+
+		assert.EqualValues(t, 6, count)
+	})
+}

From c198cb6e65a8867e1fcacb9490e2677854c6ee07 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Wed, 29 Jan 2025 08:28:25 +0000
Subject: [PATCH 060/125] [v10.0/forgejo] fix(i18n): add forgotten translatable
 string (#6718)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6701

- Regression of 75ce1e2ac12042cf00713353055ab1d40b53b798

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6718
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 options/locale/locale_en-US.ini        | 1 +
 templates/repo/editor/commit_form.tmpl | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index cf69f6ef16..4d1ebd62c6 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -1428,6 +1428,7 @@ editor.user_no_push_to_branch = User cannot push to branch
 editor.require_signed_commit = Branch requires a signed commit
 editor.cherry_pick = Cherry-pick %s onto:
 editor.revert = Revert %s onto:
+editor.commit_email = Commit email
 
 commits.desc = Browse source code change history.
 commits.commits = Commits
diff --git a/templates/repo/editor/commit_form.tmpl b/templates/repo/editor/commit_form.tmpl
index fc04289b70..c42eed69a5 100644
--- a/templates/repo/editor/commit_form.tmpl
+++ b/templates/repo/editor/commit_form.tmpl
@@ -67,7 +67,7 @@
 			{{end}}
 		</div>
 		<div class="field {{if .Err_CommitMailID}}error{{end}}">
-			<label for="commit_mail_id">Commit email</label>
+			<label for="commit_mail_id">{{ctx.Locale.Tr "repo.editor.commit_email"}}</label>
 			<select class="ui selection dropdown" name="commit_mail_id">
 			{{range .CommitMails}}
 				<option{{if eq $.DefaultCommitMail .Email}} selected="selected"{{end}} value="{{.ID}}">{{.Email}}</option>

From 4016f2890d82d2f37160cd774bf6162400c9f1cb Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Wed, 29 Jan 2025 09:34:03 +0000
Subject: [PATCH 061/125] [v10.0/forgejo] fix: disallow blame on directories
 (#6720)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6716

- Don't allow the blame operation on directories.
- Added integration test.
- Resolves forgejo/forgejo#6533

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6720
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 routers/web/repo/blame.go      |  5 +++++
 tests/integration/repo_test.go | 12 ++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/routers/web/repo/blame.go b/routers/web/repo/blame.go
index 4f962d4c19..c7fbaaefcb 100644
--- a/routers/web/repo/blame.go
+++ b/routers/web/repo/blame.go
@@ -56,6 +56,11 @@ func RefBlame(ctx *context.Context) {
 		HandleGitError(ctx, "Repo.Commit.GetTreeEntryByPath", err)
 		return
 	}
+	if entry.IsDir() {
+		ctx.NotFound("Cannot blame directory", nil)
+		return
+	}
+
 	blob := entry.Blob()
 
 	ctx.Data["PageIsViewCode"] = true
diff --git a/tests/integration/repo_test.go b/tests/integration/repo_test.go
index 90fc19c193..01d905895a 100644
--- a/tests/integration/repo_test.go
+++ b/tests/integration/repo_test.go
@@ -1462,3 +1462,15 @@ func TestRepoSubmoduleView(t *testing.T) {
 		htmlDoc.AssertElement(t, fmt.Sprintf(`tr[data-entryname="repo1"] a[href="%s"]`, u.JoinPath("/user2/repo1").String()), true)
 	})
 }
+
+func TestBlameDirectory(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// Ensure directory exists.
+	req := NewRequest(t, "GET", "/user2/repo59/src/branch/master/deep")
+	MakeRequest(t, req, http.StatusOK)
+
+	// Blame is not allowed
+	req = NewRequest(t, "GET", "/user2/repo59/blame/branch/master/deep")
+	MakeRequest(t, req, http.StatusNotFound)
+}

From 0db9a24a4b9557e2a8fa99965a10b93cb13c04f3 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Wed, 29 Jan 2025 19:28:12 +0000
Subject: [PATCH 062/125] [v10.0/forgejo] fix: check for webauthn in 2fa user
 search (#6730)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6726

- Check for webauthn credentials in the user search when the two factor
filter is enabled.
- Resolves forgejo/forgejo#6524

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6730
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 models/user/search.go    | 10 ++++------
 models/user/user_test.go |  2 +-
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/models/user/search.go b/models/user/search.go
index cb90ca850e..143f9d39c9 100644
--- a/models/user/search.go
+++ b/models/user/search.go
@@ -126,17 +126,15 @@ func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) *xorm.Sess
 		return e.Where(cond)
 	}
 
-	// 2fa filter uses LEFT JOIN to check whether a user has a 2fa record
-	// While using LEFT JOIN, sometimes the performance might not be good, but it won't be a problem now, such SQL is seldom executed.
-	// There are some possible methods to refactor this SQL in future when we really need to optimize the performance (but not now):
-	// (1) add a column in user table (2) add a setting value in user_setting table (3) use search engines (bleve/elasticsearch)
+	// Check if the user has two factor enabled, which is TOTP or Webauthn.
 	if opts.IsTwoFactorEnabled.Value() {
-		cond = cond.And(builder.Expr("two_factor.uid IS NOT NULL"))
+		cond = cond.And(builder.Expr("two_factor.uid IS NOT NULL OR webauthn_credential.user_id IS NOT NULL"))
 	} else {
-		cond = cond.And(builder.Expr("two_factor.uid IS NULL"))
+		cond = cond.And(builder.Expr("two_factor.uid IS NULL AND webauthn_credential.user_id IS NULL"))
 	}
 
 	return e.Join("LEFT OUTER", "two_factor", "two_factor.uid = `user`.id").
+		Join("LEFT OUTER", "webauthn_credential", "webauthn_credential.user_id = `user`.id").
 		Where(cond)
 }
 
diff --git a/models/user/user_test.go b/models/user/user_test.go
index 1c734fa926..bc23a5da48 100644
--- a/models/user/user_test.go
+++ b/models/user/user_test.go
@@ -222,7 +222,7 @@ func TestSearchUsers(t *testing.T) {
 		[]int64{1041, 37})
 
 	testUserSuccess(&user_model.SearchUserOptions{ListOptions: db.ListOptions{Page: 1}, IsTwoFactorEnabled: optional.Some(true)},
-		[]int64{24})
+		[]int64{24, 32})
 }
 
 func TestEmailNotificationPreferences(t *testing.T) {

From 1fc2fcd4380c9ab211bfa6b236226edc8b423015 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 30 Jan 2025 10:50:48 +0000
Subject: [PATCH 063/125] Pre-populate the git-annex UUID cache at startup
 (#59)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This eliminates the wait time for the first p2phttp connection since
server startup at the cost of adding that time to the startup itself.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/59
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go | 9 +++++++++
 routers/init.go        | 3 +++
 2 files changed, 12 insertions(+)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 7b499fe3f1..a94321f359 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -20,6 +20,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 )
 
@@ -100,6 +101,14 @@ var (
 	repoPath2uuidCache = make(map[string]string)
 )
 
+func Init() error {
+	if !setting.Annex.Enabled {
+		return nil
+	}
+	log.Info("Populating the git-annex UUID cache with existing repositories")
+	return updateUUID2RepoPathCache()
+}
+
 func updateUUID2RepoPathCache() error {
 	return filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
 		if err == nil && repoConfigFileRe.MatchString(path) {
diff --git a/routers/init.go b/routers/init.go
index 821a0ef38c..d881edd030 100644
--- a/routers/init.go
+++ b/routers/init.go
@@ -11,6 +11,7 @@ import (
 	"code.gitea.io/gitea/models"
 	asymkey_model "code.gitea.io/gitea/models/asymkey"
 	authmodel "code.gitea.io/gitea/models/auth"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/eventsource"
 	"code.gitea.io/gitea/modules/git"
@@ -167,6 +168,8 @@ func InitWebInstalled(ctx context.Context) {
 
 	actions_service.Init()
 
+	mustInit(annex.Init)
+
 	// Finally start up the cron
 	cron.NewContext(ctx)
 }

From 69bc17ea357b91d7335054a85b36023843956c6f Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Thu, 30 Jan 2025 11:49:16 +0000
Subject: [PATCH 064/125] [v10.0/forgejo] fix inline file preview for files
 with encoded URL, fix #5069 (#6739)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6525

### Screenshot
#### Before
See #5069.
#### After
![image](/attachments/d57c2ff8-d29e-41b8-9280-c884ac43f12e)
### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).
- Manual testing: see https://codeberg.org/forgejo/forgejo/pulls/6525#issuecomment-2578814. Thanks @earl-warren.

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Co-authored-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6739
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 modules/markup/file_preview.go                |   5 +++
 modules/markup/html_test.go                   |  31 ++++++++++++++++++
 .../18/9739e1c2a6cdb8ee094ba1ef8a2e40cf65b2ec | Bin 0 -> 90 bytes
 .../2a/4032b49cff56d6d4921133e087d9dc0341a2c5 | Bin 0 -> 108 bytes
 .../2d/2f8eaa17b17359ee1c73222065575d50d9a157 | Bin 0 -> 108 bytes
 .../2f/b9577a8e940a0a84a789cdd4a45d0f172e3fdd | Bin 0 -> 45 bytes
 .../2f/f8eb63aad050c3f20e9cb27090ab7378267ab2 | Bin 0 -> 90 bytes
 .../3e/2a4f1b9a15ffa15ea7ffdc06acd302442b3eca |   1 +
 .../8a/3b1881b5c4e7dc2be7ee1c0f37f93ffbb5ff77 | Bin 0 -> 90 bytes
 .../95/31b649823095acf5d79ab9e4f8b8d86046352f | Bin 0 -> 108 bytes
 .../ac/769ab4baa91060a4c2f828f53e6c3cc2f708f8 | Bin 0 -> 176 bytes
 .../c5/3110b1957cefc56c4b2d879476ddbe905980bf | Bin 0 -> 44 bytes
 .../e7/99b34ea867a0364d0df33f382562db9ff39084 | Bin 0 -> 45 bytes
 .../ee/b243c3395e1921c5d90e73bd739827251fc99d | Bin 0 -> 175 bytes
 .../f7/0f10e4db19068f79bc43844b49f3eece45c4e8 | Bin 0 -> 17 bytes
 .../repo/repo1_filepreview/refs/heads/master  |   2 +-
 16 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/18/9739e1c2a6cdb8ee094ba1ef8a2e40cf65b2ec
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/2a/4032b49cff56d6d4921133e087d9dc0341a2c5
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/2d/2f8eaa17b17359ee1c73222065575d50d9a157
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/2f/b9577a8e940a0a84a789cdd4a45d0f172e3fdd
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/2f/f8eb63aad050c3f20e9cb27090ab7378267ab2
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/3e/2a4f1b9a15ffa15ea7ffdc06acd302442b3eca
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/8a/3b1881b5c4e7dc2be7ee1c0f37f93ffbb5ff77
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/95/31b649823095acf5d79ab9e4f8b8d86046352f
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/ac/769ab4baa91060a4c2f828f53e6c3cc2f708f8
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/c5/3110b1957cefc56c4b2d879476ddbe905980bf
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/e7/99b34ea867a0364d0df33f382562db9ff39084
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/ee/b243c3395e1921c5d90e73bd739827251fc99d
 create mode 100644 modules/markup/tests/repo/repo1_filepreview/objects/f7/0f10e4db19068f79bc43844b49f3eece45c4e8

diff --git a/modules/markup/file_preview.go b/modules/markup/file_preview.go
index 3caf08f7bb..2171f6097b 100644
--- a/modules/markup/file_preview.go
+++ b/modules/markup/file_preview.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"html/template"
 	"io"
+	"net/url"
 	"regexp"
 	"slices"
 	"strconv"
@@ -83,6 +84,10 @@ func newFilePreview(ctx *RenderContext, node *html.Node, locale translation.Loca
 	} else if Type(filePath) != "" {
 		urlFullSource = node.Data[m[0]:m[6]] + filePath + "?display=source#" + node.Data[m[8]:m[1]]
 	}
+	filePath, err := url.QueryUnescape(filePath)
+	if err != nil {
+		return nil
+	}
 	hash := node.Data[m[8]:m[9]]
 
 	preview.start = m[0]
diff --git a/modules/markup/html_test.go b/modules/markup/html_test.go
index 702c5a716d..05ba321548 100644
--- a/modules/markup/html_test.go
+++ b/modules/markup/html_test.go
@@ -1129,4 +1129,35 @@ func TestRender_FilePreview(t *testing.T) {
 			localMetas,
 		)
 	})
+
+	commitFileURL = util.URLJoin(markup.TestRepoURL, "src", "commit", "eeb243c3395e1921c5d90e73bd739827251fc99d", "path", "to", "file%20%23.txt")
+
+	t.Run("file with strange characters in name", func(t *testing.T) {
+		testRender(
+			commitFileURL+"#L1",
+			`<p></p>`+
+				`<div class="file-preview-box">`+
+				`<div class="header">`+
+				`<div>`+
+				`<a href="http://localhost:3000/gogits/gogs/src/commit/eeb243c3395e1921c5d90e73bd739827251fc99d/path/to/file%20%23.txt#L1" class="muted" rel="nofollow">path/to/file #.txt</a>`+
+				`</div>`+
+				`<span class="text small grey">`+
+				`Line 1 in <a href="http://localhost:3000/gogits/gogs/src/commit/eeb243c3395e1921c5d90e73bd739827251fc99d" class="text black" rel="nofollow">eeb243c</a>`+
+				`</span>`+
+				`</div>`+
+				`<div class="ui table">`+
+				`<table class="file-preview">`+
+				`<tbody>`+
+				`<tr>`+
+				`<td class="lines-num"><span data-line-number="1"></span></td>`+
+				`<td class="lines-code chroma"><code class="code-inner">A`+"\n"+`</code></td>`+
+				`</tr>`+
+				`</tbody>`+
+				`</table>`+
+				`</div>`+
+				`</div>`+
+				`<p></p>`,
+			localMetas,
+		)
+	})
 }
diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/18/9739e1c2a6cdb8ee094ba1ef8a2e40cf65b2ec b/modules/markup/tests/repo/repo1_filepreview/objects/18/9739e1c2a6cdb8ee094ba1ef8a2e40cf65b2ec
new file mode 100644
index 0000000000000000000000000000000000000000..c8b99f906b521d61dc9016cd7da2405c14400b62
GIT binary patch
literal 90
zcmV-g0HyzU0V^p=O;s>AVK6ZO0)>Lak_-m@o#9n|Q@FTVmUo`LvLu#YT+jZlp@D&!
wiHSmSW?p(us%}nZUaDS6MF~SsT~u1Vbh(84zm5YkwvSze7j9Aj0D8<FY_Ys1asU7T

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/2a/4032b49cff56d6d4921133e087d9dc0341a2c5 b/modules/markup/tests/repo/repo1_filepreview/objects/2a/4032b49cff56d6d4921133e087d9dc0341a2c5
new file mode 100644
index 0000000000000000000000000000000000000000..f799e8a98867980431ec0b6867cab8ca65e39bb3
GIT binary patch
literal 108
zcmV-y0F(cC0V^p=O;s>7uwXDWFfcPQQAo?oNma1dE2$`9_|7lz<hCSRf8`$M7H`kb
z@6Nd%d4Z%#FFl{3Md=E^P+^_i-kA3)p5G44l`oIXL{^fU!q9!@s(6lSXLtB5)xZa3
O-!obLc>4gGzbn;_D>e53

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/2d/2f8eaa17b17359ee1c73222065575d50d9a157 b/modules/markup/tests/repo/repo1_filepreview/objects/2d/2f8eaa17b17359ee1c73222065575d50d9a157
new file mode 100644
index 0000000000000000000000000000000000000000..7f4c451d0049897020a600fced28ca0096226b4e
GIT binary patch
literal 108
zcmV-y0F(cC0V^p=O;s>7uwXDWFfcPQQAo?oNmWqRE2$`9_|7lz<hCSRf8`$M7H`kb
z@6Nd%d4Z%#FFl{3Md=E^P+^_i-kA3)p5G44l`oIXL{^fU!q9!@s(6lSXLtB5)xZa3
O-!obLc>4g6KP$OxGc@o3

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/2f/b9577a8e940a0a84a789cdd4a45d0f172e3fdd b/modules/markup/tests/repo/repo1_filepreview/objects/2f/b9577a8e940a0a84a789cdd4a45d0f172e3fdd
new file mode 100644
index 0000000000000000000000000000000000000000..fc97712911748ce487ee2f7ffa6f4833a3cc9d6d
GIT binary patch
literal 45
zcmb<m)YkO!4K>)5VqnO?)H<n#O_zPKZt=hN*xg2+7k)VYK5KoZue*<l;du++ZUAZe
B5<ma|

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/2f/f8eb63aad050c3f20e9cb27090ab7378267ab2 b/modules/markup/tests/repo/repo1_filepreview/objects/2f/f8eb63aad050c3f20e9cb27090ab7378267ab2
new file mode 100644
index 0000000000000000000000000000000000000000..e230df1343eb798c6c9eb7b5089ca9f9490657bf
GIT binary patch
literal 90
zcmV-g0HyzU0V^p=O;s>AVK6ZO0)>Lak_?8Uh5{R>*1SKO<E`61rR?s$36Tx^4Gj#;
wOiUDtGxO4OQgw4O^HTLnDoPl7>Y~!>rOPGU|8*RYv3=|!yl|5O0N}?TYrBXkL;wH)

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/3e/2a4f1b9a15ffa15ea7ffdc06acd302442b3eca b/modules/markup/tests/repo/repo1_filepreview/objects/3e/2a4f1b9a15ffa15ea7ffdc06acd302442b3eca
new file mode 100644
index 0000000000..78189a52f6
--- /dev/null
+++ b/modules/markup/tests/repo/repo1_filepreview/objects/3e/2a4f1b9a15ffa15ea7ffdc06acd302442b3eca
@@ -0,0 +1 @@
+x
��AN�0EY��GB;a	U=D9�=�&����r}�7�������ҌB�^����yY8�:A��
X}�R�Xk�s�"�;u�F��9x��� �EdВ%�~**Z�3\��v��9Й>n�8�fxk�=�[9K�%L>����{��7�s�;a�v�4�hXO�H�ԓ�Ն��`K�
\ No newline at end of file
diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/8a/3b1881b5c4e7dc2be7ee1c0f37f93ffbb5ff77 b/modules/markup/tests/repo/repo1_filepreview/objects/8a/3b1881b5c4e7dc2be7ee1c0f37f93ffbb5ff77
new file mode 100644
index 0000000000000000000000000000000000000000..0ea93376dcb1c114b81b06768e82bb507d9477e6
GIT binary patch
literal 90
zcmV-g0HyzU0V^p=O;s>AVK6ZO0)>Lak_?9DGdKIKNMB&)%lp~hLN)33{Ld3w3=Is-
wOiUDtGxO4OQgw4O^HTLnDoPl7>Y~!>rOPGU|8*RYv3=|!yl|5O0Ln2Q>HQWeB>(^b

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/95/31b649823095acf5d79ab9e4f8b8d86046352f b/modules/markup/tests/repo/repo1_filepreview/objects/95/31b649823095acf5d79ab9e4f8b8d86046352f
new file mode 100644
index 0000000000000000000000000000000000000000..ab36311f6f3dc9a2d9f9bf894b34fd8b64dfffa1
GIT binary patch
literal 108
zcmV-y0F(cC0V^p=O;s>7uwXDWFfcPQQAo?oNmWqME2$`9_|7lz<hCSRf8`$M7H`kb
z@6Nd%d4Z%#FFl{3Md=E^P+^_i-kA3)p5G44l`oIXL{^fU!q9!@s(6lSXLtB5)xZa3
O-!obLc>4g6pDVg+ur*8o

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/ac/769ab4baa91060a4c2f828f53e6c3cc2f708f8 b/modules/markup/tests/repo/repo1_filepreview/objects/ac/769ab4baa91060a4c2f828f53e6c3cc2f708f8
new file mode 100644
index 0000000000000000000000000000000000000000..59afaebf4aec3790bab4cf98a2f72438ea5785e1
GIT binary patch
literal 176
zcmV;h08jsT0gcW<PQ)+_1yI&Gh4)A(PSU!OMraNJ2XGvhMw;oM#4}u<f;a%HzxnU$
z%k6q?1|g;=>#BfDrkE8a@GP|~sy?T}sO!Q(lb3a#N>Fj1+;umQoH1hXT7#el60Ahi
zQK*G@@~H|Pq^RS&ZMP2ZLp#Fh{uAfXOkdjm;7hBofD~y7$;S-O9=&(+`_1$}Y9{(q
e?oEfm+Aa!T%{Ca;dH+z5jXTS+HrzM7a7&w&6<I?7

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/c5/3110b1957cefc56c4b2d879476ddbe905980bf b/modules/markup/tests/repo/repo1_filepreview/objects/c5/3110b1957cefc56c4b2d879476ddbe905980bf
new file mode 100644
index 0000000000000000000000000000000000000000..3de089bf6a15a2a126e58ac2df59e94228c6c8a0
GIT binary patch
literal 44
zcmb<m)YkO!4K>)5VqnO?)H<n#E%xue&_~kU%J)x-XlpKMJI;0|MuLywf*el>09Y~)
A#{d8T

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/e7/99b34ea867a0364d0df33f382562db9ff39084 b/modules/markup/tests/repo/repo1_filepreview/objects/e7/99b34ea867a0364d0df33f382562db9ff39084
new file mode 100644
index 0000000000000000000000000000000000000000..ef73ed1791d5d093c18d99b89dcc126f024efd4d
GIT binary patch
literal 45
zcmb<m)YkO!4K>)5VqnO?)H<oAZDreSo7p_e*8Qxiy>?FBzU+=if$>##hObTh4FHUI
B64n3!

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/ee/b243c3395e1921c5d90e73bd739827251fc99d b/modules/markup/tests/repo/repo1_filepreview/objects/ee/b243c3395e1921c5d90e73bd739827251fc99d
new file mode 100644
index 0000000000000000000000000000000000000000..5515b07d4ab96b7655d5c080f7416496daaef3e8
GIT binary patch
literal 175
zcmV;g08syU0gaA9ZUQk3MZ3-^yho}WXJ$gA3ULT}0LO7UkzlA21J^G_JwR7~^WM{!
z>*dl6C`@nGRe@^VYhD6#!5Jk~LQRq>VnWU_#62yMGr4c>x*14HKKLh8NW4-MUt*j|
zrR2ynPDP^BC9C6`t=A5pL%WBM+wUAlGktH{ozJZtz`yDfh6FqGh)!PLO#flcl$Jls
dopcz~c2;;aTVYt|?Mp#c?kvyRa6e4UO8Y(EQJVk&

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/objects/f7/0f10e4db19068f79bc43844b49f3eece45c4e8 b/modules/markup/tests/repo/repo1_filepreview/objects/f7/0f10e4db19068f79bc43844b49f3eece45c4e8
new file mode 100644
index 0000000000000000000000000000000000000000..2e15b4fb0a3915335f8dded678ddb7150d75b5b4
GIT binary patch
literal 17
Ycmb<m^geacKgb}d;0Y50p9+&L066#sQUCw|

literal 0
HcmV?d00001

diff --git a/modules/markup/tests/repo/repo1_filepreview/refs/heads/master b/modules/markup/tests/repo/repo1_filepreview/refs/heads/master
index f3d5d39dd5..709cffca17 100644
--- a/modules/markup/tests/repo/repo1_filepreview/refs/heads/master
+++ b/modules/markup/tests/repo/repo1_filepreview/refs/heads/master
@@ -1 +1 @@
-c9913120ed2c1e27c1d7752ecdb7a504dc7cf6be
+eeb243c3395e1921c5d90e73bd739827251fc99d

From e118cb948595e7f81c401dfdc76192bec40fd324 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 30 Jan 2025 16:44:59 +0000
Subject: [PATCH 065/125] Invalidate outdated annex UUID cache entries (#60)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous implementation could lead to errors e.g. when a repository
was removed and a new one with a new UUID was created under the same
name. This now checks the validity of the retrieved cache entry every
time and invalidates the cache if necessary.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/60
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index a94321f359..9a70612a1e 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -131,7 +131,7 @@ func updateUUID2RepoPathCache() error {
 	})
 }
 
-func UUID2RepoPath(uuid string) (string, error) {
+func repoPathFromUUIDCache(uuid string) (string, error) {
 	if repoPath, ok := uuid2repoPathCache[uuid]; ok {
 		return repoPath, nil
 	}
@@ -144,3 +144,37 @@ func UUID2RepoPath(uuid string) (string, error) {
 	}
 	return "", fmt.Errorf("no repository known for UUID '%s'", uuid)
 }
+
+func checkValidity(uuid, repoPath string) (bool, error) {
+	stdout, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return false, err
+	}
+	repoUUID := strings.TrimSpace(stdout)
+	return uuid == repoUUID, nil
+}
+
+func removeCachedEntries(uuid, repoPath string) {
+	delete(uuid2repoPathCache, uuid)
+	delete(repoPath2uuidCache, repoPath)
+}
+
+func UUID2RepoPath(uuid string) (string, error) {
+	// Get the current cache entry for the UUID
+	repoPath, err := repoPathFromUUIDCache(uuid)
+	if err != nil {
+		return "", err
+	}
+	// Check if it is still up-to-date
+	valid, err := checkValidity(uuid, repoPath)
+	if err != nil {
+		return "", err
+	}
+	if !valid {
+		// If it isn't, remove the cache entry and try again
+		removeCachedEntries(uuid, repoPath)
+		return UUID2RepoPath(uuid)
+	}
+	// Otherwise just return the cached entry
+	return repoPath, nil
+}

From 1f4fe5bfe6a1fd0a7fd725c0b17d547464dc9782 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 31 Jan 2025 00:43:20 +0000
Subject: [PATCH 066/125] Use annexed content for comparison in diffs (#57)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This makes it such that annexed files are treated like plain git files
in comparisons (e.g. the diff of a commit).

It also changes the image diff viewer to show a more reasonable error
message when one of the annexed files under comparison is missing.

Fixes #56.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/57
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go           | 12 ++++++++++++
 routers/web/repo/compare.go      | 27 +++++++++++++++++++++------
 web_src/js/features/imagediff.js | 12 +++++++++++-
 3 files changed, 44 insertions(+), 7 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 9a70612a1e..dee24d21bc 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -22,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/typesniffer"
 )
 
 // ErrBlobIsNotAnnexed occurs if a blob does not contain a valid annex key
@@ -178,3 +179,14 @@ func UUID2RepoPath(uuid string) (string, error) {
 	// Otherwise just return the cached entry
 	return repoPath, nil
 }
+
+// GuessContentType guesses the content type of the annexed blob.
+func GuessContentType(blob *git.Blob) (typesniffer.SniffedType, error) {
+	r, err := Content(blob)
+	if err != nil {
+		return typesniffer.SniffedType{}, err
+	}
+	defer r.Close()
+
+	return typesniffer.DetectContentTypeFromReader(r)
+}
diff --git a/routers/web/repo/compare.go b/routers/web/repo/compare.go
index 03d49fa692..104655e134 100644
--- a/routers/web/repo/compare.go
+++ b/routers/web/repo/compare.go
@@ -23,6 +23,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/charset"
 	csv_module "code.gitea.io/gitea/modules/csv"
@@ -72,7 +73,21 @@ func setCompareContext(ctx *context.Context, before, head *git.Commit, headOwner
 			return st
 		}
 
-		st, err := blob.GuessContentType()
+		isAnnexed, err := annex.IsAnnexed(blob)
+		if err != nil {
+			log.Error("IsAnnexed failed: %v", err)
+			return st
+		}
+		if isAnnexed {
+			st, err = annex.GuessContentType(blob)
+			if err != nil {
+				log.Error("GuessContentType failed: %v", err)
+				return st
+			}
+			return st
+		}
+
+		st, err = blob.GuessContentType()
 		if err != nil {
 			log.Error("GuessContentType failed: %v", err)
 			return st
@@ -90,18 +105,18 @@ func SourceCommitURL(owner, name string, commit *git.Commit) string {
 	return setting.AppSubURL + "/" + url.PathEscape(owner) + "/" + url.PathEscape(name) + "/src/commit/" + url.PathEscape(commit.ID.String())
 }
 
-// RawCommitURL creates a relative URL for the raw commit in the given repository
-func RawCommitURL(owner, name string, commit *git.Commit) string {
-	return setting.AppSubURL + "/" + url.PathEscape(owner) + "/" + url.PathEscape(name) + "/raw/commit/" + url.PathEscape(commit.ID.String())
+// MediaCommitURL creates a relative URL for the commit media (plain git, LFS, or annex content) in the given repository
+func MediaCommitURL(owner, name string, commit *git.Commit) string {
+	return setting.AppSubURL + "/" + url.PathEscape(owner) + "/" + url.PathEscape(name) + "/media/commit/" + url.PathEscape(commit.ID.String())
 }
 
 // setPathsCompareContext sets context data for source and raw paths
 func setPathsCompareContext(ctx *context.Context, base, head *git.Commit, headOwner, headName string) {
 	ctx.Data["SourcePath"] = SourceCommitURL(headOwner, headName, head)
-	ctx.Data["RawPath"] = RawCommitURL(headOwner, headName, head)
+	ctx.Data["RawPath"] = MediaCommitURL(headOwner, headName, head)
 	if base != nil {
 		ctx.Data["BeforeSourcePath"] = SourceCommitURL(headOwner, headName, base)
-		ctx.Data["BeforeRawPath"] = RawCommitURL(headOwner, headName, base)
+		ctx.Data["BeforeRawPath"] = MediaCommitURL(headOwner, headName, base)
 	}
 }
 
diff --git a/web_src/js/features/imagediff.js b/web_src/js/features/imagediff.js
index d1b139ffde..52c9017b07 100644
--- a/web_src/js/features/imagediff.js
+++ b/web_src/js/features/imagediff.js
@@ -92,7 +92,17 @@ export function initImageDiff() {
         return loadElem(img, info.path);
       }));
       // only the first images is associated with $boundsInfo
-      if (!success) info.$boundsInfo.text('(image error)');
+      if (!success) {
+        const blobContent = await GET(info.path.replace('/media/', '/raw/')).then((response) => response.text());
+        if (blobContent.startsWith('.git/annex/objects')) {
+          for (const item of document.querySelectorAll('.image-diff .overflow-menu-items .item')) {
+            item.style.display = 'none';
+          }
+          info.$boundsInfo[0].parentElement.textContent = 'annexed file is not present on the server';
+        } else {
+          info.$boundsInfo.text('(image error)');
+        }
+      }
       if (info.mime === 'image/svg+xml') {
         const resp = await GET(info.path);
         const text = await resp.text();

From 1b00bf2d26f8cdd5bf27e7022c49967978d971a7 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 31 Jan 2025 10:40:23 +0000
Subject: [PATCH 067/125] [v10.0/forgejo] fix: Remove autofocus on the
 dashboard repository search box (#6748)

- No longer autofocus on the searchbox for the repository list that is on the dashboard. There is no justification for doing so.
- Fixes #6653
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 web_src/js/components/DashboardRepoList.vue | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/web_src/js/components/DashboardRepoList.vue b/web_src/js/components/DashboardRepoList.vue
index 007891a39f..0d8396b6f3 100644
--- a/web_src/js/components/DashboardRepoList.vue
+++ b/web_src/js/components/DashboardRepoList.vue
@@ -1,5 +1,5 @@
 <script>
-import {createApp, nextTick} from 'vue';
+import {createApp} from 'vue';
 import $ from 'jquery';
 import {SvgIcon} from '../svg.js';
 import {GET} from '../modules/fetch.js';
@@ -103,9 +103,6 @@ const sfc = {
     const el = document.getElementById('dashboard-repo-list');
     this.changeReposFilter(this.reposFilter);
     $(el).find('.dropdown').dropdown();
-    nextTick(() => {
-      this.$refs.search.focus();
-    });
 
     this.textArchivedFilterTitles = {
       'archived': this.textShowOnlyArchived,

From 27276ff26e467d449dfd4a9f4a539b5539bfcca8 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 31 Jan 2025 11:12:01 +0000
Subject: [PATCH 068/125] [v10.0/forgejo] fix: set explore pages to
 configurable default sort (#6749)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6708

- Currently, the explore/organizations page always defaults to using "newest" as its sort. Instead, use the pre-existing config option (`setting.UI.ExploreDefaultSort`) so server administrators can change the default sort order.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

(Sorry, not sure how to add a test for this change)

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

I don't mind either way.

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Co-authored-by: John Moon <john.moon@vts-i.com>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6749
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 routers/web/explore/org.go             |  6 +++-
 routers/web/explore/user.go            |  6 +++-
 tests/integration/explore_org_test.go  | 49 ++++++++++++++++++++++++++
 tests/integration/explore_user_test.go |  7 +++-
 4 files changed, 65 insertions(+), 3 deletions(-)
 create mode 100644 tests/integration/explore_org_test.go

diff --git a/routers/web/explore/org.go b/routers/web/explore/org.go
index 7178630b64..d13271ae53 100644
--- a/routers/web/explore/org.go
+++ b/routers/web/explore/org.go
@@ -39,7 +39,11 @@ func Organizations(ctx *context.Context) {
 	)
 	sortOrder := ctx.FormString("sort")
 	if sortOrder == "" {
-		sortOrder = "newest"
+		if supportedSortOrders.Contains(setting.UI.ExploreDefaultSort) {
+			sortOrder = setting.UI.ExploreDefaultSort
+		} else {
+			sortOrder = "newest"
+		}
 		ctx.SetFormString("sort", sortOrder)
 	}
 
diff --git a/routers/web/explore/user.go b/routers/web/explore/user.go
index 15c60f546f..da5dd39f3e 100644
--- a/routers/web/explore/user.go
+++ b/routers/web/explore/user.go
@@ -149,7 +149,11 @@ func Users(ctx *context.Context) {
 	)
 	sortOrder := ctx.FormString("sort")
 	if sortOrder == "" {
-		sortOrder = "newest"
+		if supportedSortOrders.Contains(setting.UI.ExploreDefaultSort) {
+			sortOrder = setting.UI.ExploreDefaultSort
+		} else {
+			sortOrder = "newest"
+		}
 		ctx.SetFormString("sort", sortOrder)
 	}
 
diff --git a/tests/integration/explore_org_test.go b/tests/integration/explore_org_test.go
new file mode 100644
index 0000000000..e0c48ccf0d
--- /dev/null
+++ b/tests/integration/explore_org_test.go
@@ -0,0 +1,49 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/test"
+	"code.gitea.io/gitea/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestExploreOrg(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// Set the default sort order
+	defer test.MockVariableValue(&setting.UI.ExploreDefaultSort, "alphabetically")()
+
+	cases := []struct{ sortOrder, expected string }{
+		{"", "?sort=" + setting.UI.ExploreDefaultSort + "&q="},
+		{"newest", "?sort=newest&q="},
+		{"oldest", "?sort=oldest&q="},
+		{"alphabetically", "?sort=alphabetically&q="},
+		{"reversealphabetically", "?sort=reversealphabetically&q="},
+	}
+	for _, c := range cases {
+		req := NewRequest(t, "GET", "/explore/organizations?sort="+c.sortOrder)
+		resp := MakeRequest(t, req, http.StatusOK)
+		h := NewHTMLParser(t, resp.Body)
+		href, _ := h.Find(`.ui.dropdown .menu a.active.item[href^="?sort="]`).Attr("href")
+		assert.Equal(t, c.expected, href)
+	}
+
+	// these sort orders shouldn't be supported, to avoid leaking user activity
+	cases404 := []string{
+		"/explore/organizations?sort=mostMembers",
+		"/explore/organizations?sort=leastGroups",
+		"/explore/organizations?sort=leastupdate",
+		"/explore/organizations?sort=reverseleastupdate",
+	}
+	for _, c := range cases404 {
+		req := NewRequest(t, "GET", c).SetHeader("Accept", "text/html")
+		MakeRequest(t, req, http.StatusNotFound)
+	}
+}
diff --git a/tests/integration/explore_user_test.go b/tests/integration/explore_user_test.go
index 441d89cea5..d1e3fd85af 100644
--- a/tests/integration/explore_user_test.go
+++ b/tests/integration/explore_user_test.go
@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"testing"
 
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/test"
 	"code.gitea.io/gitea/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -15,8 +17,11 @@ import (
 func TestExploreUser(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
+	// Set the default sort order
+	defer test.MockVariableValue(&setting.UI.ExploreDefaultSort, "reversealphabetically")()
+
 	cases := []struct{ sortOrder, expected string }{
-		{"", "?sort=newest&q="},
+		{"", "?sort=" + setting.UI.ExploreDefaultSort + "&q="},
 		{"newest", "?sort=newest&q="},
 		{"oldest", "?sort=oldest&q="},
 		{"alphabetically", "?sort=alphabetically&q="},

From 184bdef3402cb4f615dc6260e6b444e08384f9bd Mon Sep 17 00:00:00 2001
From: 0ko <0ko@noreply.codeberg.org>
Date: Sun, 2 Feb 2025 18:38:07 +0000
Subject: [PATCH 069/125] [v10.0/forgejo] i18n: backport of translation updates
 6565 and 6665 (#6764)

Translation updates that are applicable to v10 strings were picked from these commits:
* dac7d5e73bd29ae7ae57bab26bae31dcc3dd40a9
* 76783861384292756d7ca6a2b127cc6e8cfde6e0

Changes to strings that are only present in the v11 branch were not picked.

Below is a list of co-authors of the ported commits. It may contain co-authors who's changes were not picked due to being v11-only.

Co-authored-by: 0ko <0ko@users.noreply.translate.codeberg.org>
Co-authored-by: artnay <artnay@users.noreply.translate.codeberg.org>
Co-authored-by: Atul_Eterno <atul_eterno@users.noreply.translate.codeberg.org>
Co-authored-by: Dirk <dirk@users.noreply.translate.codeberg.org>
Co-authored-by: earl-warren <earl-warren@users.noreply.translate.codeberg.org>
Co-authored-by: Edgarsons <edgarsons@users.noreply.translate.codeberg.org>
Co-authored-by: Fjuro <fjuro@alius.cz>
Co-authored-by: Fjuro <fjuro@users.noreply.translate.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: Ikuyo Mita <searinminecraft@outlook.ph>
Co-authored-by: jedik <jedik@users.noreply.translate.codeberg.org>
Co-authored-by: Juno Takano <jutty@users.noreply.translate.codeberg.org>
Co-authored-by: justbispo <justbispo@users.noreply.translate.codeberg.org>
Co-authored-by: killawabbit <killawabbit@users.noreply.translate.codeberg.org>
Co-authored-by: Kita Ikuyo <searinminecraft@courvix.com>
Co-authored-by: mahlzahn <mahlzahn@posteo.de>
Co-authored-by: Miguel P.L <miguel_pl@users.noreply.translate.codeberg.org>
Co-authored-by: Outbreak2096 <outbreak2096@users.noreply.translate.codeberg.org>
Co-authored-by: Ricky-Tigg <ricky-tigg@users.noreply.translate.codeberg.org>
Co-authored-by: SomeTr <sometr@users.noreply.translate.codeberg.org>
Co-authored-by: tacaly <frederick@tacaly.com>
Co-authored-by: Wuzzy <wuzzy@disroot.org>
Co-authored-by: xtex <xtexchooser@duck.com>

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6764
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
---
 options/locale/locale_cs-CZ.ini | 236 ++++++++++++++++----------------
 options/locale/locale_da.ini    | 159 +++++++++++++++++++++
 options/locale/locale_de-DE.ini |   8 +-
 options/locale/locale_es-ES.ini |  40 ++++--
 options/locale/locale_fi-FI.ini |  28 +++-
 options/locale/locale_fil.ini   |   6 +-
 options/locale/locale_fr-FR.ini |   2 +
 options/locale/locale_lv-LV.ini | 190 ++++++++++++-------------
 options/locale/locale_nb_NO.ini |  10 +-
 options/locale/locale_nl-NL.ini |   6 +-
 options/locale/locale_pt-BR.ini |   4 +-
 options/locale/locale_pt-PT.ini |   2 +
 options/locale/locale_ru-RU.ini |  20 +--
 options/locale/locale_sv-SE.ini |  50 ++++++-
 options/locale/locale_uk-UA.ini |  17 ++-
 options/locale/locale_zh-CN.ini |   8 +-
 16 files changed, 539 insertions(+), 247 deletions(-)

diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 7d8fdee165..16869146f3 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -517,8 +517,8 @@ issue_assigned.issue=@%[1]s vás přiřadil/a k problému %[2]s v repozitáři %
 
 issue.x_mentioned_you=<b>@%s</b> vás zmínil/a:
 issue.action.force_push=<b>%[1]s</b> vynutil/a nahrání <b>%[2]s</b> z %[3]s do %[4]s.
-issue.action.push_1=<b>@%[1]s</b> nahrál/a %[3]d commit do %[2]s
-issue.action.push_n=<b>@%[1]s</b> nahrál/a %[3]d commity do %[2]s
+issue.action.push_1=Uživatel <b>@%[1]s</b> nahrál %[3]d revizi do %[2]s
+issue.action.push_n=Uživatel <b>@%[1]s</b> nahrál %[3]d revizí do %[2]s
 issue.action.close=<b>@%[1]s</b> uzavřel/a #%[2]d.
 issue.action.reopen=<b>@%[1]s</b> znovu otevřel/a #%[2]d.
 issue.action.merge=<b>@%[1]s</b> sloučil/a #%[2]d do %[3]s.
@@ -590,9 +590,9 @@ AuthName=Název ověření
 AdminEmail=E-mailová adresa správce
 
 NewBranchName=Název nové větve
-CommitSummary=Shrnutí commity
-CommitMessage=Zpráva commitu
-CommitChoice=Výběr commitu
+CommitSummary=Shrnutí revize
+CommitMessage=Zpráva revize
+CommitChoice=Výběr revize
 TreeName=Cesta k souboru
 Content=Obsah
 
@@ -681,6 +681,8 @@ To = Název větve
 Biography = Životopis
 AccessToken = Přístupový token
 
+email_domain_is_not_allowed = Doména uživatelské e-mailové adresy <b>%s</b> je v rozporu se seznamem EMAIL_DOMAIN_ALLOWLIST nebo EMAIL_DOMAIN_BLOCKLIST. Ujistěte se, že je vaše adresa správně nastavena.
+
 [user]
 change_avatar=Změnit váš avatar…
 joined_on=Přidal/a se %s
@@ -767,7 +769,7 @@ language=Jazyk
 ui=Motiv vzhledu
 hidden_comment_types=Skryté typy komentářů
 hidden_comment_types_description=Zde zkontrolované typy komentářů nebudou zobrazeny na stránkách problémů. Zaškrtnutí „Štítek“ například odstraní všechny komentáře „<user> přidal/odstranil <label>“.
-hidden_comment_types.ref_tooltip=Komentáře, kde byl tento problém odkázán u jiného problému/commitu/…
+hidden_comment_types.ref_tooltip=Komentáře, kde byl tento problém odkázán z jiného problému/revize/…
 hidden_comment_types.issue_ref_tooltip=Komentáře, kde uživatel změní větev/značku spojenou s problémem
 comment_type_group_reference=Reference
 comment_type_group_label=Štítek
@@ -780,7 +782,7 @@ comment_type_group_deadline=Uzávěrka
 comment_type_group_dependency=Závislost
 comment_type_group_lock=Stav zámku
 comment_type_group_review_request=Žádost o posouzení
-comment_type_group_pull_request_push=Přidané commity
+comment_type_group_pull_request_push=Přidané revize
 comment_type_group_project=Projekt
 comment_type_group_issue_ref=Referenční číslo problému
 saved_successfully=Vaše nastavení bylo úspěšně uloženo.
@@ -822,7 +824,7 @@ activations_pending=Čekající aktivace
 can_not_add_email_activations_pending=Existuje čekající aktivace, zkuste to znovu za pár minut, pokud chcete přidat nový e-mail.
 delete_email=Smazat
 email_deletion=Odstranit e-mailovou adresu
-email_deletion_desc=E-mailová adresa a přidružené informace budou z vašeho účtu odstraněny. Commity Gitu s touto e-mailovou adresou zůstanou nezměněny. Pokračovat?
+email_deletion_desc=E-mailová adresa a přidružené informace budou z vašeho účtu odstraněny. Revize Gitu s touto e-mailovou adresou zůstanou nezměněny. Pokračovat?
 email_deletion_success=E-mailová adresa byla odstraněna.
 theme_update_success=Váš motiv vzhledu byl aktualizován.
 theme_update_error=Vybraný motiv vzhledu neexistuje.
@@ -838,16 +840,16 @@ add_email_success=Nová e-mailová adresa byla přidána.
 email_preference_set_success=Nastavení e-mailu bylo úspěšně nastaveno.
 add_openid_success=Nová OpenID adresa byla přidána.
 keep_email_private=Skrýt e-mailovou adresu
-keep_email_private_popup=Vaše e-mailová adresa nebude zobrazena na vašem profilu a nebude výchozí adresou pro commity provedené skrze webové rozhraní, jako nahrávání, úpravy a sloučení. Namísto toho lze použít speciální adresu %s pro propojení commitů s vaším účtem. Tato možnost neovlivní existující commity.
+keep_email_private_popup=Vaše e-mailová adresa nebude zobrazena na vašem profilu a nebude výchozí adresou pro revize provedené skrze webové rozhraní, jako nahrávání, úpravy a slučování. Namísto toho lze použít speciální adresu %s pro propojení revizí s vaším účtem. Tato možnost neovlivní existující revize.
 openid_desc=OpenID vám umožní delegovat ověřování na externího poskytovatele.
 
 manage_ssh_keys=Správa klíčů SSH
 manage_ssh_principals=Spravovat SSH Principal certifikáty
 manage_gpg_keys=Správa klíčů GPG
 add_key=Přidat klíč
-ssh_desc=Tyto veřejné klíče SSH jsou propojeny s vaším účtem. Odpovídající soukromé klíče umožní plný přístup k vašim repozitářům. Klíče SSH, které byly ověřeny, mohou být použity pro ověření Git commitů podepsaných přes SSH.
+ssh_desc=Tyto veřejné klíče SSH jsou propojeny s vaším účtem. Odpovídající soukromé klíče umožní plný přístup k vašim repozitářům. Klíče SSH, které byly ověřeny, mohou být použity pro ověření Git revizí podepsaných přes SSH.
 principal_desc=Tyto SSH Principal certifikáty jsou přidruženy k vašemu účtu a umožňují plný přístup do vašich repozitářů.
-gpg_desc=Tyto veřejné klíče GPG jsou propojeny s vaším účtem a používají se k ověření vašich commitů. Uložte je na bezpečné místo, jelikož umožňují podepsat commity vaší identitou.
+gpg_desc=Tyto veřejné klíče GPG jsou propojeny s vaším účtem a používají se k ověření vašich revizí. Uložte je na bezpečné místo, jelikož umožňují podepsat revize vaší identitou.
 ssh_helper=<strong>Potřebujete pomoct?</strong> Podívejte se do příručky, jak <a href="%s">vytvořit vlastní klíče SSH</a> nebo vyřešte <a href="%s">běžné problémy</a>, se kterými se můžete potkat při použití SSH.
 gpg_helper=<strong>Potřebujete pomoct?</strong> Podívejte se do příručky <a href="%s">o GPG</a>.
 add_new_key=Přidat klíč SSH
@@ -861,9 +863,9 @@ ssh_principal_been_used=Tento SSH Principal certifikát již byl přidán na ser
 gpg_key_id_used=Veřejný GPG klíč se stejným ID již existuje.
 gpg_no_key_email_found=Tento GPG klíč neodpovídá žádné aktivované e-mailové adrese spojené s vaším účtem. Může být stále přidán, pokud podepíšete zadaný token.
 gpg_key_matched_identities=Odpovídající identity:
-gpg_key_matched_identities_long=Vložené identity v tomto klíči odpovídají následujícím aktivovaným e-mailovým adresám tohoto uživatele. Commity odpovídající těmto e-mailovým adresám lze ověřit pomocí tohoto klíče.
+gpg_key_matched_identities_long=Vložené identity v tomto klíči odpovídají následujícím aktivovaným e-mailovým adresám tohoto uživatele. Revize odpovídající těmto e-mailovým adresám lze ověřit pomocí tohoto klíče.
 gpg_key_verified=Ověřený klíč
-gpg_key_verified_long=Klíč byl ověřen pomocí tokenu a může být použit k ověření commitů shodujících se s libovolnou aktivovanou e-mailovou adresou pro tohoto uživatele navíc k jakékoli odpovídající identitě tohoto klíče.
+gpg_key_verified_long=Klíč byl ověřen pomocí tokenu a může být použit k ověření revizí shodujících se s libovolnou aktivovanou e-mailovou adresou pro tohoto uživatele navíc k jakékoli odpovídající identitě tohoto klíče.
 gpg_key_verify=Ověřit
 gpg_invalid_token_signature=Zadaný GPG klíč, podpis a token se neshodují nebo je token zastaralý.
 gpg_token_required=Musíte zadat podpis pro níže uvedený token
@@ -874,7 +876,7 @@ gpg_token_signature=Zakódovaný podpis GPG
 key_signature_gpg_placeholder=Začíná textem „-----BEGIN PGP SIGNATURE-----“
 verify_gpg_key_success=GPG klíč „%s“ byl ověřen.
 ssh_key_verified=Ověřený klíč
-ssh_key_verified_long=Klíč byl ověřen pomocí tokenu a může být použit k ověření commitů shodujících se s libovolnou vaší aktivovanou e-mailovou adresou pro tohoto uživatele.
+ssh_key_verified_long=Klíč byl ověřen pomocí tokenu a může být použit k ověření revizí shodujících se s libovolnou vaší aktivovanou e-mailovou adresou pro tohoto uživatele.
 ssh_key_verify=Ověřit
 ssh_invalid_token_signature=Zadaný SSH klíč, podpis nebo token se neshodují nebo je token zastaralý.
 ssh_token_required=Musíte zadat podpis pro níže uvedený token
@@ -896,7 +898,7 @@ ssh_key_deletion=Odebrat klíč SSH
 gpg_key_deletion=Odebrat klíč GPG
 ssh_principal_deletion=Odstranit SSH Principal certifikát
 ssh_key_deletion_desc=Odstranění SSH klíče zruší jeho přístup k vašemu účtu. Pokračovat?
-gpg_key_deletion_desc=Odstraněním klíče GPG zneplatníte ověření commitů, které jsou jím podepsány. Pokračovat?
+gpg_key_deletion_desc=Odstraněním klíče GPG zneplatníte ověření revizí, které jsou jím podepsány. Pokračovat?
 ssh_principal_deletion_desc=Odstranění SSH Principal certifikátu zruší jeho přístup k vašemu účtu. Pokračovat?
 ssh_key_deletion_success=SSH klíč byl odstraněn.
 gpg_key_deletion_success=GPG klíč byl odstraněn.
@@ -914,7 +916,7 @@ principal_state_desc=Tento SSH Principal certifikát byl použit během posledn
 show_openid=Zobrazit na profilu
 hide_openid=Odstranit z profilu
 ssh_disabled=SSH je zakázáno
-ssh_signonly=SSH je v současné době zakázáno, proto jsou tyto klíče použity pouze pro ověření podpisu.
+ssh_signonly=SSH je v současné době zakázáno, proto jsou tyto klíče použity pouze pro ověření podpisu revizí.
 ssh_externally_managed=Tento SSH klíč je spravován externě pro tohoto uživatele
 manage_social=Správa propojených účtů sociálních sítí
 social_desc=Tyto účty sociálních sítí lze použít k přihlášení k vašemu účtu. Ujistěte se, že jsou všechny vaše.
@@ -966,7 +968,7 @@ oauth2_client_secret_hint=Tajný klíč se znovu nezobrazí po opuštění nebo
 oauth2_application_edit=Upravit
 oauth2_application_create_description=Aplikace OAuth2 poskytují přístup vašim aplikacím třetích stran k uživatelským účtům na této instanci.
 oauth2_application_remove_description=Odebráním OAuth2 aplikace zabrání přístupu ověřeným uživatelům na této instanci. Pokračovat?
-oauth2_application_locked=Gitea předregistruje některé OAuth2 aplikace při spuštění, pokud je to povoleno v konfiguraci. Aby se zabránilo neočekávanému chování, nelze je upravovat ani odstranit. Více informací naleznete v dokumentaci OAuth2.
+oauth2_application_locked=Forgejo předem zaregistruje některé OAuth2 aplikace při spuštění, pokud je to povoleno v konfiguraci. Aby se zabránilo neočekávanému chování, nelze je upravovat ani odstranit. Více informací naleznete v dokumentaci OAuth2.
 
 authorized_oauth2_applications=Autorizované aplikace OAuth2
 authorized_oauth2_applications_description=Těmto aplikacím třetích stran jste udělili přístup ke svému osobnímu účtu Forgejo. Zrušte prosím přístup aplikacím, které již nejsou používány.
@@ -1113,12 +1115,12 @@ trust_model_helper_default=Výchozí: Použít výchozí model důvěry pro tuto
 create_repo=Vytvořit repozitář
 default_branch=Výchozí větev
 default_branch_label=výchozí
-default_branch_helper=Výchozí větev je základní větev pro žádosti o sloučení a commity kódu.
+default_branch_helper=Výchozí větev je základní větev pro žádosti o sloučení a revize kódu.
 mirror_prune=Vyčistit
 mirror_prune_desc=Odstranit zastaralé reference na vzdálené sledování
 mirror_interval=Interval zrcadlení (platné časové jednotky jsou „h“, „m“ a „s“). Nastavením na 0 zakážete periodickou synchronizaci. (Minimální interval: %s)
 mirror_interval_invalid=Interval zrcadlení není platný.
-mirror_sync_on_commit=Synchronizovat při nahrávání commitů
+mirror_sync_on_commit=Synchronizovat při nahrávání revizí
 mirror_address=Klonovat z URL
 mirror_address_desc=Zadejte požadované přístupové údaje do sekce Ověření.
 mirror_address_url_invalid=Poskytnutá URL je neplatná. Všechny části musíte správně nahradit escape sekvencí.
@@ -1151,7 +1153,7 @@ blame_prior=Zobrazit blame před touto změnou
 blame.ignore_revs.failed=Nepodařilo se ignorovat revize v <a href="%s">.git-blame-ignore-revs</a>.
 author_search_tooltip=Zobrazí maximálně 30 uživatelů
 
-tree_path_not_found_commit=Cesta %[1]s v commitu %[2]s neexistuje
+tree_path_not_found_commit=Cesta %[1]s v revizi %[2]s neexistuje
 tree_path_not_found_branch=Cesta %[1]s ve větvi %[2]s neexistuje
 tree_path_not_found_tag=Cesta %[1]s ve značce %[2]s neexistuje
 
@@ -1267,7 +1269,7 @@ empty_message=Tento repozitář nemá žádný obsah.
 broken_message=Data gitu, která jsou základem tohoto repozitáře, nelze číst. Kontaktujte správce této instance nebo smažte tento repositář.
 
 code=Zdrojový kód
-code.desc=Přístup ke zdrojovým kódům, souborům, commitům a větvím.
+code.desc=Přístup ke zdrojovým kódům, souborům, revizím a větvím.
 branch=Větev
 tree=Strom
 clear_ref=Vymazat aktuální referenci
@@ -1285,8 +1287,8 @@ org_labels_desc=Štítky na úrovni organizace, které mohou být použity se <s
 org_labels_desc_manage=spravovat
 
 milestones=Milníky
-commits=Commity
-commit=Commit
+commits=Revize
+commit=Revize
 release=Vydání
 releases=Vydání
 tag=Značka
@@ -1319,14 +1321,14 @@ symbolic_link=Symbolický odkaz
 executable_file=Spustitelný soubor
 vendored = Vendorováno
 generated = Generováno
-commit_graph=Graf commitů
+commit_graph=Graf revizí
 commit_graph.select=Vybrat větve
 commit_graph.hide_pr_refs=Skrýt žádosti o sloučení
 commit_graph.monochrome=Černobílé
 commit_graph.color=Barva
-commit.contained_in=Tento commit je obsažen v:
-commit.contained_in_default_branch=Tento commit je součástí výchozí větve
-commit.load_referencing_branches_and_tags=Načíst větve a značky odkazující na tento commit
+commit.contained_in=Tato revize je obsažena v:
+commit.contained_in_default_branch=Tato revize je součástí výchozí větve
+commit.load_referencing_branches_and_tags=Načíst větve a značky odkazující na tuto revizi
 blame=Blame
 download_file=Stáhnout soubor
 normal_view=Normální zobrazení
@@ -1363,12 +1365,12 @@ editor.patching=Záplatování:
 editor.fail_to_apply_patch=Nelze použít záplatu „%s“
 editor.new_patch=Nová záplata
 editor.commit_message_desc=Přidat volitelný rozšířený popis…
-editor.signoff_desc=Přidat Signed-off-by podpis přispěvatele na konec zprávy o commitu.
+editor.signoff_desc=Přidat podpis přispěvatele „Signed-off-by“ na konec zprávy revize.
 editor.commit_directly_to_this_branch=Odeslat přímo do větve <strong class="%[2]s">%[1]s</strong>.
-editor.create_new_branch=Vytvořit <strong>novou větev</strong> pro tento commit a vytvořit žádost o sloučení.
-editor.create_new_branch_np=Vytvořte <strong>novou větev</strong> z tohoto commitu.
+editor.create_new_branch=Vytvořit <strong>novou větev</strong> pro tuto revizi a vytvořit žádost o sloučení.
+editor.create_new_branch_np=Vytvořit <strong>novou větev</strong> z této revize.
 editor.propose_file_change=Navrhnout změnu souboru
-editor.new_branch_name=Pojmenujte novou větev pro tento commit
+editor.new_branch_name=Pojmenujte novou větev pro tuto revizi
 editor.new_branch_name_desc=Název nové větve…
 editor.cancel=Zrušit
 editor.filename_cannot_be_empty=Jméno nemůže být prázdné.
@@ -1380,7 +1382,7 @@ editor.file_is_a_symlink=`„%s“ je symbolický odkaz. Symbolické odkazy nemo
 editor.filename_is_a_directory=Jméno souboru „%s“ je již použito jako jméno adresáře v tomto repozitáři.
 editor.file_editing_no_longer_exists=Upravovaný soubor „%s“ již není součástí tohoto repozitáře.
 editor.file_deleting_no_longer_exists=Odstraňovaný soubor „%s“ již není součástí tohoto repozitáře.
-editor.file_changed_while_editing=Obsah souboru se od zahájení úprav změnil. <a target="_blank" rel="noopener noreferrer" href="%s">Klikněte sem</a> pro jejich zobrazení nebo <strong>proveďte commit změn ještě jednou</strong> pro jejich přepsání.
+editor.file_changed_while_editing=Obsah souboru se od zahájení úprav změnil. <a target="_blank" rel="noopener noreferrer" href="%s">Klikněte sem</a> pro jeho zobrazení nebo <strong>odešlete změny ještě jednou</strong> pro jeho přepsání.
 editor.file_already_exists=Soubor „%s“ již existuje v tomto repozitáři.
 editor.commit_empty_file_header=Odeslat prázdný soubor
 editor.commit_empty_file_text=Soubor, který se chystáte odeslat, je prázdný. Pokračovat?
@@ -1394,16 +1396,16 @@ editor.add_subdir=Přidat adresář…
 editor.unable_to_upload_files=Nepodařilo se nahrát soubory do „%s“. Chyba: %v
 editor.upload_file_is_locked=Soubor „%s“ je uzamčen uživatelem %s.
 editor.upload_files_to_dir=Nahrány soubory do „%s“
-editor.cannot_commit_to_protected_branch=Nelze vytvořit commit v chráněné větvi „%s“.
+editor.cannot_commit_to_protected_branch=Nelze vytvořit revizi v chráněné větvi „%s“.
 editor.no_commit_to_branch=Nepodařilo se odeslat přímo do větve:
 editor.user_no_push_to_branch=Uživatel nemůže nahrávat do větve
-editor.require_signed_commit=Větev vyžaduje podepsaný commit
+editor.require_signed_commit=Větev vyžaduje podepsanou revizi
 editor.cherry_pick=Cherry-pick %s na:
 editor.revert=Vrátit %s na:
 
 commits.desc=Procházet historii změn zdrojového kódu.
-commits.commits=Commity
-commits.no_commits=Žádné společné commity. „%s“ a „%s“ mají zcela odlišnou historii.
+commits.commits=Revize
+commits.no_commits=Žádné společné revize. „%s“ a „%s“ mají zcela odlišnou historii.
 commits.nothing_to_compare=Tyto větve jsou stejné.
 commits.search=Hledání commitů…
 commits.search.tooltip=Můžete předřadit klíčová slova s „author:“, „committer:“, „after:“ nebo „before:“, např. „revert author:Alice before:2019-01-03“.
@@ -1416,21 +1418,21 @@ commits.older=Starší
 commits.newer=Novější
 commits.signed_by=Podepsáno
 commits.signed_by_untrusted_user=Podepsáno nedůvěryhodným uživatelem
-commits.signed_by_untrusted_user_unmatched=Podepsáno nedůvěryhodným uživatelem, který nesouhlasí s přispěvatelem
+commits.signed_by_untrusted_user_unmatched=Podepsáno nedůvěryhodným uživatelem, který neodpovídá přispěvateli
 commits.gpg_key_id=ID klíče GPG
 commits.ssh_key_fingerprint=Otisk klíče SSH
-commits.view_path=Zobrazit v tomto bodě v historii
+commits.view_path=Zobrazit tento bod v historii
 
 commit.operations=Operace
 commit.revert=Vrátit
 commit.revert-header=Vrátit: %s
-commit.revert-content=Vyberte větev pro návrat na:
+commit.revert-content=Vyberte větev pro návrat:
 commit.cherry-pick=Cherry-pick
 commit.cherry-pick-header=Cherry-pick: %s
-commit.cherry-pick-content=Vyberte větev pro Cherry-pick na:
+commit.cherry-pick-content=Vyberte větev pro Cherry-pick:
 
 commitstatus.error=Chyba
-commitstatus.failure=Chyba
+commitstatus.failure=Selhání
 commitstatus.pending=Čekající
 commitstatus.success=Úspěch
 
@@ -1613,15 +1615,15 @@ issues.context.edit=Upravit
 issues.context.delete=Smazat
 issues.no_content=K dispozici není žádný popis.
 issues.close=Zavřít problém
-issues.comment_pull_merged_at=sloučený commit %[1]s do %[2]s %[3]s
-issues.comment_manually_pull_merged_at=ručně sloučený commit %[1]s do %[2]s %[3]s
+issues.comment_pull_merged_at=sloučena revize %[1]s do %[2]s %[3]s
+issues.comment_manually_pull_merged_at=ručně sloučena revize %[1]s do %[2]s %[3]s
 issues.close_comment_issue=Zavřít s komentářem
 issues.reopen_issue=Znovu otevřít
 issues.reopen_comment_issue=Znovu otevřít s komentářem
 issues.create_comment=Okomentovat
 issues.closed_at=`uzavřel/a tento problém <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.reopened_at=`znovu otevřel/a tento problém <a id="%[1]s" href="#%[1]s">%[2]s</a>`
-issues.commit_ref_at=`odkázal/a na tento problém z commitu <a id="%[1]s" href="#%[1]s">%[2]s</a>`
+issues.commit_ref_at=`odkázal/a na tento problém z revize <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_issue_from=`<a href="%[3]s">odkázal/a na tento problém %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_pull_from=`<a href="%[3]s">odkázal/a na tuto žádost o sloučení %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_closing_from=`<a href="%[3]s">odkazoval/a na tento problém ze žádosti o sloučení %[4]s, která jej uzavře</a>, <a id="%[1]s" href="#%[1]s">%[2]s</a>`
@@ -1727,8 +1729,8 @@ issues.due_date=Termín dokončení
 issues.invalid_due_date_format=Termín dokončení musí být ve formátu „rrrr-mm-dd“.
 issues.error_modifying_due_date=Změna termínu dokončení selhala.
 issues.error_removing_due_date=Odstranění termínu dokončení selhalo.
-issues.push_commit_1=přidal/a %d commit %s
-issues.push_commits_n=přidal/a %d commity %s
+issues.push_commit_1=přidal/a %d revizi %s
+issues.push_commits_n=přidal/a %d revize %s
 issues.force_push_codes=`vynucené nahrání %[1]s od <a class="%[7]s" href="%[3]s"><code>%[2]s</code></a> do <a class="%[7]s" href="%[5]s"><code>%[4]s</code></a> %[6]s`
 issues.force_push_compare=Porovnat
 issues.due_date_form=rrrr-mm-dd
@@ -1833,13 +1835,13 @@ pulls.switch_comparison_type=Přepnout typ porovnání
 pulls.switch_head_and_base=Prohodit hlavní a základní větev
 pulls.filter_branch=Filtrovat větev
 pulls.no_results=Nebyly nalezeny žádné výsledky.
-pulls.show_all_commits=Zobrazit všechny commity
+pulls.show_all_commits=Zobrazit všechny revize
 pulls.show_changes_since_your_last_review=Zobrazit změny od vašeho posledního posouzení
-pulls.showing_only_single_commit=Zobrazuji pouze změny commitu %[1]s
+pulls.showing_only_single_commit=Zobrazuji pouze změny revize %[1]s
 pulls.showing_specified_commit_range=Zobrazují se pouze změny mezi %[1]s..%[2]s
-pulls.select_commit_hold_shift_for_range=Vyberte commit. Podržte klávesu shift + klepněte pro výběr rozsahu
+pulls.select_commit_hold_shift_for_range=Vyberte revizi. Podržte klávesu Shift a klikněte pro výběr rozsahu
 pulls.review_only_possible_for_full_diff=Posouzení je možné pouze při zobrazení plného rozlišení
-pulls.filter_changes_by_commit=Filtrovat podle commitu
+pulls.filter_changes_by_commit=Filtrovat podle revize
 pulls.nothing_to_compare=Tyto větve jsou stejné. Není třeba vytvářet žádost o sloučení.
 pulls.nothing_to_compare_have_tag = Vybraná větev a značka jsou shodné.
 pulls.nothing_to_compare_and_allow_empty_pr=Tyto větve jsou stejné. Tato žádost o sloučení bude prázdná.
@@ -1849,7 +1851,7 @@ pulls.title_desc_few=chce sloučit %[1]d commity z větve <code>%[2]s</code> do
 pulls.merged_title_desc_few=sloučil %[1]d commity z větve <code>%[2]s</code> do větve <code>%[3]s</code> před %[4]s
 pulls.change_target_branch_at=`změnil/a cílovou větev z <b>%s</b> na <b>%s</b> %s`
 pulls.tab_conversation=Konverzace
-pulls.tab_commits=Commity
+pulls.tab_commits=Revize
 pulls.tab_files=Změněné soubory
 pulls.reopen_to_merge=Otevřete znovu tuto žádost pro provedení sloučení.
 pulls.cant_reopen_deleted_branch=Tuto žádost o sloučení nelze znovu otevřít, protože větev byla smazána.
@@ -1868,7 +1870,7 @@ pulls.data_broken=Tato žádost o sloučení je rozbitá kvůli chybějícím in
 pulls.files_conflicted=Tato žádost o sloučení obsahuje změny, které jsou v rozporu s cílovou větví.
 pulls.is_checking=Právě probíhá kontrola konfliktů při sloučení. Zkuste to za chvíli.
 pulls.is_ancestor=Tato větev je již součástí cílové větve. Není co sloučit.
-pulls.is_empty=Změny na této větvi jsou již na cílové větvi. Toto bude prázdný commit.
+pulls.is_empty=Změny na této větvi se již nacházejí na cílové větvi. Tato revize bude prázdná.
 pulls.required_status_check_failed=Některé požadované kontroly nebyly úspěšné.
 pulls.required_status_check_missing=Některé požadované kontroly chybí.
 pulls.required_status_check_administrator=Jako administrátor stále můžete sloučit tuto žádost.
@@ -1889,25 +1891,25 @@ pulls.reject_count_1=%d žádost o změnu
 pulls.reject_count_n=%d žádostí o změnu
 pulls.waiting_count_1=%d čekající posouzení
 pulls.waiting_count_n=%d čekajících posouzení
-pulls.wrong_commit_id=id commitu musí být id commitu v cílové větvi
+pulls.wrong_commit_id=id revize musí být id revize v cílové větvi
 
 pulls.no_merge_desc=Tato žádost nemůže být sloučena, protože všechny možnosti repozitáře na sloučení jsou zakázány.
 pulls.no_merge_helper=Povolte možnosti sloučení v nastavení repozitáře nebo proveďte sloučení žádosti ručně.
 pulls.no_merge_wip=Tato žádost nemůže být sloučena, protože je označena jako rozpracovaná.
 pulls.no_merge_not_ready=Tento žádost není připravena na sloučení, zkontrolujte stav posouzení a kontroly stavu.
 pulls.no_merge_access=Nemáte oprávnění sloučit tuto žádost.
-pulls.merge_pull_request=Vytvořit slučovací commit
+pulls.merge_pull_request=Vytvořit slučovací revizi
 pulls.rebase_merge_pull_request=Rebase pak fast-forward
-pulls.rebase_merge_commit_pull_request=Rebase a poté vytvořit slučovací commit
-pulls.squash_merge_pull_request=Vytvořit squash commit
+pulls.rebase_merge_commit_pull_request=Provést rebase a poté vytvořit slučovací revizi
+pulls.squash_merge_pull_request=Vytvořit squash revizi
 pulls.merge_manually=Sloučeno ručně
-pulls.merge_commit_id=ID slučovacího commitu
-pulls.require_signed_wont_sign=Větev vyžaduje podepsané commity, ale toto sloučení nebude podepsáno
+pulls.merge_commit_id=ID slučovací revize
+pulls.require_signed_wont_sign=Větev vyžaduje podepsané revize, ale toto sloučení nebude podepsáno
 
 pulls.invalid_merge_option=Pro tuto žádost nemůžete použít tuto možnost sloučení.
 pulls.merge_conflict=Sloučení selhalo: při slučování došlo ke konfliktu. Tip: zkuste jinou strategii
 pulls.merge_conflict_summary=Chybové hlášení
-pulls.rebase_conflict=Sloučení selhalo: došlo ke konfliktu při rebase commitu: %[1]s. Tip: zkuste jinou strategii
+pulls.rebase_conflict=Sloučení selhalo: došlo ke konfliktu při provádění rebase revize %[1]s. Tip: zkuste jinou strategii
 pulls.rebase_conflict_summary=Chybové hlášení
 pulls.unrelated_histories=Sloučení selhalo: hlava a základ revize nesdílí společnou historii. Tip: zkuste jinou strategii
 pulls.merge_out_of_date=Sloučení selhalo: základ byl aktualizován při generování sloučení. Tip: zkuste to znovu.
@@ -1937,7 +1939,7 @@ pulls.reopened_at=`znovu otevřel/a tuto žádost o sloučení <a id="%[1]s" hre
 pulls.cmd_instruction_hint=Zobrazit instrukce příkazové řádky
 pulls.cmd_instruction_checkout_desc=Z vašeho repositáře projektu se podívejte na novou větev a vyzkoušejte změny.
 pulls.cmd_instruction_merge_title=Sloučit
-pulls.cmd_instruction_merge_desc=Slučte změny a aktualizujte je na Gitea.
+pulls.cmd_instruction_merge_desc=Slučte změny a aktualizujte je na Forgeju.
 pulls.clear_merge_message=Vymazat zprávu o sloučení
 
 pulls.auto_merge_button_when_succeed=(Když kontroly uspějí)
@@ -1959,7 +1961,7 @@ pulls.delete.text=Opravdu chcete odstranit tuto žádost o sloučení? (Tímto t
 pull.deleted_branch=(odstraněno):%s
 
 milestones.new=Nový milník
-milestones.closed=Zavřen dne %s
+milestones.closed=Uzavřeno %s
 milestones.update_ago=Aktualizováno %s
 milestones.no_due_date=Bez lhůty dokončení
 milestones.open=Otevřít
@@ -1988,15 +1990,15 @@ milestones.filter_sort.most_complete=Nejvíce dokončené
 milestones.filter_sort.most_issues=Nejvíce problémů
 milestones.filter_sort.least_issues=Nejméně problémů
 
-signing.will_sign=Tento commit bude podepsána klíčem „%s“.
-signing.wont_sign.error=Došlo k chybě při kontrole, zda může být commit podepsán.
-signing.wont_sign.nokey=Tato instance nemá žádný klíč k podepsání tohoto commitu.
-signing.wont_sign.never=Commity nejsou nikdy podepsány.
-signing.wont_sign.always=Commity jsou vždy podepsány.
-signing.wont_sign.pubkey=Commit nebude podepsán, protože nemáte veřejný klíč spojený s vaším účtem.
-signing.wont_sign.twofa=Pro podepisování commitů musíte mít zapnuto dvoufázové ověření.
-signing.wont_sign.parentsigned=Commit nebude podepsán, protože nadřazený commit není podepsán.
-signing.wont_sign.basesigned=Sloučení nebude podepsáno, protože základní commit není podepsaný.
+signing.will_sign=Tato revize bude podepsána klíčem „%s“.
+signing.wont_sign.error=Došlo k chybě při kontrole, zda může být revize podepsána.
+signing.wont_sign.nokey=Tato instance nemá žádný klíč k podepsání této revize.
+signing.wont_sign.never=Revize nebudou nikdy podepsány.
+signing.wont_sign.always=Revize budou vždy podepsány.
+signing.wont_sign.pubkey=Reviz nebude podepsána, protože nemáte veřejný klíč spojený s vaším účtem.
+signing.wont_sign.twofa=Pro podepisování revizí musíte mít zapnuto dvoufázové ověření.
+signing.wont_sign.parentsigned=Revize nebude podepsána, protože nadřazená revize není podepsána.
+signing.wont_sign.basesigned=Revize nebude podepsána, protože základní revize není podepsána.
 signing.wont_sign.headsigned=Sloučení nebude podepsáno, protože hlavní revize není podepsána.
 signing.wont_sign.commitssigned=Sloučení nebude podepsáno, protože všechny přidružené revize nejsou podepsány.
 signing.wont_sign.approved=Sloučení nebude podepsáno, protože žádost o sloučení není schválena.
@@ -2015,9 +2017,9 @@ wiki.filter_page=Filtr stránky
 wiki.new_page=Stránka
 wiki.page_title=Název stránky
 wiki.page_content=Obsah stránky
-wiki.default_commit_message=Napište poznámku k této aktualizaci stránky (nepovinný).
+wiki.default_commit_message=Napište poznámku k této aktualizaci stránky (nepovinné).
 wiki.save_page=Uložit stránku
-wiki.last_commit_info=%s upravil tuto stránku %s
+wiki.last_commit_info=Uživatel %s upravil tuto stránku %s
 wiki.edit_page_button=Změnit stránku
 wiki.new_page_button=Nová stránka
 wiki.file_revision=Revize stránky
@@ -2076,14 +2078,14 @@ activity.title.releases_1=%d vydání
 activity.title.releases_n=%d vydání
 activity.title.releases_published_by=%s publikoval %s
 activity.published_release_label=Vydání
-activity.no_git_activity=V tomto období nebyla žádná aktivita při odevzdání.
+activity.no_git_activity=V tomto období nebyla žádná aktivita přispěvatelů.
 activity.git_stats_exclude_merges=Při vyloučení slučování,
 activity.git_stats_author_1=%d autor
 activity.git_stats_author_n=%d autoři
 activity.git_stats_pushed_1=nahrál
 activity.git_stats_pushed_n=nahrály
-activity.git_stats_commit_1=%d commit
-activity.git_stats_commit_n=%d commity
+activity.git_stats_commit_1=%d revize
+activity.git_stats_commit_n=%d revizí
 activity.git_stats_push_to_branch=do %s a
 activity.git_stats_push_to_all_branches=do všech větví.
 activity.git_stats_on_default_branch=Na %s,
@@ -2099,7 +2101,7 @@ activity.git_stats_deletion_1=%d odebrání
 activity.git_stats_deletion_n=%d odebrání
 
 contributors.contribution_type.filter_label = Typ přispění:
-contributors.contribution_type.commits=Commity
+contributors.contribution_type.commits=Revize
 
 search=Vyhledat
 search.search_repo=Hledat repozitář
@@ -2125,9 +2127,9 @@ settings.hooks=Webhooky
 settings.githooks=Git hooky
 settings.basic_settings=Základní nastavení
 settings.mirror_settings=Nastavení zrcadel
-settings.mirror_settings.docs=Nastavte repozitář pro automatickou synchronizaci commitů, značek a větví s jiným repozitářem.
-settings.mirror_settings.docs.disabled_pull_mirror.instructions=Nastavte váš projekt pro automatické nahrávání commitů, značek a větví do jiného repozitáře. Správce webu zakázal zrcadla pro natažení.
-settings.mirror_settings.docs.disabled_push_mirror.instructions=Nastavte svůj projekt pro automatické natažení commitů, značek a větví z jiného repozitáře.
+settings.mirror_settings.docs=Nastavte repozitář pro automatickou synchronizaci revizí, značek a větví s jiným repozitářem.
+settings.mirror_settings.docs.disabled_pull_mirror.instructions=Nastavte váš projekt pro automatické nahrávání revizí, značek a větví do jiného repozitáře. Správce webu zakázal nahrávání ze zrcadel.
+settings.mirror_settings.docs.disabled_push_mirror.instructions=Nastavte svůj projekt pro automatické nahrávání revizí, značek a větví z jiného repozitáře.
 settings.mirror_settings.docs.no_new_mirrors=Váš repozitář zrcadlí změny do nebo z jiného repozitáře. Mějte prosím na paměti, že v tuto chvíli nemůžete vytvořit žádná nová zrcadla.
 settings.mirror_settings.docs.can_still_use=I když nemůžete upravit stávající zrcadla nebo vytvořit nová, stále můžete použít své stávající zrcadlo.
 settings.mirror_settings.docs.more_information_if_disabled=Více informací o zrcadlech pro nahrání a natažení naleznete zde:
@@ -2188,11 +2190,11 @@ settings.admin_settings=Administrátorská nastavení
 settings.admin_enable_health_check=Povolit kontrolu stavu repozitáře (git fsck)
 settings.admin_code_indexer=Indexování kódu
 settings.admin_stats_indexer=Index statistiky kódu
-settings.admin_indexer_commit_sha=Poslední indexovaný commit
+settings.admin_indexer_commit_sha=Poslední indexovaná revize
 settings.admin_indexer_unindexed=Neindexováno
 settings.reindex_button=Přidat do fronty reindexace
 settings.reindex_requested=Požadováno reindexování
-settings.admin_enable_close_issues_via_commit_in_any_branch=Zavřít problém pomocí commitu v jiné než výchozí větvi
+settings.admin_enable_close_issues_via_commit_in_any_branch=Zavřít problém pomocí revize provedené v jiné než výchozí větvi
 settings.danger_zone=Nebezpečná zóna
 settings.new_owner_has_same_repo=Nový vlastník již repozitář se stejným názvem má. Vyberte prosím jiné jméno.
 settings.convert=Převést na běžný repozitář
@@ -2229,11 +2231,11 @@ settings.trust_model.collaborator=Spolupracovník
 settings.trust_model.collaborator.long=Spolupracovník: Důvěřovat podpisům spolupracovníků
 settings.trust_model.collaborator.desc=Platné podpisy spolupracovníků tohoto repozitáře budou označeny jako „důvěryhodné“ - (ať se shodují s autorem, či nikoli). V opačném případě budou platné podpisy označeny jako „nedůvěryhodné“, pokud se podpis shoduje s přispěvatelem a „neodpovídající“, pokud ne.
 settings.trust_model.committer=Přispěvatel
-settings.trust_model.committer.long=Přispěvatel: Důvěřovat podpisům, které odpovídají autorům (což odpovídá GitHub a přinutí Giteu nastavit jako tvůrce pro Giteou podepsané revize)
-settings.trust_model.committer.desc=Platné podpisy budou označeny jako „důvěryhodné“ pouze, pokud se shodují s přispěvatelem, v opačném případě budou označeny jako „neodpovídající“. To přinutí Forgejo, aby bylo přispěvatelem podepsaných commitů se skutečným přispěvatelem označeným jako Co-authored-by: a Co-committed-by: na konci commitu. Výchozí klíč Forgejo musí odpovídat uživateli v databázi.
+settings.trust_model.committer.long=Přispěvatel: Důvěřovat podpisům, které odpovídají autorům (což odpovídá GitHubu a přinutí Forgejo nastavit se jako autora pro Forgejem podepsané revize)
+settings.trust_model.committer.desc=Platné podpisy budou označeny jako „důvěryhodné“ pouze, pokud se shodují s přispěvatelem, v opačném případě budou označeny jako „neodpovídající“. To přinutí Forgejo, aby bylo přispěvatelem podepsaných revizí se skutečným přispěvatelem označeným jako Co-authored-by: a Co-committed-by: na konci revize. Výchozí klíč Forgejo musí odpovídat uživateli v databázi.
 settings.trust_model.collaboratorcommitter=Spolupracovník+Přispěvatel
 settings.trust_model.collaboratorcommitter.long=Spolupracovník+Přispěvatel: Důvěřovat podpisům od spolupracovníků, které odpovídají tvůrci revize
-settings.trust_model.collaboratorcommitter.desc=Platné podpisy spolupracovníků tohoto repozitáře budou označeny jako „důvěryhodné“, pokud se shodují s přispěvatelem. V opačném případě budou platné podpisy označeny jako "nedůvěryhodné", pokud se podpis shoduje s přispěvatelem a „neodpovídajícím“ v opačném případě. To přinutí Giteu, aby byla označena jako přispěvatel podepsaných commitů se skutečným přispěvatelem označeným jako Co-Authored-By: a Co-Committed-By: na konci commitu. Výchozí klíč Forgejo musí odpovídat uživateli v databázi.
+settings.trust_model.collaboratorcommitter.desc=Platné podpisy spolupracovníků tohoto repozitáře budou označeny jako „důvěryhodné“, pokud se shodují s přispěvatelem. V opačném případě budou platné podpisy označeny jako "nedůvěryhodné", pokud se podpis shoduje s přispěvatelem a „neodpovídajícím“ v opačném případě. To přinutí Forgejo, aby bylo označeno jako autor podepsaných revizí se skutečným přispěvatelem označeným jako Co-Authored-By: a Co-Committed-By: na konci revize. Výchozí klíč Forgejo musí odpovídat uživateli v databázi.
 settings.wiki_delete=Odstranit data wiki
 settings.wiki_delete_desc=Smazání Wiki dat repozitáře je trvalé a nemůže být vráceno zpět.
 settings.wiki_delete_notices_1=- Natrvalo odstraní a zakáže wiki repozitáře pro %s.
@@ -2412,14 +2414,14 @@ settings.protect_enable_push=Povolit nahrávání
 settings.protect_enable_push_desc=Každý, kdo má přístup k zápisu, bude moci nahrávat do této větve (ale ne vynucená nahrávání).
 settings.protect_enable_merge=Povolit sloučení
 settings.protect_whitelist_committers=Povolit omezené nahrání
-settings.protect_whitelist_committers_desc=Pouze povolení uživatelé budou moci nahrávat do této větve (ale ne vynucení nahrávání).
+settings.protect_whitelist_committers_desc=Pouze povolení uživatelé budou moci nahrávat do této větve (ale ne vynutit nahrání).
 settings.protect_whitelist_deploy_keys=Povolit nahrání klíčům pro nasazení s přístupem pro zápis.
 settings.protect_whitelist_users=Povolení uživatelé pro nahrávání
 settings.protect_whitelist_search_users=Hledat uživatele…
 settings.protect_whitelist_teams=Povolené týmy pro nahrávání
 settings.protect_whitelist_search_teams=Vyhledat týmy…
 settings.protect_merge_whitelist_committers=Povolit whitelist pro slučování
-settings.protect_merge_whitelist_committers_desc=Povolit pouze vyjmenovaným uživatelům nebo týmům slučovat požadavky na natažení do této větve.
+settings.protect_merge_whitelist_committers_desc=Povolit slučování požadavků na sloučení do této větve pouze vyjmenovaným uživatelům nebo týmům.
 settings.protect_merge_whitelist_users=Povolení uživatelé pro slučování
 settings.protect_merge_whitelist_teams=Povolené týmy pro slučování
 settings.protect_check_status_contexts=Povolit kontrolu stavu
@@ -2437,8 +2439,8 @@ settings.protect_approvals_whitelist_users=Povolení posuzovatelé
 settings.protect_approvals_whitelist_teams=Povolené týmy pro posuzování
 settings.dismiss_stale_approvals=Odmítnout nekvalitní schválení
 settings.dismiss_stale_approvals_desc=Pokud budou do větve nahrány nové revize, které mění obsah tohoto požadavku na natažení, všechna stará schválení budou zamítnuta.
-settings.require_signed_commits=Vyžadovat podepsané commity
-settings.require_signed_commits_desc=Odmítnout nahrání do této větve pokud nejsou podepsaná nebo jsou neověřitelná.
+settings.require_signed_commits=Vyžadovat podepsané revize
+settings.require_signed_commits_desc=Odmítnout nahrání do této větve, pokud nejsou podepsaná nebo jsou neověřitelná.
 settings.protect_branch_name_pattern=Vzor jména chráněné větve
 settings.protect_branch_name_pattern_desc=Vzory názvů chráněných větví. Pro vzorovou syntaxi viz <a href="%s">dokumentace</a>. Příklady: main, release/**
 settings.protect_patterns=Vzory
@@ -2459,7 +2461,7 @@ settings.block_on_official_review_requests=Blokovat sloučení při oficiální
 settings.block_on_official_review_requests_desc=Slučování nebude možné, pokud mají oficiální požadavek na posouzení, i když mají k dispozici dostatek schválení.
 settings.block_outdated_branch=Blokovat sloučení, pokud je požadavek na natažení zastaralý
 settings.block_outdated_branch_desc=Slučování nebude možné, pokud je hlavní větev za základní větví.
-settings.default_branch_desc=Vybrat výchozí větev repozitáře pro požadavky na natažení a revize kódu:
+settings.default_branch_desc=Vybrat výchozí větev repozitáře pro žádosti o sloučení a příspěvky kódu:
 settings.merge_style_desc=Sloučit styly
 settings.default_merge_style_desc=Výchozí styl sloučení
 settings.choose_branch=Vyberte větev…
@@ -2486,7 +2488,7 @@ settings.matrix.room_id=ID místnosti
 settings.matrix.message_type=Typ zprávy
 settings.archive.button=Archivovat repozitář
 settings.archive.header=Archivovat tento repozitář
-settings.archive.text = Archivováním repozitáře jej celý převedete do stavu pouze pro čtení. Bude skryt z nástěnky. Nikdo (ani vy!) nebude moci vytvářet nové commity ani otevírat problémy a žádosti o sloučení.
+settings.archive.text = Archivováním repozitáře jej celý převedete do stavu pouze pro čtení. Bude skryt z nástěnky. Nikdo (ani vy!) nebude moci vytvářet nové revize ani otevírat problémy a žádosti o sloučení.
 settings.archive.success=Repozitář byl úspěšně archivován.
 settings.archive.error=Nastala chyba při archivování repozitáře. Prohlédněte si záznam pro více detailů.
 settings.archive.error_ismirror=Nemůžete archivovat zrcadlený repozitář.
@@ -2494,7 +2496,7 @@ settings.archive.branchsettings_unavailable=Nastavení větví není v archivova
 settings.archive.tagsettings_unavailable=Nastavení značek nejsou v archivovaných repozitářích k dispozici.
 settings.unarchive.button=Zrušit archivaci repozitáře
 settings.unarchive.header=Obnovit tento repozitář
-settings.unarchive.text=Obnovení repozitáře vrátí možnost přijímání commitů a nahrávání. Stejně tak se obnoví i možnost vytváření nových problémů a žádostí o sloučení.
+settings.unarchive.text=Obnovení repozitáře vrátí možnost přijímání revizí a nahrávání. Stejně tak se obnoví i možnost vytváření nových problémů a žádostí o sloučení.
 settings.unarchive.success=Repozitář byl úspěšně obnoven.
 settings.unarchive.error=Nastala chyba při obnovování repozitáře. Prohlédněte si záznam pro více detailů.
 settings.update_avatar_success=Avatar repozitáře byl aktualizován.
@@ -2502,7 +2504,7 @@ settings.lfs=LFS
 settings.lfs_filelist=LFS soubory uložené v tomto repozitáři
 settings.lfs_no_lfs_files=V tomto repozitáři nejsou uloženy žádné LFS soubory
 settings.lfs_findcommits=Najít revize
-settings.lfs_lfs_file_no_commits=Pro tento soubor LFS nebyly nalezeny žádné commity
+settings.lfs_lfs_file_no_commits=Pro tento soubor LFS nebyly nalezeny žádné revize
 settings.lfs_noattribute=Tato cesta nemá uzamykatelný atribut ve výchozí větvi
 settings.lfs_delete=Odstranit LFS soubor s OID %s
 settings.lfs_delete_warning=Odstranění souboru LFS může při kontrole způsobit chybu „objekt neexistuje“. Jste si jisti?
@@ -2578,7 +2580,7 @@ diff.review.approve=Schválit
 diff.review.self_reject=Autoři požadavků na natažení nemohou požadovat změny na svém vlastním požadavku na natažení
 diff.review.reject=Požadovat změny
 diff.review.self_approve=Autoři požadavku na natažení nemohou schválit svůj vlastní požadavek na natažení
-diff.committed_by=odevzdal
+diff.committed_by=autor:
 diff.protected=Chráněno
 diff.image.side_by_side=Vedle sebe
 diff.image.swipe=Posunout
@@ -2620,7 +2622,7 @@ release.edit_release=Aktualizovat vydání
 release.delete_release=Smazat vydání
 release.delete_tag=Smazat značku
 release.deletion=Smazat vydání
-release.deletion_desc=Smazání vydání jej pouze odebere z Gitea. Nebude to mít vliv na značku Git, obsah vašeho repozitáře nebo jeho historii. Pokračovat?
+release.deletion_desc=Smazáním vydání jej pouze odeberete z Forgeja. Nebude to mít vliv na značku Gitu, obsah vašeho repozitáře nebo jeho historii. Pokračovat?
 release.deletion_success=Vydání bylo odstraněno.
 release.deletion_tag_desc=Odstraní tuto značku z repozitáře. Obsah repozitáře a historie zůstanou nezměněny. Pokračovat?
 release.deletion_tag_success=Značka byla odstraněna.
@@ -2643,7 +2645,7 @@ branch.delete_html=Odstranit větev
 branch.delete_desc=Smazání větve je trvalé. Přestože zrušená větev může existovat i po krátkou dobu, než bude skutečně odstraněna, NELZE ji většinou vrátit. Pokračovat?
 branch.deletion_success=Větev „%s“ byla smazána.
 branch.deletion_failed=Nepodařilo se odstranit větev „%s“.
-branch.delete_branch_has_new_commits=Větev „%s“ nemůže být smazána, protože byly přidány nové commity po sloučení.
+branch.delete_branch_has_new_commits=Větev „%s“ nelze odstranit, protože byly po sloučení přidány nové revize.
 branch.create_branch=Vytvořit větev %s
 branch.create_from=z „%s“
 branch.create_success=Větev „%s“ byla vytvořena.
@@ -2710,12 +2712,12 @@ mirror_sync = synchronizováno
 blame.ignore_revs = Ignorování revizí v souboru <a href="%s">.git-blame-ignore-revs</a>. Klikněte <a href="%s">sem pro udělení výjimky</a> a zobrazení normálního přehledu blame.
 commits.browse_further = Procházet dále
 issues.role.first_time_contributor = První přispěvatel
-editor.invalid_commit_mail = Neplatný e-mail pro vytvoření commitu.
+editor.invalid_commit_mail = Neplatný e-mail pro vytvoření revize.
 commits.renamed_from = Přejmenováno z %s
-activity.navbar.recent_commits = Nedávné commity
+activity.navbar.recent_commits = Nedávné revize
 settings.units.units = Jednotky
 pulls.blocked_by_user = V tomto repozitáři nemůžete vytvořit žádost o sloučení, protože jste byli zablokováni jeho majitelem.
-pulls.clear_merge_message_hint = Vymazáním zprávy o sloučení pouze odstraníte obsah zprávy commitu a ponecháte vygenerované git trailery, jako „Co-Authored-By …“.
+pulls.clear_merge_message_hint = Vymazáním zprávy o sloučení pouze odstraníte obsah zprávy revize a ponecháte vygenerované git trailery, jako „Co-Authored-By …“.
 pulls.agit_explanation = Vytvořeno pomocí workflow AGit. AGit umožňuje přispěvatelům navrhovat změny pomocí „git push“ bez vytváření forku nebo nové větve.
 contributors.contribution_type.deletions = Odstranění
 settings.pull_mirror_sync_in_progress = Probíhá načítání změn ze vzdáleného %s.
@@ -2724,7 +2726,7 @@ settings.mirror_settings.docs.disabled_push_mirror.pull_mirror_warning = Tuto ak
 settings.new_owner_blocked_doer = Nový majitel vás zablokoval.
 settings.mirror_settings.pushed_repository = Odeslaný repozitář
 settings.add_collaborator_blocked_our = Nepodařilo se přidat spolupracovníka, jelikož byl zablokován majitelem repozitáře.
-pulls.commit_ref_at = `se odkázal na tuto žádost o sloučení z commitu <a id="%[1]s" href="#%[1]s">%[2]s</a>`
+pulls.commit_ref_at = `se odkázal/a na tuto žádost o sloučení z revize <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 settings.wiki_rename_branch_main = Normalizovat název větve Wiki
 settings.wiki_rename_branch_main_desc = Přejmenovat větev interně používanou pro Wiki na „%s“. Tato změna je trvalá a nelze ji vrátit.
 pulls.fast_forward_only_merge_pull_request = Pouze zrychlené
@@ -2748,24 +2750,24 @@ settings.add_collaborator_blocked_them = Nepodařilo se přidat spolupracovníka
 settings.ignore_stale_approvals = Ignorovat zastaralá schválení
 settings.event_pull_request_merge = Sloučení žádosti o sloučení
 settings.event_pull_request_approvals = Schválení žádostí o sloučení
-settings.ignore_stale_approvals_desc = Nepočítat schválení udělená u starších commitů (zastaralá schválení) do celkového počtu schválení u ŽS. Není relevantní, pokud byla zastaralá schválení již zrušena.
+settings.ignore_stale_approvals_desc = Nepočítat schválení udělená u starších revizí (zastaralá schválení) do celkového počtu schválení u žádosti o sloučení. Není relevantní, pokud byla zastaralá schválení již zrušena.
 file_follow = Následovat symbolický odkaz
 settings.protect_status_check_patterns_desc = Zadejte vzorce pro upřesnění kontrol, které musí projít před sloučením větví do větve, která se shoduje s tímto pravidlem. Na každý řádek zadejte jeden vzorec. Vzorce nesmí být prázdné.
 settings.archive.mirrors_unavailable = Zrcadla nejsou v archivovaných repozitářích k dispozici.
 settings.protect_enable_merge_desc = Kdokoli s přístupem k zápisu bude moci slučovat žádosti o sloučení do této větve.
 settings.event_pull_request_review_request_desc = Bylo požádáno o posouzení žádosti o sloučení nebo bylo toto požádání odstraněno.
-error.broken_git_hook = Zdá se, že u tohoto repozitáře jsou rozbité Git hooks. Pro jejich opravení se prosím řiďte pokyny v <a target="_blank" rel="noreferrer" href="%s">dokumentaci</a> a poté odešlete několik commitů pro obnovení stavu.
+error.broken_git_hook = Zdá se, že u tohoto repozitáře jsou rozbité Git webhooky. Pro jejich opravení se prosím řiďte pokyny v <a target="_blank" rel="noreferrer" href="%s">dokumentaci</a> a poté odešlete pár revizí pro obnovení stavu.
 pulls.title_desc_one = žádá o sloučení %[1]d commitu z <code>%[2]s</code> do <code id="%[4]s">%[3]s</code>
 pulls.merged_title_desc_one = sloučil %[1]d commit z <code>%[2]s</code> do <code>%[3]s</code> %[4]s
 open_with_editor = Otevřít pomocí %s
 commits.search_branch = Tato větev
-editor.commit_id_not_matching = Tento soubor se během úpravy změnil. Proveďte commit do nové větve a poté je slučte.
+editor.commit_id_not_matching = Tento soubor se během úpravy změnil. Odešlete změny do nové větve a poté je slučte.
 pulls.ready_for_review = Připraveni na posouzení?
 settings.rename_branch_failed_protected = Nepodařilo se přejmenovat větev %s, jelikož se jedná o chráněnou větev.
 editor.push_out_of_date = Push je nejspíše zastaralý.
 stars = Oblíbení
-n_commit_one = %s commit
-n_commit_few = %s commitů
+n_commit_one = %s revize
+n_commit_few = %s revizí
 n_branch_one = %s větev
 n_tag_one = %s značka
 n_tag_few = %s značek
@@ -2811,7 +2813,7 @@ subscribe.issue.guest.tooltip = Přihlaste se pro odebírání tohoto problému.
 subscribe.pull.guest.tooltip = Přihlaste se pro odebírání této žádosti o sloučení.
 issues.author.tooltip.pr = Tento uživatel je autorem této žádosti o sloučení.
 issues.author.tooltip.issue = Tento uživatel je autorem tohoto problému.
-activity.commit = Aktivita commitů
+activity.commit = Aktivita revizí
 milestones.filter_sort.name = Název
 release.type_attachment = Příloha
 release.type_external_asset = Externí příloha
@@ -2872,7 +2874,7 @@ component_loading_info = Tohle může chvíli trvat…
 component_failed_to_load = Došlo k neočekávané chybě.
 code_frequency.what = frekvence kódu
 contributors.what = příspěvky
-recent_commits.what = nedávné commity
+recent_commits.what = nedávné revize
 component_loading = Načítání %s...
 component_loading_failed = Nepodařilo se načíst %s
 
@@ -3020,7 +3022,7 @@ last_page=Poslední
 total=Celkem: %d
 settings=Nastavení správce
 
-dashboard.new_version_hint=Gitea %s je nyní k dispozici, právě u vás běži %s. Podívej se na <a target="_blank" rel="noreferrer" href="%s">blogu</a> pro více informací.
+dashboard.new_version_hint=Forgejo %s je nyní k dispozici, aktuálně používáte verzi %s. Pro více informací viz <a target="_blank" rel="noreferrer" href="%s">blog</a>.
 dashboard.statistic=Souhrn
 dashboard.operations=Operace údržby
 dashboard.system_status=Stav systému
@@ -3533,7 +3535,7 @@ self_check.database_collation_mismatch=Očekávejte, že databáze použije coll
 self_check.database_inconsistent_collation_columns=Databáze používá collation %s, ale tyto sloupce používají chybné collation. To může způsobit neočekávané problémy.
 self_check.database_fix_mysql=Pro uživatele MySQL/MariaDB můžete použít příkaz „forgejo doctor convert“, který opraví problémy s porovnáním. Problém také můžete ručně vyřešit příkazem „ALTER ... COLLATE ...“ SQL.
 self_check = Vlastní kontrola
-self_check.database_collation_case_insensitive=Databáze používá collation %s, což je collation nerozlišující velká a malá písmena. Ačkoli s ní Gitea může pracovat, mohou se vyskytnout vzácné případy, kdy nebude fungovat podle očekávání.
+self_check.database_collation_case_insensitive=Databáze používá collation %s, což je collation nerozlišující velká a malá písmena. Ačkoli s ní Forgejo může pracovat, mohou se vyskytnout vzácné případy, kdy nebude fungovat podle očekávání.
 auths.oauth2_map_group_to_team = Zmapovat zabrané skupiny u týmů organizací (volitelné - vyžaduje název claimu výše)
 monitor.queue.settings.desc = Pooly dynamicky rostou podle blokování fronty jejich workerů.
 
@@ -3580,7 +3582,7 @@ delete_branch=smazal/a větev %[2]s z <a href="%[1]s">%[3]s</a>
 compare_branch=Porovnat
 compare_commits=Porovnat %d revizí
 compare_commits_general=Porovnat revize
-mirror_sync_push=synchronizoval/a commity do <a href="%[2]s">%[3]s</a> v <a href="%[1]s">%[4]s</a> ze zrcadla
+mirror_sync_push=synchronizoval/a revize do <a href="%[2]s">%[3]s</a> v <a href="%[1]s">%[4]s</a> ze zrcadla
 mirror_sync_create=synchronizoval/a novou referenci <a href="%[2]s">%[3]s</a> do <a href="%[1]s">%[4]s</a> ze zrcadla
 mirror_sync_delete=synchronizoval/a a smazal/a referenci <code>%[2]s</code> v <a href="%[1]s">%[3]s</a> ze zrcadla
 approve_pull_request=`schválil/a <a href="%[1]s">%[3]s#%[2]s</a>`
@@ -3635,13 +3637,13 @@ no_subscriptions=Žádné odběry
 [gpg]
 default_key=Podepsáno výchozím klíčem
 error.extract_sign=Selhalo získání podpisu
-error.generate_hash=Selhalo vygenerování hash revize
+error.generate_hash=Selhalo vygenerování hashe revize
 error.no_committer_account=Žádný účet není propojen s e-mailovou adresou přispěvatele
 error.no_gpg_keys_found=V databázi nebyl nalezen žádný známý klíč pro tento podpis
-error.not_signed_commit=Nepodepsaný commit
+error.not_signed_commit=Nepodepsaná revize
 error.failed_retrieval_gpg_keys=Nepodařilo se získat žádný klíč propojený s účtem přispěvatele
-error.probable_bad_signature=VAROVÁNÍ! Přestože v databázi existuje klíč s tímto ID, tento commit neověřuje! Tento commit je PODEZŘELÝ.
-error.probable_bad_default_signature=VAROVÁNÍ! Ačkoli výchozí klíč má toto ID, neověřuje tento commit! Tento commit je PODEZŘELÝ.
+error.probable_bad_signature=VAROVÁNÍ! Přestože v databázi existuje klíč s tímto ID, tato revize jím není ověřena! Tato revize je PODEZŘELÁ.
+error.probable_bad_default_signature=VAROVÁNÍ! Přestože má výchozí klíč toto ID, tato revize jím není ověřena! Tato revize je PODEZŘELÁ.
 
 [units]
 unit=Jednotka
@@ -3863,7 +3865,7 @@ runners.task_list.no_tasks=Zatím zde nejsou žádné úlohy.
 runners.task_list.run=Spustit
 runners.task_list.status=Status
 runners.task_list.repository=Repozitář
-runners.task_list.commit=Commit
+runners.task_list.commit=Revize
 runners.task_list.done_at=Dokončeno v
 runners.edit_runner=Upravit Runner
 runners.update_runner=Aktualizovat změny
@@ -3883,7 +3885,7 @@ runners.reset_registration_token=Resetovat registrační token
 runners.reset_registration_token_success=Registrační token runneru byl úspěšně obnoven
 
 runs.all_workflows=Všechny workflowy
-runs.commit=Commit
+runs.commit=Revize
 runs.scheduled=Naplánováno
 runs.invalid_workflow_helper=Konfigurační soubor pracovního postupu je neplatný. Zkontrolujte prosím konfigurační soubor: %s
 runs.no_matching_online_runner_helper=Žádný odpovídající online runner s popiskem: %s
@@ -3896,7 +3898,7 @@ runs.no_workflows=Zatím neexistují žádné pracovní postupy.
 runs.no_workflows.quick_start = Nevíte jak začít s Gitea Action? Podívejte se na <a target="_blank" rel="noopener noreferrer" href="%s">průvodce rychlým startem</a>.
 runs.no_workflows.documentation = Další informace o Gitea Action, viz <a target="_blank" rel="noopener noreferrer" href="%s">dokumentace</a>.
 runs.no_runs=Pracovní postup zatím nebyl spuštěn.
-runs.empty_commit_message=(prázdná zpráva commitu)
+runs.empty_commit_message=(prázdná zpráva revize)
 
 workflow.disable=Zakázat workflow
 workflow.disable_success=Workflow „%s“ byl úspěšně deaktivován.
@@ -3969,7 +3971,7 @@ code_kind = Hledat kód...
 package_kind = Hledat balíčky...
 project_kind = Hledat projekty...
 branch_kind = Hledat větve...
-commit_kind = Hledat commity...
+commit_kind = Hledat revize...
 runner_kind = Hledat runnery...
 no_results = Nenalezeny žádné odpovídající výsledky.
 fuzzy_tooltip = Zahrnout také výsledky, které úzce odpovídají hledanému výrazu
diff --git a/options/locale/locale_da.ini b/options/locale/locale_da.ini
index cbe65c6583..d73c48a160 100644
--- a/options/locale/locale_da.ini
+++ b/options/locale/locale_da.ini
@@ -627,6 +627,8 @@ unsupported_login_type = Login typen understøttes ikke for at slette kontoen.
 cannot_add_org_to_team = En organisation kan ikke tilføjes som et holdmedlem.
 must_use_public_key = Nøglen du har angivet er en privat nøgle. Lad være med at uploade din private nøgle nogen steder. Brug din offentlige nøgle i stedet.
 
+email_domain_is_not_allowed = Domænet for brugerens e-mailadresse <b>%s</b> er i konflikt med EMAIL_DOMAIN_ALLOWLIST eller EMAIL_DOMAIN_BLOCKLIST. Sørg for, at du har indstillet e-mailadressen korrekt.
+
 [user]
 change_avatar = Skift din avatar…
 joined_on = Tilmeldte sig den %s
@@ -1627,6 +1629,163 @@ issues.lock_confirm = Lås
 issues.unlock_confirm = Lås op
 issues.lock.notice_1 = - Andre brugere kan ikke tilføje nye kommentarer til dette problem.
 
+issues.unpin_issue = Frigør problemet
+issues.max_pinned = Du kan ikke fastgøre flere problemer
+issues.pin_comment = fastgjort dette %s
+issues.unpin_comment = frigjorde dette %s
+issues.lock = Lås samtale
+issues.unlock = Lås samtale op
+issues.lock.unknown_reason = Kan ikke låse et problem med en ukendt årsag.
+issues.lock.notice_2 = - Du og andre samarbejdspartnere med adgang til dette lager kan stadig efterlade kommentarer, som andre kan se.
+issues.lock.notice_3 = - Du kan altid låse op for dette problem igen i fremtiden.
+issues.unlock.notice_1 = - Alle ville kunne udtale sig om dette spørgsmål endnu en gang.
+issues.unlock.notice_2 = - Du kan altid låse dette problem igen i fremtiden.
+issues.lock.reason = Årsag til låsning
+issues.lock.title = Lås samtale om dette problem.
+issues.unlock.title = Lås op for samtale om dette problem.
+issues.comment_on_locked = Du kan ikke kommentere på et låst problem.
+issues.delete = Slet
+issues.delete.title = Slet dette problem?
+issues.delete.text = Vil du virkelig slette dette problem? (Dette fjerner alt indhold permanent. Overvej at lukke det i stedet, hvis du har til hensigt at holde det arkiveret)
+issues.tracker = Tidsregistrering
+issues.start_tracking_short = Start timer
+issues.start_tracking = Start tidsregistrering
+issues.start_tracking_history = `begyndte at arbejde %s`
+issues.tracker_auto_close = Timeren stoppes automatisk, når dette problem lukkes
+issues.tracking_already_started = `Du har allerede startet tidsregistrering på <a href="%s">et andet problem</a>!`
+issues.stop_tracking = Stop timer
+issues.stop_tracking_history = "stoppede med at arbejde %s`
+issues.cancel_tracking = Kassér
+issues.cancel_tracking_history = `annulleret tidssporing %s`
+issues.add_time = Tilføj tid manuelt
+issues.del_time = Slet denne tidslog
+issues.add_time_short = Tilføj tid
+issues.add_time_cancel = Annuller
+issues.add_time_history = `tilført brugt tid %s`
+issues.del_time_history = `slettet brugt tid %s`
+issues.add_time_hours = Timer
+issues.add_time_minutes = Minutter
+issues.add_time_sum_to_small = Ingen tid blev indtastet.
+issues.time_spent_total = Samlet tid brugt
+issues.time_spent_from_all_authors = `Samlet tid brugt: %s`
+issues.due_date = Forfaldsdato
+issues.push_commit_1 = tilføjet %d commit %s
+issues.push_commits_n = tilføjet %d commits %s
+issues.force_push_codes = `force-pushed %[1]s fra <a class="%[7]s" href="%[3]s"><code>%[2]s</code></a> til <a class="%[7]s" href="%[5]s"><code>%[4]s</code></a> %[6]s`
+issues.force_push_compare = Sammenlign
+issues.due_date_form = yyyy-mm-dd
+issues.due_date_form_edit = Redigere
+issues.due_date_form_remove = Slet
+issues.due_date_not_set = Ingen forfaldsdato fastsat.
+issues.due_date_added = tilføjede forfaldsdatoen %s %s
+issues.due_date_modified = ændrede forfaldsdatoen fra %[2]s til %[1]s %[3]s
+issues.due_date_remove = fjernede forfaldsdatoen %s %s
+issues.due_date_overdue = Forfalden
+issues.due_date_invalid = Forfaldsdatoen er ugyldig eller uden for intervallet. Brug venligst formatet "yyyy-mm-dd".
+issues.dependency.title = Afhængigheder
+issues.dependency.issue_no_dependencies = Ingen afhængigheder angivet.
+issues.dependency.pr_no_dependencies = Ingen afhængigheder angivet.
+issues.dependency.no_permission_1 = Du har ikke tilladelse til at læse %d afhængighed
+issues.dependency.no_permission_n = Du har ikke tilladelse til at læse %d afhængigheder
+issues.dependency.no_permission.can_remove = Du har ikke tilladelse til at læse denne afhængighed, men du kan fjerne denne afhængighed
+issues.dependency.add = Tilføj afhængighed…
+issues.dependency.cancel = Annuller
+issues.dependency.remove = Slet
+issues.dependency.remove_info = Fjern denne afhængighed
+issues.dependency.added_dependency = `tilføjede en ny afhængighed %s`
+issues.dependency.removed_dependency = `fjernede en afhængighed %s`
+issues.dependency.pr_closing_blockedby = Lukning af denne pull-anmodning er blokeret af følgende problemer
+issues.dependency.issue_closing_blockedby = Lukning af dette problem er blokeret af følgende problemer
+issues.dependency.issue_close_blocks = Dette problem blokerer for lukning af følgende problemer
+issues.dependency.pr_close_blocks = Denne pull-anmodning blokerer lukning af følgende problemer
+issues.dependency.issue_close_blocked = Du skal lukke alle problemer, der blokerer dette problem, før du kan lukke det.
+issues.dependency.issue_batch_close_blocked = Kan ikke batchlukke valgte problemer, fordi problem #%d stadig har åbne afhængigheder
+issues.dependency.pr_close_blocked = Du skal lukke alle problemer, der blokerer denne pull-anmodning, før du kan flette den.
+issues.dependency.blocks_short = Blockere
+issues.dependency.blocked_by_short = Afhænger af
+issues.dependency.remove_header = Fjern afhængighed
+issues.dependency.issue_remove_text = Dette vil fjerne afhængigheden af dette problem. Vil du fortsætte?
+issues.dependency.pr_remove_text = Dette vil fjerne afhængigheden fra denne pull-anmodning. Vil du fortsætte?
+issues.dependency.setting = Aktiver afhængigheder for problemer og pull-anmodninger
+issues.dependency.add_error_same_issue = Du kan ikke få et problem til at afhænge af sig selv.
+issues.dependency.add_error_dep_issue_not_exist = Afhængigt problem eksisterer ikke.
+issues.dependency.add_error_dep_not_exist = Afhængighed eksisterer ikke.
+issues.dependency.add_error_dep_exists = Afhængighed eksisterer allerede.
+issues.dependency.add_error_cannot_create_circular = Du kan ikke oprette en afhængighed med to problemer, der blokerer hinanden.
+issues.dependency.add_error_dep_not_same_repo = Begge problemer skal være i samme depot.
+issues.review.self.approval = Du kan ikke godkende din egen pull-anmodning.
+issues.review.self.rejection = Du kan ikke anmode om ændringer på din egen pull-anmodning.
+issues.review.approve = godkendte disse ændringer %s
+issues.review.comment = gennemgået %s
+issues.review.dismissed = afviste %s's gennemgang %s
+issues.review.dismissed_label = Afvist
+issues.review.left_comment = efterladt en kommentar
+issues.review.content.empty = Du skal efterlade en kommentar, der angiver de ønskede ændringer.
+issues.review.reject = anmodende ændringer %s
+issues.review.wait = blev anmodet om gennemgang %s
+issues.review.add_review_request = anmodet om gennemgang fra %[1]s %[2]s
+issues.review.add_review_requests = anmodet om gennemgange fra %[1]s %[2]s
+issues.review.remove_review_request = fjernet anmodning om gennemgang for %[1]s %[2]s
+issues.review.remove_review_requests = fjernet anmodning om gennemgange for %[1]s %[2]s
+issues.review.remove_review_request_self = nægtede at gennemgå %s
+issues.review.add_remove_review_requests = anmodede om gennemgang fra %[1]s og fjernede gennemgangsanmodninger for %[2]s %[3]s
+issues.review.pending = Afventer
+issues.review.pending.tooltip = Denne kommentar er i øjeblikket ikke synlig for andre brugere. For at indsende dine afventende kommentarer, vælg "%s" -> "%s/%s/%s" øverst på siden.
+issues.review.review = Gennemgå
+issues.review.reviewers = Gemmengåer
+issues.review.outdated = Forældet
+issues.review.outdated_description = Indholdet er ændret siden denne kommentar blev lavet
+issues.review.option.show_outdated_comments = Vis forældede kommentarer
+issues.review.option.hide_outdated_comments = Skjul forældede kommentarer
+issues.review.show_outdated = Vis forældet
+issues.review.hide_outdated = Skjul forældede
+issues.review.show_resolved = Vis løst
+issues.review.hide_resolved = Skjul løst
+issues.review.resolve_conversation = Løs samtale
+issues.review.un_resolve_conversation = Uafklaret samtale
+issues.review.resolved_by = markerede denne samtale som løst
+issues.reference_issue.body = Body
+issues.content_history.deleted = slettet
+issues.content_history.edited = redigeret
+issues.content_history.created = oprettet
+issues.content_history.delete_from_history = Slet fra historikken
+issues.content_history.delete_from_history_confirm = Slet fra historikken?
+issues.content_history.options = Valgmuligheder
+issues.reference_link = Reference: %s
+issues.blocked_by_user = Du kan ikke oprette et problem på dette depot, fordi du er blokeret af depotes ejer.
+issues.comment.blocked_by_user = Du kan ikke oprette en kommentar til dette problem, fordi du er blokeret af depotes ejer eller anmelder af problemet.
+issues.summary_card_alt = Oversigtskort over et problem med titlen "%s" i depotet %s
+compare.compare_base = base
+compare.compare_head = sammenlign
+pulls.desc = Aktiver pull-anmodninger og kodegennemgange.
+pulls.new = Ny pull anmodning
+pulls.view = Se pull-anmodning
+pulls.edit.already_changed = Kunne ikke gemme ændringer af pull-anmodningen. Det ser ud til, at indholdet allerede er blevet ændret af en anden bruger. Opdater siden, og prøv at redigere igen for at undgå at overskrive deres ændringer
+pulls.compare_changes = Ny pull-anmodning
+pulls.sign_in_require = <a href="%s">Log ind</a> for at oprette en ny pull-anmodning.
+pulls.allow_edits_from_maintainers = Tillad redigeringer fra vedligeholdere
+pulls.allow_edits_from_maintainers_desc = Brugere med skriveadgang til basisgrenen kan også trykke til denne gren
+pulls.allow_edits_from_maintainers_err = Opdatering mislykkedes
+pulls.compare_changes_desc = Vælg den gren, der skal flettes ind i, og den gren, der skal trækkes fra.
+pulls.has_viewed_file = Set
+pulls.has_changed_since_last_review = Ændret siden din sidste gennemgang
+pulls.viewed_files_label = %[1]d / %[2]d filer set
+pulls.expand_files = Udvid alle filer
+pulls.collapse_files = Skjul alle filer
+pulls.compare_base = flet ind i
+pulls.compare_compare = pull fra
+pulls.switch_comparison_type = Skift sammenligningstype
+pulls.switch_head_and_base = Skift hoved og base
+pulls.filter_branch = Filter gren
+pulls.no_results = Ingen resultater fundet.
+pulls.show_all_commits = Vis alle commits
+pulls.show_changes_since_your_last_review = Vis ændringer siden din sidste gennemgang
+pulls.showing_only_single_commit = Viser kun ændringer af commit %[1]s
+pulls.showing_specified_commit_range = Viser kun ændringer mellem %[1]s..%[2]s
+pulls.select_commit_hold_shift_for_range = Vælg commit. Hold Shift + klik for at vælge et område
+pulls.review_only_possible_for_full_diff = Gennemgang er kun mulig, når du ser den fulde diff
+pulls.filter_changes_by_commit = Filtrer efter commit
+
 [notification]
 watching = Overvåger
 
diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 6a479b7629..4791a3807c 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -683,6 +683,8 @@ To = Branchname
 AccessToken = Zugangstoken
 
 
+email_domain_is_not_allowed = Die Domain der E-Mail-Adresse des Benutzers <b>%s</b> steht in Konflikt mit EMAIL_DOMAIN_ALLOWLIST oder EMAIL_DOMAIN_BLOCKLIST. Bitte stelle sicher, dass du die E-Mail-Adresse richtig gesetzt hast.
+
 [user]
 change_avatar=Profilbild ändern …
 joined_on=Beigetreten am %s
@@ -3109,7 +3111,7 @@ dashboard.sync_branch.started=Synchronisierung der Branches gestartet
 dashboard.rebuild_issue_indexer=Issue-Indexer neu bauen
 
 users.user_manage_panel=Benutzerkonten verwalten
-users.new_account=Benutzerkonto erstellen
+users.new_account=Benutzeraccount erstellen
 users.name=Benutzername
 users.full_name=Vollständiger Name
 users.activated=Aktiviert
@@ -3578,7 +3580,7 @@ comment_pull=`hat den Pull-Request <a href="%[1]s">%[3]s#%[2]s</a> kommentiert`
 merge_pull_request=`führte Pull-Request <a href="%[1]s">%[3]s#%[2]s</a> zusammen`
 auto_merge_pull_request=`führte Pull-Request <a href="%[1]s">%[3]s#%[2]s</a> automatisch zusammen`
 transfer_repo=hat Repository <code>%s</code> übertragen zu <a href="%s">%s</a>
-push_tag=Tag <a href="%[2]s">%[3]s</a> nach <a href="%[1]s">%[4]s</a> wurde gepusht
+push_tag=hat Tag <a href="%[2]s">%[3]s</a> auf <a href="%[1]s">%[4]s</a> gepusht
 delete_tag=hat Tag %[2]s in <a href="%[1]s">%[3]s</a> gelöscht
 delete_branch=hat Branch %[2]s in <a href="%[1]s">%[3]s</a> gelöscht
 compare_branch=Vergleichen
@@ -3975,7 +3977,7 @@ package_kind = Pakete suchen …
 project_kind = Projekte suchen …
 branch_kind = Branches suchen …
 commit_kind = Commits suchen …
-runner_kind = Runners suchen …
+runner_kind = Runner suchen …
 no_results = Keine passenden Ergebnisse gefunden.
 code_search_unavailable = Die Code-Suche ist momentan nicht verfügbar. Bitte kontaktiere den Webseitenadministrator.
 keyword_search_unavailable = Die Suche mittels Schlüsselwort ist momentan nicht verfügbar. Bitte kontaktiere den Webseitenadministrator.
diff --git a/options/locale/locale_es-ES.ini b/options/locale/locale_es-ES.ini
index 4f9d141423..74098beb12 100644
--- a/options/locale/locale_es-ES.ini
+++ b/options/locale/locale_es-ES.ini
@@ -56,7 +56,7 @@ mirror=Réplica
 new_repo=Nuevo repositorio
 new_migrate=Nueva migración
 new_mirror=Nueva réplica
-new_fork=Nuevo fork de repositorio
+new_fork=Nueva bifurcación del repositorio
 new_org=Nueva organización
 new_project=Nuevo proyecto
 new_project_column=Nueva columna
@@ -75,7 +75,7 @@ collaborative=Colaborativo
 forks=Forks
 
 activities=Actividades
-pull_requests=Pull requests
+pull_requests=Solicitudes de incorporación de cambios
 issues=Incidencias
 milestones=Hitos
 
@@ -156,8 +156,8 @@ invalid_data = Datos inválidos: %v
 confirm_delete_artifact = ¿Estás seguro de que deseas eliminar el artefacto "%s"?
 more_items = Mas cosas
 copy_generic = Copiar al portapapeles
-filter.not_fork = No forks
-filter.is_fork = Forks
+filter.not_fork = No hay bifurcaciones
+filter.is_fork = Bifurcaciones
 test = Test
 error413 = Has agotado tu cuota.
 new_repo.title = Nuevo repositorio
@@ -397,8 +397,8 @@ code_search_results=Resultados de búsqueda para «%s»
 code_last_indexed_at=Indexado por última vez %s
 relevant_repositories_tooltip=Repositorios que son bifurcaciones o que no tienen ningún tema, ningún icono, y ninguna descripción están ocultos.
 relevant_repositories=Solo se muestran repositorios relevantes, <a href="%s">mostrar resultados sin filtrar</a>.
-forks_few = %d forks
-forks_one = %d fork
+forks_few = %d bifurcaciones
+forks_one = %d bifurcación
 stars_few = %d estrellas
 stars_one = %d estrella
 
@@ -1054,6 +1054,8 @@ keep_activity_private.description = Tu <a href="%s">actividad pública</a> solo
 language.description = Este idioma se guardará en tu cuenta y se utilizará como predeterminado cuando te conectes.
 language.localization_project = ¡Ayúdanos a traducir Forgejo a tu idioma! <a href="%s">Más información</a>.
 
+pronouns_custom_label = Pronombres personalizados
+
 [repo]
 owner=Propietario
 owner_helper=Algunas organizaciones pueden no aparecer en el menú desplegable debido a un límite máximo de recuento de repositorios.
@@ -1068,10 +1070,10 @@ visibility=Visibilidad
 visibility_description=Sólo el propietario o los miembros de la organización -si tienen derechos- podrán verlo.
 visibility_helper=Hacer el repositorio privado
 visibility_helper_forced=El administrador de su sitio obliga a nuevos repositorios a ser privados.
-visibility_fork_helper=(Cambiar esto afectará a la visibilidad de todos los forks.)
+visibility_fork_helper=(Cambiar esto afectará a la visibilidad de todas las bifurcaciones.)
 clone_helper=¿Necesita ayuda para clonar? Visite <a target="_blank" rel="noopener noreferrer" href="%s">Ayuda</a>.
-fork_repo=Hacer fork del repositorio
-fork_from=Crear un fork desde
+fork_repo=Hacer una bifurcación del repositorio
+fork_from=Crear una bifurcación desde
 already_forked=Ya ha forkeado %s
 fork_to_different_account=Forkear a una cuenta diferente
 fork_visibility_helper=La visibilidad de un repositorio del cual se ha hecho fork no puede ser cambiada.
@@ -1098,7 +1100,7 @@ license_helper_desc=Una licencia regula lo que otros pueden y no pueden hacer co
 readme=LÉAME
 readme_helper=Selecciona una plantilla de archivo README
 readme_helper_desc=Este es el lugar donde puedes escribir una descripción completa de su proyecto.
-auto_init=Inicializar el repositorio (añade .gitignore, licencia y README)
+auto_init=Inicializar el repositorio
 trust_model_helper=Seleccionar modelo de confianza para la verificación de la firma. Las opciones posibles son:
 trust_model_helper_collaborator=Colaborador: Confiar en firmas de colaboradores
 trust_model_helper_committer=Comitter: Firmas de confianza que coinciden con los committers
@@ -2796,7 +2798,7 @@ settings.confirmation_string = Cadena de confirmación
 issues.filter_sort.relevance = Relevancia
 settings.transfer_quota_exceeded = El nuevo propietario (%s) ha sobrepasado la cuota. El repositorio no ha sido transferido.
 settings.web_hook_name_sourcehut_builds = Builds de SourceHut
-settings.wiki_rename_branch_main_notices_2 =
+settings.wiki_rename_branch_main_notices_2 = 
 settings.wiki_rename_branch_main = Normalizar el nombre de la rama de la wiki
 settings.wiki_rename_branch_main_desc = Renombrar la rama interna usada por la wiki a "%s". Este cambio es permanente y no se puede deshacer.
 settings.confirm_wiki_branch_rename = Renombrar la rama de la wiki
@@ -2815,6 +2817,20 @@ diff.git-notes.remove-header = Eliminar nota
 release.download_count_few = %s descargas
 diff.git-notes.remove-body = Esta nota se eliminará.
 
+new_from_template = Usa una plantilla
+new_from_template_description = Puedes seleccionar una plantilla de repositorio ya existente en esta instancia y aplicar sus ajustes.
+new_advanced = Ajustes avanzados
+new_advanced_expand = Click para expandir
+auto_init_description = Empieza el historial Git con un README y opcionalmente añade una Licencia y archivos .gitignore.
+editor.add_tmpl.filename = nombre de fichero
+issues.num_reviews_one = %d revisión
+issues.num_reviews_few = %d revisiones
+issues.reaction.add = Añadir reacción
+issues.reaction.alt_remove = Quitar %[1]s reacción de comentario.
+issues.reaction.alt_add = Añadir %[1]s reacción al comentario.
+issues.review.add_review_requests = solicitada revisiones de %[1]s %[2]s
+issues.review.remove_review_requests = eliminada la solicitud de revisiones para %[1]s %[2]s
+
 [graphs]
 component_loading = Cargando %s...
 component_loading_failed = No se pudo cargar %s
@@ -3837,7 +3853,7 @@ search = Buscar...
 type_tooltip = Tipo de búsqueda
 project_kind = Buscar proyectos...
 branch_kind = Buscar ramas...
-commit_kind = Buscar commits...
+commit_kind = Buscar confirmaciones...
 repo_kind = Buscar repositorios...
 user_kind = Buscar usuarios...
 org_kind = Buscar organizaciones...
diff --git a/options/locale/locale_fi-FI.ini b/options/locale/locale_fi-FI.ini
index 937a577936..1a98459321 100644
--- a/options/locale/locale_fi-FI.ini
+++ b/options/locale/locale_fi-FI.ini
@@ -1766,7 +1766,7 @@ issues.close = Sulje ongelma
 issues.no_content = Ei kuvausta.
 pulls.reject_count_1 = %d muutospyyntö
 pulls.update_branch_success = Haarapäivitys onnistui
-milestones.completeness = <strong>%d%%</strong> valmiina
+milestones.completeness = <strong>%d% %</strong> valmiina
 contributors.contribution_type.additions = Lisäykset
 contributors.contribution_type.deletions = Poistot
 settings.webhook_deletion_success = Webkoukku on poistettu.
@@ -2097,6 +2097,16 @@ settings.archive.text = Repon arkistointi asettaa sen pelkkään lukutilaan. Se
 no_eol.text = Ei EOL:ää
 pulls.compare_changes_desc = Valitse haara, johon yhdistetään, ja haara, josta vedetään.
 
+new_from_template = Käytä mallipohjaa
+new_from_template_description = Voit valita olemassa olevan repon mallipohjan ja toteuttaa sen asetukset.
+new_advanced = Lisäasetukset
+new_advanced_expand = Laajenna napsauttamalla
+template_description = Repojen mallipohjat mahdollistavat uusien repojen luomisen halutulla hakemistorakenteella, tiedostoilla ja valinnaisilla asetuksilla.
+auto_init_description = Aloita Git-historia README-tiedostolla ja valinnaisesti License- ja .gitignore-tiedostoilla.
+settings.enter_repo_name = Kirjoita omistajan ja repon nimi täsmälleen kuten esitetty:
+settings.confirmation_string = Vahvistusteksti
+settings.delete_notices_2 = - Tämä toiminto poistaa pysyvästi repon <strong>%s</strong> mukaan lukien koodin, ongelmat, kommentit, wikidatan ja avustaja-asetukset.
+
 [graphs]
 component_loading_info = Tämä saattaa kestää hetken…
 component_failed_to_load = Odottamaton virhe.
@@ -2582,6 +2592,16 @@ compare_branch = Vertaa
 review_dismissed_reason = Syy:
 commit_repo = työnsi haaraan <a href="%[2]s">%[3]s</a> repossa <a href="%[1]s">%[4]s</a>
 
+create_issue = `avasi ongelman <a href="%[1]s">%[3]s#%[2]s</a>`
+close_issue = `sulki ongelman <a href="%[1]s">%[3]s#%[2]s</a>`
+reopen_issue = `avasi uudelleen ongelman <a href="%[1]s">%[3]s#%[2]s</a>`
+create_pull_request = `loi vetopyynnön <a href="%[1]s">%[3]s#%[2]s</a>`
+close_pull_request = `sulki vetopyynnön <a href="%[1]s">%[3]s#%[2]s</a>`
+reopen_pull_request = `avasi uudelleen vetopyynnön <a href="%[1]s">%[3]s#%[2]s</a>`
+comment_issue = `kommentoi ongelmaa <a href="%[1]s">%[3]s#%[2]s</a>`
+comment_pull = `kommentoi vetopyyntöä <a href="%[1]s">%[3]s#%[2]s</a>`
+merge_pull_request = `yhdisti vetopyynnön <a href="%[1]s">%[3]s#%[2]s</a>`
+
 [tool]
 now=nyt
 1s=1 sekunti
@@ -2628,6 +2648,8 @@ error.extract_sign = Allekirjoituksen purkaminen epäonnistui
 default_key = Allekirjoitettu oletusavaimella
 error.failed_retrieval_gpg_keys = Ei saatu yhtäkään kommitin tekijän tiliin liitettyä avainta
 
+error.generate_hash = Tiivisteen luominen kommitista epäonnistui
+
 [units]
 unit = Yksikkö
 
@@ -2768,6 +2790,10 @@ owner.settings.cargo.rebuild.error = Cargo-indeksin rakentaminen uudelleen epäo
 owner.settings.cargo.rebuild.success = Cargo-indeksi rakennettiin uudelleen.
 owner.settings.cleanuprules.preview.none = Siivoussääntö ei vastaa yhtäkään pakettia.
 
+settings.link.error = Repositorion linkin päivittäminen epäonnistui.
+owner.settings.cargo.initialize = Alusta indeksi
+owner.settings.cargo.initialize.description = Erityinen Git-repoindeksi vaaditaan Cargo-rekisterin käyttämiseksi. Tämän valinnan käyttäminen luo (tarvittaessa uudelleen) repon ja määrittää sen asetukset automaattisesti.
+
 [secrets]
 creation.failed = Salaisuuden lisääminen epäonnistui.
 deletion = Poista salaisuus
diff --git a/options/locale/locale_fil.ini b/options/locale/locale_fil.ini
index 9d0ec9f308..b859885bd7 100644
--- a/options/locale/locale_fil.ini
+++ b/options/locale/locale_fil.ini
@@ -641,6 +641,8 @@ Biography = Byograpya
 Location = Lokasyon
 visit_rate_limit = Natugunan ang limitasyon sa rate ng malayuang pagbisita.
 
+email_domain_is_not_allowed = Sumasalungat ang domain ng email address ng user <b>%s</b> sa EMAIL_DOMAIN_ALLOWLIST o EMAIL_DOMAIN_BLOCKLIST. Siguraduhing natakda mo ang email address nang tama.
+
 [user]
 joined_on = Sumali noong %s
 repositories = Mga Repositoryo
@@ -2911,7 +2913,7 @@ dashboard.delete_old_system_notices = Burahin ang lahat ng mga lumang paunawa ng
 dashboard.gc_lfs = I-garbage collect ang mga LFS meta object
 dashboard.stop_zombie_tasks = Itigil ang mga zombie action task
 users.user_manage_panel = Ipamahala ang mga user account
-users.new_account = Gumawa ng User Account
+users.new_account = Gumawa ng user account
 users.auth_login_name = Pangalan ng sign-in authentication
 users.password_helper = Iwanang walang laman ang password upang panatilihing hindi nabago.
 users.max_repo_creation = Pinakamataas na numero ng mga repositoryo
@@ -3684,7 +3686,7 @@ approve_pull_request = `inaprubahan ang <a href="%[1]s">%[3]s#%[2]s</a>`
 review_dismissed_reason = Dahilan:
 compare_branch = Ikumpara
 reject_pull_request = `nagmungkahi ng mga pagbabago para sa <a href="%[1]s">%[3]s#%[2]s</a>`
-rename_repo = pinalitan ang pangalan ng repositoryo mula <code>%[1]s</code> sa <a href="%[2]s">%[3]#</a>
+rename_repo = pinalitan ang pangalan ng repositoryo mula <code>%[1]s</code> sa <a href="%[2]s">%[3]s</a>
 close_issue = `sinara ang isyu na <a href="%[1]s">%[3]s#%[2]s</a>`
 review_dismissed = `na-dismiss ang pagsusuri mula <b>%[4]s</b> para sa <a href="%[1]s">%[3]s#%[2]s</a>`
 close_pull_request = `sinara ang hiling sa paghila na <a href="%[1]s">%[3]s#%[2]s</a>`
diff --git a/options/locale/locale_fr-FR.ini b/options/locale/locale_fr-FR.ini
index 2585eb1616..50e4a65bc6 100644
--- a/options/locale/locale_fr-FR.ini
+++ b/options/locale/locale_fr-FR.ini
@@ -681,6 +681,8 @@ Website = Site web
 Location = Emplacement
 To = Nom de la branche
 
+email_domain_is_not_allowed = Le domaine <b>%s</b> du courriel utilisateur entre en conflit avec EMAIL_DOMAIN_ALLOWLIST ou EMAIL_DOMAIN_BLOCKLIST. Veuillez vous assurer le courriel est renseigné.
+
 [user]
 change_avatar=Changer votre avatar…
 joined_on=Inscrit le %s
diff --git a/options/locale/locale_lv-LV.ini b/options/locale/locale_lv-LV.ini
index c179158213..8ed697a164 100644
--- a/options/locale/locale_lv-LV.ini
+++ b/options/locale/locale_lv-LV.ini
@@ -40,7 +40,7 @@ passcode=Kods
 webauthn_insert_key=Jāievieto sava drošības atslēga
 webauthn_sign_in=Jānospiež poga uz drošības. Ja drošības atslēgai nav pogas, tā ir atkārtoti jāievieto.
 webauthn_press_button=Lūgums nospiest pogu uz savas drošības atslēgas…
-webauthn_use_twofa=Izmantot divfaktoru kodu no tālruņa
+webauthn_use_twofa=Izmantot divpakāpju kodu no sava tālruņa
 webauthn_error=Nevar nolasīt drošības atslēgu.
 webauthn_unsupported_browser=Pārlūks pašlaik nenodrošina WebAuthn.
 webauthn_error_unknown=Atgadījās nezināma kļūda. Lūgums mēģināt vēlreiz.
@@ -75,7 +75,7 @@ mirrors=Spoguļglabātavas
 collaborative=Līdzdarbošanās
 forks=Atzarojumi
 
-activities=Aktivitāte
+activities=Darbības
 pull_requests=Izmaiņu pieprasījumi
 issues=Pieteikumi
 milestones=Atskaites punkti
@@ -83,8 +83,8 @@ milestones=Atskaites punkti
 ok=Labi
 cancel=Atcelt
 retry=Mēģināt vēlreiz
-rerun=Palaist atkārtoti
-rerun_all=Palaist atkārtoti visus darbus
+rerun=Atkārtoti izpildīt
+rerun_all=Atkārtoti izpildīt visus darbus
 save=Saglabāt
 add=Pievienot
 add_all=Pievienot visus
@@ -221,18 +221,18 @@ network_error=Tīkla kļūda
 server_internal = Iekšēja servera kļūda
 
 [startpage]
-app_desc=Viegli uzstādāms Git serviss
-install=Vienkārši instalējams
+app_desc=Pašmitināms Git pakalpojums bez galvassāpēm
+install=Viegli uzstādīt
 install_desc=Vienkārši <a target="_blank" rel="noopener noreferrer" href="%[1]s">jāpalaiž izpildāmā datne</a> vajadzīgajai sistēmai, jāizmanto <a target="_blank" rel="noopener noreferrer" href="%[2]s">Docker</a> vai jāiegūst <a target="_blank" rel="noopener noreferrer" href="%[3]s">pakotne</a>.
 platform=Pieejama dažādām platformām
 lightweight=Viegla
-lightweight_desc=Forgejo ir miminālas prasības un to var darbināt uz nedārga Raspberry Pi datora. Ietaupi savai ierīcei resursus!
+lightweight_desc=Forgejo ir zemas tehniskās prasības, un tas var darboties nedārgā Raspberry Pi. Taupām savu ierīču patērēto enerģiju!
 license=Atvērtā pirmkoda
 license_desc=Iegūsti <a target="_blank" rel="noopener noreferrer" href="%[1]s">Forgejo</a>! Pievienojies mums <a target="_blank" rel="noopener noreferrer" href="%[2]s">līdzdarbojoties</a>, lai padarītu šo projektu vēl labāku! Nekautrējies un līdzdarbojies!
-platform_desc = Ir apstiprināts, ka Forgejo darbojas brīvās operētājsistēmāš, piemēram, GNU/Linux un FreeBSD, kā arī ar dažādām procesoru arhitektūrām. Izvēlies to, kas patīk!
+platform_desc = Ir apstiprināts, ka Forgejo darbojas brīvās operētājsistēmās, piemēram, GNU/Linux un FreeBSD, kā arī ar dažādām procesoru arhitektūrām. Izvēlies to, kas patīk!
 
 [install]
-install=Instalācija
+install=Uzstādīšana
 title=Sākotnējā konfigurācija
 docker_helper=Ja Forgejo ir uzstādīts Docker konteinerā, lūgums izlasīt <a target="_blank" rel="noopener noreferrer" href="%s">vadlīnijas</a>, pirms tiek mainīti iestatījumi.
 require_db_desc=Forgejo nepieciešams MySQL, PostgreSQL, SQLite3 vai TiDB (ar MySQL protokolu).
@@ -247,11 +247,11 @@ db_schema_helper=Atstāt tukšu, lai izmantotu datubāzes noklusējumu ("public"
 ssl_mode=SSL
 path=Ceļš
 sqlite_helper=SQLite3 datubāzes datnes ceļš.<br>Jāievada pilns ceļš, ja Forgejo tiek palaists kā sistēmas pakalpojums.
-reinstall_error=Nevar instalēt datubāzē, kura jau satur Forgejo datus
+reinstall_error=Tiek mēģināts uzstādīt esošā Forgejo datubāzē
 reinstall_confirm_message=Atkārtota uzstādīšana ar esošu Forgejo datubāzi var izraisīt vairākas nebūšanas. Vairumā gadījumu vajadzētu izmantot esošo "app.ini", lai palaistu Forgejo. Jāapstiprina zemāk esošais, ja ir skaidrs, kas tiek darīts:
 reinstall_confirm_check_1=Dati, kas šifrēti ar SECRET_KEY, kas ir norādīta app.ini datnē, var tikt pazaudēti: lietotāji nevarēs pieteikties ar 2FA/OTP, kā arī spoguļglabātavas var pārstāt darboties. Ar šīs izvēles rūtiņas atzīmēšanu tiek apstiprināts, ka pašreizējā app.ini datne satur pareizu SECRET_KEY vērtību.
 reinstall_confirm_check_2=Glabātavas un iestatījumus var būt nepieciešams atkārtoti sinhronizēt. Ar šīs izvēles rūtiņas atzīmēšanu tiek apstiprināts, ka pašrocīgi tiks veikta glabātavu aizķeru un authorized_keys datnes atkārtota sinhronizēšana, kā arī tiek apstiprināts, ka tiks nodrošināts, ka glabātavas un spoguļošanas iestatījumi ir pareizi.
-reinstall_confirm_check_3=Ar šo tiek apstiprināts, ka ir pilnīga pārliecība, ka Forgejo darbojas ar pareizu app.ini atrašanāš vietu un ka tiešām ir nepieciešama atkārtota uzstādīšana. Tiek apliecināts, ka iepriekšminētais var novest pie kļūmēm.
+reinstall_confirm_check_3=Ar šo tiek apstiprināts, ka ir pilnīga pārliecība, ka Forgejo darbojas ar pareizu app.ini atrašanās vietu un ka tiešām ir nepieciešama atkārtota uzstādīšana. Tiek apliecināts, ka iepriekšminētais var novest pie kļūmēm.
 err_empty_db_path=Nav norādīts SQLite3 datu bāzes ceļš.
 no_admin_and_disable_registration=Lietotāju reģistrēšanos nevar atspējot bez pārvaldītāja konta izveidošanas.
 err_empty_admin_password=Pārvaldītāja parole nevar būt tukša.
@@ -267,7 +267,7 @@ repo_path=Glabātavu atrašanās vieta
 repo_path_helper=Attālās Git glabātavas tiks saglabātas šajā mapē.
 lfs_path=Git LFS atrašanās vieta
 lfs_path_helper=Datnes, kas pievienotas Git LFS, tiks glabātas šajā mapē. Atstāt tukšu, lai atspējotu.
-run_user=Lietotājus, ar kuru palaist
+run_user=Lietotājs, ar kuru palaist
 run_user_helper=Operētājsistēms lietotājs, ar kuru tiks palaists Forgejo. Jāņem vērā, ka šim lietotājam ir jābūt piekļuvei glabātavas atrašanās vietai.
 domain=Servera domēna vārds
 domain_helper=Domēns vai servera adrese.
@@ -314,19 +314,19 @@ admin_name=Pārvaldītāja lietotājvārds
 admin_password=Parole
 confirm_password=Apstiprināt paroli
 admin_email=E-pasta adrese
-install_btn_confirm=Instalēt Forgejo
+install_btn_confirm=Uzstādīt Forgejo
 test_git_failed=Nevarēja pārbaudīt "git" komandu: %v
 sqlite3_not_available=Šī Forgejo versija neatbalsta SQLite3. Lūgums lejupielādēt oficiālo bināro versiju no %s (ne 'gobuild' versiju).
 invalid_db_setting=Nederīgi datu bāzes iestatījumi: %v
 invalid_db_table=Datubāzes tabula "%s" ir kļūdaina: %v
 invalid_repo_path=Nederīga glabātavu atrašanās vieta: %v
-invalid_app_data_path=Lietojumprogrammas datu ceļš ir kļūdains: %v
-run_user_not_match="Izpildīt kā lietotājam" lietotājvārds neatbilst pašreizējam lietotājam: %s -> %s
+invalid_app_data_path=Lietotnes datu ceļš ir kļūdains: %v
+run_user_not_match="Lietotājs, ar kuru palaist" lietotājvārds neatbilst pašreizējam lietotājam: %s -> %s
 internal_token_failed=Neizdevās izveidot iekšējo pilnvaru: %v
 secret_key_failed=Neizdevās izveidot drošības atslēgu: %v
 save_config_failed=Neizdevās saglabāt konfigurāciju: %v
 invalid_admin_setting=Pārvaldītāja konta iestatījums ir nederīgs: %v
-invalid_log_root_path=Nederīgs žurnalizēšanas ceļš: %v
+invalid_log_root_path=Žurnāla atrašanās vieta ir nederīga: %v
 default_keep_email_private=Pēc noklusējuma slēpt e-pasta adreses
 default_keep_email_private.description=Pēc noklusējuma iespējot e-pasta adreses slēpšanu jauniem lietotājiem, lai šī informāciju nenoplūstu uzreiz pēc reģistrēšanās.
 default_allow_create_organization=Pēc noklusējuma ļaut apvienību izveidošanu
@@ -424,7 +424,7 @@ account_activated=Konts ir aktivēts
 prohibit_login=Konta darbība ir apturēta
 prohibit_login_desc=Kontam ir liegts mijiedarboties ar serveri. Jāsazinās ar tā pārvaldītāju, lai atgūtu piekļuvi.
 resent_limit_prompt=Nesen jau tika pieprasīts aktivēšanas e-pasta ziņojums. Lūgums uzgaidīt 3 minūtes un mēģināt vēlreiz.
-has_unconfirmed_mail=Sveiciens, %s! Tev ir neapstiprināta e-pasta adrese (<b>%s</b>). Ja neesi saņēmis apstiprinājuma e-pasta ziņojumu vai ir nepieciešams nosūtīt jaunu, lūgums klikšķināt uz zemāk esošās pogas.
+has_unconfirmed_mail=Sveiciens, %s! Tev ir neapstiprināta e-pasta adrese (<b>%s</b>). Ja nav saņemts apstiprinājuma e-pasta ziņojums vai ir nepieciešams nosūtīt jaunu, lūgums klikšķināt uz zemāk esošās pogas.
 resend_mail=Klikšķināt šeit, lai atkārtoti nosūtītu aktivēšanas e-pasta ziņojumu
 email_not_associate=Šī e-pasta adrese nav saistīta ar nevienu kontu.
 send_reset_mail=Nosūtīt atkopes e-pasta ziņojumu
@@ -680,6 +680,8 @@ AccessToken = Piekļuves pilnvara
 To = Zara nosaukums
 
 
+email_domain_is_not_allowed = Lietotāja e-pasta adreses <b>%s</b> domēna vārds ir pretrunāt ar EMAIL_DOMAIN_ALLOWLIST vai EMAIL_DOMAIN_BLOCKLIST. Jāpārliecinās, ka e-pasta adrese ir norādīta pareizi.
+
 [user]
 change_avatar=Mainīt profila attēlu…
 joined_on=Pievienojās %s
@@ -695,7 +697,7 @@ following_few=%d seko
 follow=Sekot
 unfollow=Nesekot
 user_bio=Biogrāfija
-disabled_public_activity=Šis lietotājs ir atslēdzies iespēju aplūkot tā aktivitāti.
+disabled_public_activity=Šis lietotājs ir atspējojis darbību redzamību visiem.
 email_visibility.limited=E-pasta adrese ir redzama visiem autentificētajiem lietotājiem
 email_visibility.private=E-pasta adrese ir redzama tikai administratoriem
 show_on_map=Rādīt šo vietu kartē
@@ -736,7 +738,7 @@ social=Sociālie konti
 applications=Lietotnes
 orgs=Apvienības
 repos=Glabātavas
-delete=Dzēst kontu
+delete=Izdzēst kontu
 twofa=Divpakāpju pieteikšanās (TOTP)
 account_link=Saistītie konti
 organization=Apvienības
@@ -780,7 +782,7 @@ comment_type_group_dependency=Atkarības
 comment_type_group_lock=Aizslēgšanas stāvoklis
 comment_type_group_review_request=Izskatīšanas pieprasījums
 comment_type_group_pull_request_push=Pievienotie iesūtījumi
-comment_type_group_project=Projektus
+comment_type_group_project=Projekts
 comment_type_group_issue_ref=Pieteikumu atsauces
 saved_successfully=Iestatījumi tika sekmīgi saglabāti.
 privacy=Privātums
@@ -804,15 +806,15 @@ new_password=Jaunā parole
 retype_new_password=Apstiprināt jauno paroli
 password_incorrect=Ievadīta nepareiza pašreizējā parole.
 change_password_success=Parole tika sekmīgi nomainīta. Turpmāk jāpiesakās ar savu jauno paroli.
-password_change_disabled=Ārējie konti nevar mainīt paroli, izmantojot, Forgejo saskarni.
+password_change_disabled=Ārējie lietotāji nevar mainīt savu paroli Forgejo tīmekļa saskarnē.
 
 emails=E-pasta adreses
 manage_emails=Pārvaldīt e-pasta adreses
 manage_themes=Noklusējuma izskats
 manage_openid=OpenID adreses
-email_desc=Galvenā e-pasta adrese tiks izmantota paziņojumiem, paroļu atkopšanai un, ja tā nav paslēpta, Git tīmekļa darbībām.
+email_desc=Galvenā e-pasta adrese tiks izmantota paziņojumiem, paroļu atkopei un, ja tā nav paslēpta, Git tīmekļa darbībām.
 theme_desc=Šis izskats tiks izmantots tīmekļa saskarnei pēc pieteikšanās.
-primary=Primārā
+primary=Galvenā
 activated=Aktivēts
 requires_activation=Nepieciešama aktivēšana
 primary_email=Padarīt par galveno
@@ -904,7 +906,7 @@ added_on=Pievienots %s
 valid_until_date=Derīgs līdz %s
 valid_forever=Derīgs mūžīgi
 last_used=Pēdējo reizi izmantota
-no_activity=Nav nesenas aktivitātes
+no_activity=Nav nesenu darbību
 can_read_info=Lasīt
 can_write_info=Rakstīt
 key_state_desc=Šī atslēga ir izmantota pēdējo 7 dienu laikā
@@ -922,17 +924,17 @@ unbind_success=Sociālā tīkla konts tika veiksmīgi noņemts.
 
 manage_access_token=Piekļuves pilnvaras
 generate_new_token=Izveidot jaunu pilnvaru
-tokens_desc=Šīs pilnvaras nodrošina piekļuvi kontam ar Gitea API.
+tokens_desc=Šīs pilnvaras nodrošina piekļuvi kontam ar Forgejo API.
 token_name=Pilnvaras nosaukums
 generate_token=Izveidot pilnvaru
 generate_token_success=Jaunā pilnvara tika izveidota. Tā ir jāievieto starpliktuvē, jo tā vairs netiks rādīta.
 generate_token_name_duplicate=Lietotnes nosaukums <strong>%s</strong> jau tiek izmantots. Lūgums izmantot citu.
-delete_token=Dzēst
+delete_token=Izdzēst
 access_token_deletion=Izdzēst piekļuves pilnvaru
 access_token_deletion_cancel_action=Atcelt
 access_token_deletion_confirm_action=Dzēst
-access_token_deletion_desc=Izdzēšot pilnvaru, lietojumprogrammām, kas to izmanto, tiks liegta piekļuve šim kontam. Šī darbība ir neatgriezeniska. Vai turpināt?
-delete_token_success=Pilnvara tika izdzēsta. Lietojumprogrammām, kas izmantoja šo pilnvaru, vairs nav piekļuves kontam.
+access_token_deletion_desc=Pilnvaras izdzēšana atsauks lietotņu, kas to izmanto, piekļuvi kontam. Šo darbību nevar atsaukt. Turpināt?
+delete_token_success=Pilnvara tika izdzēsta. Lietotnēm, kas to izmanto, vairs nav piekļuves kontam.
 repo_and_org_access=Glabātavas un apvienības piekļuve
 permissions_public_only=Tikai publiskie
 permissions_access_all=Visi (publiskie, privātie un ierobežotie)
@@ -975,18 +977,18 @@ revoke_oauth2_grant=Atsaukt piekļuvi
 revoke_oauth2_grant_description=Šīs trešās puses lietotnes piekļuves atsaukšana liegs tai piekļūt Taviem datiem. Turpināt?
 revoke_oauth2_grant_success=Piekļuve sekmīgi atsaukta.
 
-twofa_desc=Divfaktoru autentifikācija uzlabo konta drošību.
+twofa_desc=Lai aizsargātu savu kontu no paroļu zādzības, var izmantot viedtālruni vai citu ierīci, lai saņemtu laikā balstītas vienreiz izmantojamas paroles ("TOTP").
 twofa_recovery_tip=Ja ierīce tiks pazaudēta, būs iespējams izmantot vienreizējas izmantošanas atkopšanas atslēgu, lai atgūtu piekļuvi savam kontam.
-twofa_is_enrolled=Kontam ir <strong>ieslēgta</strong> divfaktoru autentifikācija.
-twofa_not_enrolled=Kontam šobrīd nav ieslēgta divfaktoru autentifikācija.
+twofa_is_enrolled=Kontam šobrīd ir <strong>ieslēgta</strong> divpakāpju pieteikšanās.
+twofa_not_enrolled=Kontam šobrīd nav ieslēgta divpakāpju pieteikšanās.
 twofa_disable=Atspējot divpakāpju pieteikšanos
 twofa_scratch_token_regenerate=Atkārtoti izveidot vienreizējas izmantošanas atkopes atslēgu
 twofa_scratch_token_regenerated=Vienreizējā pilnvara tagad ir %s. Tā ir jāglabā drošā vietā, tā vairs nekad netiks rādīta.
 twofa_enroll=Ieslēgt divpakāpju pieteikšanos
-twofa_disable_note=Nepieciešamības gadījumā divfaktoru autentifikāciju ir iespējams atslēgt.
-twofa_disable_desc=Atslēdzot divfaktoru autentifikāciju, konts vairs nebūs tik drošs. Vai turpināt?
+twofa_disable_note=Ja nepieciešams, divpakāpju pieteikšanos var atslēgt.
+twofa_disable_desc=Divpakāpju pieteikšanās atspējošana padarīs kontu mazāk drošu. Turpināt?
 regenerate_scratch_token_desc=Ja atkopšanas atslēga ir pazaudēta vai tā jau ir izmantota, lai pieteiktos, to var atiestatīt šeit.
-twofa_disabled=Divfaktoru autentifikācija tika atslēgta.
+twofa_disabled=Divpakāpju pieteikšanās tika atspējota.
 scan_this_image=Šis attēls ir jānolasa ar autentificēšanās lietotni:
 or_enter_secret=Vai jāievada noslēpums: %s
 then_enter_passcode=Pēc tam jāievada lietotnē attēlotais piekļuves kods:
@@ -1007,7 +1009,7 @@ manage_account_links_desc=Šie ārējie konti ir sasaistīti ar Tavu Forgejo kon
 account_links_not_available=Pašlaik nav neviena ārējā konta piesaistīta šim kontam.
 link_account=Sasaistīt kontu
 remove_account_link=Noņemt sasaistīto kontu
-remove_account_link_desc=Sasaistītā konta noņemšana atsauks tā piekļuvi Tavam Gitea kontam. Turpināt?
+remove_account_link_desc=Sasaistītā konta noņemšana atsauks tā piekļuvi Tavam Forgejo kontam. Turpināt?
 remove_account_link_success=Sasaistītais konts tika noņemts.
 
 hooks.desc=Pievienot tīmekļa aizķeres, kas izpildīsies <strong>visās piederošajās glabātavās</strong>.
@@ -1016,7 +1018,7 @@ orgs_none=Nav dalības nevienā apvienībā.
 repos_none=Tev nav nevienas glabātavas.
 
 delete_account=Izdzēst savu kontu
-delete_prompt=Šī darbība neatgriezeniski izdzēsīs lietotāja kontu. To <strong>NEVAR</strong> atdarīt.
+delete_prompt=Šī darbība neatgriezeniski izdzēsīs lietotāja kontu. To <strong>NEVAR</strong> atsaukt.
 delete_with_all_comments=Konts ir jaunāks kā %s. Lai izvairītos no spoku piebildēm, visas pieteikumu/izmaiņu pieprasījumu piebildes tiks izdzēstas kopā ar to.
 confirm_delete_account=Apstiprināt izdzēšanu
 delete_account_title=Izdzēst lietotāja kontu
@@ -1129,7 +1131,7 @@ mirror_password_placeholder=(bez izmaiņām)
 mirror_password_blank_placeholder=(nav uzstādīts)
 mirror_password_help=Jānomaina lietotājvārds, lai izdzēstu saglabāto paroli.
 watchers=Novērotāji
-stargazers=Zvaigžņdevēji
+stargazers=Zvaigžņu vērotāji
 stars_remove_warning=Šī glabātava tiks izņemta no visām izlasēm.
 forks=Atzarojumi
 reactions_more=un vēl %d
@@ -1226,7 +1228,7 @@ migrate.migrating_failed_no_addr=Pārcelšana neizdevās.
 migrate.github.description=Pārcelt datus no github.com vai GitHub Enterprise servera.
 migrate.git.description=Pārcelt tikai glabātavu no jebkura Git pakalpojuma.
 migrate.gitlab.description=Pārcelt datus no gitlab.com vai citiem GitLab serveriem.
-migrate.gitea.description=Pārcelt datus no gitea.com vai citiem Gitea/Forgejo serveriem.
+migrate.gitea.description=Pārcelt datus no gitea.com vai citiem Gitea serveriem.
 migrate.gogs.description=Pārcelt datus no notabug.org vai citiem Gogs serveriem.
 migrate.onedev.description=Pārcelt datus no code.onedev.io vai citiem OneDev serveriem.
 migrate.codebase.description=Pārcelt datus no codebasehq.com.
@@ -1273,7 +1275,7 @@ clear_ref=`Notīrīt pašreizējo atsauci`
 filter_branch_and_tag=Atlasīt zaru vai birku
 find_tag=Atrast birku
 branches=Zari
-tags=Tagi
+tags=Birkas
 issues=Pieteikumi
 pulls=Izmaiņu pieprasījumi
 project_board=Projekti
@@ -1291,7 +1293,7 @@ releases=Laidieni
 tag=Tags
 released_this=izveidoja šo laidienu
 tagged_this=izveidoja tagu revīzijai
-file.title=%s atzarā %s
+file.title=%s zarā %s
 file_raw=Neapstrādāts
 file_history=Vēsture
 file_view_source=Skatīt avotu
@@ -1346,7 +1348,7 @@ editor.delete_this_file=Izdzēst datni
 editor.must_have_write_access=Ir jābūt rakstīšanas piekļuvei, lai šajā datnē veiktu vai ierosinātu izmaiņas.
 editor.file_delete_success=Datne "%s" tika izdzēsta.
 editor.name_your_file=Jāpiešķir datnei nosaukums…
-editor.filename_help=Mapi var pievienot, ja ieraksta tās nosaukumu, aiz kura ir slīpsvītra ('/'). Mapi var noņemt ar atpakaļatkāpes taustiņa nospiešanu ievades lauka sākumā.
+editor.filename_help=Mapi var pievienot, ja ieraksta tās nosaukumu, aiz kura ir slīpsvītra ("/"). Mapi var noņemt ar atpakaļatkāpes taustiņa nospiešanu ievades lauka sākumā.
 editor.or=vai
 editor.cancel_lower=Atcelt
 editor.commit_signed_changes=Iesūtīt parakstītas izmaiņas
@@ -1360,7 +1362,7 @@ editor.patch=Pielietot ielāpu
 editor.patching=Pielieto ielāpu:
 editor.fail_to_apply_patch=`Neizdevās pielietot ielāpu "%s"`
 editor.new_patch=Jauns ielāps
-editor.commit_message_desc=Pievienot neobligātu paplašinātu aprakstu…
+editor.commit_message_desc=Pēc izvēles var pievienot paplašinātu aprakstu…
 editor.signoff_desc=Iesūtījuma žurnāla ziņojumam pievienot noslēgumu Signed-off-by ar iesūtītāju.
 editor.commit_directly_to_this_branch=Iesūtīt uzreiz zarā <strong class="%[2]s">%[1]s</strong>.
 editor.create_new_branch=Izveidot šim iesūtījumam <strong>jaunu zaru</strong> un uzsākt izmaiņu pieprasījumu.
@@ -1437,7 +1439,7 @@ ext_issues.desc=Saite uz ārējo problēmu sekotāju.
 
 projects=Projekti
 projects.desc=Pārvaldīt pieteikumus un izmaiņu pieprasījumus projektos.
-projects.description=Apraksts (neobligāts)
+projects.description=Apraksts (pēc izvēles)
 projects.description_placeholder=Apraksts
 projects.create=Izveidot projektu
 projects.title=Nosaukums
@@ -1597,8 +1599,8 @@ issues.opened_by_fake=%[2]s atvēra %[1]s
 issues.closed_by_fake=%[2]s aizvēra %[1]s
 issues.previous=Iepriekšējā
 issues.next=Nākamā
-issues.open_title=Atvērta
-issues.closed_title=Slēgta
+issues.open_title=Atvērti
+issues.closed_title=Aizvērti
 issues.draft_title=Melnraksts
 issues.num_comments_1=%d piebilde
 issues.num_comments=%d piebildes
@@ -1652,7 +1654,7 @@ issues.save=Saglabāt
 issues.label_title=Nosaukums
 issues.label_description=Apraksts
 issues.label_color=Krāsa
-issues.label_exclusive=Ekskluzīvs
+issues.label_exclusive=Sevišķa
 issues.label_archive=Arhivēt iezīmi
 issues.label_archived_filter=Rādīt arhivētās iezīmes
 issues.label_archive_tooltip=Arhivētās iezīmes pēc noklusējuma netiek iekļautas ieteikumos, kad meklē pēc iezīmes.
@@ -1728,7 +1730,7 @@ issues.error_modifying_due_date=Neizdevās izmainīt izpildes termiņu.
 issues.error_removing_due_date=Neizdevās noņemt izpildes termiņu.
 issues.push_commit_1=pievienoja %d iesūtījumu %s
 issues.push_commits_n=pievienoja %d iesūtījumus %s
-issues.force_push_codes=`veica uzspiestu aizgādāšanu zarā %[1]s no <a class="%[7]s" href="%[3]s"><code>%[2]s</code></a> to <a class="%[7]s" href="%[5]s"><code>%[4]s</code></a> %[6]s`
+issues.force_push_codes=`veica uzspiestu aizgādāšanu zarā %[1]s no <a class="%[7]s" href="%[3]s"><code>%[2]s</code></a> uz <a class="%[7]s" href="%[5]s"><code>%[4]s</code></a> %[6]s`
 issues.force_push_compare=Salīdzināt
 issues.due_date_form=dd.mm.gggg.
 issues.due_date_form_add=Pievienot izpildes termiņu
@@ -1868,7 +1870,7 @@ pulls.is_checking=Notiek apvienošanas nesaderību pārbaude. Pēc brīža jām
 pulls.is_ancestor=Zars jau ir pilnībā iekļauts mērķa zarā. Nav izmaiņu, ko apvienot.
 pulls.is_empty=Šī zara izmaiņas jau ir mērķa zarā. Šis būs tukšs iesūtījums.
 pulls.required_status_check_failed=Dažas no nepieciešamajām pārbaudēm bija nesekmīgas.
-pulls.required_status_check_missing=Trūkst dažu obligāto pārbaužu.
+pulls.required_status_check_missing=Trūkst dažu nepieciešamo pārbaužu.
 pulls.required_status_check_administrator=Kā pārvaldītājs joprojām vari iekļaut šo izmaiņu pieprasījumu.
 pulls.blocked_by_approvals=Šim izmaiņu pieprasījumam vēl nav pietiekami daudz apstiprinājumu. Nodrošināti %d no %d apstiprinājumiem.
 pulls.blocked_by_rejection=Šim izmaiņu pieprasījumam oficiālais izskatītājs ir pieprasījis labojumus.
@@ -1895,7 +1897,7 @@ pulls.no_merge_wip=Šo izmaiņu pieprasījumu nav iespējams iekļaut, jo tas ir
 pulls.no_merge_not_ready=Šis izmaiņu pieprasījums nav gatavs apvienošanai, jāpārbauda izskatīšanas stāvoklis un stāvokļa pārbaudes.
 pulls.no_merge_access=Nav pilnvaru, lai iekļautu šo izmaiņu pieprasījumu.
 pulls.merge_pull_request=Izveidot apvienošanas iesūtījumu
-pulls.rebase_merge_pull_request=Pārbāzēt un pārtīt uz priekšu
+pulls.rebase_merge_pull_request=Pārbāzēt, tad pārlēkt
 pulls.rebase_merge_commit_pull_request=Pārbāzēt, tad izveidot apvienošanas iesūtījumu
 pulls.squash_merge_pull_request=Izveidot saspiešanas iesūtījumu
 pulls.merge_manually=Pašrocīgi apvienots
@@ -1920,7 +1922,7 @@ pulls.status_checks_success=Visas pārbaudes bija sekmīgas
 pulls.status_checks_warning=Dažas pārbaudes ziņoja brīdinājumus
 pulls.status_checks_failure=Dažas pārbaudes neizdevās izpildīt
 pulls.status_checks_error=Dažu pārbaužu izpildes laikā, radās kļūdas
-pulls.status_checks_requested=Obligāts
+pulls.status_checks_requested=Nepieciešama
 pulls.status_checks_details=Papildu informācija
 pulls.status_checks_hide_all=Paslēpt visas pārbaudes
 pulls.status_checks_show_all=Parādīt visas pārbaudes
@@ -1963,7 +1965,7 @@ milestones.new=Jauns atskaites punkts
 milestones.closed=Aizvērts %s
 milestones.update_ago=Atjaunināts %s
 milestones.no_due_date=Bez termiņa
-milestones.open=Atvērta
+milestones.open=Atvērts
 milestones.close=Aizvērt
 milestones.new_subheader=Atskaites punkti var palīdzēt pārvaldīt pieteikumus un sekot to attīstībai.
 milestones.completeness=Pabeigtni <strong>%d%%</strong>
@@ -2033,7 +2035,7 @@ wiki.last_updated=Pēdējo reizi labota %s
 wiki.page_name_desc=Jāievada šīs vikivietnes lapas nosaukums. Daži īpašie nosaukumi ir: "Home", "_Sidebar" un "_Footer".
 wiki.original_git_entry_tooltip=Rādīt sākotnējo Git datni, nevis izmantot draudzīgo saiti.
 
-activity=Aktivitāte
+activity=Notikumi
 activity.period.filter_label=Laika periods:
 activity.period.daily=1 diena
 activity.period.halfweekly=3 dienas
@@ -2065,10 +2067,10 @@ activity.title.issues_1=%d pieteikumu
 activity.title.issues_n=%d pieteikumus
 activity.title.issues_closed_from=%s aizvērts no %s
 activity.title.issues_created_by=%s izveidoja %s
-activity.closed_issue_label=Slēgta
+activity.closed_issue_label=Aizvēra
 activity.new_issues_count_1=Jauns pieteikums
 activity.new_issues_count_n=Jauni pieteikumi
-activity.new_issue_label=Atvērta
+activity.new_issue_label=Atvēra
 activity.title.unresolved_conv_1=%d neatrisināta saruna
 activity.title.unresolved_conv_n=%d neatrisinātu apspriešanu
 activity.unresolved_conv_desc=Šie nesen mainītie pieteikumi un izmaiņu pieprasījumi vēl nav atrisināti.
@@ -2085,9 +2087,9 @@ activity.git_stats_pushed_1=aizgādāja
 activity.git_stats_pushed_n=aizgādāja
 activity.git_stats_commit_1=%d iesūtījumu
 activity.git_stats_commit_n=%d iesūtījumus
-activity.git_stats_push_to_branch=atzarā %s un
+activity.git_stats_push_to_branch=zarā %s un
 activity.git_stats_push_to_all_branches=visos zaros.
-activity.git_stats_on_default_branch=Atzarā %s,
+activity.git_stats_on_default_branch=Zarā %s,
 activity.git_stats_file_1=%d datne
 activity.git_stats_file_n=%d datnes
 activity.git_stats_files_changed_1=tika izmainīts
@@ -2207,7 +2209,7 @@ settings.convert_notices_1=Šī darbība pārveidos spoguļglabātavu par parast
 settings.convert_confirm=Pārveidot glabātavu
 settings.convert_succeed=Spoguļglabātava tika pārveidota par parastu glabātavu.
 settings.convert_fork=Pārveidot par parastu glabātavu
-settings.convert_fork_desc=Šo atzarojumu var pārveidot par parastu glabātavu. To nevar atdarīt.
+settings.convert_fork_desc=Šo atzarojumu var pārveidot par parastu glabātavu. To nevar atsaukt.
 settings.convert_fork_notices_1=Šī darbība pārveidos atzarojumu par parastu glabātavu, un tā nav atsaucama.
 settings.convert_fork_confirm=Pārveidot glabātavu
 settings.convert_fork_succeed=Atzarojums tika pārveidots par parastu glabātavu.
@@ -2406,13 +2408,13 @@ settings.deploy_key_deletion=Noņemt izvietošanas atslēgu
 settings.deploy_key_deletion_desc=Izvietošanas atslēgas noņemšana atsauks tās piekļuvi šai glabātavai. Turpināt?
 settings.deploy_key_deletion_success=Izvietošanas atslēga tika noņemta.
 settings.branches=Zari
-settings.protected_branch=Zaru aizsardzība
+settings.protected_branch=Zaru aizsargāšana
 settings.protected_branch.save_rule=Saglabāt kārtulu
 settings.protected_branch.delete_rule=Izdzēst kārtulu
 settings.protected_branch_can_push=Atļaut izmaiņu nosūtīšanu?
 settings.protected_branch_can_push_yes=Jūs varat nosūtīt izmaiņas
 settings.protected_branch_can_push_no=Jūs nevarat nosūtīt izmaiņas
-settings.branch_protection=Zara "<b>%s</b>" aizsardzības kārtulas
+settings.branch_protection=Zara "<b>%s</b>" aizsargāšanas kārtulas
 settings.protect_this_branch=Iespējot atzara aizsardzību
 settings.protect_this_branch_desc=Neļauj atzara dzēšanu, kā arī ierobežo izmaiņu iesūtīšanu un sapludināšanu šajā atzarā.
 settings.protect_disable_push=Atspējot aizgādāšanu
@@ -2433,7 +2435,7 @@ settings.protect_merge_whitelist_committers_desc=Atļaut tikai noteiktiem lietot
 settings.protect_merge_whitelist_users=Lietotāji, kuri var veikt apvienošanu
 settings.protect_merge_whitelist_teams=Komandas, kuras var veikt apvienošanu
 settings.protect_check_status_contexts=Iespējot stāvokļa pārbaudi
-settings.protect_status_check_patterns=Stāvokļa pārbaudes paraugi
+settings.protect_status_check_patterns=Stāvokļa pārbaužu paraugi
 settings.protect_status_check_patterns_desc=Jāievada paraugi, lai norādītu, kurām stāvokļa pārbaudēm sekmīgi jāizpildās, pirms zari var tikt iekļauti zarā, kas atbilst šai kārtulai. Katrā rindā ir norādāms viens paraugs. Paraugi nevar būt tukši.
 settings.protect_check_status_contexts_desc=Pirms apvienošanas ir nepieciešama sekmīga stāvokļa pārbaužu izpilde. Kad iespējots, iesūtījumiem vispirms jābūt aizgādātiem citā zarā, tad pēc stāvokļa pārbaužu sekmīgas izpildes iekļautiem vai aizgādātiem tieši zarā, kas atbilst šai kārtulai. Ja nav atbilstošu kontekstu, pēdējam iesūtījumam jābūt sekmīgam neatkarīgi no konteksta.
 settings.protect_check_status_contexts_list=Stāvokļa pārbaudes, kas šajā glabātavā atrastas pēdējās nedēļas laikā
@@ -2459,11 +2461,11 @@ settings.protect_unprotected_file_patterns=Neaizsargāto datņu paraugs (vairāk
 settings.protect_unprotected_file_patterns_desc=Neaizsargātās datnes, kuras ir ļauts izmainīt tiešā veidā, apejot aizgādāšanas ierobežojumu, ja lietotājam ir rakstīšanas piekļuve. Vairāki paraugi ir atdalāmi ar semikolu (";"). Paraugu pierakstu skatīt <a href='%[1]s'>%[2]s</a> dokumentācijā. Piemēri: <code>.drone.yml</code>, <code>/docs/**/*.txt</code>.
 settings.add_protected_branch=Iespējot aizsargāšanu
 settings.delete_protected_branch=Atspējot aizsargāšanu
-settings.update_protect_branch_success=Zara aizsardzības kārtula "%s" tika atjaunināta.
-settings.remove_protected_branch_success=Zara aizsardzības kārtula "%s" tika noņemta.
-settings.remove_protected_branch_failed=Zara aizsardzības kārtulas "%s" noņemšana neizdevās.
-settings.protected_branch_deletion=Izdzēst zara aizsardzību
-settings.protected_branch_deletion_desc=Zara aizsardzības atspējošana ļauj lietotājiem ar rakstīšanas atļauju aizgādāt izmaiņas uz zaru. Turpināt?
+settings.update_protect_branch_success=Zara aizsargāšanas kārtula "%s" tika atjaunināta.
+settings.remove_protected_branch_success=Zara aizsargāšanas kārtula "%s" tika noņemta.
+settings.remove_protected_branch_failed=Zara aizsargāšanas kārtulas "%s" noņemšana neizdevās.
+settings.protected_branch_deletion=Izdzēst zara aizsargāšanu
+settings.protected_branch_deletion_desc=Zara aizsargāšanas atspējošana ļauj lietotājiem ar rakstīšanas atļauju aizgādāt zarā izmaiņas. Turpināt?
 settings.block_rejected_reviews=Liegt apvienošanu, ja izskatīšana ir beigusies ar noraidīšanu
 settings.block_rejected_reviews_desc=Apvienošana nebūs iespējama, kad oficiālie izskatītāji ir pieprasījuši izmaiņas, pat ja ir pietiekami daudz apstiprinājumu.
 settings.block_on_official_review_requests=Liegt apvienošanu, ja ir oficiāli izskatīšanas pieprasījumi
@@ -2479,7 +2481,7 @@ settings.edit_protected_branch=Labot
 settings.protected_branch_required_rule_name=Jānorāda kārtulas nosaukums
 settings.protected_branch_duplicate_rule_name=Šai zaru kopai jau pastāv kārtula
 settings.protected_branch_required_approvals_min=Pieprasīto izskatīšanu skaits nevar būt mazāks par nulli.
-settings.tags=Tagi
+settings.tags=Birkas
 settings.tags.protection=Birku aizsargāšana
 settings.tags.protection.pattern=Birku paraugs
 settings.tags.protection.allowed=Atļauts
@@ -2601,7 +2603,7 @@ diff.hide_file_tree=Paslēpt datņu koku
 releases.desc=Projekta versiju un lejupielāžu pārraudzīšana.
 release.releases=Laidieni
 release.detail=Informācija par laidienu
-release.tags=Tagi
+release.tags=Birkas
 release.new_release=Jauns laidiens
 release.draft=Melnraksts
 release.prerelease=Pirmsizlaide
@@ -2843,7 +2845,7 @@ pulls.fast_forward_only_merge_pull_request = Tikai pārlēkšana
 settings.federation_apapiurl = Šīs glabātavas federācijas URL. Tas ir jāievieto starpliktuvē un jāielīmē citas glabātavas federācijas iestatījumos kā sekojošas glabātavas URL.
 settings.federation_following_repos = Sekojošu glabātavu URL. Atdalīti ar ";", bez atstarpes.
 settings.add_webhook.invalid_path = Ceļš nedrīkst saturēt daļu, kas ir "." vai "..", vai tukša virkne. Tas nevar sākties vai beigties ar slīpsvītru.
-settings.protect_new_rule = Izveidot jaunu zaru aizsardzības kārtulu
+settings.protect_new_rule = Izveidot jaunu zaru aizsargāšanas kārtulu
 settings.sourcehut_builds.secrets_helper = Dot darbam piekļuvi būvēšanas noslēpumiem (nepieciešams nodrošināt SECRETS:RO)
 release.asset_external_url = Ārējais URL
 release.add_external_asset = Pievienot ārēju līdzekli
@@ -3039,7 +3041,7 @@ dashboard.task.unknown=Nezināms uzdevums: %[1]s
 dashboard.cron.started=Uzsākts Cron: %[1]s
 dashboard.cron.process=Cron: %[1]s
 dashboard.cron.cancelled=Cron: %[1]s atcelts: %[3]s
-dashboard.cron.error=Kļūda Cron: %s: %[3]s
+dashboard.cron.error=Cron kļūda: %s: %[3]s
 dashboard.cron.finished=Cron: %[1]s pabeigts
 dashboard.delete_inactive_accounts=Izdzēst visus neaktivētos kontus
 dashboard.delete_inactive_accounts.started=Ir uzsākts visu neaktivēto kontu izdzēšanas uzdevums.
@@ -3113,7 +3115,7 @@ users.activated=Aktivēts
 users.admin=Pārvaldītājs
 users.restricted=Ierobežots
 users.reserved=Aizņemts
-users.bot=Bots
+users.bot=Robotprogrammatūra
 users.remote=Attāls
 users.2fa=2FA
 users.repos=Glabātavas
@@ -3164,7 +3166,7 @@ users.list_status_filter.not_2fa_enabled=2FA atspējota
 users.details=Lietotāja informācija
 
 emails.email_manage_panel=Pārvaldīt lietotāju e-pasta adreses
-emails.primary=Primārais
+emails.primary=Galvenā
 emails.activated=Aktivēta
 emails.filter_sort.email=E-pasts
 emails.filter_sort.email_reverse=E-pasta adrese (pretēji alfabētiski)
@@ -3237,7 +3239,7 @@ auths.bind_password=Saistīšanas parole
 auths.user_base=Lietotāju meklēšanas pamatnosacījumi
 auths.user_dn=Lietotāja DN
 auths.attribute_username=Lietotājvārda atribūts
-auths.attribute_username_placeholder=Atstāt tukšu, lai izmantotu Gitea ievadīto lietotājvārdu.
+auths.attribute_username_placeholder=Atstāt tukšu, lai izmantotu Forgejo ievadīto lietotājvārdu.
 auths.attribute_name=Vārda atribūts
 auths.attribute_surname=Uzvārda atribūts
 auths.attribute_mail=E-pasta atribūts
@@ -3290,7 +3292,7 @@ auths.oauth2_required_claim_name=Nepieciešamās prasības nosaukums
 auths.oauth2_required_claim_name_helper=Šis nosaukums ir iestatāms, lai ierobežotu pieteikšanos no šī avota lietotājiem, kuriem ir prasība ar šādu nosaukumu
 auths.oauth2_required_claim_value=Nepieciešamās prasības vērtība
 auths.oauth2_required_claim_value_helper=Šī vērtība ir iestatāma, lai ierobežotu pieteikšanos no šī avota lietotājiem, kuriem ir prasība ar šādu nosaukumu un vērtību
-auths.oauth2_group_claim_name=Prasības nosaukums, kas nodrošina grupu nosaukumus šim avotam. (Neobligāts)
+auths.oauth2_group_claim_name=Prasības nosaukums, kas šim avotam nodrošina grupu nosaukumus. (Pēc izvēles)
 auths.oauth2_admin_group=Kopas prasības vērtība pārvaldītājiem. (Izvēles - nepieciešams augstāk esošais prasības nosaukums)
 auths.oauth2_restricted_group=Grupas prasības vērtība ierobežotajiem lietotājiem. (Izvēles - nepieciešams augstāk esošais prasības nosaukums)
 auths.oauth2_map_group_to_team=Sasaistīt pieprasītās kopas ar apvienības komandām. (Izvēles - nepieciešams augstāk esošais prasības nosaukums)
@@ -3308,7 +3310,7 @@ auths.sspi_default_language=Lietotāju noklusējuma valoda
 auths.sspi_default_language_helper=Noklusējuma valoda lietotājiem, kurus automātiski izveido SSPI autentificēšanās veids. Atstāt tukšu, ja ir vēlams, lai valoda tiktu noteikta automātiski.
 auths.tips=Padomi
 auths.tips.oauth2.general=OAuth2 autentificēšanās
-auths.tips.oauth2.general.tip=Kad tiek reģistrēta jauna OAuth2 autentifikācija, atzvanīšanas/pārvirzīšanas URL vajadzētu būt:
+auths.tips.oauth2.general.tip=Kad tiek reģistrēta jauna OAuth2 autentificēšana, atzvanīšanas/pārvirzīšanas URL vajadzētu būt:
 auths.tip.oauth2_provider=OAuth2 nodrošinātājs
 auths.tip.bitbucket=Jāizveido jauns OAuth patērētājs %s un jāpievieno atļauja "Account" - "Read"
 auths.tip.nextcloud=Reģistrēt jaunu OAuth patērētāju savā serverī var izvēlnē "Iestatījumi -> Drošība -> OAuth 2.0 klients"
@@ -3320,7 +3322,7 @@ auths.tip.google_plus=OAuth2 klienta piekļuves dati ir iegūstami Google API ko
 auths.tip.openid_connect=Jāizmanto OpenID savienošanās atklāšanas URL (<server>/.well-known/openid-configuration), lai norādītu galapunktus
 auths.tip.twitter=Jādodas uz %s, jāizveido lietotne un jānodrošina, ka iespēja "Allow this application to be used to Sign in with Twitter" ir iespējota
 auths.tip.discord=Jāizveido jauna lietotne %s
-auths.tip.gitea=Pievienot jaunu OAuth2 lietojumprogrammu. Dokumentācija ir pieejama %s
+auths.tip.gitea=Pievienot jaunu OAuth2 lietotni. Norādes ir atrodamas %s
 auths.tip.yandex=%s jāizveido jauna lietotne. Sadaļā "Yandex.Passport API" jāatlasa šīs atļaujas: "Access to email address", "Access to user avatar" un "Access to username, first name and surname, gender"
 auths.tip.mastodon=Jāievada pielāgota Mastodon servera URL, ar kuru vēlies autentificēties (vai jāizmanto noklusējuma)
 auths.edit=Labot autentificēšanas avotu
@@ -3347,7 +3349,7 @@ config.custom_file_root_path=Pielāgoto datņu pamata ceļš
 config.domain=Servera domēna vārds
 config.offline_mode=Bezsaistes režīms
 config.disable_router_log=Atspējot maršrutētāja žurnālu
-config.run_user=Lietotājs, ar kuru palaists
+config.run_user=Lietotājs, ar kuru palaist
 config.run_mode=Palaišanas veids
 config.git_version=Git versija
 config.app_data_path=Lietotnes datu ceļš
@@ -3605,7 +3607,7 @@ future=nākotnē
 1y=1 gada
 seconds=%d sekundēm
 minutes=%d minūtēm
-hours=%d stundām
+hours=%d stundās
 days=%d dienas
 weeks=%d nedēļām
 months=%d mēnešiem
@@ -3655,7 +3657,7 @@ desc=Pārvaldīt glabātavas pakotnes.
 empty=Pašlaik šeit nav nevienas pakotnes.
 empty.documentation=Papildu informācija par pakotņu reģistru ir pieejama <a target="_blank" rel="noopener noreferrer" href="%s">dokumentācijā</a>.
 empty.repo=Šeit netiek parādīta augšupielādēta pakotne? Jādodas uz <a href="%[1]s">pakotņu iestatījumiem</a> un jāsasaista tā ar šo glabātavu.
-registry.documentation=Vairāk informācija par %s reģistru ir pieejama <a target="_blank" rel="noopener noreferrer" href="%s">dokumentācijā</a>.
+registry.documentation=Vairāk informācijas par %s reģistru ir <a target="_blank" rel="noopener noreferrer" href="%s">dokumentācijā</a>.
 filter.type=Veids
 filter.type.all=Visas
 filter.no_result=Pēc norādītajiem kritērijiem nekas netika atrasts.
@@ -3663,7 +3665,7 @@ filter.container.tagged=Ar atzīmi
 filter.container.untagged=Bez atzīmes
 published_by=Publicēja <a href="%[2]s">%[3]s</a> %[1]s
 published_by_in=<a href="%[2]s">%[3]s</a> laida klajā %[1]s <a href="%[4]s"><strong>%[5]s</strong></a>
-installation=Instalācija
+installation=Uzstādīšana
 about=Par šo pakotni
 requirements=Prasības
 dependencies=Atkarības
@@ -3696,7 +3698,7 @@ composer.install=Lai uzstādīt pakotni ar Composer, jāizpilda šī komanda:
 composer.dependencies=Atkarības
 composer.dependencies.development=Izstrādes atkarības
 conan.details.repository=Glabātava
-conan.registry=Šis reģistrs ir uzstādāms komandrindā:
+conan.registry=Šis reģistra uzstādīšana komandrindā:
 conan.install=Lai uzstādītu pakotni ar Conan, jāizpilda šī komanda:
 conda.registry=Izveidot šo reģistru kā Conda glabātavu datnē <code>.condarc</code>:
 conda.install=Lai uzstādītu pakotni ar Conda, jāizpilda šī komanda:
@@ -3711,7 +3713,7 @@ container.labels.key=Atslēga
 container.labels.value=Vērtība
 cran.registry=Iestatīt šo reģistru datnē <code>Rprofile.site</code>:
 cran.install=Lai uzstādītu pakotni, ir jāizpilda šī komanda:
-debian.registry=Šis reģistrs ir uzstādāms komandrindā:
+debian.registry=Šis reģistra uzstādīšana komandrindā:
 debian.registry.info=No zemāk esošā saraksta jāizvēlas $distribution un $component.
 debian.install=Lai uzstādītu pakotni, ir jāizpilda šī komanda:
 debian.repository=Glabātavas informācija
@@ -3719,14 +3721,14 @@ debian.repository.distributions=Distribūcijas
 debian.repository.components=Komponentes
 debian.repository.architectures=Arhitektūras
 generic.download=Lejupielādēt pakotni, izmantojot, komandrindu:
-go.install=Instalēt pakotni no komandrindas:
-helm.registry=Šis reģistrs ir uzstādāms komandrindā:
-helm.install=Lai instalētu pakotni, nepieciešams izpildīt sekojošu komandu:
+go.install=Uzstādīt pakotni komandrindā:
+helm.registry=Šī reģistra uzstādīšana komandrindā:
+helm.install=Lai uzstādītu pakotni, ir jāizpilda šī komanda:
 maven.registry=Iestatīt šo reģistru sava projekta datnē <code>pom.xml</code>:
 maven.install=Lai izmantotu pakotni, datnes <code>pom.xml</code> sadaļā <code>dependencies</code> jāievieto šīs rindas:
 maven.install2=Jāizpilda komandrindā:
 maven.download=Jāizpilda komandrindā, lai lejupielādētu šo atkarību:
-nuget.registry=Šis reģistrs ir uzstādāms komandrindā:
+nuget.registry=Šī reģistra uzstādīšana komandrindā:
 nuget.install=Lai uzstādītu pakotni ar NuGet, jāizpilda šī komanda:
 nuget.dependency.framework=Mērķa ietvars
 npm.registry=Iestatīt šo reģistru sava projekta datnē <code>.npmrc</code>:
@@ -3740,7 +3742,7 @@ npm.details.tag=Tags
 pub.install=Lai uzstādītu pakotni ar Dart, jāizpilda šī komanda:
 pypi.requires=Nepieciešams Python
 pypi.install=Lai uzstādītu pakotni ar pip, jāizpilda šī komanda:
-rpm.registry=Šis reģistrs ir uzstādāms komandrindā:
+rpm.registry=Šī reģistra uzstādīšana komandrindā:
 rpm.distros.redhat=uz RedHat balstītās operētājsistēmās
 rpm.distros.suse=uz SUSE balstītās operētājsistēmās
 rpm.install=Lai uzstādītu pakotni, ir jāizpilda šī komanda:
@@ -3752,7 +3754,7 @@ rubygems.dependencies.runtime=Izpildlaika atkarības
 rubygems.dependencies.development=Izstrādes atkarības
 rubygems.required.ruby=Nepieciešamā Ruby versija
 rubygems.required.rubygems=Nepieciešamā RubyGem versija
-swift.registry=Šis reģistrs ir uzstādāms komandrindā:
+swift.registry=Šī reģistra uzstādīšana komandrindā:
 swift.install=Pakotne jāpievieno datnē <code>Package.swift</code>:
 swift.install2=vai jāpievieno tā Gemfile:
 vagrant.install=Lai pievienotu Vagrant kasti, jāizpilda šī komanda:
@@ -3762,7 +3764,7 @@ settings.link.select=Atlasīt glabātavu
 settings.link.button=Atjaunināt glabātavas saiti
 settings.link.success=Glabātavas saite tika sekmīgi atjaunināta.
 settings.link.error=Neizdevās atjaunināt glabātavas saiti.
-settings.delete=Dzēst pakotni
+settings.delete=Izdzēst pakotni
 settings.delete.description=Pakotne tiks neatgriezeniski izdzēsta.
 settings.delete.notice=Tiks izdzēsta pakotne %s (%s). Šī darbība ir neatgriezeniska. Tiešām turpināt?
 settings.delete.success=Pakotne tika izdzēsta.
@@ -3888,14 +3890,14 @@ runners.reset_registration_token=Atiestatīt reģistrācijas pilnvaru
 runners.reset_registration_token_success=Izpildītāja reģistrācijas pilnvara tika sekmīgi atiestatīta
 
 runs.all_workflows=Visas darbplūsmas
-runs.commit=Iesūtījums
+runs.commit=Iesūtījumu
 runs.scheduled=Ieplānots
 runs.pushed_by=aizgādāja
 runs.invalid_workflow_helper=Darbplūsmas konfigurācijas datne ir nederīga. Lūgums pārbaudīt konfigurācijas datni: %s
-runs.no_matching_online_runner_helper=Nav pieejami izpildītāji, kas atbilstu šai iezīmei: %s
-runs.actor=Aktors
+runs.no_matching_online_runner_helper=Nav tiešsaistē esošu izpildītāju, kas atbilstu iezīmei: %s
+runs.actor=Izraisītājs
 runs.status=Statuss
-runs.actors_no_select=Visi aktori
+runs.actors_no_select=Visi izraisītāji
 runs.status_no_select=Visi stāvokļi
 runs.no_results=Netika atrasts nekas atbilstošs.
 runs.no_workflows=Vēl nav nevienas darbplūsmas.
@@ -3915,7 +3917,7 @@ variables.management=Pārvaldīt mainīgos
 variables.creation=Pievienot mainīgo
 variables.none=Vēl nav neviena mainīgā.
 variables.deletion=Noņemt mainīgo
-variables.deletion.description=Mainīgā noņemšana ir neatgriezeniska un nav atsaucama. Vai turpināt?
+variables.deletion.description=Mainīgā noņemšana ir neatgriezeniska un nav atsaucama. Turpināt?
 variables.description=Mainīgie tiks padoti noteiktām darbībām, un citādāk tos nevar nolasīt.
 variables.id_not_exist=Mainīgais ar identifikatoru %d nepastāv.
 variables.edit=Labot mainīgo
@@ -3929,7 +3931,7 @@ variables.update.success=Mainīgais tika labots.
 runs.workflow = Darbplūsma
 runs.no_job_without_needs = Darbplūsmā ir jābūt vismaz vienam darbam bez atkarībām.
 runs.no_job = Darbplūsmā ir jābūt vismaz vienam darbam
-runs.no_workflows.help_write_access = Nav skaidrs, kā sākt izmantot Forgejo Actions? Jāieskatās <a target="_blank" rel="noopener noreferrer" href="%s">ātro ievadu lietotāja dokumentācijā</a>, lai uzrakstītu savu pirmo darbplūsmu, tad <a target="_blank" rel="noopener noreferrer" href="%s">jāiestata Forgejo izpildītājs</a>, lai izpildītu savus darbus.
+runs.no_workflows.help_write_access = Nav skaidrs, kā sākt izmantot Forgejo Actions? Jāieskatās <a target="_blank" rel="noopener noreferrer" href="%s">ātrajā ievadā lietotāja dokumentācijā</a>, lai uzrakstītu savu pirmo darbplūsmu, tad <a target="_blank" rel="noopener noreferrer" href="%s">jāiestata Forgejo izpildītājs</a>, lai izpildītu savus darbus.
 runs.no_workflows.help_no_write_access = Lai uzzinātu par Forgejo Acties, jāieskatās <a target="_blank" rel="noopener noreferrer" href="%s">dokumentācijā</a>.
 runs.expire_log_message = Žurnāli tika iztīrīti, jo tie bija pārāk veci.
 workflow.dispatch.trigger_found = Šai darbplūsmai ir <c>workflow_dispatch</c> notikuma izraisītājs.
diff --git a/options/locale/locale_nb_NO.ini b/options/locale/locale_nb_NO.ini
index 918feb5c55..e43036e08c 100644
--- a/options/locale/locale_nb_NO.ini
+++ b/options/locale/locale_nb_NO.ini
@@ -1,5 +1,5 @@
 [common]
-enable_javascript = Denne nettsiden behøver JavaScript.
+enable_javascript = Denne nettsiden krever JavaScript.
 toc = Innholdsfortegnelse
 licenses = Lisenser
 return_to_forgejo = Tilbake til Forgejo
@@ -128,6 +128,14 @@ webauthn_error_unable_to_process = Tjeneren kunne ikke behandle forespørselen d
 webauthn_error_empty = Du må gi nøkkelen et navn.
 copy_path = Kopier sti
 
+toggle_menu = Åpne/lukke meny
+twofa_scratch = To-faktor skrapekode
+webauthn_press_button = Vennligst trykk på knappen på sikkerhetsnøkkelen…
+webauthn_error_duplicated = Sikkerhetsnøkkelen er ikke tillatt for denne forespørselen. Vennligst sørg for at nøkkelen ikke allerede er registrert.
+webauthn_error_timeout = Et tidsavbrudd oppsto før nøkkelen din kunne leses. Vennligst last inn siden på nytt og prøv igjen.
+new_fork = Ny fork av repository
+collaborative = Samarbeidende
+
 [search]
 search = Søk...
 type_tooltip = Søketype
diff --git a/options/locale/locale_nl-NL.ini b/options/locale/locale_nl-NL.ini
index c884160c56..b8f36ca5b4 100644
--- a/options/locale/locale_nl-NL.ini
+++ b/options/locale/locale_nl-NL.ini
@@ -683,6 +683,8 @@ AccessToken = Toegangstoken
 Pronouns = Voornaamwoorden
 
 
+email_domain_is_not_allowed = Het domein van het e-mailadres van de gebruiker <b>%s</b> is in strijd met EMAIL_DOMAIN_ALLOWLIST of EMAIL_DOMAIN_BLOCKLIST. Controleer of u het e-mailadres correct hebt ingesteld.
+
 [user]
 change_avatar=Wijzig je profielfoto…
 repositories=repositories
@@ -2868,6 +2870,8 @@ issues.reaction.alt_add = Voeg %[1]s reactie toe aan commentaar.
 issues.context.menu = Commentaar menu
 release.summary_card_alt = Samenvattende kaart van een release met de titel "%s" in repository %s
 
+editor.commit_email = Commit e-mail
+
 [graphs]
 component_loading_info = Dit kan even duren…
 component_failed_to_load = Er is een onverwachte fout opgetreden.
@@ -3085,7 +3089,7 @@ dashboard.gc_times=GC verwerkingen
 dashboard.delete_old_system_notices=Verwijder alle oude systeemmededelingen uit de database
 
 users.user_manage_panel=Gebruikersaccounts beheren
-users.new_account=Nieuw account aanmaken
+users.new_account=Gebruikersaccount aanmaken
 users.name=Gebruikersnaam
 users.full_name=Volledige naam
 users.activated=Geactiveerd
diff --git a/options/locale/locale_pt-BR.ini b/options/locale/locale_pt-BR.ini
index d826e60417..31594ee437 100644
--- a/options/locale/locale_pt-BR.ini
+++ b/options/locale/locale_pt-BR.ini
@@ -682,6 +682,8 @@ Description = Descrição
 unset_password = O usuário de login não definiu a senha.
 
 
+email_domain_is_not_allowed = O domínio do endereço de email da conta <b>%s</b> está em conflito com EMAIL_DOMAIN_ALLOWLIST ou EMAIL_DOMAIN_BLOCKLIST. Certifique-se de que você colocou o endereço de email correto.
+
 [user]
 change_avatar=Altere seu avatar...
 joined_on=Inscreveu-se em %s
@@ -2620,7 +2622,7 @@ tag.create_tag_from=`Criar nova tag a partir de "%s"`
 
 tag.create_success=Tag "%s" criada.
 
-topic.manage_topics=Gerenciar Tópicos
+topic.manage_topics=Gerenciar tópicos
 topic.done=Feito
 topic.count_prompt=Você não pode selecionar mais de 25 tópicos
 
diff --git a/options/locale/locale_pt-PT.ini b/options/locale/locale_pt-PT.ini
index 309fdbe54d..95f4c83889 100644
--- a/options/locale/locale_pt-PT.ini
+++ b/options/locale/locale_pt-PT.ini
@@ -682,6 +682,8 @@ FullName = Nome completo
 Description = Descrição
 Pronouns = Pronomes
 
+email_domain_is_not_allowed = O domínio do endereço de email <b>%s</b> do utilizador entra em conflito com EMAIL_DOMAIN_ALLOWLIST ou EMAIL_DOMAIN_BLOCKLIST. Certifique-se de que definiu corretamente o endereço de email.
+
 [user]
 change_avatar=Mude o seu avatar…
 joined_on=Inscreveu-se em %s
diff --git a/options/locale/locale_ru-RU.ini b/options/locale/locale_ru-RU.ini
index ec844faea7..2b723d1e43 100644
--- a/options/locale/locale_ru-RU.ini
+++ b/options/locale/locale_ru-RU.ini
@@ -341,7 +341,7 @@ password_algorithm_helper=Задайте алгоритм хеширования
 enable_update_checker=Проверка обновлений
 env_config_keys=Настройка окружения
 env_config_keys_prompt=Следующие переменные окружения также будут применены к вашему конфигурационному файлу:
-enable_update_checker_helper_forgejo = Периодически проверять наличие новых версий Forgejo через DNS-запись TXT на release.forgejo.org.
+enable_update_checker_helper_forgejo = Периодически проверять наличие новых версий Forgejo через «TXT» DNS-запись домена release.forgejo.org.
 allow_dots_in_usernames = Разрешить точки в именах пользователей. Это не повлияет на уже созданные учётные записи.
 smtp_from_invalid = Адрес для отправки писем некорректен
 config_location_hint = Эти настройки конфигурации будут сохранены в:
@@ -682,6 +682,8 @@ Location = Местоположение
 To = Название ветви
 
 
+email_domain_is_not_allowed = Домен адреса эл. почты <b>%s</b> не разрешён к использованию. Убедитесь, что он введён правильно или попробуйте другой адрес.
+
 [user]
 change_avatar=Изменить изображение профиля…
 joined_on=Регистрация %s
@@ -761,7 +763,7 @@ update_language_success=Язык обновлён.
 update_profile_success=Ваш профиль успешно обновлён.
 change_username=Ваше имя пользователя было изменено.
 change_username_prompt=Обратите внимание: изменение имени пользователя также меняет URL вашей учётной записи.
-change_username_redirect_prompt=Старое имя пользователя будет перенаправлять на новое до тех пор, пока его не займут.
+change_username_redirect_prompt=Старое имя будет перенаправлять на новое до тех пор, пока оно не будет занято.
 continue=Далее
 cancel=Отмена
 language=Язык
@@ -2650,7 +2652,7 @@ tag.create_tag_from=Создать новый тег из «%s»
 
 tag.create_success=Тег «%s» создан.
 
-topic.manage_topics=Редактировать тематические метки
+topic.manage_topics=Изменить темы
 topic.done=Сохранить
 topic.count_prompt=Нельзя выбрать более 25 тем
 topic.format_prompt=Темы должны начинаться с буквы или цифры и могут содержать дефисы («-») и точки («.»). Длина темы не должна превышать 35 символов. Все буквы должны быть строчными.
@@ -3708,7 +3710,7 @@ composer.install=Чтобы установить пакет с помощью Co
 composer.dependencies=Зависимости
 composer.dependencies.development=Зависимости для разработки
 conan.details.repository=Репозиторий
-conan.registry=Настроить реестр из командной строки:
+conan.registry=Добавьте реестр командой:
 conan.install=Чтобы установить пакет с помощью Conan, выполните следующую команду:
 conda.registry=Пропишите этот реестр в качестве репозитория Conda в своём файле <code>.condarc</code>:
 conda.install=Чтобы установить пакет с помощью Conda, выполните следующую команду:
@@ -3723,7 +3725,7 @@ container.labels.key=Ключ
 container.labels.value=Значение
 cran.registry=Настройте этот реестр в файле <code>Rprofile.site</code>:
 cran.install=Чтобы установить пакет, выполните следующую команду:
-debian.registry=Настроить реестр из командной строки:
+debian.registry=Добавьте реестр командой:
 debian.registry.info=Выберите $distribution и $component из списка ниже.
 debian.install=Чтобы установить пакет, выполните следующую команду:
 debian.repository=О репозитории
@@ -3732,13 +3734,13 @@ debian.repository.components=Компоненты
 debian.repository.architectures=Архитектуры
 generic.download=Скачать пакет из командной строки:
 go.install=Установите пакет из командной строки:
-helm.registry=Настроить реестр из командной строки:
+helm.registry=Добавьте реестр командой:
 helm.install=Чтобы установить пакет, выполните следующую команду:
 maven.registry=Настройте реестр в файле <code>pom.xml</code> вашего проекта:
 maven.install=Чтобы использовать пакет, включите в блок <code>dependencies</code> в файле <code>pom.xml</code> следующее:
 maven.install2=Выполнить через командную строку:
 maven.download=Чтобы скачать зависимость, запустите в командной строке:
-nuget.registry=Настроить реестр из командной строки:
+nuget.registry=Добавьте реестр командой:
 nuget.install=Чтобы установить пакет с помощью NuGet, выполните следующую команду:
 nuget.dependency.framework=Целевой фреймворк
 npm.registry=Настройте реестр в файле <code>.npmrc</code> вашего проекта:
@@ -3752,7 +3754,7 @@ npm.details.tag=Тег
 pub.install=Чтобы установить пакет с помощью Dart, выполните следующую команду:
 pypi.requires=Требуется Python
 pypi.install=Чтобы установить пакет с помощью pip, выполните следующую команду:
-rpm.registry=Настроить реестр из командной строки:
+rpm.registry=Добавьте реестр командой:
 rpm.distros.redhat=на дистрибутивах семейства RedHat
 rpm.distros.suse=на дистрибутивах семейства SUSE
 rpm.install=Чтобы установить пакет, выполните следующую команду:
@@ -3764,7 +3766,7 @@ rubygems.dependencies.runtime=Зависимости времени выполн
 rubygems.dependencies.development=Зависимости для разработки
 rubygems.required.ruby=Требуется версия Ruby
 rubygems.required.rubygems=Требуется версия RubyGem
-swift.registry=Настроить реестр из командной строки:
+swift.registry=Добавьте реестр командой:
 swift.install=Добавьте пакет в свой файл <code>Package.swift</code>:
 swift.install2=и запустите следующую команду:
 vagrant.install=Чтобы добавить бокс Vagrant, выполните следующую команду:
diff --git a/options/locale/locale_sv-SE.ini b/options/locale/locale_sv-SE.ini
index 928d4a3f1e..4d94211540 100644
--- a/options/locale/locale_sv-SE.ini
+++ b/options/locale/locale_sv-SE.ini
@@ -154,11 +154,27 @@ filter.not_mirror = Inte speglar
 filter.is_template = Mallar
 filter.private = Privata
 
+active_stopwatch = Spårning av aktiv tid
+tracked_time_summary = Sammanfattning av spårad tid baserat på filter av ärendelistan
+toggle_menu = Visningsmeny
+webauthn_use_twofa = Använd en tvåfaktorskod från din telefon
+webauthn_error_insecure = WebAuthn stöder endast säkra anslutningar. För testning över HTTP kan du använda "localhost" eller "127.0.0.1"
+webauthn_error_unable_to_process = Servern kunde inte hantera din begäran.
+webauthn_error_duplicated = Säkerhetsnyckeln är inte tillåten för denna begäran. Se till att nyckeln inte redan är registrerad.
+webauthn_error_timeout = Timeout uppnåddes innan din nyckel kan läsas. Vänligen ladda om denna sida och försök igen.
+remove_label_str = Ta bort objektet "%"
+copy_generic = Kopiera till urklipp
+confirm_delete_selected = Bekräfta för att ta bort alla valda objekt?
+filter.is_fork = Förgreningar
+filter.not_fork = Inte gafflar
+
 [aria]
 footer.software = Om den här mjukvaran
 footer.links = Länkar
 footer = Sidfot
 
+navbar = Navigeringsfält
+
 [heatmap]
 contributions_one = bidrag
 contributions_zero = Inga bidrag
@@ -367,10 +383,10 @@ remember_me=Kom ihåg denna enhet
 forgot_password_title=Glömt lösenord
 forgot_password=Glömt lösenord?
 sign_up_now=Behöver du ett konto? Registrera nu.
-confirmation_mail_sent_prompt=Ett nytt bekräftelsemejl has skickats till <b>%s</b>. För att slutföra registreringsprocessen, vänligen kolla din inkorg inom dom kommande %s. Om mejlet är fel så kan du logga in och få ett bekräftelsemejlet skickat till en annan e-postadress.
+confirmation_mail_sent_prompt=Ett nytt bekräftelsemejl has skickats till <b>%s</b>. För att slutföra registreringsprocessen, vänligen kolla din inkorg inom dom kommande %s. Om e-postadressen är felaktig så kan du logga in och begära att få ett nytt bekräftelsemejlet skickat till en annan e-postadressen.
 must_change_password=Ändra ditt lösenord
 allow_password_change=Kräv att användaren byter lösenord (rekommenderas)
-reset_password_mail_sent_prompt=Ett nytt bekräftelsemail has skickats till <b>%s</b>. Vänligen kontrollera din inkorg inom de kommande %s för att slutföra återställning av ditt konto.
+reset_password_mail_sent_prompt=Ett nytt bekräftelsemail has skickats till <b>%s</b>. För att slutföra återställning av ditt konto, kontrollera din inkorg och gå till den bifogade länken inom de kommande %s.
 active_your_account=Aktivera ditt konto
 account_activated=Kontot har aktiverats
 prohibit_login=Kontot är avstängd
@@ -427,6 +443,9 @@ hint_register = Behöver du ett konto? <a href="%s">Registrera ett nu.</a>
 prohibit_login_desc = Ditt konto har blivit avstängt från att interagera med instansen. Kontakta instansadministratören för att återfå tillgång.
 password_pwned = Lösenordet du valde finns på en <a target="_blank" rel="noopener noreferrer" href="%s">lista över stulna lösenord</a> som tidigare exponerats i offentliga dataintrång. Försök igen med ett annat lösenord och överväg att ändra detta lösenord på annat håll också.
 
+sign_up_button = Registrera dig.
+sign_up_successful = Kontot skapades. Välkommen!
+
 [mail]
 activate_account=Vänligen aktivera ditt konto
 
@@ -2118,6 +2137,15 @@ notices.op=Op.
 notices.delete_success=Systemnotifikationer har blivit raderade.
 
 
+users.reserved = Reserverad
+users.bot = Bott
+users.remote = Fjärråtkomst
+users.2fa = 2FA
+users.is_restricted = Begränsat konto
+users.restricted.description = Tillåt endast interaktion med utvecklingskataloger och organisationer där den här användaren finns tillagd som medarbetare. Det förhindrar tillgång till allmänna utvecklingskataloger i den här instansen.
+self_check.database_inconsistent_collation_columns = Databasen använder kollateringen %s, men dessa kolumner använder felanpassade kollateringar. Det kan komma att orsaka oväntade problem.
+self_check.database_fix_mysql = För MySQL/MariaDB-användare så kan du använda kommandot ”forgejo doctor convert” för att åtgärda problemet med kollateringen, eller så du åtgärda det genom att manuellt använda SQL "ALTER ... COLLATE ...".
+
 [action]
 create_repo=skapade utvecklingskatalog <a href="%s"> %s</a>
 rename_repo=döpte om utvecklingskalatogen från <code>%[1]s</code> till <a href="%[2]s">%[3]s</a>
@@ -2129,6 +2157,11 @@ compare_commits=Jämför %d commits
 compare_commits_general=Jämför commits
 mirror_sync_delete=synkade och raderade referens <code>%[2]s</code> på <a href="%[1]s">%[3]s</a> från spegel
 
+approve_pull_request = `godkände <a href="%[1]s">%[3]s#%[2]s</a>`
+create_branch = skapade grenen <a href="%[2]s">%[3]s</a> i <a href="%[1]s">%[4]s</a>
+starred_repo = stjärnmärkte <a href="%[1]s">%[2]s</a>
+watched_repo = började följa <a href="%[1]s">%[2]s</a>
+
 [tool]
 now=nu
 future=framtiden
@@ -2229,3 +2262,16 @@ team_kind = Sök lag...
 org_kind = Sök organisationer...
 issue_kind = Sök ärenden...
 regexp_tooltip = Tolka söktermen som ett reguljärt uttryck
+fuzzy = Ungefärlig
+fuzzy_tooltip = Inkludera resultat som är närliggande till söktermen
+union = Nyckelord
+union_tooltip = Inkludera resultat som matchar något av de med mellanslag sepererade sökorden
+regexp = RegExp
+code_search_unavailable = Kodsökning är för närvarande inte tillgänglig. Vänligen kontakta webbplatsadministratören.
+code_search_by_git_grep = Nuvarande kodsökningsresultat gjordes med "git grep". Det kan finnas bättre resultat om webbplatsadministratören möjliggör indexering av kod.
+no_results = Inga matchande resultat hittades.
+pull_kind = Sök ändringsförslag…
+keyword_search_unavailable = Sökning på nyckelord är för närvarande inte tillgängligt. Vänligen kontakta webbplatsadministratören.
+
+[translation_meta]
+test = Det här är en teststräng. Den visas inte i Forgejo UI men används vid testtillfälle. Vänligen skriv in "ok" för att spara tid (eller en intressant fakta du själv väljer) för att nå upp till 100% komplett :)
diff --git a/options/locale/locale_uk-UA.ini b/options/locale/locale_uk-UA.ini
index 2186f44719..b04cca5779 100644
--- a/options/locale/locale_uk-UA.ini
+++ b/options/locale/locale_uk-UA.ini
@@ -671,6 +671,8 @@ unable_verify_ssh_key = Не вдалося перевірити ключ SSH, 
 still_has_org = Ваш обліковий запис є учасником однієї або декількох організацій, спочатку покиньте їх.
 admin_cannot_delete_self = Ви не можете видалити себе, якщо ви є адміністратором. Спочатку зніміть із себе права адміністратора.
 
+email_domain_is_not_allowed = Домен адреси електронної пошти <b>%s</b> конфліктує з EMAIL_DOMAIN_ALLOWLIST або EMAIL_DOMAIN_BLOCKLIST. Перевірте, чи ви правильно вказали адресу електронної пошти.
+
 [user]
 change_avatar=Змінити свій аватар…
 repositories=Репозиторії
@@ -1011,6 +1013,8 @@ at_least_one_permission = Для створення токена необхід
 repos_none = Ви не є власником жодного репозиторію.
 blocked_since = Заблокований з %s
 
+change_username_redirect_prompt = Старе ім'я користувача буде перенаправленням, поки хтось не присвоїть ім'я собі.
+
 [repo]
 owner=Власник
 owner_helper=Деякі організації можуть не відображатися у випадаючому списку через максимальну кількість репозиторііїв.
@@ -3194,7 +3198,7 @@ arch.version.groups = Група
 conda.install = Аби встановити пакунок, використовуючи Conda, запустіть команду:
 cargo.install = Аби встановити пакунок, використовуючи Cargo, запустіть команду:
 versions.view_all = Переглянути всі
-generic.download = Завантажте пакунок з командного рядка:
+generic.download = Завантажте пакунок із командного рядка:
 details = Подробиці
 arch.version.optdepends = Необовʼязково залежить
 installation = Установлення
@@ -3235,7 +3239,7 @@ debian.repository = Про репозиторій
 debian.repository.distributions = Дистрибутиви
 alpine.repository.architectures = Архітектури
 arch.version.depends = Залежить
-go.install = Встановити пакунок з командного рядка:
+go.install = Встановити пакунок із командного рядка:
 debian.repository.architectures = Архітектури
 helm.install = Аби встановити пакунок, запустіть команду:
 keywords = Ключові слова
@@ -3260,6 +3264,15 @@ settings.delete.description = Видалення пакунка є остато
 owner.settings.cleanuprules.keep.count.1 = 1 версію на пакунок
 owner.settings.cleanuprules.keep.count.n = %d версій на пакунок
 
+conan.registry = Налаштуйте цей реєстр із командного рядка:
+debian.registry = Налаштуйте цей реєстр із командного рядка:
+debian.registry.info = Виберіть $distribution і $component зі списку нижче.
+helm.registry = Налаштуйте цей реєстр із командного рядка:
+nuget.registry = Налаштуйте цей реєстр із командного рядка:
+rpm.registry = Налаштуйте цей реєстр із командного рядка:
+rpm.repository.multiple_groups = Цей пакунок доступний у кількох групах.
+swift.registry = Налаштуйте цей реєстр із командного рядка:
+
 [secrets]
 deletion = Видалити секрет
 creation.success = Секрет «%s» додано.
diff --git a/options/locale/locale_zh-CN.ini b/options/locale/locale_zh-CN.ini
index 7354a4d02b..16490accef 100644
--- a/options/locale/locale_zh-CN.ini
+++ b/options/locale/locale_zh-CN.ini
@@ -681,6 +681,8 @@ Description = 描述
 Pronouns = 代称
 Biography = 简历
 
+email_domain_is_not_allowed = 用户电子邮箱的域名<b>%s</b>与EMAIL_DOMAIN_ALLOWLIST或EMAIL_DOMAIN_BLOCKLIST冲突。请确保您正确设置了电子邮件地址。
+
 [user]
 change_avatar=修改头像…
 joined_on=加入于 %s
@@ -1609,7 +1611,7 @@ issues.num_comments=%d 条评论
 issues.commented_at=`评论于 <a href="#%s">%s</a>`
 issues.delete_comment_confirm=您确定要删除该条评论吗？
 issues.context.copy_link=复制链接
-issues.context.quote_reply=引用回复
+issues.context.quote_reply=回复
 issues.context.reference_issue=在新工单中引用
 issues.context.edit=编辑
 issues.context.delete=删除
@@ -1793,7 +1795,7 @@ issues.review.pending=待定
 issues.review.pending.tooltip=此评论目前对其他用户不可见。 若要提交您的待定评论，请在页面顶部选择 %s -> %s/%s/%s。
 issues.review.review=评审
 issues.review.reviewers=评审人
-issues.review.outdated=已过期
+issues.review.outdated=已过时
 issues.review.outdated_description=评论发布后内容已经修改
 issues.review.option.show_outdated_comments=显示过时的评论
 issues.review.option.hide_outdated_comments=隐藏过时的评论
@@ -2868,6 +2870,8 @@ issues.reaction.alt_add = 对评论添加 %[1]s 回应。
 summary_card_alt = 仓库 %s 的摘要卡片
 release.summary_card_alt = 仓库 %[2]s 中标题为 %[1]s 的版本发布的摘要卡片
 
+editor.commit_email = 提交电子邮件
+
 [graphs]
 component_loading=正在加载 %s…
 component_loading_failed=无法加载 %s

From b615d41457879b2829620f5a3dfa0a9a649cd09d Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Mon, 3 Feb 2025 08:35:41 +0000
Subject: [PATCH 070/125] [v10.0/forgejo] fix(ui): add triangle down octicon to
 code search options dropdown (#6770)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6620

This adds the triangle down oction to the code search options dropdown to match the other search option dropdowns (issue, pull).

Co-authored-by: Beowulf <beowulf@beocode.eu>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6770
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 templates/shared/search/combo_multi.tmpl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/shared/search/combo_multi.tmpl b/templates/shared/search/combo_multi.tmpl
index 89dc20b530..07d0ea8839 100644
--- a/templates/shared/search/combo_multi.tmpl
+++ b/templates/shared/search/combo_multi.tmpl
@@ -7,6 +7,7 @@
 <div class="ui small fluid action input">
 	{{template "shared/search/input" dict "Value" .Value "Disabled" .Disabled "Placeholder" .Placeholder}}
 	<div class="ui small dropdown selection {{if .Disabled}} disabled{{end}}" data-tooltip-content="{{ctx.Locale.Tr "search.type_tooltip"}}">
+		{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 		<div class="text">
 			{{ctx.Locale.Tr (printf "search.%s" .Selected)}}
 		</div>

From ac01c7a384bc0cb3348d55c3730bf3a7ba5f3ee6 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Tue, 4 Feb 2025 17:06:20 +0000
Subject: [PATCH 071/125] [v10.0/forgejo] fix: make author search case
 insenstive (#6783)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6782

- Make the author search in the issues and pull request list case
insenstive.
- Background: Forgejo mandates that all columns are case senstive and
only SQLite ignores this for ASCII characters with the `LIKE` operator
any other database will indeed do case senstive searching. Codeberg
recently made all columns case senstive, hence why this issue now surfaces.
- Added integration test.
- Resolves forgejo/forgejo#6744

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6783
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 models/repo/user_repo.go        |  4 +--
 tests/integration/issue_test.go | 43 +++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/models/repo/user_repo.go b/models/repo/user_repo.go
index 781a75730a..0f95f5ab6b 100644
--- a/models/repo/user_repo.go
+++ b/models/repo/user_repo.go
@@ -166,9 +166,9 @@ func GetReviewers(ctx context.Context, repo *Repository, doerID, posterID int64)
 // If isShowFullName is set to true, also include full name prefix search
 func GetIssuePostersWithSearch(ctx context.Context, repo *Repository, isPull bool, search string, isShowFullName bool) ([]*user_model.User, error) {
 	users := make([]*user_model.User, 0, 30)
-	var prefixCond builder.Cond = builder.Like{"name", search + "%"}
+	prefixCond := db.BuildCaseInsensitiveLike("name", search+"%")
 	if isShowFullName {
-		prefixCond = prefixCond.Or(builder.Like{"full_name", "%" + search + "%"})
+		prefixCond = db.BuildCaseInsensitiveLike("full_name", "%"+search+"%")
 	}
 
 	cond := builder.In("`user`.id",
diff --git a/tests/integration/issue_test.go b/tests/integration/issue_test.go
index 4c0a64ad70..3cdb0b8a28 100644
--- a/tests/integration/issue_test.go
+++ b/tests/integration/issue_test.go
@@ -1336,3 +1336,46 @@ func TestIssueCount(t *testing.T) {
 	allCount := htmlDoc.doc.Find("a[data-test-name='all-issue-count']").Text()
 	assert.Contains(t, allCount, "2\u00a0All")
 }
+
+func TestIssuePostersSearch(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	type userSearchInfo struct {
+		UserID   int64  `json:"user_id"`
+		UserName string `json:"username"`
+	}
+
+	type userSearchResponse struct {
+		Results []*userSearchInfo `json:"results"`
+	}
+
+	t.Run("Name search", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+		defer test.MockVariableValue(&setting.UI.DefaultShowFullName, false)()
+
+		req := NewRequest(t, "GET", "/user2/repo1/issues/posters?q=USer2")
+		resp := MakeRequest(t, req, http.StatusOK)
+
+		var data userSearchResponse
+		DecodeJSON(t, resp, &data)
+
+		assert.Len(t, data.Results, 1)
+		assert.EqualValues(t, "user2", data.Results[0].UserName)
+		assert.EqualValues(t, 2, data.Results[0].UserID)
+	})
+
+	t.Run("Full name search", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+		defer test.MockVariableValue(&setting.UI.DefaultShowFullName, true)()
+
+		req := NewRequest(t, "GET", "/user2/repo1/issues/posters?q=OnE")
+		resp := MakeRequest(t, req, http.StatusOK)
+
+		var data userSearchResponse
+		DecodeJSON(t, resp, &data)
+
+		assert.Len(t, data.Results, 1)
+		assert.EqualValues(t, "user1", data.Results[0].UserName)
+		assert.EqualValues(t, 1, data.Results[0].UserID)
+	})
+}

From 2491bbfa69a78ac55ca0868d08fa4f798106c7d9 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Thu, 6 Feb 2025 08:15:36 +0000
Subject: [PATCH 072/125] [v10.0/forgejo] ci: fix go version check (#6810)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6646

Allow ci go version to be higher than the tool chain. This will fix the current build issues on forgejo branch

Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6810
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 .forgejo/workflows-composite/setup-env/action.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows-composite/setup-env/action.yaml b/.forgejo/workflows-composite/setup-env/action.yaml
index 28216e9b8d..f19569a137 100644
--- a/.forgejo/workflows-composite/setup-env/action.yaml
+++ b/.forgejo/workflows-composite/setup-env/action.yaml
@@ -19,7 +19,7 @@ runs:
         set -ex
         toolchain=$(grep -oP '(?<=toolchain ).+' go.mod)
         version=$(go version | cut -d' ' -f3)
-        if [ "$toolchain" != "$version" ]; then
-          echo "go version mismatch: $toolchain <> $version"
+        if dpkg --compare-versions ${version#go} lt ${toolchain#go}; then
+          echo "go version too low: $toolchain >= $version"
           exit 1
         fi

From 3168330425192d81c1c024cd7cfbdc49763121e7 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Thu, 6 Feb 2025 12:37:53 +0000
Subject: [PATCH 073/125] [v10.0/forgejo] chore(i18n): lint errors (#6809)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6808

settings.hidden_comment_types_description: Rodzaje komentarzy zaznaczone tutaj nie będą wyświetlały się na stronach zgłoszeń. Zaznaczenie "Etykieta" na przykład usunie wszystkie komentarze "<użytkownik> dodał/usunął <etykieta>".
repo.settings.add_web_hook_desc: Zintegruj <a target="_black" rel="noreferrer" href="https://TO-BE-REPLACED.COM">%s</a> ze swoim repozytorium.

Add user & label in Polish.

Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6809
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 build/lint-locale.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build/lint-locale.go b/build/lint-locale.go
index 44d320994c..0b5e501701 100644
--- a/build/lint-locale.go
+++ b/build/lint-locale.go
@@ -59,9 +59,9 @@ func initRemoveTags() {
 	oldnew := []string{}
 	for _, el := range []string{
 		"email@example.com", "correu@example.com", "epasts@domens.lv", "email@exemplo.com", "eposta@ornek.com", "email@példa.hu", "email@esempio.it",
-		"user", "utente", "lietotājs", "gebruiker", "usuário", "Benutzer", "Bruker", "bruger",
+		"user", "utente", "lietotājs", "gebruiker", "usuário", "Benutzer", "Bruker", "bruger", "użytkownik",
 		"server", "servidor", "kiszolgáló", "serveris",
-		"label", "etichetta", "etiķete", "rótulo", "Label", "utilizador", "etiket", "iezīme",
+		"label", "etichetta", "etiķete", "rótulo", "Label", "utilizador", "etiket", "iezīme", "etykieta",
 	} {
 		oldnew = append(oldnew, "<"+el+">", "REPLACED-TAG")
 	}

From d260013a512f696056de34ef29f7714df9e4340d Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 7 Feb 2025 10:46:08 +0000
Subject: [PATCH 074/125] [v10.0/forgejo] fix: avoid y-axis clipping for branch
 name (#6832)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6817

- `gt-ellipsis` is set on elements to avoid overflowing its text contents and in the case of overflowing it would show an ellipsis. To force it to not overflow `overflow: hidden` is set, however this also hides the overflow on the y-axis, `overflow-x: hidden` has the same behavior.
- To avoid avoid the branch name from being clipped, add a very small amount of padding on the y-axis. This is a workaround and not a proper solution. There does not seem a good cross-platform solution available to fix this in a proper way.
- Resolves forgejo/forgejo#6811

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6832
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 web_src/css/repo.css | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/web_src/css/repo.css b/web_src/css/repo.css
index e9cfc1ddde..d6faa4b2a7 100644
--- a/web_src/css/repo.css
+++ b/web_src/css/repo.css
@@ -2425,6 +2425,11 @@ details.repo-search-result summary::marker {
   padding-right: 22px !important; /* normal buttons have !important paddings, so we need to override it for dropdown (Add File) icons */
 }
 
+.repo-button-row .button strong {
+  /* Workaround where 'overflow: hidden' is clipping the y-axis, force a small amount of extra padding in the y-axis. */
+  padding: .1em 0;
+}
+
 .repo-button-row input {
   height: 30px;
 }

From 34d2a8531c38d3a6f34755ff7cab6ed2e1c5d435 Mon Sep 17 00:00:00 2001
From: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Date: Fri, 7 Feb 2025 13:16:23 +0000
Subject: [PATCH 075/125] [v10.0/forgejo] fix(ui): display verified icon for
 default gpg key (#6833)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/6803

## Description
Thank you for this amazing project!

I recently noticed that the icon next to the GPG key reference appears to be incorrect for commits signed by the default GPG key:

| Default GPG Key  | User GPG Key  |
|---------|---------|
| ![image](/attachments/ff27597a-d38c-48fc-8284-e16d4fd3ea2d) | ![image](/attachments/3c8c5540-dd29-45c9-a9f0-dc3b69677ef3) |

Looking into the commit history of the template file, I noticed that Forgejo-signed commits originally had a distinct icon:
[gitea-unlock-cog](https://codeberg.org/forgejo/forgejo/commit/b918609acc11d2deb1dd2182597c7cbb3624dbdb) --> [octicon-shield-lock](https://codeberg.org/forgejo/forgejo/commit/12ddc48c5c02123b1e6dab9d2d38b03f027d196e) --> octicon-unverified (current)

Since `octicon-unverified` is also used when a commit cannot be verified (.Verification.Warning), I find it misleading for successfully signed commits. This PR changes the icon to the verified variant for better clarity.

### Tests

1. Set up automatic commit signing by Forgejo ([guide](https://forgejo.org/docs/latest/admin/signing/#automatic-signing))
2. Trigger automatic commit signing in any of the following scenarios:
    - Repository Initialisation (should be the easiest)
    - Wiki Changes
    - CRUD actions using the editor or the API
    - Merges from Pull Requests
3. Open the commit signed by Forgejo
4. Verify that the icon next to the GPG key id is `octicon-verified`:
![image](/attachments/7b4eb81c-d33c-4daf-84dd-9f99ebb0b99d)

### Documentation

- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I want the title to show in the release notes with a link to this pull request.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- User Interface bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/6803): <!--number 6803 --><!--line 0 --><!--description Zml4KHVpKTogZGlzcGxheSB2ZXJpZmllZCBpY29uIGZvciBkZWZhdWx0IGdwZyBrZXk=-->fix(ui): display verified icon for default gpg key<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: shgew <shgew@noreply.codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6833
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
---
 templates/repo/commit_page.tmpl | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/templates/repo/commit_page.tmpl b/templates/repo/commit_page.tmpl
index 36de789dd1..7bc6dd1c97 100644
--- a/templates/repo/commit_page.tmpl
+++ b/templates/repo/commit_page.tmpl
@@ -217,8 +217,8 @@
 				</div>
 				<div class="tw-flex tw-items-center">
 					{{if .Verification.Verified}}
+						{{svg "octicon-verified" 16 "tw-mr-2"}}
 						{{if ne .Verification.SigningUser.ID 0}}
-							{{svg "octicon-verified" 16 "tw-mr-2"}}
 							{{if .Verification.SigningSSHKey}}
 								<span class="ui text tw-mr-2">{{ctx.Locale.Tr "repo.commits.ssh_key_fingerprint"}}:</span>
 								{{.Verification.SigningSSHKey.Fingerprint}}
@@ -227,7 +227,6 @@
 								{{.Verification.SigningKey.PaddedKeyID}}
 							{{end}}
 						{{else}}
-							{{svg "octicon-unverified" 16 "tw-mr-2"}}
 							{{if .Verification.SigningSSHKey}}
 								<span class="ui text tw-mr-2" data-tooltip-content="{{ctx.Locale.Tr "gpg.default_key"}}">{{ctx.Locale.Tr "repo.commits.ssh_key_fingerprint"}}:</span>
 								{{.Verification.SigningSSHKey.Fingerprint}}

From 57ad0b868d0969bad2b3d0e719a618200690f65e Mon Sep 17 00:00:00 2001
From: 0ko <0ko@noreply.codeberg.org>
Date: Sat, 8 Feb 2025 00:01:24 +0000
Subject: [PATCH 076/125] [v10.0/forgejo] i18n: update of translations from
 Codeberg Translate (#6834)

Backport: https://codeberg.org/forgejo/forgejo/pulls/6745

Feel free to leave merge to me. My strategy is to use squash-merge, but copy the description of the actual commit into squash description, so attribution is preserved.

https://codeberg.org/forgejo/forgejo/pulls/6745 was quite large, so I decided it will be ok to backport just one PR before a new release.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Localization
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/6834): <!--number 6834 --><!--line 0 --><!--description aTE4bjogdXBkYXRlIG9mIHRyYW5zbGF0aW9ucyBmcm9tIENvZGViZXJnIFRyYW5zbGF0ZQ==-->i18n: update of translations from Codeberg Translate<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6834
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
---
 options/locale/locale_cs-CZ.ini |    4 +-
 options/locale/locale_da.ini    |   46 +-
 options/locale/locale_de-DE.ini |    2 +
 options/locale/locale_el-GR.ini |   10 +-
 options/locale/locale_es-ES.ini |   96 ++-
 options/locale/locale_fa-IR.ini |    4 +-
 options/locale/locale_fil.ini   |    2 +
 options/locale/locale_fr-FR.ini |    4 +-
 options/locale/locale_he.ini    |  239 +++++++
 options/locale/locale_it-IT.ini |  130 ++--
 options/locale/locale_ja-JP.ini |    2 +-
 options/locale/locale_ko-KR.ini |    2 +
 options/locale/locale_lv-LV.ini |    4 +-
 options/locale/locale_nds.ini   |    4 +
 options/locale/locale_nl-NL.ini |    4 +-
 options/locale/locale_pl-PL.ini | 1175 ++++++++++++++++++++++++++-----
 options/locale/locale_pt-BR.ini |    4 +-
 options/locale/locale_pt-PT.ini |    6 +-
 options/locale/locale_ru-RU.ini |   14 +-
 options/locale/locale_si-LK.ini |    2 +-
 options/locale/locale_sk-SK.ini |    2 +-
 options/locale/locale_sr-SP.ini |    2 +-
 options/locale/locale_tr-TR.ini |    8 +-
 options/locale/locale_uk-UA.ini |   38 +-
 options/locale/locale_zh-CN.ini |    4 +-
 options/locale/locale_zh-TW.ini |  315 +++++----
 26 files changed, 1703 insertions(+), 420 deletions(-)
 create mode 100644 options/locale/locale_he.ini

diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 16869146f3..0143a9aed2 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -4,7 +4,7 @@ dashboard=Přehled
 explore=Procházet
 help=Nápověda
 logo=Logo
-sign_in=Přihlášení
+sign_in=Přihlásit se
 sign_in_with_provider = Přihlásit se přes %s
 sign_in_or=nebo
 sign_out=Odhlásit se
@@ -2869,6 +2869,8 @@ issues.context.menu = Nabídka komentáře
 issues.reaction.alt_remove = Odstranit %[1]s reakci z komentáře.
 issues.reaction.alt_add = Přidat %[1]s reakci na komentář.
 
+editor.commit_email = E-mail revize
+
 [graphs]
 component_loading_info = Tohle může chvíli trvat…
 component_failed_to_load = Došlo k neočekávané chybě.
diff --git a/options/locale/locale_da.ini b/options/locale/locale_da.ini
index d73c48a160..6abcd284c5 100644
--- a/options/locale/locale_da.ini
+++ b/options/locale/locale_da.ini
@@ -1122,7 +1122,7 @@ migrate_items_pullrequests = Pull-anmodninger
 migrate_items_merge_requests = Flet anmodninger
 migrate_items_releases = Udgivelser
 migrate_repo = Migrer depot
-migrate.clone_address_desc = HTTP(S) eller Git "klone" URL'en for et eksisterende lager
+migrate.clone_address_desc = HTTP(S) eller Git "klone" URL'en for et eksisterende depot
 migrate.clone_local_path = eller en lokal serversti
 migrate.permission_denied = Du har ikke tilladelse til at importere lokale depoter.
 migrate.permission_denied_blocked = Du kan ikke importere fra ikke-tilladte værter. Bed venligst administratoren om at kontrollere ALLOWED_DOMAINS/ALLOW_LOCALNETWORKS/BLOCKED_DOMAINS indstillingerne.
@@ -1159,7 +1159,7 @@ migrated_from = Migreret fra <a href="%[1]s">%[2]s</a>
 migrate.gitea.description = Migrer data fra gitea.com eller andre Gitea-instanser.
 migrate.gitbucket.description = Migrer data fra GitBucket-instanser.
 migrate.github_token_desc = Du kan sætte et eller flere tokens med kommasepareret her for at gøre migreringen hurtigere på grund af GitHub API-hastighedsgrænsen. ADVARSEL: Misbrug af denne funktion kan overtræde tjenesteudbyderens politik og føre til kontoblokering.
-migrate_options_lfs_endpoint.description = Migration vil forsøge at bruge din fjern-Git til at <a target="_blank" rel="noopener noreferrer" href="%s">bestemme LFS-serveren</a>. Du kan også angive et brugerdefineret slutpunkt, hvis lagerets LFS-data er gemt et andet sted.
+migrate_options_lfs_endpoint.description = Migration vil forsøge at bruge din fjern-Git til at <a target="_blank" rel="noopener noreferrer" href="%s">bestemme LFS-serveren</a>. Du kan også angive et brugerdefineret slutpunkt, hvis depots LFS-data er gemt et andet sted.
 form.name_pattern_not_allowed = Mønsteret "%s" er ikke tilladt i et depotnavn.
 migrate_options_lfs_endpoint.placeholder = Hvis det efterlades tomt, vil endepunktet blive afledt fra klonens URL
 migrate.clone_address = Migrer / Klon fra URL
@@ -1636,7 +1636,7 @@ issues.unpin_comment = frigjorde dette %s
 issues.lock = Lås samtale
 issues.unlock = Lås samtale op
 issues.lock.unknown_reason = Kan ikke låse et problem med en ukendt årsag.
-issues.lock.notice_2 = - Du og andre samarbejdspartnere med adgang til dette lager kan stadig efterlade kommentarer, som andre kan se.
+issues.lock.notice_2 = - Du og andre samarbejdspartnere med adgang til dette depot kan stadig efterlade kommentarer, som andre kan se.
 issues.lock.notice_3 = - Du kan altid låse op for dette problem igen i fremtiden.
 issues.unlock.notice_1 = - Alle ville kunne udtale sig om dette spørgsmål endnu en gang.
 issues.unlock.notice_2 = - Du kan altid låse dette problem igen i fremtiden.
@@ -1786,6 +1786,46 @@ pulls.select_commit_hold_shift_for_range = Vælg commit. Hold Shift + klik for a
 pulls.review_only_possible_for_full_diff = Gennemgang er kun mulig, når du ser den fulde diff
 pulls.filter_changes_by_commit = Filtrer efter commit
 
+editor.commit_email = Commit email
+pulls.nothing_to_compare = Disse grene er lige store. Der er ingen grund til at oprette en pull-anmodning.
+pulls.nothing_to_compare_have_tag = Den valgte gren/tag er ens.
+pulls.nothing_to_compare_and_allow_empty_pr = Disse grene er lige store. Denne PR vil være tom.
+pulls.has_pull_request = `Der findes allerede en pull-anmodning mellem disse grene: <a href="%[1]s">%[2]s#%[3]d</a>`
+pulls.create = Opret pull-anmodning
+pulls.change_target_branch_at = `ændrede målgren fra <b>%s</b> til <b>%s</b> %s`
+pulls.tab_conversation = Samtale
+pulls.tab_commits = Commits
+pulls.tab_files = Filer ændret
+pulls.reopen_to_merge = Genåbn denne pull-anmodning for at udføre en fletning.
+pulls.cant_reopen_deleted_branch = Denne pull-anmodning kan ikke genåbnes, fordi grenen blev slettet.
+pulls.merged = Flettet
+pulls.merged_success = Pull-anmodning blev flettet og lukket
+pulls.closed = Pull-anmodning lukket
+pulls.manually_merged = Manuelt flettet
+pulls.merged_info_text = Grenen %s kan nu slettes.
+pulls.is_closed = Pull-anmodningen er blevet lukket.
+pulls.title_wip_desc = `<a href="#">Start titlen med <strong>%s</strong></a> for at forhindre pull-anmodningen i at blive flettet ved et uheld.`
+pulls.cannot_merge_work_in_progress = Denne pull-anmodning er markeret som et igangværende arbejde.
+pulls.still_in_progress = Stadig i gang?
+pulls.add_prefix = Tilføj <strong>%s</strong> præfiks
+pulls.ready_for_review = Klar til gennemgang?
+pulls.remove_prefix = Fjern <strong>%s</strong> præfiks
+pulls.data_broken = Denne pull-anmodning er ødelagt på grund af manglende fork-information.
+pulls.files_conflicted = Denne pull-anmodning har ændringer, der er i konflikt med målgrenen.
+pulls.is_checking = Kontrol af fletkonflikt er i gang. Prøv igen om få øjeblikke.
+pulls.is_ancestor = Denne gren er allerede inkluderet i målgrenen. Der er ikke noget at flette sammen.
+pulls.is_empty = Ændringerne på denne gren er allerede på målgrenen. Dette vil være en tom commit.
+pulls.required_status_check_failed = Nogle påkrævede checks lykkedes ikke.
+pulls.required_status_check_missing = Nogle påkrævede checks mangler.
+pulls.required_status_check_administrator = Som administrator kan du stadig flette denne pull-anmodning.
+pulls.blocked_by_approvals = Denne pull-anmodning har endnu ikke nok godkendelser. %d af %d godkendte godkendelser.
+pulls.blocked_by_rejection = Denne pull-anmodning har ændringer anmodet af en officiel anmelder.
+pulls.blocked_by_official_review_requests = Denne pull-anmodning er blokeret, fordi den mangler godkendelse fra en eller flere officielle anmeldere.
+pulls.blocked_by_outdated_branch = Denne pull-anmodning er blokeret, fordi den er forældet.
+pulls.blocked_by_changed_protected_files_1 = Denne pull-anmodning er blokeret, fordi den ændrer en beskyttet fil:
+pulls.blocked_by_changed_protected_files_n = Denne pull-anmodning er blokeret, fordi den ændrer beskyttede filer:
+pulls.can_auto_merge_desc = Denne pull-anmodning kan flettes automatisk.
+
 [notification]
 watching = Overvåger
 
diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 4791a3807c..3064552aac 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -2871,6 +2871,8 @@ issues.reaction.alt_remove = Entferne %[1]s Reaktion von diesem Kommentar.
 summary_card_alt = Zusammenfassungskarte des Repositorys %s
 release.summary_card_alt = Übersichtskarte eines Releases mit dem Titel „%s“ im Repository %s
 
+editor.commit_email = Commit-E-Mail
+
 [graphs]
 component_loading_failed = Konnte %s nicht laden
 component_loading_info = Dies könnte einen Moment dauern …
diff --git a/options/locale/locale_el-GR.ini b/options/locale/locale_el-GR.ini
index cb99563034..e80b815843 100644
--- a/options/locale/locale_el-GR.ini
+++ b/options/locale/locale_el-GR.ini
@@ -1226,7 +1226,7 @@ migrate.migrating_failed_no_addr=Η μεταφορά απέτυχε.
 migrate.github.description=Μεταφορά δεδομένων από το github.com ή διακομιστές GitHub Enterprise.
 migrate.git.description=Μεταφορά μόνο του αποθετηρίου από μια οποιαδήποτε υπηρεσία Git.
 migrate.gitlab.description=Μεταφορά δεδομένων από το gitlab.com ή άλλες εγκαταστάσεις GitLab.
-migrate.gitea.description=Μεταφορά δεδομένων από το gitea.com ή άλλες εγκαταστάσεις Gitea/Forgejo.
+migrate.gitea.description=Μεταφορά δεδομένων από το gitea.com ή άλλες εγκαταστάσεις Gitea.
 migrate.gogs.description=Μεταφορά δεδομένων από το notabug.org ή άλλες εγκαταστάσεις Gogs.
 migrate.onedev.description=Μεταφορά δεδομένων από το code.onedev.io ή άλλες εγκαταστάσεις OneDev.
 migrate.codebase.description=Μεταφορά δεδομένων από το codebasehq.com.
@@ -1935,7 +1935,7 @@ pulls.cmd_instruction_hint=Προβολή οδηγιών γραμμής εντο
 pulls.cmd_instruction_checkout_title=Έλεγχος
 pulls.cmd_instruction_checkout_desc=Από το repository του έργου σας, ελέγξτε έναν νέο κλάδο και δοκιμάστε τις αλλαγές.
 pulls.cmd_instruction_merge_title=Συγχώνευση
-pulls.cmd_instruction_merge_desc=Συγχώνευση των αλλαγών και ενημέρωση στο Gitea.
+pulls.cmd_instruction_merge_desc=Συγχώνευση των αλλαγών και ενημέρωση στο Forgejo.
 pulls.clear_merge_message=Εκκαθάριση μηνύματος συγχώνευσης
 pulls.clear_merge_message_hint=Η εκκαθάριση του μηνύματος συγχώνευσης θα αφαιρέσει μόνο το περιεχόμενο του μηνύματος υποβολής και θα διατηρήσει τα παραγόμενα git trailers όπως "Co-Authored-By …".
 
@@ -2630,7 +2630,7 @@ release.edit_release=Ενημέρωση κυκλοφορίας
 release.delete_release=Διαγραφή κυκλοφορίας
 release.delete_tag=Διαγραφή ετικέτας
 release.deletion=Διαγραφή κυκλοφορίας
-release.deletion_desc=Διαγράφοντας μια κυκλοφορία, αυτή αφαιρείται μόνο από το Gitea. Δε θα επηρεάσει την ετικέτα Git, τα περιεχόμενα του αποθετηρίου σας ή το ιστορικό της. Συνέχεια;
+release.deletion_desc=Διαγράφοντας μια κυκλοφορία, αυτή αφαιρείται μόνο από το Forgejo. Δε θα επηρεάσει την ετικέτα Git, τα περιεχόμενα του αποθετηρίου σας ή το ιστορικό της. Συνέχεια;
 release.deletion_success=Η κυκλοφορία έχει διαγραφεί.
 release.deletion_tag_desc=Θα διαγράψει αυτή την ετικέτα από το repository. Τα περιεχόμενα του repository και το ιστορικό δεν θα πειραχτούν. Να γίνει συνέχεια;
 release.deletion_tag_success=Η ετικέτα έχει διαγραφεί.
@@ -3172,12 +3172,12 @@ packages.size=Μέγεθος
 packages.published=Δημοσιευμένα
 
 defaulthooks=Προεπιλεγμένα webhooks
-defaulthooks.desc=Τα Webhooks κάνουν αυτόματα αιτήσεις HTTP POST σε ένα διακομιστή όταν ενεργοποιούν ορισμένα γεγονότα στο Gitea. Τα Webhooks που ορίζονται εδώ είναι προκαθορισμένα και θα αντιγραφούν σε όλα τα νέα αποθετήρια. Διαβάστε περισσότερα στον οδηγό <a target="_blank" rel="noopener" href="%s">webhooks</a>.
+defaulthooks.desc=Τα Webhooks κάνουν αυτόματα αιτήσεις HTTP POST σε ένα διακομιστή όταν ενεργοποιούν ορισμένα γεγονότα στο Forgejo. Τα Webhooks που ορίζονται εδώ είναι προκαθορισμένα και θα αντιγραφούν σε όλα τα νέα αποθετήρια. Διαβάστε περισσότερα στον οδηγό <a target="_blank" rel="noopener" href="%s">webhooks</a>.
 defaulthooks.add_webhook=Προσθήκη Προεπιλεγμένου Webhook
 defaulthooks.update_webhook=Ενημέρωση Προεπιλεγμένου Webhook
 
 systemhooks=Webhooks συστήματος
-systemhooks.desc=Τα Webhooks κάνουν αυτόματα αιτήσεις HTTP POST σε ένα διακομιστή όταν ενεργοποιούνται ορισμένα γεγονότα στο Gitea. Τα Webhooks που ορίζονται εδώ θα ενεργούν σε όλα τα αποθετήρια του συστήματος, γι 'αυτό παρακαλώ εξετάστε τυχόν επιπτώσεις απόδοσης που μπορεί να έχει. Διαβάστε περισσότερα στον οδηγό <a target="_blank" rel="noopener" href="%s">webhooks</a>.
+systemhooks.desc=Τα Webhooks κάνουν αυτόματα αιτήσεις HTTP POST σε ένα διακομιστή όταν ενεργοποιούνται ορισμένα γεγονότα στο Forgejo. Τα Webhooks που ορίζονται εδώ θα ενεργούν σε όλα τα αποθετήρια του συστήματος, γι 'αυτό παρακαλώ εξετάστε τυχόν επιπτώσεις απόδοσης που μπορεί να έχει. Διαβάστε περισσότερα στον οδηγό <a target="_blank" rel="noopener" href="%s">webhooks</a>.
 systemhooks.add_webhook=Προσθήκη Webhook Συστήματος
 systemhooks.update_webhook=Ενημέρωση Webhook Συστήματος
 
diff --git a/options/locale/locale_es-ES.ini b/options/locale/locale_es-ES.ini
index 74098beb12..cc24e95703 100644
--- a/options/locale/locale_es-ES.ini
+++ b/options/locale/locale_es-ES.ini
@@ -229,7 +229,7 @@ platform_desc=Se ha confirmado que Forgejo funciona en sistemas operativos libre
 lightweight=Ligero
 lightweight_desc=Forgejo tiene pocos requisitos y puede funcionar en una Raspberry Pi barata. ¡Ahorra energía!
 license=Código abierto
-license_desc=¡Está todo en < <a target="_blank" rel="noopener noreferrer" href="%[1]s">Forgejo</a>! Únase <a target="_blank" rel="noopener noreferrer" href="%[2]s">contribuyendo</a> a hacer este proyecto todavía mejor. ¡No sea tímido y colabore!
+license_desc=¡Pasa a conseguir <a target="_blank" rel="noopener noreferrer" href="%[1]s">Forgejo</a>! Únete a nosotros y <a target="_blank" rel="noopener noreferrer" href="%[2]s">colabora</a> para mejorar este proyecto. ¡No seas tímido y colabora!
 
 [install]
 install=Instalación
@@ -746,7 +746,7 @@ webauthn=Autenticación de dos factores (claves de seguridad)
 public_profile=Perfil público
 biography_placeholder=¡Cuenta a otros un poco sobre ti! (Se admite Markdown)
 location_placeholder=Comparte tu ubicación aproximada con otros
-profile_desc=Controla cómo se muestra su perfil a otros usuarios. Tu dirección de correo electrónico principal se utilizará para notificaciones, recuperación de contraseña y operaciones de Git basadas en la web.
+profile_desc=Acerca de ti
 password_username_disabled=Usuarios no locales no tienen permitido cambiar su nombre de usuario. Por favor, contacta con el administrador del sistema para más detalles.
 full_name=Nombre completo
 website=Página web
@@ -811,7 +811,7 @@ manage_emails=Administrar direcciones de correo electrónico
 manage_themes=Tema por defecto
 manage_openid=Direcciones OpenID
 email_desc=Su dirección de correo electrónico principal se utilizará para notificaciones, recuperación de contraseña y, siempre y cuando no esté oculto, operaciones de Git basadas en la web.
-theme_desc=Este será su tema por defecto en todo el sitio.
+theme_desc=Este tema será usado en la interfaz web cuando hayas iniciado sesión.
 primary=Principal
 activated=Activado
 requires_activation=Requiere activación
@@ -837,14 +837,14 @@ add_email_success=La nueva dirección de correo electrónico ha sido añadida.
 email_preference_set_success=La preferencia de correo electrónico se ha establecido correctamente.
 add_openid_success=La nueva dirección OpenID ha sido añadida.
 keep_email_private=Ocultar dirección de correo electrónico
-keep_email_private_popup=Esto ocultará tu dirección de correo electrónico de tu perfil. Ya no será la dirección predeterminada para los commits realizados a través de la interfaz web, como las subidas y ediciones de archivos, y no se utilizará para los commits de fusión. En su lugar, se utilizará una dirección especial %s para asociar los commits a tu cuenta. Ten en cuenta que cambiar esta opción no afectará a los commits existentes.
+keep_email_private_popup=Esto ocultará tu dirección de correo electrónico de tu perfil. Ya no será la dirección predeterminada para los confirmaciones realizadas a través de la interfaz web, como las subidas y ediciones de archivos, y no se utilizará para las confirmaciones de fusión. En su lugar, se utilizará una dirección especial %s para asociar las confirmaciones a tu cuenta. Ten en cuenta que cambiar esta opción no afectará a las confirmaciones existentes.
 openid_desc=OpenID le permite delegar la autenticación a un proveedor externo.
 
 manage_ssh_keys=Gestionar claves SSH
 manage_ssh_principals=Administrar Principales de Certificado SSH
 manage_gpg_keys=Gestionar claves GPG
 add_key=Añadir clave
-ssh_desc=Estas claves SSH públicas están asociadas a tu cuenta. Las correspondientes claves privadas permiten el acceso total a tus repositorios. Las claves SSH que han sido verificadas pueden utilizarse para verificar commits de Git firmados por SSH.
+ssh_desc=Estas claves SSH públicas están asociadas a tu cuenta. Las correspondientes claves privadas permiten el acceso total a tus repositorios. Las claves SSH que han sido verificadas pueden utilizarse para verificar confirmaciones de Git firmadas por SSH.
 principal_desc=Estos principales de certificado SSH están asociados con su cuenta y permiten el acceso completo a sus repositorios.
 gpg_desc=Estas claves GPG públicas están asociadas a tu cuenta y se utilizan para verificar tus commits. Mantén a salvo tus claves privadas, ya que permiten firmar commits con tu identidad.
 ssh_helper=<strong>¿Necesitas ayuda?</strong> Echa un vistazo en la guía de GitHub para <a href="%s">crear tus propias claves SSH</a> o resolver <a href="%s">problemas comunes</a> que puede encontrar al usar SSH.
@@ -1096,7 +1096,7 @@ issue_labels=Etiquetas
 issue_labels_helper=Selecciona un conjunto de etiquetas
 license=Licencia
 license_helper=Selecciona un archivo de licencia
-license_helper_desc=Una licencia regula lo que otros pueden y no pueden hacer con tu código. ¿No está seguro de cuál es el adecuado para su proyecto? Vea <a target="_blank" rel="noopener noreferrer" href="%s">Elija una licencia.</a>
+license_helper_desc=Una licencia regula lo que otros pueden y no pueden hacer con tu código. ¿No está seguro de cuál es el adecuado para su proyecto? Vea <a target="_blank" rel="noopener noreferrer" href="%s">Elija una licencia</a>.
 readme=LÉAME
 readme_helper=Selecciona una plantilla de archivo README
 readme_helper_desc=Este es el lugar donde puedes escribir una descripción completa de su proyecto.
@@ -1224,7 +1224,7 @@ migrate.migrating_failed_no_addr=Migración fallida.
 migrate.github.description=Migrar datos desde github.com o un servidor GitHub Enterprise.
 migrate.git.description=Migrar un repositorio sólo desde cualquier servicio Git.
 migrate.gitlab.description=Migrar datos de gitlab.com u otra instancia de GitLab.
-migrate.gitea.description=Migrar datos de gitea.com u otra instancia de Gitea/Forgejo.
+migrate.gitea.description=Migrar datos de gitea.com u otra instancia de Gitea.
 migrate.gogs.description=Migrar datos de notabug.org u otra instancia de Gogs.
 migrate.onedev.description=Migrar datos desde code.onedev.io u otra instancia de OneDev.
 migrate.codebase.description=Migrar datos desde codebasehq.com.
@@ -1235,7 +1235,7 @@ migrate.migrating_milestones=Migrando hitos
 migrate.migrating_labels=Migrando etiquetas
 migrate.migrating_releases=Migrando lanzamientos
 migrate.migrating_issues=Migrando incidencias
-migrate.migrating_pulls=Migrando pull requests
+migrate.migrating_pulls=Migrando solicitudes de incorporación de cambios
 migrate.cancel_migrating_title=Cancelar la migración
 migrate.cancel_migrating_confirm=¿Quiere cancelar esta migración?
 
@@ -1861,7 +1861,7 @@ pulls.add_prefix=Añadir prefijo <strong>%s</strong>
 pulls.remove_prefix=Eliminar prefijo <strong>%s</strong>
 pulls.data_broken=Este pull request está rota debido a que falta información del fork.
 pulls.files_conflicted=Este pull request tiene cambios en conflicto con la rama de destino.
-pulls.is_checking=La comprobación de conflicto de fusión está en progreso. Inténtalo de nuevo en unos momentos.
+pulls.is_checking=La comprobación de conflicto de fusión está en progreso. Inténtelo de nuevo en unos momentos.
 pulls.is_ancestor=Esta rama ya está incluida en la rama de destino. No hay nada que fusionar.
 pulls.is_empty=Los cambios en esta rama ya están en la rama de destino. Esto será un commit vacío.
 pulls.required_status_check_failed=Algunos controles requeridos no han tenido éxito.
@@ -2041,8 +2041,8 @@ activity.opened_prs_count_1=Pull request propuesta
 activity.opened_prs_count_n=Pull requests propuestas
 activity.title.user_1=%d usuario
 activity.title.user_n=%d usuarios
-activity.title.prs_1=%d pull request
-activity.title.prs_n=%d pull requests
+activity.title.prs_1=%d solicitud de incorporación de cambios
+activity.title.prs_n=%d solicitudes de incorporación de cambios
 activity.title.prs_merged_by=%s fusionado por %s
 activity.title.prs_opened_by=%s propuesto por %s
 activity.merged_prs_label=Fusionado
@@ -2089,7 +2089,7 @@ activity.git_stats_and_deletions=y
 activity.git_stats_deletion_1=%d eliminación
 activity.git_stats_deletion_n=%d eliminaciones
 
-contributors.contribution_type.commits=Commits
+contributors.contribution_type.commits=Confirmaciones
 
 search=Buscar
 search.search_repo=Buscar repositorio
@@ -2333,7 +2333,7 @@ settings.event_pull_request_desc=Pull request abierto, cerrado, reabierto o edit
 settings.event_pull_request_assign=Asignación
 settings.event_pull_request_assign_desc=Pull Request asignado o no asignado.
 settings.event_pull_request_label=Etiquetas
-settings.event_pull_request_label_desc=Etiqueta de pull request actualizada o borrada.
+settings.event_pull_request_label_desc=Etiquetas de pull request actualizadas o borradas.
 settings.event_pull_request_milestone=Hitos
 settings.event_pull_request_milestone_desc=Hitos añadidos, eliminados o modificados.
 settings.event_pull_request_comment=Comentarios
@@ -2438,7 +2438,7 @@ settings.protect_approvals_whitelist_users=Lista blanca de usuarios revisores
 settings.protect_approvals_whitelist_teams=Lista blanca de equipos revisores
 settings.dismiss_stale_approvals=Descartar aprobaciones obsoletas
 settings.dismiss_stale_approvals_desc=Cuando los nuevos commits que cambien el contenido de la pull request sean empujados a la rama, se descartarán las aprobaciones antiguas.
-settings.require_signed_commits=Exigir commits firmados
+settings.require_signed_commits=Exigir confirmaciones firmadas
 settings.require_signed_commits_desc=Rechazar push en esta rama si los commits no están firmados o no son verificables.
 settings.protect_branch_name_pattern=Patrón de nombre de ramas protegidas
 settings.protect_patterns=Patrones
@@ -2466,7 +2466,7 @@ settings.choose_branch=Elija una rama…
 settings.no_protected_branch=No hay ramas protegidas.
 settings.edit_protected_branch=Editar
 settings.protected_branch_required_rule_name=Nombre de regla requerido
-settings.protected_branch_duplicate_rule_name=Nombre de regla duplicado
+settings.protected_branch_duplicate_rule_name=Ya hay una regla para este conjunto de ramas
 settings.protected_branch_required_approvals_min=Las aprobaciones necesarias no pueden ser negativas.
 settings.tags=Etiquetas
 settings.tags.protection=Protección de etiquetas
@@ -2490,11 +2490,11 @@ settings.archive.text=Archivar el repositorio lo hará de sólo lectura. Se ocul
 settings.archive.success=El repositorio ha sido archivado exitosamente.
 settings.archive.error=Ha ocurrido un error al intentar archivar el repositorio. Vea el registro para más detalles.
 settings.archive.error_ismirror=No puede archivar un repositorio replicado.
-settings.archive.branchsettings_unavailable=Los ajustes de rama no están disponibles si el repositorio está archivado.
+settings.archive.branchsettings_unavailable=Los ajustes de rama no están disponibles en repositorios archivados.
 settings.archive.tagsettings_unavailable=Los ajustes de las etiquetas no están disponibles si el repositorio está archivado.
 settings.unarchive.button=Desarchivar repositorio
 settings.unarchive.header=Desarchivar este repositorio
-settings.unarchive.text=La desarchivación del repositorio restablecerá su capacidad de recibir commits y pushes, así como nuevas incidencias y pull requests.
+settings.unarchive.text=La desarchivación del repositorio restablecerá su capacidad de recibir confirmaciones y subidos, así como nuevas incidencias y solicitudes de incorporación de cambios.
 settings.unarchive.success=El repositorio se ha desarchivado correctamente.
 settings.unarchive.error=Ocurrió un error mientras se trataba de des-archivar el repositorio. Revisa el registro para más detalles.
 settings.update_avatar_success=El avatar del repositorio ha sido actualizado.
@@ -2565,7 +2565,7 @@ diff.generated=generado
 diff.vendored=vendido
 diff.comment.add_line_comment=Añadir comentario en línea
 diff.comment.placeholder=Deja un comentario
-diff.comment.markdown_info=Es posible estilizar con markdown.
+diff.comment.markdown_info=Es posible dar estilos con Markdown.
 diff.comment.add_single_comment=Añadir solo comentario
 diff.comment.add_review_comment=Añadir comentario
 diff.comment.start_review=Comenzar revisión
@@ -2720,7 +2720,7 @@ size_format = %[1]s: %[2]s, %[3]s: %[4]s
 admin.update_flags = Actualizar indicadores
 admin.flags_replaced = Indicadores del repositorio sustituidos
 admin.failed_to_replace_flags = Fallo al substituir los indicadores del repositorio
-new_repo_helper = Un repositorio contiene todos los archivos del proyecto, incluido el historial de revisiones. ¿Ya tienes uno en otro sitio? <a href="%s">Migrar repositorio.</a>
+new_repo_helper = Un repositorio contiene todos los archivos del proyecto, incluido el historial de revisiones. ¿Ya tienes uno en otro sitio? <a href="%s">Migrar repositorio</a>.
 object_format_helper = Formato de objeto del repositorio. No puede ser modificado más tarde. SHA1 es el más compatible.
 commits.browse_further = Seguir explorando
 subscribe.issue.guest.tooltip = Inicia sesión para suscribirte a esta incidencia.
@@ -2798,7 +2798,7 @@ settings.confirmation_string = Cadena de confirmación
 issues.filter_sort.relevance = Relevancia
 settings.transfer_quota_exceeded = El nuevo propietario (%s) ha sobrepasado la cuota. El repositorio no ha sido transferido.
 settings.web_hook_name_sourcehut_builds = Builds de SourceHut
-settings.wiki_rename_branch_main_notices_2 = 
+settings.wiki_rename_branch_main_notices_2 =Se va a renombrar de forma permanente la rama interna de la wiki del repositorio %s. Se actualizaran los checkouts existentes.
 settings.wiki_rename_branch_main = Normalizar el nombre de la rama de la wiki
 settings.wiki_rename_branch_main_desc = Renombrar la rama interna usada por la wiki a "%s". Este cambio es permanente y no se puede deshacer.
 settings.confirm_wiki_branch_rename = Renombrar la rama de la wiki
@@ -2815,7 +2815,7 @@ release.download_count_one = %s descarga
 diff.git-notes.add = Añadir nota
 diff.git-notes.remove-header = Eliminar nota
 release.download_count_few = %s descargas
-diff.git-notes.remove-body = Esta nota se eliminará.
+diff.git-notes.remove-body = Esta nota será eliminada.
 
 new_from_template = Usa una plantilla
 new_from_template_description = Puedes seleccionar una plantilla de repositorio ya existente en esta instancia y aplicar sus ajustes.
@@ -2831,6 +2831,17 @@ issues.reaction.alt_add = Añadir %[1]s reacción al comentario.
 issues.review.add_review_requests = solicitada revisiones de %[1]s %[2]s
 issues.review.remove_review_requests = eliminada la solicitud de revisiones para %[1]s %[2]s
 
+editor.commit_email = Correo electrónico del commit
+issues.context.menu = Menú de comentarios
+issues.review.add_remove_review_requests = Revisiones solicitadas de %[1]s y revisiones eliminadas para %[2]s %[3]s
+pulls.sign_in_require = <a href="%s">Inicia sesión</a> para crear un nuevo pull request.
+pulls.cmd_instruction_checkout_title = Cambiar rama
+settings.protect_new_rule = Crear una nueva regla de protección de rama
+settings.enforce_on_admins_desc = Los administradores del repositorio no pueden saltarse esta regla.
+release.type_external_asset = Recurso externo
+release.asset_name = Nombre del recurso
+release.add_external_asset = Añadir un recurso externo
+
 [graphs]
 component_loading = Cargando %s...
 component_loading_failed = No se pudo cargar %s
@@ -2838,6 +2849,9 @@ contributors.what = contribuciones
 recent_commits.what = commits recientes
 code_frequency.what = frecuencia de código
 
+component_loading_info = Esto puede tomar un tiempo…
+component_failed_to_load = Ocurrió un error inesperado.
+
 [org]
 org_name_holder=Nombre de la organización
 org_full_name_holder=Nombre completo de la organización
@@ -2963,6 +2977,8 @@ teams.invite.by=Invitado por %s
 teams.invite.description=Por favor, haga clic en el botón de abajo para unirse al equipo.
 follow_blocked_user = No puedes seguir a esta organización porque esta organización te ha bloqueado.
 
+open_dashboard = Abrir panel de control
+
 [admin]
 dashboard=Panel de control
 identity_access=Identidad y acceso
@@ -3490,6 +3506,20 @@ notices.op=Operación
 notices.delete_success=Los avisos del sistema se han eliminado.
 
 
+config_summary = Resumen
+config_settings = Ajustes
+users.activated.description = Finalización de la verificación del correo electrónico. El propietario de una cuenta sin activar no podrá iniciar sesión hasta que la verificación se complete.
+users.organization_creation.description = Permitir la creación de nuevas organizaciones.
+emails.change_email_text = ¿Estás seguro que quieres actualizar esta dirección de correo electrónico?
+emails.delete = Eliminar correo electrónico
+emails.delete_desc = ¿Estás seguro que quieres eliminar esta dirección de correo electrónico?
+emails.deletion_success = El correo electrónico ha sido eliminado.
+emails.delete_primary_email_error = No puedes eliminar el correo electrónico principal.
+auths.tips.gmail_settings = Ajustes de Gmail:
+auths.tip.gitlab_new = Registrar una nueva aplicación en %s
+config.cache_test = Caché de prueba
+self_check.no_problem_found = Aún no se encontró un problema.
+
 [action]
 create_repo=creó el repositorio <a href="%s">%s</a>
 rename_repo=repositorio renombrado de <code>%[1]s</code> a <a href="%[2]s">%[3]s</a>
@@ -3633,7 +3663,7 @@ conda.install=Para instalar el paquete usando Conda, ejecute el siguiente comand
 container.details.type=Tipo de imagen
 container.details.platform=Plataforma
 container.pull=Arrastra la imagen desde la línea de comandos:
-container.digest=Resumen:
+container.digest=Resumen
 container.multi_arch=SO / Arquitectura
 container.layers=Capas de imagen
 container.labels=Etiquetas
@@ -3730,6 +3760,19 @@ owner.settings.chef.title=Registro de Chef
 owner.settings.chef.keypair=Generar par de claves
 owner.settings.chef.keypair.description=Un par de claves es necesario para autenticarse en el registro del Chef. Si ha generado un par de claves antes, generar un nuevo par de claves descartará el par de claves antiguo.
 
+arch.pacman.repo.multi = %s tiene la misma versión en diferentes distribuciones.
+arch.pacman.repo.multi.item = Configuración para %s
+arch.pacman.conf = Añadir servidor con distribución y arquitectura relacionadas a <code>/etc/pacman.conf</code> :
+arch.pacman.sync = Sincronizar el paquete con pacman:
+arch.version.properties = Propiedades de la versión
+arch.version.groups = Grupo
+arch.version.depends = Depende
+arch.version.conflicts = Conflictos
+arch.version.replaces = Reemplazos
+arch.version.backup = Copia de seguridad
+container.images.title = Imágenes
+rpm.repository.multiple_groups = Este paquete está disponible en múltiples grupos.
+
 [secrets]
 secrets=Secretos
 description=Los secretos pasarán a ciertas acciones y no se podrán leer de otro modo.
@@ -3748,7 +3791,7 @@ management=Gestión de secretos
 [actions]
 actions=Acciones
 
-unit.desc=Gestionar acciones
+unit.desc=Gestione procesos CI/CD integrados con Forgejo Actions.
 
 status.unknown=Desconocido
 status.waiting=Esperando
@@ -3832,6 +3875,9 @@ variables.update.failed=Error al editar la variable.
 variables.update.success=La variable ha sido editada.
 variables.id_not_exist = Variable con id %d no existe.
 
+runs.empty_commit_message = (mensaje de commit vacío)
+runs.expire_log_message = Los registros han sido eliminados porque eran demasiado antiguos.
+
 [projects]
 type-1.display_name=Proyecto individual
 type-2.display_name=Proyecto repositorio
@@ -3876,6 +3922,8 @@ fuzzy = Difusa
 runner_kind = Buscar ejecutores…
 regexp_tooltip = Interpretar los términos de búsqueda como una expresión regular
 
+regexp = Expresión Regular
+
 [markup]
 filepreview.lines = Líneas %[1]d a %[2]d en %[3]s
 filepreview.line = Línea %[1]d en %[2]s
@@ -3886,7 +3934,7 @@ releases.write = <b>Write:</b> Publicar, editar y eliminar lanzamientos y sus ar
 packages.read = <b>Lectura:</b> Ver y descargar paquetes asignados al repositorio.
 wiki.read = <b>Lectura:</b> Leer la wiki integrada y su historial.
 issues.read = <b>Lectura:</b> Leer y crear incidencias y comentarios.
-pulls.write = <b>Escritura:</b> Cerrar pull requests y gestionar metadatos como etiquetas, hitos,  asignaciones, fechas de vencimiento y dependencias.
+pulls.write = <b>Escritura:</b> Cerrar solicitudes de incorporación de cambios y gestionar metadatos como etiquetas, hitos, asignaciones, fechas de vencimiento y dependencias.
 releases.read = <b>Lectura:</b> Ver y descagar lanzamientos.
 wiki.write = <b>Escritura:</b> Crear, actualizar y eliminar páginas en la wiki integrada.
 projects.read = <b>Lectura:</b> Acceso a las tablas de proyecto del repositorio.
diff --git a/options/locale/locale_fa-IR.ini b/options/locale/locale_fa-IR.ini
index 8960be8bf4..e2c9dc4bdd 100644
--- a/options/locale/locale_fa-IR.ini
+++ b/options/locale/locale_fa-IR.ini
@@ -881,7 +881,7 @@ migrate.migrating_failed=مهاجرت از <b>%s</b> ناموفق بود.
 migrate.migrating_failed_no_addr=مهاجرت ناموفق بود.
 migrate.git.description=کوچ یک مخزن فقط از یک سرویس Git.
 migrate.gitlab.description=مهاجرت داده از gitlabb.com یا پیاده‌سازی‌های دیگر GitLab.
-migrate.gitea.description=مهاجرت داده از gitea.com یا پیاده‌سازی‌های دیگر Gitea/Forgejo.
+migrate.gitea.description=مهاجرت داده از gitea.com یا پیاده‌سازی‌های دیگر Gitea.
 migrate.gogs.description=مهاجرت داده از notabug.com یا پیاده‌سازی‌های دیگر Gogs.
 migrate.onedev.description=مهاجرت داده از code.onedev.io یا پیاده‌سازی‌های دیگر OneDev.
 migrate.codebase.description=مهاجر داده ها از codebasehq.com.
@@ -2291,7 +2291,7 @@ auths.bind_password=اتصال گذرواژه
 auths.user_base=پایگاه جستجوی کاربر
 auths.user_dn=کاربر DN
 auths.attribute_username=ویژگی نام کاربری
-auths.attribute_username_placeholder=نام کاربری را خالی بگذارید برای انتخاب نام کاربری gitea انتخاب شود.
+auths.attribute_username_placeholder=نام کاربری را خالی بگذارید برای انتخاب نام کاربری Forgejo انتخاب شود.
 auths.attribute_name=ویژگی نام
 auths.attribute_surname=ویژگی نام خانوادگی
 auths.attribute_mail=ویژگی ایمیل
diff --git a/options/locale/locale_fil.ini b/options/locale/locale_fil.ini
index b859885bd7..7f5be3cab3 100644
--- a/options/locale/locale_fil.ini
+++ b/options/locale/locale_fil.ini
@@ -2727,6 +2727,8 @@ issues.context.menu = Menu ng komento
 summary_card_alt = Pangkalahatang-ideyang card ng repositoryo na %s
 release.summary_card_alt = Pangkalahatang-ideyang card ng isang release na nakapamagat na "%s" sa repositoryo na %s
 
+editor.commit_email = Email ng commit
+
 [search]
 commit_kind = Maghanap ng mga commit…
 keyword_search_unavailable = Kasalukuyang hindi available ang paghahanap sa pamamagitan ng keyword. Mangyaring makipag-ugnayan sa tagapangasiwa ng site.
diff --git a/options/locale/locale_fr-FR.ini b/options/locale/locale_fr-FR.ini
index 50e4a65bc6..92da5ee8a2 100644
--- a/options/locale/locale_fr-FR.ini
+++ b/options/locale/locale_fr-FR.ini
@@ -1230,7 +1230,7 @@ migrate.migrating_failed_no_addr=Échec de la migration.
 migrate.github.description=Migrer les données depuis github.com ou GitHub Enterprise Server.
 migrate.git.description=Migrer uniquement un dépôt depuis n’importe quel service Git.
 migrate.gitlab.description=Migrer les données depuis gitlab.com ou d’autres instances de GitLab.
-migrate.gitea.description=Migrer les données depuis gitea.com ou d’autres instances de Gitea/Forgejo.
+migrate.gitea.description=Migrer les données depuis gitea.com ou d’autres instances de Gitea.
 migrate.gogs.description=Migrer les données depuis notabug.org ou d’autres instances de Gogs.
 migrate.onedev.description=Migrer les données depuis code.onedev.io ou d’autre instance de OneDev.
 migrate.codebase.description=Migrer les données depuis codebasehq.com.
@@ -2870,6 +2870,8 @@ issues.context.menu = Menu commentaire
 pulls.sign_in_require = <a href="%s">Identifiez vous</a> pour créer une nouvelle demande d'ajout.
 release.summary_card_alt = Carte résumé de la publication dont le titre est "%s" dans le dépôt %s
 
+editor.commit_email = Courriel de commit
+
 [graphs]
 component_loading = Chargement %s...
 component_loading_failed = Échec de chargement de %s
diff --git a/options/locale/locale_he.ini b/options/locale/locale_he.ini
new file mode 100644
index 0000000000..61845d49f3
--- /dev/null
+++ b/options/locale/locale_he.ini
@@ -0,0 +1,239 @@
+[common]
+home = בית
+dashboard = מבט על
+help = עזרה
+logo = לוגו
+sign_in = כניסה
+sign_in_with_provider = כניסה דרך %s
+sign_in_or = או
+sign_out = יציאה מהחשבון
+sign_up = הרשמה
+link_account = חיבור חשבון
+register = הרשמה
+version = גרסה
+powered_by = רץ על %s
+page = דף
+template = תבנית
+language = שפה
+notifications = הודעות
+active_stopwatch = סטופר
+create_new = חדש…
+user_profile_and_more = פרופיל והגדרות…
+signed_in_as = שלום
+enable_javascript = אתר זה משתמש בJavaScript.
+toc = תוכן הענינים
+licenses = רישיונות
+return_to_forgejo = חזרה לפורג'ו
+more_items = עוד אפשרויות
+username = שם משתמש
+email = כתובת אימייל
+password = סיסמה
+access_token = קוד גישה
+captcha = CAPTCHA
+twofa = אימות דו־שלבי
+twofa_scratch = קוד אימות דו־שלבי
+passcode = קוד כניסה
+webauthn_insert_key = יש להכניס את מפתח אבטחך
+webauthn_sign_in = יש ללחוץ על הכפתור שעל מפתח האבטחה. אם אין כפתור, אפשר להוציא את המפתח ולחבר אותו שוב.
+webauthn_press_button = נא ללחוץ על הכפתור שעל מפתח האבטחה…
+webauthn_error = קריאת מפתח האבטחה נכשלה.
+webauthn_unsupported_browser = הדפדפן שלך לא תומך בWebAuthn.
+webauthn_error_unknown = שגיאה לא ידועה, אפשר לנסות שוב.
+webauthn_error_insecure = הפרוטוקול WebAuthn לא תומך בחיבורים לא מאובטחים, למעט דרך "localhost" או "127.0.0.1"
+webauthn_error_unable_to_process = שרת זה נכשל בעיבוד בקשתך.
+webauthn_error_duplicated = מפתח האבטחה לא יכול לשמש לבקשה זו. נא לוודא שהמפתח לא רשום.
+webauthn_error_empty = שם המפתח הוא שדה חובה.
+webauthn_error_timeout = קריאת מפתחך לקחה יותר מדי זמן. אפשר לטעון מחדש את הדף ולנסות שוב.
+repository = קרפיף
+organization = ארגון
+mirror = מראה
+new_mirror = מראה חדשה
+new_fork = מזלוג חדש של קרפיף זה
+new_project = פרויקט חדש
+new_project_column = עמודה חדשה
+admin_panel = לוח ניהול מערכת
+settings = הגדרות
+your_profile = פרופיל
+your_starred = כיכבת
+your_settings = הגדרות
+new_repo.title = קרפיף חדש
+new_migrate.title = יבוא קרפיף
+new_org.title = ארגון חדש
+new_repo.link = קרפיף חדש
+new_migrate.link = יבוא קרפיף
+new_org.link = ארגון חדש
+all = הכל
+sources = מקורות
+mirrors = מראות
+collaborative = שיתופי
+forks = מזלוגים
+activities = פעילויות
+pull_requests = בקשות מיזוג
+issues = סוגיות
+milestones = מטרות
+ok = אישור
+cancel = ביטול
+retry = לנסות שוב
+rerun = הרצה חוזרת
+save = שמירה
+add = הוספה
+add_all = הוספת הכל
+remove = הסרה
+remove_all = הסרת הכל
+remove_label_str = הסרת "%s"
+edit = עריכה
+test = בדיקה
+enabled = מופעל
+disabled = כבוי
+locked = נעול
+copy = העתקה
+copy_generic = העתקה לCtrl + C
+copy_url = העתקת קישור
+copy_hash = העתקת קוד גיבוב
+copy_path = העתקת מיקום קובץ
+copy_content = העתקת תוכן
+copy_branch = העתקת שם ענף
+copy_success = הועתק!
+copy_error = העתקה נכשלה
+copy_type_unsupported = אי אפשר להעתיק קבצים מסוג זה
+write = כתיבה
+preview = תצוגה מקדימה
+loading = נטען…
+error = שגיאה
+error404 = דף זה <strong>לא קיים</strong> או ש<strong>אין לך אילו גישה</strong>.
+go_back = אחורה
+invalid_data = הבנת הקלט נכשלה: %v
+never = אף פעם
+unknown = לא ידוע
+rss_feed = פיד RSS
+pin = הצמדה
+unpin = ביטול הצמדה
+archived = ארכיון
+concept_system_global = גלובלי
+concept_user_individual = אישי
+concept_code_repository = קרפיף
+concept_user_organization = ארגון
+show_timestamps = הצגת זמנים
+show_log_seconds = הצגת שניות
+show_full_screen = מסך מלא
+download_logs = הורדת לוגים
+confirm_delete_selected = למחוק את כל הפריטים המסומנים?
+name = שם
+value = ערך
+filter = מסנן
+filter.clear = ניקוי מסננים
+filter.is_archived = בארכיון
+filter.not_archived = מחוץ לארכיון
+filter.is_fork = רק מזלוגים
+filter.not_fork = להוציא מזלוגים
+filter.is_mirror = רק מראות
+filter.not_mirror = להוציא מראות
+filter.is_template = רק תבניות
+filter.not_template = להוציא תבניות
+filter.public = ציבורי
+filter.private = פרטי
+
+[search]
+search = חיפוש...
+type_tooltip = סוג חיפוש
+fuzzy = מקורב
+fuzzy_tooltip = תוצאות יתאימו לתוכן תיבת החיפוש בקירוב; מומלץ כנגד שגיאות כתיב
+union = מילות מפתח
+union_tooltip = תוצאות יכללו לפחות מילת מפתח אחת; אפשר להפריד מילות מפתח עם רווחים
+exact = מדויק
+exact_tooltip = תוצאות יתאימו במדויק לתוכן תיבת החיפוש
+regexp = רג'קס
+repo_kind = חיפוש קרפיפים...
+user_kind = חיפוש אנשים...
+org_kind = חיפוש ארגונים...
+team_kind = חיפוש צוותים...
+code_kind = חיפוש קוד...
+code_search_unavailable = חיפוש קוד לא זמין. נא לדווח למנהלי המערכת.
+package_kind = חיפוש חבילות...
+project_kind = חיפוש פרוייקטים...
+branch_kind = חיפוש ענפים...
+commit_kind = חיפוש קומיטים...
+runner_kind = חיפוש מריצים...
+no_results = לא נמצאו תוצאות.
+issue_kind = חיפוש סוגיות...
+keyword_search_unavailable = חיפוש מילות מפתח לא זמין. נא לדווח למנהלי המערכת.
+
+[aria]
+navbar = סרגל הניווט
+footer.software = על תוכנה זו
+footer.links = קישורים
+
+[heatmap]
+number_of_contributions_in_the_last_12_months = % תרומות ב־12 החודשים האחרונים
+contributions_zero = אפס תרומות
+contributions_format = {contributions} ב{day} ל{month} {year}
+contributions_one = תרומה
+contributions_few = תרומות
+less = פחות
+more = יותר
+
+[editor]
+buttons.heading.tooltip = הוספת כותרת
+buttons.bold.tooltip = הדגשת טקסט
+buttons.italic.tooltip = הטיית טקסט
+buttons.quote.tooltip = ציטוט
+buttons.code.tooltip = הוספת קוד
+buttons.link.tooltip = הוספת קישור
+buttons.list.unordered.tooltip = הוספת רשימה לא ממוספרת
+buttons.list.ordered.tooltip = הוספת רשימה ממוספרת
+buttons.list.task.tooltip = הוספת רשימת משימות
+buttons.mention.tooltip = תיוג אדם או צוות
+buttons.ref.tooltip = ריפרור לסוגיה או בקשת מיזוג
+buttons.switch_to_legacy.tooltip = מעבר לעורך הישן
+buttons.enable_monospace_font = הפעלת גופן קבוע־רוחב
+buttons.disable_monospace_font = כיבוי גופן קבוע־רוחב
+buttons.new_table.tooltip = הוספת טבלה
+table_modal.header = הוספת טבלה
+table_modal.placeholder.header = כותרת
+table_modal.placeholder.content = תוכן
+table_modal.label.rows = שורות
+table_modal.label.columns = עמודות
+
+[filter]
+string.asc = סדר אלפבתי עולה
+string.desc = סדר אלפבתי יורד
+
+[error]
+occurred = קרתה שגיאה
+not_found = המטרה לא נמצאה.
+network_error = שגיאת אינטרנט
+server_internal = שגיאת שרת פנימית
+
+[startpage]
+install = קל להתקנה
+lightweight = קל
+license = קוד פתוח
+
+[install]
+install = התקנה
+title = הגדרה ראשונית
+db_title = הגדרות מסד מידע
+db_type = סוג מסד מידע
+user = שם משתמש
+password = סיסמה
+db_name = שם מסד המידע
+db_schema = סכימה
+db_schema_helper = תוכן ריק משמע ערך ברירת המחדל ("public") של מסד המידע.
+ssl_mode = SSL
+err_empty_admin_password = סיסמה של מנהל מערכת לא יכולה להיות ריקה.
+err_empty_admin_email = כתובת אימייל של מנהל מערכת היא חובה.
+general_title = הגדרות כלליות
+app_name = שם שרת זה
+
+[mail]
+issue_assigned.pull = @%[1]s שייך אותך לבקשת המיזוג %[2]s בקרפיף %[3]s.
+issue_assigned.issue = @%[1]s שייך אותך לסוגיה %[2]s בקרפיף %[3]s.
+repo.transfer.subject_to = %s רוצה להעביר את הקרפיף "%s" ל־%s
+repo.transfer.subject_to_you = %s רוצה להעביר את הקרפיף "%s" אליך
+repo.collaborator.added.text = הוספת בתור פועל לקרפיף:
+
+[form]
+RepoName = שם קרפיף
+repo_name_been_taken = כבר יש קרפיף בשם זה.
+repository_force_private = פרטיות כפויה מופעלת: קרפיפים פרטיים לא יכולים להעשות ציבוריים.
+repository_files_already_exist = כבר יש קבצים בקרפיף זה. יש לדבר עם מנהל המערכת כדי לתקן את הבעיה.
diff --git a/options/locale/locale_it-IT.ini b/options/locale/locale_it-IT.ini
index 2f5bf6f0c1..61753a718f 100644
--- a/options/locale/locale_it-IT.ini
+++ b/options/locale/locale_it-IT.ini
@@ -220,7 +220,7 @@ platform=Multipiattaforma
 lightweight=Leggero
 lightweight_desc=Forgejo ha requisiti minimi bassi e può funzionare su un economico Raspberry Pi. Risparmia l'energia della tua macchina!
 license=Open Source
-license_desc=Ottieni <a target="_blank" rel="noopener noreferrer" href="%[1]s">Forgejo</a>! Partecipa per <a target="_blank" rel="noopener noreferrer" href="%[2]s">contribuire</a> a rendere questo progetto ancora migliore. Non aver paura di diventare un collaboratore!
+license_desc=Ottieni <a target="_blank" rel="noopener noreferrer" href="%[1]s">Forgejo</a>! Partecipa per <a target="_blank" rel="noopener noreferrer" href="%[2]s">contribuire</a> a rendere questo progetto ancora più bello. Non aver paura di diventare collaborante!
 install_desc = Semplicemente <a target="_blank" rel="noopener noreferrer" href="%[1]s">avvia l'eseguibile</a> per la tua piattaforma, distribuiscilo con <a target="_blank" rel="noopener noreferrer" href="%[2]s">Docker</a>, oppure scarica il <a target="_blank" rel="noopener noreferrer" href="%[3]s">pacchetto</a>.
 
 [install]
@@ -511,11 +511,11 @@ issue.action.push_n=<b>@%[1]s</b> ha immesso %[3]d commit presso %[2]s
 issue.action.close=<b>@%[1]s</b> chiuso #%[2]d.
 issue.action.reopen=<b>@%[1]s</b> riaperto #%[2]d.
 issue.action.merge=<b>@%[1]s</b> unito #%[2]d in %[3]s.
-issue.action.approve=<b>@%[1]s</b> ha approvato questa pull request.
-issue.action.reject=<b>@%[1]s</b> ha richiesto modifiche su questa pull request.
-issue.action.review=<b>@%[1]s</b> ha commentato questa pull request.
-issue.action.review_dismissed=<b>@%[1]s</b> ha respinto l'ultima recensione da %[2]s per questa pull request.
-issue.action.ready_for_review=<b>@%[1]s</b> ha contrassegnato questa pull request pronta per la revisione.
+issue.action.approve=<b>@%[1]s</b> ha approvato questa richiesta di modifica.
+issue.action.reject=<b>@%[1]s</b> ha richiesto modifiche su questa richiesta.
+issue.action.review=<b>@%[1]s</b> ha commentato questa richiesta di modifica.
+issue.action.review_dismissed=<b>@%[1]s</b> ha respinto l'ultima revisione di %[2]s per questa richiesta di modifica.
+issue.action.ready_for_review=<b>@%[1]s</b> ha contrassegnato questa richiesta di modifica come pronta per la revisione.
 issue.action.new=<b>@%[1]s</b> creato #%[2]d.
 issue.in_tree_path=In %s:
 
@@ -532,8 +532,8 @@ repo.transfer.subject_to_you=%s ti vorrebbe trasferire il repositorio "%s"
 repo.transfer.to_you=tu
 repo.transfer.body=Per accettare o respingerla visita %s o semplicemente ignorarla.
 
-repo.collaborator.added.subject=%s ti ha aggiunto a %s come collaboratorə
-repo.collaborator.added.text=Sei statə aggiuntə come collaboratorə al repositorio:
+repo.collaborator.added.subject=%s ti ha aggiunto a %s come collaborante
+repo.collaborator.added.text=Sei statə aggiuntə come collaborante al repositorio:
 reply = o rispondi direttamente a questa email
 admin.new_user.subject = Il nuovo utente %s si è appena registrato
 admin.new_user.user_info = Informazioni utente
@@ -690,7 +690,7 @@ joined_on = Membro dal %s
 block_user = Blocca utente
 block_user.detail_1 = Questo utente non ti seguirà più.
 block_user.detail_2 = Quest'utente non potrà interagire né con i tuoi repositori, né con le segnalazioni che hai aperto, né con i tuoi commenti.
-block_user.detail_3 = Non sarete in grado di aggiungervi come collaboratorɜ del repositorio.
+block_user.detail_3 = Non sarete in grado di aggiungervi come collaboranti del repositorio.
 code = Codice
 block = Blocca
 unblock = Sblocca
@@ -762,7 +762,7 @@ comment_type_group_lock=Stato blocco
 comment_type_group_review_request=Richiesta di revisione
 comment_type_group_pull_request_push=Commit aggiunti
 comment_type_group_project=Progetto
-comment_type_group_issue_ref=Riferimento del problema
+comment_type_group_issue_ref=Riferimento alla segnalazione
 saved_successfully=Le impostazioni sono state salvate correttamente.
 privacy=Privacy
 keep_activity_private_popup=La tua attività sarà visibile solo a te e agli amministratori dell'istanza
@@ -1029,7 +1029,7 @@ oauth2_application_locked = Forgejo preregistra alcune applicazioni OAuth2 all'a
 hooks.desc = Aggiungi richiami HTTP che saranno innescati per <strong>tutti i progetti</strong> che possiedi.
 repos_none = Non possiedi alcun progetto.
 blocked_users_none = Non ci sono utenti bloccati.
-keep_email_private_popup = Questo nasconderà il tuo indirizzo e-mail nel tuo profilo, nelle pull request e quando modifichi un file usando l'interfaccia web. I commit inoltrati non saranno modificati. Usa %s nei commit per associarli al tuo profilo.
+keep_email_private_popup = Questo nasconderà il tuo indirizzo e-mail nel tuo profilo, nelle richieste di modifica e quando modifichi un file usando l'interfaccia web. I commit inoltrati non saranno modificati. Usa %s nei commit per associarli al tuo profilo.
 verify_gpg_key_success = La chiave GPG "%s" è stata verificata.
 added_on = Aggiunto su %s
 additional_repo_units_hint = Suggerisci l'attivazione di unità aggiuntive nel repositorio
@@ -1189,7 +1189,7 @@ migrate.migrating_failed_no_addr=Migrazione non riuscita.
 migrate.github.description=Migrare i dati da github.com o da server GitHub Enterprise.
 migrate.git.description=Migra un repositorio solo da qualsiasi servizio Git.
 migrate.gitlab.description=Migrare i dati da gitlab.com o da altre istanze di GitLab.
-migrate.gitea.description=Migrare i dati da gitea.com o altre istanze di Gitea/Forgejo.
+migrate.gitea.description=Migrare i dati da gitea.com o altre istanze di Gitea.
 migrate.gogs.description=Migrare i dati da notabug.org o da altre istanze Gogs.
 migrate.onedev.description=Migrare i dati da code.onedev.io o da altre istanze OneDev.
 migrate.codebase.description=Migrare i dati da codebasehq.com.
@@ -1338,8 +1338,8 @@ commits.date=Data
 commits.older=Più vecchio
 commits.newer=Più recente
 commits.signed_by=Firmato da
-commits.signed_by_untrusted_user=Firmato da un utente non attendibile
-commits.signed_by_untrusted_user_unmatched=Firmato da un utente non attendibile che non corrisponde al committer
+commits.signed_by_untrusted_user=Firmato da un*utente non attendibile
+commits.signed_by_untrusted_user_unmatched=Firmato da un*utente non attendibile che non corrisponde al committente
 commits.gpg_key_id=ID chiave GPG
 commits.ssh_key_fingerprint=Impronta chiave SSH
 
@@ -1411,7 +1411,7 @@ issues.new.no_reviewers=Nessun revisore
 issues.choose.get_started=Cominciare
 issues.choose.open_external_link=Apri
 issues.choose.blank=Default
-issues.choose.blank_about=Crea un problema dal modello predefinito.
+issues.choose.blank_about=Crea una segnalazione dal modello predefinito.
 issues.no_ref=Nessun ramo/etichetta specificati
 issues.create=Crea segnalazione
 issues.new_label=Nuova etichetta
@@ -1482,8 +1482,8 @@ issues.action_milestone_no_select=Nessuna pietra miliare
 issues.action_assignee=Assegnatario
 issues.action_assignee_no_select=Nessun assegnatario
 issues.opened_by=aperta %[1]s da <a href="%[2]s">%[3]s</a>
-pulls.merged_by=di <a href="%[2]s">%[3]s</a> è stato fuso %[1]s
-pulls.merged_by_fake=di %[2]s è stato fuso %[1]s
+pulls.merged_by=di <a href="%[2]s">%[3]s</a> è stata fusa %[1]s
+pulls.merged_by_fake=di %[2]s è stata fusa %[1]s
 issues.closed_by=di <a href="%[2]s">%[3]s</a> è stato chiuso %[1]s
 issues.opened_by_fake=aperta %[1]s da %[2]s
 issues.closed_by_fake=di %[2]s è stato chiuso %[1]s
@@ -1511,7 +1511,7 @@ issues.ref_issue_from=`<a href="%[3]s">ha fatto riferimento a questa segnalazion
 issues.ref_pull_from=`<a href="%[3]s">ha fatto riferimento a questa richiesta di modifica %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_closing_from=`<a href="%[3]s">ha fatto riferimento a questa segnalazione da una richiesta di modifica %[4]s che la chiuderà</a>, <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_reopening_from=`<a href="%[3]s">ha fatto riferimento a questa segnalazione da una richiesta di modifica %[4]s che la riaprirà</a>, <a id="%[1]s" href="#%[1]s">%[2]s</a>`
-issues.ref_closed_from=`<a href="%[3]s">chiuso questo problema %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
+issues.ref_closed_from=`<a href="%[3]s">chiuso questa segnalazione %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_reopened_from=`<a href="%[3]s">ha riaperto questa segnalazione %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_from=`da %[1]s`
 issues.author=Autore
@@ -1549,32 +1549,32 @@ issues.subscribe=Iscriviti
 issues.unsubscribe=Annulla iscrizione
 issues.lock=Blocca conversazione
 issues.unlock=Sblocca conversazione
-issues.lock.unknown_reason=Impossibile bloccare un problema con un motivo sconosciuto.
+issues.lock.unknown_reason=Impossibile bloccare una segnalazione senza un motivo.
 issues.lock_duplicate=Un issue non può essere bloccato due volte.
-issues.unlock_error=Impossibile sbloccare un problema che non è bloccato.
-issues.lock_with_reason=ha bloccato come <strong>%s</strong> e limitato la conversazione ai collaboratori %s
-issues.lock_no_reason=ha bloccato e limitato la conversazione ai collaboratori %s
+issues.unlock_error=Impossibile sbloccare una segnalazione che non è bloccata.
+issues.lock_with_reason=ha bloccato come <strong>%s</strong> e limitato la conversazione allɜ collaboranti %s
+issues.lock_no_reason=ha bloccato e limitato la conversazione allɜ collaboranti %s
 issues.unlock_comment=ha sbloccato questa conversazione %s
 issues.lock_confirm=Blocca
 issues.unlock_confirm=Sblocca
 issues.lock.notice_1=- Altri utenti non possono aggiungere nuovi commenti a questa segnalazione.
-issues.lock.notice_2=- Tu e altri collaboratori con accesso a questo repository potete ancora lasciare commenti che altri possono vedere.
-issues.lock.notice_3=- Puoi sempre sbloccare questo problema in futuro.
-issues.unlock.notice_1=- Tutti potranno commentare nuovamente questo problema.
-issues.unlock.notice_2=- Puoi sempre chiudere nuovamente questo problema in futuro.
+issues.lock.notice_2=- Tu e altrɜ collaboranti con accesso a questo repositorio potete ancora lasciare commenti visibili da altre persone.
+issues.lock.notice_3=- Puoi sempre sbloccare questa segnalazione in futuro.
+issues.unlock.notice_1=- Tuttɜ potranno commentare nuovamente questa segnalazione.
+issues.unlock.notice_2=- Puoi sempre chiudere nuovamente questa segnalazione in futuro.
 issues.lock.reason=Motivo per il blocco
 issues.lock.title=Blocca la conversazione su questa issue.
 issues.unlock.title=Sblocca la conversazione su questa issue.
-issues.comment_on_locked=Non puoi commentare un problema bloccato.
+issues.comment_on_locked=Non puoi commentare una segnalazione bloccata.
 issues.delete=Elimina
-issues.delete.title=Eliminare questo problema?
-issues.delete.text=Vuoi davvero eliminare questo problema? (Questo rimuoverà permanentemente tutti i contenuti. Considera invece di chiuderlo, se vuoi tenerlo archiviato)
+issues.delete.title=Eliminare la segnalazione?
+issues.delete.text=Vuoi davvero eliminare la segnalazione? (Questo rimuoverà permanentemente tutti i contenuti. Considera invece di chiuderla, se vuoi tenerla archiviata)
 issues.tracker=Cronografo
 issues.start_tracking_short=Avvia timer
 issues.start_tracking=Avvia cronografo
 issues.start_tracking_history=ha iniziato a lavorare %s
-issues.tracker_auto_close=Il timer verrà interrotto automaticamente una volta che il problema verrá chiuso
-issues.tracking_already_started=`Hai già avviato il monitoraggio del tempo su <a href="%s">un altro problema</a>!`
+issues.tracker_auto_close=Il timer verrà fermato automaticamente quando questa segnalazione verrà chiusa
+issues.tracking_already_started=`Hai già avviato il monitoraggio del tempo su <a href="%s">un'altra segnalazione</a>!`
 issues.stop_tracking=Ferma timer
 issues.stop_tracking_history=`ha smesso di funzionare %s`
 issues.cancel_tracking=Scarta
@@ -1620,7 +1620,7 @@ issues.dependency.pr_closing_blockedby=Questa richiesta di modifica non può ess
 issues.dependency.issue_closing_blockedby=Questa segnalazione non può essere chiusa per via delle seguenti segnalazioni
 issues.dependency.issue_close_blocks=Questa segnalazione impedisce la chiusura delle seguenti segnalazioni
 issues.dependency.pr_close_blocks=Questa richiesta di modifica impedisce la chiusura delle seguenti segnalazioni
-issues.dependency.issue_close_blocked=Devi chiudere tutte le anomalie che bloiccano questo problema prima di chiudelo.
+issues.dependency.issue_close_blocked=Vanno chiuse tutte le segnalazioni che bloccano quest'ultima, prima di poterla chiudere.
 issues.dependency.pr_close_blocked=Chiudere tutte le anomalie che bloccano la richiesta di pull prima di effettaure il merge.
 issues.dependency.blocks_short=Blocchi
 issues.dependency.blocked_by_short=Dipende da
@@ -1628,8 +1628,8 @@ issues.dependency.remove_header=Rimuovi Dipendenza
 issues.dependency.issue_remove_text=Questo rimuoverà la dipendenza da questa issue. Continuare?
 issues.dependency.pr_remove_text=Questo rimuoverà la dipendenza da questa pull request. Continuare?
 issues.dependency.setting=Abilita le dipendenze per segnalazioni e richieste di modifica
-issues.dependency.add_error_same_issue=Non si può fare dipendere un problema da se stesso.
-issues.dependency.add_error_dep_issue_not_exist=Il problema dipendente non esiste.
+issues.dependency.add_error_same_issue=Non si può fare dipendere una segnalazione da se stessa.
+issues.dependency.add_error_dep_issue_not_exist=La segnalazione dalla quale dipende non esiste.
 issues.dependency.add_error_dep_not_exist=La dipendenza non esiste.
 issues.dependency.add_error_dep_exists=La dipendenza esiste già.
 issues.dependency.add_error_cannot_create_circular=Non puoi creare una dipendenza con due segnalazioni che si bloccano a vicenda.
@@ -1782,7 +1782,7 @@ pulls.auto_merge_newly_scheduled_comment=`ha programmato questa pull request per
 pulls.auto_merge_canceled_schedule_comment=`cancella l'auto-merging di questa pull request quando tutti i testi sono superati %[1]s`
 
 pulls.delete.title=Eliminare questa pull request?
-pulls.delete.text=Vuoi davvero eliminare questo problema? (Questo rimuoverà permanentemente tutti i contenuti. Considera invece di chiuderlo, se vuoi tenerlo archiviato)
+pulls.delete.text=Vuoi davvero eliminare questa richiesta di modifica? (Ciò rimuoverà permanentemente tutti i contenuti. Considera invece di chiuderla, se vuoi tenerla archiviata)
 
 
 
@@ -1816,8 +1816,8 @@ ext_wiki.desc=Collegamento a una wiki esterna.
 
 wiki=Wiki
 wiki.welcome=Benvenuti nella Wiki.
-wiki.welcome_desc=La wiki ti permette di scrivere e condividere documentazione con i collaboratori.
-wiki.desc=Scrivi e condividi documentazione con i collaboratori.
+wiki.welcome_desc=La wiki ti permette di scrivere e condividere documentazione con lɜ collaboranti.
+wiki.desc=Scrivi e condividi documentazione con lɜ collaboranti.
 wiki.create_first_page=Crea la prima pagina
 wiki.page=Pagina
 wiki.filter_page=Filtra pagina
@@ -1915,7 +1915,7 @@ search.code_search_unavailable=Attualmente la ricerca di codice non è disponibi
 settings=Impostazioni
 settings.desc=Impostazioni ti permette di gestire le impostazioni del repository
 settings.options=Repository
-settings.collaboration=Collaboratori
+settings.collaboration=Collaboranti
 settings.collaboration.admin=Amministratore
 settings.collaboration.write=Scrittura
 settings.collaboration.read=Lettura
@@ -2009,14 +2009,14 @@ settings.signing_settings=Impostazioni verifica firma
 settings.trust_model=Modello di fiducia per la firma
 settings.trust_model.default=Modello di fiducia predefinito
 settings.trust_model.default.desc=Usa il modello di trust del repository predefinito per questa installazione.
-settings.trust_model.collaborator=Collaboratore
-settings.trust_model.collaborator.long=Collaboratore: Firme di fiducia da parte dei collaboratori
-settings.trust_model.collaborator.desc=Le firme valide da parte dei collaboratori di questo repository saranno contrassegnate con "trusted" (sia che corrispondano al committer o meno). Altrimenti, le firme valide saranno contrassegnate con "untrusted" se la firma corrisponde al committer e "unmatched" se non.
+settings.trust_model.collaborator=Collaborante
+settings.trust_model.collaborator.long=Collaborante: firme di fiducia da parte dellɜ collaboranti
+settings.trust_model.collaborator.desc=Le firme valide da parte dellɜ collaboranti di questo repositorio saranno contrassegnate con "fidate" (sia che corrispondano a chi ha fatto il commit o meno). Altrimenti saranno contrassegnate con "non fidate" se la firma corrisponde a chi ha fatto il commit e "senza riscontro" se non.
 settings.trust_model.committer=Autorə
 settings.trust_model.committer.long=Committer: firme affidabili che corrispondono ai committer (questo corrisponde a GitHub e costringerà i commit firmati di Forgejo ad avere Forgejo come committer)
-settings.trust_model.collaboratorcommitter=Collaboratore+Committer
-settings.trust_model.collaboratorcommitter.long=Collaboratore+Committer: Firme di fiducia da parte dei collaboratori che corrispondono al committer
-settings.trust_model.collaboratorcommitter.desc=Le firme valide da parte dei collaboratori di questa repository saranno contrassegnate "fidate" se corrispondono al committer. Altrimenti le firme saranno contrassegnate con "untrusted" se la firma corrisponde al committer non corrisponde. Questo costringerà Forgejo a essere contrassegnato come committer su impegni firmati con l'effettivo committer contrassegnato come Co-Authored-By: e Co-Committed-By: nel commit. La chiave Forgejo predefinita deve corrispondere a un utente nel database.
+settings.trust_model.collaboratorcommitter=Collaborante+Committente
+settings.trust_model.collaboratorcommitter.long=Collaborante+Committente: firme di fiducia da parte dellɜ collaboranti che corrispondono allə committente
+settings.trust_model.collaboratorcommitter.desc=Le firme valide da parte dellɜ collaboranti di questo repositorio saranno contrassegnate "fidate" se corrispondono a chi fa il commit. Altrimenti saranno contrassegnate con "non fidate" se la firma corrisponde a chi fa il commit, e "senza riscontro" se non corrisponde. Questo costringerà Forgejo a essere contrassegnato come committente sui commit firmati, con l'effettivə committente contrassegnatə come Co-Authored-By: e Co-Committed-By: nel commit. La chiave Forgejo predefinita deve corrispondere a un*utente nella base dati.
 settings.wiki_delete=Elimina dati wiki
 settings.wiki_delete_desc=L'eliminazione dei dati della wiki del repository è permanente e non può essere annullata.
 settings.wiki_delete_notices_1=-Questa operazione eliminerà permanentemente e disabiliterà la wiki repository per %s.
@@ -2025,21 +2025,21 @@ settings.wiki_deletion_success=I dati della repository wiki sono stati eliminati
 settings.delete=Elimina questo progetto
 settings.delete_desc=L'eliminazione di un repository è un'operazione permanente e non può essere annullata.
 settings.delete_notices_1=-Questa operazione <strong>NON PUÒ</strong> essere annullata.
-settings.delete_notices_2=-Questa operazione eliminerà definitivamente il repository <strong>%s</strong> inclusi codice, issue, commenti, dati wiki e impostazioni collaboratore.
+settings.delete_notices_2=-Questa operazione eliminerà definitivamente il repositorio <strong>%s</strong>, inclusi codice, segnalazioni commenti, dati della wiki e impostazioni collaboranti.
 settings.delete_notices_fork_1=-I fork di questo repository diventeranno indipendenti dopo la cancellazione.
 settings.deletion_success=Il repository è stato eliminato.
 settings.update_settings_success=Le impostazioni del repository sono state aggiornate.
 settings.confirm_delete=Elimina progetto
-settings.add_collaborator=Aggiungi collaboratore
-settings.add_collaborator_success=Il collaboratore è stato aggiunto.
-settings.add_collaborator_inactive_user=Non posso aggiungere un utente inattivo come collaboratore.
-settings.add_collaborator_duplicate=Il collaboratore è già stato aggiunto a questo repository.
+settings.add_collaborator=Aggiungi collaborante
+settings.add_collaborator_success=Lə collaborante è statə aggiuntə.
+settings.add_collaborator_inactive_user=Non posso aggiungere un*utente inattivə come collaborante.
+settings.add_collaborator_duplicate=Lə collaborante è già statə aggiuntə a questo repositorio.
 settings.delete_collaborator=Rimuovi
-settings.collaborator_deletion=Rimuovi collaboratore
-settings.collaborator_deletion_desc=Rimuovere un collaboratore revocherà l'accesso a questo repository. Continuare?
-settings.remove_collaborator_success=Il collaboratore è stato rimosso.
+settings.collaborator_deletion=Rimuovi collaborante
+settings.collaborator_deletion_desc=Rimuovere unə collaborante ne revocherà l'accesso a questo repositorio. Continuare?
+settings.remove_collaborator_success=Lə collaborante è statə rimossə.
 settings.search_user_placeholder=Ricerca utente…
-settings.org_not_allowed_to_be_collaborator=Le organizzazioni non possono essere aggiunte come un collaboratore.
+settings.org_not_allowed_to_be_collaborator=Le organizzazioni non possono essere aggiunte come collaborante.
 settings.change_team_access_not_allowed=La modifica dell'accesso al team per il repository è stato limitato al solo proprietario dell'organizzazione
 settings.team_not_in_organization=Il team non è nella stessa organizzazione del repository
 settings.teams=Gruppi
@@ -2409,7 +2409,7 @@ actions = Azioni
 commit.operations = Operazioni
 issues.action_check = Seleziona/Deseleziona
 issues.close = Chiudi segnalazione
-issues.role.collaborator = Collaboratore
+issues.role.collaborator = Collaborante
 desc.sha256 = SHA256
 editor.add = Aggiungi %s
 editor.update = Aggiorna %s
@@ -2452,7 +2452,7 @@ settings.units.overview = Panoramica
 all_branches = Tutti i rami
 projects.column.assigned_to = Assegnato a
 pulls.cmd_instruction_hint = `Visualizza istruzioni per la riga di comando.`
-settings.add_collaborator_blocked_them = Non si può aggiungere il collaboratore perché ha bloccato il proprietario del progetto.
+settings.add_collaborator_blocked_them = Non si può aggiungere lə collaborante perché ha bloccato lə proprietariə del progetto.
 branch.protected_deletion_failed = Il ramo "%s" è protetto. Non può essere eliminato.
 branch.default_deletion_failed = Il ramo "%s" è il ramo predefinito. Non può essere eliminato.
 branch.tag_collision = Il ramo "%s" non può essere creato perché esiste già un'etichetta con lo stesso nome nel repositorio.
@@ -2566,7 +2566,7 @@ settings.wiki_branch_rename_success = Il nome del ramo della wiki della repo è
 settings.wiki_branch_rename_failure = Impossibile normalizzare il nome del ramo della wiki della repo.
 settings.confirm_wiki_branch_rename = Rinomina il ramo della wiki
 settings.wiki_rename_branch_main_notices_2 = Ciò rinominerà permanentemente il ramo interno della wiki della repo di %s. Passaggi esistenti dovranno essere aggiornati.
-settings.add_collaborator_blocked_our = Non si può aggiungere il collaboratore perché il proprietario del progetto lo ha bloccato.
+settings.add_collaborator_blocked_our = Non si può aggiungere lə collaborante perché lə proprietariə del progetto l'ha bloccatə.
 settings.webhook.replay.description_disabled = Per riprodurre questo richiamo HTTP, attivalo.
 settings.event_wiki_desc = Pagina wiki creata, rinominata, modificata o rimossa.
 settings.event_pull_request_review_request = Richiesta di modifica revisionata
@@ -2609,7 +2609,7 @@ invisible_runes_description = `Questo file contiene caratteri Unicode invisibili
 issues.filter_type.reviewed_by_you = Revisionati da te
 projects.edit_success = Il progetto "%s" è stato aggiornato.
 issues.keyword_search_unavailable = La ricerca per parola chiave non è attualmente disponibile. Contatta l'amministratore del sito.
-issues.role.collaborator_helper = Questo utente è stato invitato a collaborare sul progetto.
+issues.role.collaborator_helper = Quest*utente è statə invitatə a collaborare al progetto.
 pulls.commit_ref_at = `ha fatto riferimento a questa richiesta di modifica da un commit <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 settings.thread_id = ID della discussione
 release.title = Titolo del rilascio
@@ -2661,7 +2661,7 @@ settings.branches.add_new_rule = Aggiungi una nuova regola
 settings.actions_desc = Abilita azioni del progetto
 settings.new_owner_blocked_doer = Il nuovo proprietario ti ha bloccato.
 settings.update_settings_no_unit = Ili progetto dovrebbe consentire almeno qualche tipo di interazione.
-settings.add_collaborator_owner = Non si può aggiungere un proprietario come collaboratore.
+settings.add_collaborator_owner = Non si può aggiungere unə proprietariə come collaborante.
 branch.delete_desc = L'eliminazione di un ramo è definitiva. Nonostante il ramo eliminato potrebbe continuare ad esistere per un breve periodo di tempo prima di essere realmente eliminato, l'eliminazione NON PUÒ essere annullata in molti casi. Continuare?
 editor.invalid_commit_mail = Email invalida per creare un commit.
 editor.branch_does_not_exist = Non esiste nessun ramo "%s" nel repositorio.
@@ -2780,9 +2780,9 @@ settings.matrix.access_token_helper = È consigliata l'impostazione di un accoun
 issues.author.tooltip.issue = Questo utente è l'autore di questa segnalazione.
 form.string_too_long = La stringa data è più lunga di %d caratteri.
 project = Progetti
-issues.edit.already_changed = Impossibile salvare le modifiche al problema. Sembra che il contenuto sia già stato modificato da un altro utente. Aggiornare la pagina e provare a modificare nuovamente per evitare di sovrascrivere le modifiche
+issues.edit.already_changed = Impossibile salvare le modifiche alla segnalazione. Sembra che il contenuto sia già stato modificato da un*altrə utente. Aggiornare la pagina e provare a modificare nuovamente per evitare di sovrascrivere le modifiche
 subscribe.pull.guest.tooltip = Accedi per iscriverti a questa richiesta di modifica.
-subscribe.issue.guest.tooltip = Accedere per sottoscrivere questo problema.
+subscribe.issue.guest.tooltip = Accedere per seguire questa segnalazione.
 n_release_one = rilascio %s
 n_release_few = rilasci %s
 issues.author.tooltip.pr = Quest'utente è l'autorə di questa richiesta di modifica.
@@ -2889,7 +2889,7 @@ teams.read_access_helper=I membri possono visualizzare e clonare i repository de
 teams.write_access=Scrittura
 teams.write_access_helper=I membri possono leggere e pushare sui repository del team.
 teams.admin_access=Accesso amministratore
-teams.admin_access_helper=I membri possono pullare e pushare sulle repository del team e anche aggiungere collaboratori.
+teams.admin_access_helper=I membri possono prelevare e immettere sui repositori del team e aggiungere collaboranti.
 teams.no_desc=Questo team non ha alcuna descrizione
 teams.settings=Impostazioni
 teams.owners_permission_desc=I proprietari hanno pieno accesso a <strong>tutti i repository</strong> e hanno <strong>diritti di amministratore</strong> nell'organizzazione.
@@ -2902,7 +2902,7 @@ teams.delete_team_desc=Eliminare un team revocherà l'accesso al repository da p
 teams.delete_team_success=Il team è stato eliminato.
 teams.read_permission_desc=Questo team concede l'accesso di <strong>lettura</strong>: i membri possono visualizzare e clonare i repository del team.
 teams.write_permission_desc=Questo team concede l'accesso di <strong>Scrittura</strong>: i membri possono leggere da e pushare sui repository del team.
-teams.admin_permission_desc=Questo team concede l'accesso di <strong>Amministratore</strong>: i membri possono leggere da, pushare su e aggiungere collaboratori ai repository del team.
+teams.admin_permission_desc=Questo team concede l'accesso di <strong>Amministrante</strong>: i membri possono leggere da, immettere in e aggiungere collaboranti ai repositori del team.
 teams.create_repo_permission_desc=Inoltre, questo team concede il permesso di <strong>Creare repository</strong>: i membri possono creare nuove repository nell'organizzazione.
 teams.repositories=Progetti della squadra
 teams.search_repo_placeholder=Ricerca repository…
@@ -3463,7 +3463,7 @@ auths.tips.gmail_settings = Impostazioni Gmail:
 config.test_mail_failed = Impossibile inviare email di prova a "%s": %v
 users.details = Dettagli dell'utente
 monitor.queue.review_add = Revisiona / aggiungi lavoratori
-self_check.no_problem_found = Nessun problema trovato.
+self_check.no_problem_found = Non c'è ancora nessuna segnalazione.
 self_check.database_inconsistent_collation_columns = La base di dati sta usando la collazione %s ma queste colonne usano una collazione diversa. Potrebbe causare problemi imprevisti.
 monitor.queue.settings.remove_all_items = Rimuovi tutto
 monitor.queue.settings.desc = Le piscine crescono dinamicamente in risposta al blocco dei lavoratori in coda.
@@ -3483,11 +3483,13 @@ config.app_slogan = Slogan dell'istanza
 auths.default_domain_name = Nome di dominio predefinito utilizzato per l'indirizzo e-mail
 
 
+users.restricted.description = Permetti di interagire solo con i repositori e le organizzazioni in cui l'utente è aggiuntə come collaborante. Ciò evita l'accesso ai repositori pubblici di quest'istanza.
+
 [action]
 create_repo=ha creato il repository <a href="%s">%s</a>
 rename_repo=repository rinominato da <code>%[1]s</code> a <a href="%[2]s">[3]s</a>
 create_issue=`ha aperto la segnalazione <a href="%[1]s">%[3]s#%[2]s</a>`
-close_issue=`ha chiuso il problema <a href="%[1]s">%[3]s#%[2]s</a>`
+close_issue=`ha chiuso la segnalazione <a href="%[1]s">%[3]s#%[2]s</a>`
 reopen_issue=`ha riaperto la segnalazione <a href="%[1]s">%[3]s#%[2]s</a>`
 create_pull_request=`ha creato la pull request <a href="%[1]s">%[3]s#%[2]s</a>`
 close_pull_request=`ha chiuso la pull request <a href="%[1]s">%[3]s#%[2]s</a>`
diff --git a/options/locale/locale_ja-JP.ini b/options/locale/locale_ja-JP.ini
index b0fc38d911..890c2e857c 100644
--- a/options/locale/locale_ja-JP.ini
+++ b/options/locale/locale_ja-JP.ini
@@ -1217,7 +1217,7 @@ migrate.migrating_failed_no_addr=移行に失敗しました。
 migrate.github.description=github.com やその他の GitHub エンタープライズサーバーからデータを移行します。
 migrate.git.description=Git サービスからリポジトリのみを移行します。
 migrate.gitlab.description=gitlab.com やその他の GitLab インスタンスからデータを移行します。
-migrate.gitea.description=gitea.com やその他の Gitea/Forgejo インスタンスからデータを移行します。
+migrate.gitea.description=gitea.com やその他の Gitea インスタンスからデータを移行します。
 migrate.gogs.description=notabug.org  やその他の Gogs インスタンスからデータを移行します。
 migrate.onedev.description=code.onedev.io やその他の OneDev インスタンスからデータを移行します。
 migrate.codebase.description=codebasehq.com からデータを移行します。
diff --git a/options/locale/locale_ko-KR.ini b/options/locale/locale_ko-KR.ini
index a2a50d7440..58e723db7a 100644
--- a/options/locale/locale_ko-KR.ini
+++ b/options/locale/locale_ko-KR.ini
@@ -1435,6 +1435,8 @@ issues.cancel_tracking_history = `취소된 시간 기록 %s`
 settings.enter_repo_name = 표시된 소유자와 저장소명을 정확하게 입력하세요:
 settings.packagist_username = Packagist 사용자명
 
+archive.title_date = 이 저장소는 %s에 보관처리되었습니다. 파일을 볼 수 있고 복제할 수도 있지만, 푸시하거나 이슈를 열거나 풀 리퀘스트를 만들 수 없습니다.
+
 [graphs]
 
 [org]
diff --git a/options/locale/locale_lv-LV.ini b/options/locale/locale_lv-LV.ini
index 8ed697a164..bd77588b5b 100644
--- a/options/locale/locale_lv-LV.ini
+++ b/options/locale/locale_lv-LV.ini
@@ -213,7 +213,7 @@ string.desc=Z - A
 
 [error]
 occurred=Radusies kļūda
-report_message=Ja ir pārliecība, ka šī ir Forgejo nepilnība, lūgums pārbaudīt <a href="%s" target="_blank">GitHub</a>, vai tā jau nav zināma, vai izveidot jaunu pieteikumu, ja nepieciešams.
+report_message=Ja ir pārliecība, ka šī ir Forgejo nepilnība, lūgums pārbaudīt <a href="%s" target="_blank">Codeberg</a>, vai tā jau nav zināma, vai izveidot jaunu pieteikumu, ja nepieciešams.
 missing_csrf=Kļūdains pieprasījums: netika iesūtīta drošības pilnvara
 invalid_csrf=Kļūdains pieprasījums: iesūtīta kļūdaina drošības pilnvara
 not_found=Pieprasītie dati netika atrasti.
@@ -2868,6 +2868,8 @@ issues.reaction.alt_add = Pievienot piebildei %[1] reakcijas.
 issues.context.menu = Piebildes izvēlne
 release.summary_card_alt = Laidiena "%s" apkopojuma kartīte glabātavā %s
 
+editor.commit_email = Iesūtījuma e-pasta adrese
+
 [graphs]
 component_loading=Ielādē %s...
 component_loading_failed=Nevarēja ielādēt %s
diff --git a/options/locale/locale_nds.ini b/options/locale/locale_nds.ini
index f87cd5f156..a7c96e3698 100644
--- a/options/locale/locale_nds.ini
+++ b/options/locale/locale_nds.ini
@@ -511,6 +511,8 @@ PayloadUrl = Ladung-URL
 visit_rate_limit = Frömd-Togriep hett Togrieps-Begrenz troffen.
 2fa_auth_required = Frömd-Togriep bruukt Twee-Faktooren-Anmellen.
 
+email_domain_is_not_allowed = De Domään vun de Bruker-E-Mail-Adress <b>%s</b> passt nich mit EMAIL_DOMAIN_ALLOWLIST of EMAIL_DOMAIN_BLOCKLIST. Wees wiss, dat du de E-Mail-Adress recht sett hest.
+
 [user]
 change_avatar = Änner dien Kontobill …
 joined_on = Am %s bitreden
@@ -2566,6 +2568,8 @@ issues.reaction.alt_remove = De %[1]s-Reageren vun de Kommentaar wegdoon.
 issues.context.menu = Kommentaar-Menü
 release.summary_card_alt = Tosamenfatens-Kaart vun eenem Publizeren mit de Naam »%s« im Repositorium %s
 
+editor.commit_email = Kommitterens-E-Mail
+
 [repo.permissions]
 code.read = <b>Lesen:</b> De Quelltext vun deesem Repositorium ankieken un klonen.
 code.write = <b>Schrieven:</b> Schuuv to de Repositorium un maak Twiegen un Markens.
diff --git a/options/locale/locale_nl-NL.ini b/options/locale/locale_nl-NL.ini
index b8f36ca5b4..83acf180d6 100644
--- a/options/locale/locale_nl-NL.ini
+++ b/options/locale/locale_nl-NL.ini
@@ -234,7 +234,7 @@ install_desc = Draai gewoon <a target="_blank" rel="noopener noreferrer" href="%
 [install]
 install=Installatie
 title=Initiële configuratie
-docker_helper=Als je gitea draait in Docker, Lees eerst de <a target="_blank" rel="noopener noreferrer" href="%s">documentatie</a> voordat je een instelling aanpast.
+docker_helper=Als je Forgejo draait in Docker, Lees eerst de <a target="_blank" rel="noopener noreferrer" href="%s">documentatie</a> voordat je een instelling aanpast.
 require_db_desc=Forgejo vereist MySQL, PostgreSQL, SQLite3 of TiDB (MySQL protocol).
 db_title=Database-instellingen
 db_type=Database-type
@@ -1207,7 +1207,7 @@ migrate.migrating_failed_no_addr=Migratie is mislukt.
 migrate.github.description=Migreer gegevens van github.com of GitHub Enterprise server.
 migrate.git.description=Migreer een repositorie van elke Git service.
 migrate.gitlab.description=Gegevens migreren van gitlab.com of andere GitLab-instanties.
-migrate.gitea.description=Gegevens overzetten van gitea.com of andere Gitea/Forgejo instanties.
+migrate.gitea.description=Gegevens overzetten van gitea.com of andere Gitea instanties.
 migrate.gogs.description=Gegevens overzetten van notabug.org of andere Gogs instanties.
 migrate.onedev.description=Gegevens overzetten van code.onedev.io of andere OneDev instanties.
 migrate.codebase.description=Gegevens migreren van codebasehq.com.
diff --git a/options/locale/locale_pl-PL.ini b/options/locale/locale_pl-PL.ini
index 2af7648f8d..11ea38ee2b 100644
--- a/options/locale/locale_pl-PL.ini
+++ b/options/locale/locale_pl-PL.ini
@@ -128,7 +128,7 @@ retry = Ponów
 view = Widok
 go_back = Wróć
 filter = Filtr
-confirm_delete_artifact = Jesteś penwy że chcesz usunąć artefakt "%s"?
+confirm_delete_artifact = Jesteś pewny(-na) że chcesz usunąć artefakt "%s"?
 concept_system_global = Globalne
 concept_user_individual = Indywidualny
 filter.clear = Wyczyść filtry
@@ -148,10 +148,10 @@ filter.public = Publiczne
 filter.private = Prywatne
 copy_generic = Skopiuj do schowka
 toggle_menu = Przełącz menu
-tracked_time_summary = Podsumowanie śledzonego czasu na podstawie filtrów listy problemów
+tracked_time_summary = Podsumowanie śledzonego czasu na podstawie filtrów listy zgłoszeń
 show_timestamps = Pokaż znaczniki czasu
 filter.not_archived = Nie zarchiwizowane
-filter.not_mirror = Nie mirror
+filter.not_mirror = Bez kopii lustrzanych
 filter.not_template = Nie szablony
 filter.is_archived = Zarchiwizowane
 filter.is_mirror = Kopie lustrzane
@@ -199,7 +199,7 @@ buttons.mention.tooltip = Dodaj wzmiankę o użytkowniku lub zespole
 buttons.switch_to_legacy.tooltip = Zamiast tego użyj starego edytora
 buttons.disable_monospace_font = Wyłącz czcionkę monospace
 buttons.enable_monospace_font = Włącz czcionkę monospace
-buttons.indent.tooltip = Zagnieżdż elementy o jeden poziom
+buttons.indent.tooltip = Zagnieźdź elementy o jeden poziom
 buttons.new_table.tooltip = Dodaj tabelę
 table_modal.header = Dodaj tabelę
 table_modal.placeholder.header = Nagłówek
@@ -207,6 +207,8 @@ table_modal.placeholder.content = Zawartość
 table_modal.label.rows = Wiersze
 table_modal.label.columns = Kolumny
 
+buttons.unindent.tooltip = Usuń jeden poziom zagnieżdżenia
+
 [filter]
 string.asc = A - Z
 string.desc = Z - A
@@ -297,7 +299,7 @@ disable_gravatar.description=Wyłącz Gravatar i inne usługi zewnętrzne awatar
 federated_avatar_lookup=Włącz zewnętrzne awatary
 federated_avatar_lookup.description=Wyszukuj awatary za pomocą Libravatar.
 disable_registration=Wyłącz samodzielną rejestrację
-disable_registration.description=Tylko administratorzy instancji będą mogli tworzyć nowe konta użytkowników. Zaleca się pozostawienie rejestracji wyłączonej, chyba że zamierzasz hostować publiczną instancję dla wszystkich i jesteś gotowy na radzenie sobie z dużą ilością kont spamerskich.
+disable_registration.description=Tylko administratorzy instancji będą mogli tworzyć nowe konta użytkowników. Zaleca się pozostawienie rejestracji wyłączonej, chyba że zamierzasz hostować publiczną instancję dla wszystkich i jesteś gotowy(-a) na radzenie sobie z dużą ilością kont spamerskich.
 allow_only_external_registration.description=Użytkownicy będą mogli tworzyć nowe konta tylko za pomocą skonfigurowanych usług zewnętrznych.
 openid_signin=Włącz logowanie za pomocą OpenID
 openid_signin.description=Zezwól użytkownikom na logowanie się przez OpenID.
@@ -459,9 +461,9 @@ sign_up_successful = Konto zostało pomyślnie utworzone. Witamy!
 prohibit_login_desc = Twoje konto zostało zawieszone i nie może wchodzić w interakcje z instancją. Skontaktuj się z administratorem instancji, aby odzyskać dostęp.
 change_unconfirmed_email_summary = Zmień adres e-mail, na który zostanie wysłana wiadomość aktywacyjna.
 manual_activation_only = Skontaktuj się z administratorem witryny, aby dokończyć aktywację.
-change_unconfirmed_email = Jeśli podczas rejestracji podałeś nieprawidłowy adres e-mail, możesz go zmienić poniżej, a potwierdzenie zostanie wysłane na nowy adres.
+change_unconfirmed_email = Jeśli podczas rejestracji podałeś(-aś) nieprawidłowy adres e-mail, możesz go zmienić poniżej, a potwierdzenie zostanie wysłane na nowy adres.
 openid_signin_desc = Wprowadź swój identyfikator URI OpenID. Na przykład: alice.openid.example.org lub https://openid.example.org/alice.
-authorization_failed_desc = Autoryzacja nie powiodła się, ponieważ wykryliśmy nieprawidłowe żądanie. Skontaktuj się z autorem aplikacji, którą próbowałeś autoryzować.
+authorization_failed_desc = Autoryzacja nie powiodła się, ponieważ wykryliśmy nieprawidłowe żądanie. Skontaktuj się z autorem aplikacji, którą próbowałeś(-aś) autoryzować.
 password_pwned = Wybrane hasło znajduje się na <a target="_blank" rel="noopener noreferrer" href="%s">liście skradzionych haseł</a>, które zostały wcześniej ujawnione w wyniku publicznego naruszenia danych. Spróbuj ponownie z innym hasłem i rozważ zmianę tego hasła również w innych miejscach.
 last_admin = Nie można usunąć ostatniego administratora. Musi istnieć co najmniej jeden administrator.
 tab_signin = Zaloguj
@@ -469,7 +471,7 @@ oauth.signin.error = Wystąpił błąd podczas przetwarzania żądania autoryzac
 change_unconfirmed_email_error = Nie udało się zmienić adresu email: %v
 invalid_code_forgot_password = Twój kod potwierdzający jest niepoprawny lub wygasł. Naciśnij <a href="%s">tutaj⁣</a>, aby rozpocząć nową sesję.
 invalid_password = Twoje hasło nie zgadza się z hasłem, które zostało użyte do stworzenia konta.
-reset_password_wrong_user = Jesteś zalogowany jako %s, ale link odzyskujący jest dla %s
+reset_password_wrong_user = Jesteś zalogowany(-a) jako %s, ale link odzyskujący jest dla %s
 tab_signup = Zarejestruj
 oauth.signin.error.access_denied = Wniosek o autoryzację został odrzucony.
 oauth.signin.error.temporarily_unavailable = Autoryzacja nie powiodła się, ponieważ serwer uwierzytelniania jest tymczasowo niedostępny. Spróbuj ponownie później.
@@ -503,7 +505,7 @@ register_notify.text_3=Jeśli ktoś inny utworzył dla ciebie to konto, musisz n
 
 reset_password=Odzyskaj swoje konto
 reset_password.title=%s, otrzymaliśmy prośbę o odzyskanie konta
-reset_password.text=Jeśli to byłeś ty, kliknij poniższy link, aby odzyskać swoje konto w ciągu <b>%s</b>:
+reset_password.text=Jeśli to byłeś(-aś) ty, kliknij poniższy link, aby odzyskać swoje konto w ciągu <b>%s</b>:
 
 register_success=Rejestracja powiodła się
 
@@ -533,7 +535,7 @@ repo.transfer.to_you=ciebie
 repo.transfer.body=Aby zaakceptować lub odrzucić go, odwiedź %s lub po prostu go zignoruj.
 
 repo.collaborator.added.subject=%s dodał cię do %s jako współtwórce
-repo.collaborator.added.text=Zostałeś dodany jako współtwórca do repozytorium:
+repo.collaborator.added.text=Zostałeś(-aś) dodany jako współtwórca do repozytorium:
 issue.action.push_1 = <b>@%[1]s</b> pchnął %[3]d commit do %[2]s
 activate_email.title = %s, zweryfikuj swój adres e-mail
 admin.new_user.text = <a href="%s">Kliknij tutaj</a>, aby zarządzać tym użytkownikiem z panelu administracyjnego.
@@ -542,7 +544,7 @@ reply = lub odpowiedz bezpośrednio na ten e-mail
 admin.new_user.subject = Właśnie zarejestrował się nowy użytkownik %s
 admin.new_user.user_info = Informacje użytkownika
 issue.action.approve = <b>@%[1]s</b> zatwierdził ten pull request.
-issue.action.reject = <b>@%[1]s</b> poprosił o zmiany w tym pull requescie.
+issue.action.reject = <b>@%[1]s</b> poprosił o zmiany w tym pull requeście.
 issue.action.review_dismissed = <b>@%[1]s</b> odrzucił ostatnią analizę od %[2]s dla tego pull requesta.
 team_invite.subject = %[1]s zaprosił cię do dołączenia do organizacji %[2]s
 primary_mail_change.subject = Twój główny mail został zmieniony
@@ -552,18 +554,18 @@ password_change.subject = Twoje hasło zostało zmienione
 password_change.text_1 = Hasło do twojego konta zostało właśnie zmienione.
 team_invite.text_1 = %[1]s zaprosił cię do zespołu %[2]s w organizacji %[3]s.
 removed_security_key.no_2fa = Nie ma już skonfigurowanych innych metod 2FA, co oznacza, że nie jest już konieczne logowanie się do konta za pomocą 2FA.
-account_security_caution.text_2 = Jeśli to nie byłeś Ty, Twoje konto padło ofiarą włamania. Skontaktuj się z administratorem tej strony.
-account_security_caution.text_1 = Jeśli to byłeś ty, możesz bezpiecznie zignorować tę wiadomość.
-totp_enrolled.subject = Aktywowałeś TOTP jako metodę 2FA
-totp_enrolled.text_1.no_webauthn = Właśnie włączyłeś TOTP dla swojego konta. Oznacza to, że dla wszystkich przyszłych logowań do konta musisz używać TOTP jako metody 2FA.
-team_invite.text_3 = Uwaga: To zaproszenie było przeznaczone dla %[1]s. Jeśli nie spodziewałeś się tego zaproszenia, możesz zignorować ten email.
+account_security_caution.text_2 = Jeśli to nie byłeś(-aś) Ty, Twoje konto padło ofiarą włamania. Skontaktuj się z administratorem tej strony.
+account_security_caution.text_1 = Jeśli to byłeś(-aś) ty, możesz bezpiecznie zignorować tę wiadomość.
+totp_enrolled.subject = Aktywowałeś(-aś) TOTP jako metodę 2FA
+totp_enrolled.text_1.no_webauthn = Właśnie włączyłeś(-aś) TOTP dla swojego konta. Oznacza to, że dla wszystkich przyszłych logowań do konta musisz używać TOTP jako metody 2FA.
+team_invite.text_3 = Uwaga: To zaproszenie było przeznaczone dla %[1]s. Jeśli nie spodziewałeś(-aś) się tego zaproszenia, możesz zignorować ten email.
 totp_disabled.text_1 = Jednorazowe hasło czasowe (TOTP) zostało właśnie wyłączone na twoim koncie.
 totp_disabled.no_2fa = Nie ma już skonfigurowanych innych metod 2FA, co oznacza, że nie jest już konieczne logowanie się do konta za pomocą 2FA.
 removed_security_key.subject = Klucz bezpieczeństwa został usunięty
 removed_security_key.text_1 = Klucz bezpieczeństwa "%[1]s" został właśnie usunięty z twojego konta.
-totp_enrolled.text_1.has_webauthn = Właśnie włączyłeś TOTP dla swojego konta. Oznacza to, że dla wszystkich przyszłych logowań do konta możesz użyć TOTP jako metody 2FA lub użyć dowolnego klucza bezpieczeństwa.
+totp_enrolled.text_1.has_webauthn = Właśnie włączyłeś(-aś) TOTP dla swojego konta. Oznacza to, że dla wszystkich przyszłych logowań do konta możesz użyć TOTP jako metody 2FA lub użyć dowolnego klucza bezpieczeństwa.
 team_invite.text_2 = Kliknij poniższy link, aby dołączyć do zespołu:
-issue.action.merge = połączone
+issue.action.merge = <b>@%[1]s</b> połączył(-ła) #%[2]d z %[3]s.
 
 
 [modal]
@@ -661,7 +663,7 @@ invalid_group_team_map_error = ` mapowanie jest nieprawidłowe: %s`
 url_error = `"%s" nie jest poprawnym adresem URL.`
 unset_password = Użytkownik nie ustawił hasła.
 openid_been_used = Adres OpenID "%s" jest już używany.
-organization_leave_success = Pomyślnie opuściłeś organizację %s.
+organization_leave_success = Pomyślnie opuściłeś(-aś) organizację %s.
 must_use_public_key = Podany klucz jest kluczem prywatnym. Nie przesyłaj nigdzie swojego klucza prywatnego. Zamiast tego użyj klucza publicznego.
 Location = Lokalizacja
 username_error_no_dots = ` może zawierać tylko znaki alfanumeryczne ("0-9", "a-z", "A-Z"), myślnik ("-") oraz podkreślenie ("_"). Nie może zaczynać się ani kończyć znakami niealfanumerycznymi, a znaki niealfanumeryczne występujące po sobie są również zabronione.`
@@ -671,6 +673,13 @@ org_still_own_repo = Ta organizacja nadal jest właścicielem jednego lub wielu
 admin_cannot_delete_self = Nie możesz usunąć siebie, gdy jesteś administratorem. Proszę najpierw usunąć swoje uprawnienia administratora.
 
 
+include_error = ` musi zawierać podciąg znaków "%s".`
+email_domain_is_not_allowed = Domena adresu email użytkownika <b>%s</b> konfliktuje z EMAIL_DOMAIN_ALLOWLIST lub EMAIL_DOMAIN_BLOCKLIST. Upewnij się, że ustawiony adres email jest poprawny.
+unsupported_login_type = Ta forma logowania nie wspiera możliwości usunięcia konta.
+still_own_packages = Twoje konto jest właścicielem jednego lub więcej pakietów, musisz je najpierw usunąć.
+org_still_own_packages = Ta organizacja nadal jest właścicielem jednego lub wielu pakietów, musisz je najpierw usunąć.
+required_prefix = Pole musi zaczynać się od "%s"
+
 [user]
 change_avatar=Zmień swój awatar…
 repositories=Repozytoria
@@ -689,7 +698,7 @@ code = Kod
 block = Zablokuj
 unblock = Odblokuj
 block_user.detail = Pamiętaj, że zablokowanie użytkownika powoduje inne skutki, takie jak:
-block_user.detail_2 = Ten użytkownik nie będzie mógł wchodzić w interakcję z repozytoriami, których jesteś właścicielem, ani z problemami i komentarzami, które utworzyłeś.
+block_user.detail_2 = Ten użytkownik nie będzie mógł wchodzić w interakcję z repozytoriami, których jesteś właścicielem, ani ze zgłoszeniami i komentarzami, które utworzyłeś(-aś).
 settings = Ustawienia użytkownika
 followers_one = %d obserwujących
 following_one = %d obserwowanych
@@ -700,10 +709,21 @@ following.title.few = Obserwowani
 email_visibility.limited = Twój adres e-mail jest widoczny dla wszystkich uwierzytelnionych użytkowników
 block_user = Zablokuj użytkownika
 block_user.detail_1 = Przestaniecie się wzajemnie obserwować i nie będziecie mogli się wzajemnie obserwować.
-follow_blocked_user = Nie możesz obserwować tego użytkownika, ponieważ go zablokowałeś lub ten użytkownik zablokował Ciebie.
+follow_blocked_user = Nie możesz obserwować tego użytkownika, ponieważ go zablokowałeś(-aś) lub ten użytkownik zablokował Ciebie.
 show_on_map = Pokaż to mejsce na mapie
 
 
+joined_on = Dołączył w %s
+block_user.detail_3 = Nie będziecie mogli dodać siebie jako współpracownicy repozytorium.
+public_activity.visibility_hint.self_public = Twoja aktywność jest widoczna dla wszystkich, z wyjątkiem interakcji w przestrzeniach prywatnych. <a href="%s">Konfiguruj</a>.
+public_activity.visibility_hint.admin_public = Twoja aktywność jest widoczna dla wszystkich, jednak jako administrator masz możliwość podejrzenia interakcji w przestrzeniach prywatnych.
+public_activity.visibility_hint.self_private = Twoja aktywność jest widoczna tylko dla ciebie i administratorów tej instancji. <a href="%s">Konfiguruj</a>.
+public_activity.visibility_hint.admin_private = Ta aktywność jest dla ciebie widoczna ponieważ jesteś administratorem, ale użytkownik preferuje by ta aktywność była ukryta.
+public_activity.visibility_hint.self_private_profile = Twoja aktywność jest widoczna tylko dla ciebie i administratorów tej instancji ponieważ twój profil jest prywatny. <a href="%s">Konfiguruj</a>.
+form.name_reserved = Nazwa użytkownika "%s" jest zarezerwowana.
+form.name_pattern_not_allowed = Wzór "%s" nie jest dozwolony w nazwie użytkownika.
+form.name_chars_not_allowed = Nazwa użytkownika "%s" zawiera nieprawidłowe znaki.
+
 [settings]
 profile=Profil
 account=Konto
@@ -760,7 +780,7 @@ emails=Adresy e-mail
 manage_emails=Zarządzaj adresami e-mail
 manage_themes=Domyślny motyw
 manage_openid=Adresy OpenID
-theme_desc=Będzie to domyślny motyw na całej stronie.
+theme_desc=Ten motyw będzie użyty dla interfejsu przeglądarkowego kiedy będziesz zalogowany.
 primary=Podstawowy
 activated=Aktywowany
 requires_activation=Wymaga aktywacji
@@ -948,6 +968,87 @@ permissions_list = Uprawnienia:
 hints = Wskazówki
 change_password = Zmień hasło
 
+blocked_users = Zablokowani użytkownicy
+biography_placeholder = Powiedz innym coś o sobie! (Markdown jest wspierany)
+location_placeholder = Podziel się swoim położeniem z innymi
+profile_desc = O tobie
+pronouns = Zaimki
+pronouns_custom = Własne
+pronouns_custom_label = Własne zaimki
+pronouns_unspecified = Nieokreślone
+update_language = Zmień język
+update_language_not_found = Język "%s" nie jest dostępny.
+change_username_prompt = Uwaga: Zmiana nazwy użytkownika również zmienia URL konta.
+change_username_redirect_prompt = Stara nazwa użytkownika będzie przekierowywać dopóki ktoś jej nie przejmie.
+language.title = Domyślny język
+language.description = Ten język zostanie zapisany na twoim koncie i będzie używany jako domyślny po zalogowaniu.
+language.localization_project = Pomóż nam przetłumaczyć Forgejo na twój język! <a href="%s">Dowiedz się więcej</a>.
+additional_repo_units_hint = Proponuj włączenie dodatkowych jednostek repozytorium
+additional_repo_units_hint_description = Wyświetl wskazówkę "Włącz więcej" dla repozytoriów które nie mają włączonych wszystkich jednostek.
+update_hints = Zaktualizuj wskazówki
+update_hints_success = Wskazówki zostały zaktualizowane.
+hidden_comment_types = Rodzaje ukrytych komentarzy
+hidden_comment_types_description = Rodzaje komentarzy zaznaczone tutaj nie będą wyświetlały się na stronach zgłoszeń. Zaznaczenie "Etykieta" na przykład usunie wszystkie komentarze "<użytkownik> dodał/usunął <etykieta>".
+hidden_comment_types.ref_tooltip = Komentarze które odniosły się do zgłoszenia z innego zgłoszenia/commitu/…
+hidden_comment_types.issue_ref_tooltip = Komentarze gdzie użytkowników zmienił gałąź/tag powiązany ze zgłoszeniem
+comment_type_group_time_tracking = Śledzenie czasu
+comment_type_group_lock = Status blokady
+comment_type_group_review_request = Prośba o recenzję
+comment_type_group_pull_request_push = Dodane commity
+comment_type_group_issue_ref = Odniesienie do zgłoszenia
+saved_successfully = Twoje ustawienia zostały zapisane pomyślnie.
+keep_activity_private = Ukryj aktywność ze strony profilu
+keep_activity_private.description = Twoja <a href="%s">aktywność publiczna</a> będzie widoczna tylko dla ciebie i administratorów tej instancji.
+uploaded_avatar_is_too_big = Rozmiar wgranego pliku (%d KiB) przekraczana rozmiar maksymalny (%d KiB).
+update_user_avatar_success = Awatar użytkownika został zaktualizowany.
+retype_new_password = Potwierdź nowe hasło
+email_desc = Twój główny adres email będzie użyty dla powiadomień, odzyskiwania hasła i, chyba że jest ukryty, operacji Git w przeglądarce.
+can_not_add_email_activations_pending = Aktywacja w toku, spróbuj ponownie w ciągu kolejnych kilku minut jeżeli chcesz dodać nowy email.
+add_email_confirmation_sent = Email z potwierdzeniem został wysłany do "%s". By potwierdzić swój adres email, proszę sprawdź swoją skrzynkę odbiorczą i odwiedź dostarczony link w ciągu %s.
+keep_email_private_popup = Twój adres email nie będzie pokazywany na twoim profilu i nie będzie używany jako domyślny dla commitów utworzonych przez interfejs przeglądarki, takich jak wgrywanie plików, edycje, commity scalające. Zamiast tego, specjalny adres %s może zostać użyty do powiązania commitów z twoim kontem. Ta opcja nie wpływa na commity już istniejące.
+key_content_ssh_placeholder = Rozpoczyna się z "ssh-ed25519", "ssh-rsa", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "sk-ecdsa-sha2-nistp256@openssh.com", lub "sk-ssh-ed25519@openssh.com"
+verify_gpg_key_success = Klucz GPG "%s" został zweryfikowany.
+ssh_invalid_token_signature = Zapewniony klucz SSH, sygnatura lub token nie zgadzają się lub token jest przedawniony.
+verify_ssh_key_success = Klucz SSH "%s" został zweryfikowany.
+add_key_success = Klucz SSH "%s" został dodany.
+add_gpg_key_success = Klucz GPG "%s" został dodany.
+added_on = Dodane w %s
+valid_until_date = Ważne do %s
+ssh_signonly = SSH jest obecnie wyłączone więc te klucze używane są wyłącznie do weryfikacji podpisów commitów.
+access_token_deletion_desc = Usunięcie tokenu cofnie dostęp do twojego konta aplikacjom które z niego korzystają. Ta operacja nie może zostać cofnięta. Kontynuować?
+repo_and_org_access = Dostęp do Repozytoriów i Organizacji
+permissions_public_only = Wyłącznie publiczne
+permissions_access_all = Wszystkie (publiczne, prywatne i ograniczone)
+select_permissions = Wybierz uprawnienia
+permission_no_access = Brak dostępu
+permission_write = Odczyt i zapis
+access_token_desc = Wybrane uprawnienia tokenu ograniczają autoryzację tylko dla następujących ścieżek <a href="%[1]s" target="_blank">API</a>. Więcej szczegółów znajdziesz w <a href="%[2]s" target="_blank">dokumentacji</a> .
+at_least_one_permission = Musisz wybrać przynajmniej jedno uprawnienie by utworzyć token
+create_oauth2_application_success = Pomyślnie utworzyłeś(-aś) aplikację OAuth2.
+update_oauth2_application_success = Pomyślnie zaktualizowałeś(-aś) aplikację OAuth2.
+oauth2_confidential_client = Poufny klient. Zaznacz dla aplikacji które korzystają z ukrytego sekretu, na przykład aplikacji przeglądarkowych. Nie zaznaczaj dla aplikacji natywnych, w tym aplikacji mobilnych.
+oauth2_redirect_uris = Przekierowania URI. Proszę użyj osobnej linii dla każdego URI.
+oauth2_client_secret_hint = Sekret nie będzie pokazany ponownie po opuszczeniu lub odświeżeniu tej strony. Proszę upewnij się, że został zapisany.
+oauth2_application_remove_description = Usunięcie aplikacji OAuth2 uniemożliwi dostęp autoryzowanych kont użytkowników na tej instancji. Kontynuować?
+oauth2_application_locked = Forgejo rejestruje zawczasu kilka aplikacji OAuth2 podczas rozruchu jeżeli włączono taką opcję w konfiguracji. By zapobiec nieoczekiwanym zachowaniom, nie mogą one zostać ani edytowane, ani usunięte. Proszę odnieś się do dokumentacji OAuth2 po więcej informacji.
+authorized_oauth2_applications_description = Przyznałeś(-aś) dostęp do swojego osobistego konta Forgejo tym aplikacjom stron trzecich. Proszę cofnij dostęp dla aplikacji których już nie używasz.
+revoke_oauth2_grant_success = Dostęp cofnięty pomyślnie.
+twofa_recovery_tip = Jeżeli zgubisz swoje urządzenie, będziesz mógł użyć jednorazowego klucza odzyskiwania by odzyskać dostęp do swojego konta.
+twofa_scratch_token_regenerated = Twój jednorazowy klucz odzyskiwania to %s. Przechowuj go w bezpiecznym miejscu, gdyż nie będzie już pokazywany ponownie.
+webauthn_desc = Klucze bezpieczeństwa to urządzenia zawierające klucze kryptograficzne. Mogą zostać użyte do uwierzytelniania dwuskładnikowego. Klucze bezpieczeństwa muszą wspierać standard <a rel="noreferrer" target="_blank" href="%s">WebAuthn Authenticator</a>.
+webauthn_key_loss_warning = Jeżeli zgubisz swoje klucze bezpieczeństwa, utracisz dostęp do swojego konta.
+webauthn_alternative_tip = Możesz skonfigurować dodatkową metodę uwierzytelniania.
+hooks.desc = Dodaj webhooki które będą aktywowane dla <strong>wszystkich repozytoriów</strong> których jesteś właścicielem.
+repos_none = Nie posiadasz żadnych repozytoriów.
+blocked_users_none = Brak zablokowanych użytkowników.
+email_notifications.andyourown = Dodaj swoje własne powiadomienia
+visibility.public_tooltip = Widoczne dla wszystkich
+visibility.limited_tooltip = Widoczne tylko dla zalogowanych użytkowników
+visibility.private_tooltip = Widoczne tylko dla członków organizacji do których dołączyłeś(-aś)
+blocked_since = Zablokowany od %s
+user_unblock_success = Użytkownik odblokowany pomyślnie.
+user_block_success = Użytkownik zablokowany pomyślnie.
+
 [repo]
 owner=Właściciel
 owner_helper=Niektóre organizacje mogą nie pojawiać się w liście ze względu na limit maksymalnej liczby repozytoriów.
@@ -976,16 +1077,16 @@ generate_from=Wygeneruj z
 repo_desc=Opis
 repo_desc_helper=Wprowadź krótki opis (opcjonalnie)
 repo_lang=Język
-repo_gitignore_helper=Wybierz szablony pliku .gitignore.
+repo_gitignore_helper=Wybierz szablony pliku .gitignore
 issue_labels=Etykiety
 issue_labels_helper=Wybierz zestaw etykiet zgłoszeń
 license=Licencja
 license_helper=Wybierz plik licencji
-license_helper_desc=Licencja reguluje co inni mogą a czego nie mogą zrobić z Twoim kodem. Nie jesteś pewien, która licencja jest właściwa dla Twojego projektu? Zobacz <a target="_blank" rel="noopener noreferrer" href="%s">Wybór licencji.</a>
+license_helper_desc=Licencja reguluje co inni mogą a czego nie mogą zrobić z Twoim kodem. Nie jesteś pewien(-na), która licencja jest właściwa dla Twojego projektu? Zobacz <a target="_blank" rel="noopener noreferrer" href="%s">Wybór licencji</a>.
 readme=README
 readme_helper=Wybierz szablon pliku README
 readme_helper_desc=To jest miejsce, w którym możesz napisać pełny opis swojego projektu.
-auto_init=Inicjalizuj repozytorium (dodaje .gitignore, licencję i README)
+auto_init=Inicjalizuj repozytorium
 trust_model_helper_default=Domyślnie: Użyj domyślnego modelu zaufania dla tej instalacji
 create_repo=Utwórz repozytorium
 default_branch=Domyślny branch
@@ -1030,7 +1131,7 @@ desc.internal=Wewnętrzny
 desc.archived=Zarchiwizowane
 
 template.items=Elementy szablonu
-template.git_content=Zawartość gita (domyślna gałąź)
+template.git_content=Zawartość gita (Domyślna gałąź)
 template.git_hooks=Hooki Git
 template.webhooks=Webhooki
 template.topics=Tematy
@@ -1052,33 +1153,33 @@ migrate_options_lfs=Migruj pliki LFS
 migrate_options_lfs_endpoint.label=Punkt końcowy LFS
 migrate_options_lfs_endpoint.description=Migracja spróbuje użyć Git remote, aby <a target="_blank" rel="noopener noreferrer" href="%s">określić serwer LFS</a>. Możesz również określić niestandardowy punkt końcowy, jeśli dane repozytorium LFS są przechowywane gdzieś indziej.
 migrate_options_lfs_endpoint.description.local=Obsługiwana jest również lokalna ścieżka serwera.
-migrate_items=Składniki migracji
+migrate_items=Elementy migracji
 migrate_items_wiki=Wiki
 migrate_items_milestones=Kamienie milowe
 migrate_items_labels=Etykiety
 migrate_items_issues=Zgłoszenia
-migrate_items_pullrequests=Pull Requesty
-migrate_items_merge_requests=Merge Requests
+migrate_items_pullrequests=Pull requesty
+migrate_items_merge_requests=Requesty scalające
 migrate_items_releases=Wydania
-migrate_repo=Przenieś repozytorium
-migrate.clone_address=Migruj/klonuj z adresu URL
+migrate_repo=Migruj repozytorium
+migrate.clone_address=Migruj / Klonuj z adresu URL
 migrate.clone_address_desc=Adres HTTP(S) lub "klona" Gita istniejącego repozytorium
 migrate.clone_local_path=lub ścieżka lokalnego serwera
 migrate.permission_denied=Nie możesz importować lokalnych repozytoriów.
 migrate.permission_denied_blocked=Nie możesz importować z niedozwolonych hostów, poproś administratora o sprawdzenie ustawień ALLOWED_DOMAINS/ALLOW_LOCALNETWORKS/BLOCKED_DOMAINS.
 migrate.invalid_lfs_endpoint=Punkt końcowy LFS jest nieprawidłowy.
 migrate.failed=Migracja nie powiodła się: %v
-migrate.migrate_items_options=Token dostępu jest wymagany, aby zmigrować dodatkowe elementy
+migrate.migrate_items_options=Token dostępu jest wymagany, aby migrować dodatkowe elementy
 migrated_from=Zmigrowane z <a href="%[1]s">%[2]s</a>
-migrated_from_fake=Zmigrowane z %[1]s
+migrated_from_fake=Migrowane z %[1]s
 migrate.migrate=Migracja z %s
 migrate.migrating=Migrowanie z <b>%s</b>...
 migrate.migrating_failed=Migrowanie z <b>%s</b> nie powiodło się.
 migrate.migrating_failed_no_addr=Migracja nie powiodła się.
-migrate.github.description=Migracja danych z github.com lub innych instancji GitHub.
+migrate.github.description=Migracja danych z github.com lub serwerów Github Enterprise.
 migrate.git.description=Migracja repozytorium tylko z dowolnej usługi Git.
 migrate.gitlab.description=Migruj dane z gitlab.com lub innych instancji GitLab.
-migrate.gitea.description=Migruj dane z gitea.com lub innych instancji Gitea/Forgejo.
+migrate.gitea.description=Migruj dane z gitea.com lub innych instancji Gitea.
 migrate.gogs.description=Migracja danych z notabug.org lub innych instancji Gogs.
 migrate.onedev.description=Migracja danych z code.onedev.io lub innych instancji OneDev.
 migrate.codebase.description=Migracja danych z codebasehq.com.
@@ -1088,8 +1189,8 @@ migrate.migrating_topics=Migracja tematów
 migrate.migrating_milestones=Migracja kamieni milowych
 migrate.migrating_labels=Migracja etykiet
 migrate.migrating_releases=Migracja wydań
-migrate.migrating_issues=Migracja problemów
-migrate.migrating_pulls=Migracja Pull Requestów
+migrate.migrating_issues=Migracja zgłoszeń
+migrate.migrating_pulls=Migracja pull requestów
 
 mirror_from=kopia lustrzana
 forked_from=sforkowany z
@@ -1106,7 +1207,7 @@ fork=Forkuj
 download_archive=Pobierz repozytorium
 
 no_desc=Brak opisu
-quick_guide=Skrócona instrukcja
+quick_guide=Szybki przewodnik
 clone_this_repo=Klonuj repozytorium
 create_new_repo_command=Tworzenie nowego repozytorium z linii poleceń
 push_exist_repo=Wypychanie istniejącego repozytorium z linii poleceń
@@ -1122,7 +1223,7 @@ find_tag=Znajdź tag
 branches=Gałęzie
 tags=Tagi
 issues=Zgłoszenia
-pulls=Oczekujące zmiany
+pulls=Pull requesty
 project_board=Projekty
 labels=Etykiety
 org_labels_desc=Etykiety organizacji, które mogą być używane z <strong>wszystkimi repozytoriami</strong> w tej organizacji
@@ -1138,9 +1239,9 @@ released_this=wydał to
 file.title=%s w %s
 file_raw=Czysty
 file_history=Historia
-file_view_source=Zobacz Źródło
+file_view_source=Zobacz źródło
 file_view_rendered=Wyświetl renderowane
-file_view_raw=Zobacz czysty
+file_view_raw=Zobacz nieprzetworzony
 file_permalink=Bezpośredni odnośnik
 file_too_large=Ten plik jest zbyt duży, aby go wyświetlić.
 
@@ -1151,7 +1252,7 @@ stored_lfs=Przechowane za pomocą Git LFS
 symbolic_link=Dowiązanie symboliczne
 commit_graph=Wykres commitów
 commit_graph.select=Wybierz gałęzie
-commit_graph.hide_pr_refs=Ukryj Pull Requesty
+commit_graph.hide_pr_refs=Ukryj pull requesty
 commit_graph.monochrome=Monochromatyczny
 commit_graph.color=Kolor
 blame=Wina
@@ -1173,7 +1274,7 @@ editor.fork_before_edit=Musisz sforkować to repozytorium, aby nanieść lub zap
 editor.delete_this_file=Usuń plik
 editor.must_have_write_access=Musisz mieć uprawnienia do zapisu, aby nanieść lub zaproponować zmiany tego pliku.
 editor.name_your_file=Nazwij plik…
-editor.filename_help=Utwórz katalog, poprzez wpisanie jego nazwy i dodanie ukośnika ('/'). Usuń katalog, wciskając klawisz Backspace na początku pola tekstowego.
+editor.filename_help=Utwórz katalog, poprzez wpisanie jego nazwy i dodanie ukośnika ("/"). Usuń katalog, wciskając klawisz Backspace na początku pola tekstowego.
 editor.or=lub
 editor.cancel_lower=Anuluj
 editor.commit_signed_changes=Zatwierdź podpisane zmiany
@@ -1233,10 +1334,10 @@ projects.edit=Edytuj projekty
 projects.edit_subheader=Cele pozwalają na organizację zgłoszeń i śledzenie postępów.
 projects.modify=Zaktualizuj projekt
 projects.type.none=Brak
-projects.type.basic_kanban=Basic Kanban
-projects.type.bug_triage=Bug Triage
-projects.template.desc=Szablon projektu
-projects.template.desc_helper=Wybierz szablon projektu do rozpoczęcia
+projects.type.basic_kanban=Podstawowy kanban
+projects.type.bug_triage=Segregacja bugów
+projects.template.desc=Szablon
+projects.template.desc_helper=Wybierz szablon projektu by rozpocząć
 projects.type.uncategorized=Bez kategorii
 projects.column.edit_title=Nazwa
 projects.column.new_title=Nazwa
@@ -1253,12 +1354,12 @@ issues.filter_reviewers=Filtruj recenzentów
 issues.new=Nowe zgłoszenie
 issues.new.title_empty=Tytuł nie może być pusty
 issues.new.labels=Etykiety
-issues.new.no_label=Brak etykiety
+issues.new.no_label=Brak etykiet
 issues.new.clear_labels=Wyczyść etykiety
 issues.new.projects=Projekty
 issues.new.clear_projects=Wyczyść projekty
 issues.new.no_projects=Brak projektu
-issues.new.open_projects=Otwórz projekty
+issues.new.open_projects=Otwarte projekty
 issues.new.closed_projects=Zamknięte projekty
 issues.new.no_items=Brak elementów
 issues.new.milestone=Kamień milowy
@@ -1274,7 +1375,7 @@ issues.choose.get_started=Rozpocznij
 issues.choose.open_external_link=Otwórz
 issues.choose.blank=Domyślny
 issues.choose.blank_about=Utwórz problem z domyślnego szablonu.
-issues.no_ref=Nie określono gałęzi/etykiety
+issues.no_ref=Nie określono Gałęzi/Etykiety
 issues.create=Utwórz zgłoszenie
 issues.new_label=Nowa etykieta
 issues.new_label_placeholder=Nazwa etykiety
@@ -1349,17 +1450,17 @@ issues.context.copy_link=Skopiuj link
 issues.context.quote_reply=Cytuj odpowiedź
 issues.context.edit=Edytuj
 issues.context.delete=Usuń
-issues.close_comment_issue=Skomentuj i zamknij
+issues.close_comment_issue=Zamknij z komentarzem
 issues.reopen_issue=Otwórz ponownie
-issues.reopen_comment_issue=Skomentuj i otwórz ponownie
+issues.reopen_comment_issue=Otwórz ponownie z komentarzem
 issues.create_comment=Skomentuj
 issues.closed_at=`zamknął(-ęła) to zgłoszenie <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.reopened_at=`otworzył(-a) ponownie to zgłoszenie <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.commit_ref_at=`wspomniał(-a) to zgłoszenie z commita <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_issue_from=`<a href="%[3]s">odwołał(-a) się do tego zgłoszenia %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_pull_from=`<a href="%[3]s">odwołał(-a) się do tego Pull Requesta %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
-issues.ref_closing_from=`<a href="%[3]s">odwołał(-a) się do Pull Requesta %[4]s, który zamknie to zgłoszenie</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
-issues.ref_reopening_from=`<a href="%[3]s">odwołał(-a) się do Pull Requesta %[4]s, który otworzy na nowo to zgłoszenie</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
+issues.ref_closing_from=`<a href="%[3]s">odwołał(-a) się do pull requesta %[4]s, który zamknie to zgłoszenie</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
+issues.ref_reopening_from=`<a href="%[3]s">odwołał(-a) się z pull requesta %[4]s, który otworzy na nowo to zgłoszenie</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_closed_from=`<a href="%[3]s">zamknął(-ęła) to zgłoszenie %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_reopened_from=`<a href="%[3]s">ponownie otworzył(-a) to zgłoszenie %[4]s</a> <a id="%[1]s" href="#%[1]s">%[2]s</a>`
 issues.ref_from=`z %[1]s`
@@ -1397,12 +1498,12 @@ issues.unlock=Odblokuj konwersację
 issues.lock.unknown_reason=Nie można zablokować zagadnienia bez żadnego powodu.
 issues.lock_duplicate=Zagadnienie nie może być zablokowane ponownie.
 issues.unlock_error=Nie można odblokować zagadnienia, które nie jest zablokowane.
-issues.lock_with_reason=zablokowano jako <strong>%s</strong> i ograniczono konwersację do współtwórców %s
-issues.lock_no_reason=zablokowano i ograniczono konwersację do współtwórców %s
+issues.lock_with_reason=zablokowano jako <strong>%s</strong> i ograniczono konwersację do współpracowników %s
+issues.lock_no_reason=zablokowano i ograniczono konwersację do współpracowników %s
 issues.unlock_comment=odblokowano tę konwersację %s
 issues.lock_confirm=Zablokuj
 issues.unlock_confirm=Odblokuj
-issues.lock.notice_1=- Inni użytkownicy nie mogą dodawać nowych komentarzy do tego zagadnienia.
+issues.lock.notice_1=- Inni użytkownicy nie mogą dodawać nowych komentarzy do tego zgłoszenia.
 issues.lock.notice_2=- Ty i inni współtwórcy z dostępem do tego repozytorium możecie dalej pozostawiać komentarze dla innych.
 issues.lock.notice_3=- Możesz zawsze odblokować to zagadnienie w przyszłości.
 issues.unlock.notice_1=- Wszyscy będą mogli ponownie umieszczać komentarze w tym zagadnieniu.
@@ -1461,7 +1562,7 @@ issues.dependency.blocked_by_short=Zależy od
 issues.dependency.remove_header=Usuń zależność
 issues.dependency.issue_remove_text=Usunie to zależność z tego zgłoszenia. Kontynuować?
 issues.dependency.pr_remove_text=Usunie to tę zależność z tego Pull Requesta. Kontynuować?
-issues.dependency.setting=Włącz zależności dla zgłoszeń i Pull Requestów
+issues.dependency.setting=Włącz zależności dla zgłoszeń i pull requestów
 issues.dependency.add_error_same_issue=Zgłoszenie nie może być zależne od siebie samego.
 issues.dependency.add_error_dep_issue_not_exist=Zgłoszenie zależne nie istnieje.
 issues.dependency.add_error_dep_not_exist=Zależność nie istnieje.
@@ -1500,8 +1601,8 @@ compare.compare_base=baza
 compare.compare_head=porównaj
 
 pulls.desc=Włącz Pull Requesty i recenzjonowanie kodu.
-pulls.new=Nowy Pull Request
-pulls.compare_changes=Nowy Pull Request
+pulls.new=Nowy pull request
+pulls.compare_changes=Nowy pull request
 pulls.compare_changes_desc=Wybierz gałąź, do której chcesz scalić oraz gałąź, z której pobrać zmiany.
 pulls.compare_base=scal do
 pulls.compare_compare=ściągnij z
@@ -1509,7 +1610,7 @@ pulls.filter_branch=Filtruj branch
 pulls.no_results=Nie znaleziono wyników.
 pulls.nothing_to_compare=Te gałęzie są sobie równe. Nie ma potrzeby tworzyć Pull Requesta.
 pulls.nothing_to_compare_and_allow_empty_pr=Te gałęzie są równe. Ten PR będzie pusty.
-pulls.create=Utwórz Pull Request
+pulls.create=Utwórz pull request
 pulls.title_desc_few=chce scalić %[1]d commity/ów z <code>%[2]s</code> do <code id="%[4]s">%[3]s</code>
 pulls.merged_title_desc_few=scala %[1]d commity/ów z <code>%[2]s</code> do <code>%[3]s</code> %[4]s
 pulls.change_target_branch_at=`zmienia gałąź docelową z <b>%s</b> na <b>%s</b> %s`
@@ -1534,7 +1635,7 @@ pulls.required_status_check_administrator=Jako administrator, możesz wciąż sc
 pulls.can_auto_merge_desc=Ten Pull Request może być automatycznie scalony.
 pulls.cannot_auto_merge_desc=Ten Pull Request nie może być automatycznie scalony z powodu konfliktów.
 pulls.cannot_auto_merge_helper=Scal ręcznie, aby rozwiązać konflikty.
-pulls.num_conflicting_files_1=%d plików zawierających konflikty
+pulls.num_conflicting_files_1=%d plik zawierających konflikty
 pulls.num_conflicting_files_n=%d plików zawierających konflikty
 pulls.approve_count_1=%d zatwierdzenie
 pulls.approve_count_n=%d zatwierdzeń
@@ -1596,7 +1697,7 @@ milestones.invalid_due_date_format=Format daty realizacji musi mieć wartość '
 milestones.edit=Edytuj kamień milowy
 milestones.edit_subheader=Cele pozwalają zorganizować zagadnienia i śledzić postępy.
 milestones.cancel=Anuluj
-milestones.modify=Zaktualizuj cel
+milestones.modify=Zaktualizuj kamień milowy
 milestones.deletion=Usuń kamień milowy
 milestones.deletion_desc=Usunięcie celu usuwa go z wszystkich pozostałych zagadnień. Kontynuować?
 milestones.deletion_success=Cel został usunięty.
@@ -1622,7 +1723,7 @@ wiki.last_commit_info=%s edytuje tę stronę %s
 wiki.edit_page_button=Edytuj
 wiki.new_page_button=Nowa strona
 wiki.file_revision=Wersja strony
-wiki.wiki_page_revisions=Wersje stron wiki
+wiki.wiki_page_revisions=Wersje strony
 wiki.back_to_wiki=Powrót do strony wiki
 wiki.delete_page_button=Usuń stronę
 wiki.page_already_exists=Strona Wiki o tej samej nazwie już istnieje.
@@ -1639,39 +1740,39 @@ activity.period.quarterly=3 miesiące
 activity.period.semiyearly=6 miesięcy
 activity.period.yearly=1 rok
 activity.overview=Przegląd
-activity.active_prs_count_1=<strong>%d</strong> aktywny Pull Request
-activity.active_prs_count_n=<strong>%d</strong> aktywne Pull Requesty
-activity.merged_prs_count_1=Scalono Pull Request
-activity.merged_prs_count_n=Scalone Pull Requesty
-activity.opened_prs_count_1=Proponowany Pull Request
-activity.opened_prs_count_n=Proponowane Pull Requesty
+activity.active_prs_count_1=<strong>%d</strong> aktywny pull request
+activity.active_prs_count_n=<strong>%d</strong> aktywne pull requesty
+activity.merged_prs_count_1=Scalono pull request
+activity.merged_prs_count_n=Scalone pull requesty
+activity.opened_prs_count_1=Proponowany pull request
+activity.opened_prs_count_n=Proponowane pull requesty
 activity.title.user_1=%d użytkownik
 activity.title.user_n=%d użytkowników
-activity.title.prs_1=%d Pull Request
-activity.title.prs_n=%d Pull Requesty
+activity.title.prs_1=%d pull request
+activity.title.prs_n=%d pull requesty
 activity.title.prs_merged_by=%s zmergowane przez %s
 activity.title.prs_opened_by=%s zaproponowane przez %s
 activity.merged_prs_label=Scalone
 activity.opened_prs_label=Proponowane
-activity.active_issues_count_1=<strong>%d</strong> Aktywne zgłoszenia
-activity.active_issues_count_n=<strong>%d</strong> Aktywnych zgłoszeń
+activity.active_issues_count_1=<strong>%d</strong> aktywne zgłoszenie
+activity.active_issues_count_n=<strong>%d</strong> aktywne zgłoszenia
 activity.closed_issues_count_1=Zamknięte zgłoszenie
 activity.closed_issues_count_n=Zamknięte zgłoszenia
-activity.title.issues_1=%d Zgłoszenie
-activity.title.issues_n=%d Zgłoszenia
+activity.title.issues_1=%d zgłoszenie
+activity.title.issues_n=%d zgłoszenia
 activity.title.issues_created_by=%s utworzone przez %s
 activity.closed_issue_label=Zamknięty
 activity.new_issues_count_1=Nowe zgłoszenie
 activity.new_issues_count_n=Nowe zgłoszenia
 activity.new_issue_label=Otwarte
-activity.title.unresolved_conv_1=%d Nierozstrzygnięta dyskusja
-activity.title.unresolved_conv_n=%d Nierozstrzygniętych dyskusji
+activity.title.unresolved_conv_1=%d nierozstrzygnięta dyskusja
+activity.title.unresolved_conv_n=%d nierozstrzygniętych dyskusji
 activity.unresolved_conv_desc=Te niedawno zmienione zagadnienia i Pull Requesty nie zostały jeszcze rozwiązane.
 activity.unresolved_conv_label=Otwarte
-activity.title.releases_1=%d Wydanie
-activity.title.releases_n=%d Wydań
+activity.title.releases_1=%d wydanie
+activity.title.releases_n=%d wydania
 activity.title.releases_published_by=%s opublikowane przez %s
-activity.published_release_label=Opublikowane
+activity.published_release_label=Wydanie
 activity.no_git_activity=Nie było żadnej aktywności w tym okresie czasu.
 activity.git_stats_exclude_merges=Wykluczając scalenia,
 activity.git_stats_author_1=%d autor
@@ -1715,7 +1816,7 @@ settings.collaboration.undefined=Niezdefiniowany
 settings.hooks=Webhooki
 settings.githooks=Hooki Git
 settings.basic_settings=Ustawienia podstawowe
-settings.mirror_settings=Kopia lustrzana ustawień
+settings.mirror_settings=Ustawienia kopii lustrzanej
 settings.mirror_settings.mirrored_repository=Repozytorium lustrzane
 settings.mirror_settings.direction=Kierunek
 settings.mirror_settings.direction.pull=Pull
@@ -1726,30 +1827,30 @@ settings.mirror_settings.push_mirror.remote_url=Adres URL zdalnego repozytorium
 
 settings.sync_mirror=Synchronizuj teraz
 settings.site=Strona
-settings.update_settings=Aktualizuj ustawienia
+settings.update_settings=Zapisz ustawienia
 settings.branches.update_default_branch=Aktualizuj domyślną gałąź
 settings.advanced_settings=Ustawienia zaawansowane
 settings.wiki_desc=Włącz wiki repozytorium
 settings.use_internal_wiki=Użyj wbudowanego wiki
 settings.use_external_wiki=Użyj zewnętrznego wiki
-settings.external_wiki_url=Adres URL zewnętrznego Wiki
+settings.external_wiki_url=Adres URL zewnętrznego wiki
 settings.external_wiki_url_error=URL zewnętrznego wiki nie jest prawidłowym adresem URL.
 settings.external_wiki_url_desc=Odwiedzający są przekierowywani do zewnętrznego adresu URL wiki po kliknięciu w zakładkę wiki.
-settings.issues_desc=Włącz śledzenie zgłoszeń w repozytorium
-settings.use_internal_issue_tracker=Użyj wbudowanego śledzenia zgłoszeń
-settings.use_external_issue_tracker=Użyj zewnętrznego śledzenia zgłoszeń
-settings.external_tracker_url=URL zewnętrznego systemu śledzenia zgłoszeń
+settings.issues_desc=Włącz dziennik zgłoszeń w repozytorium
+settings.use_internal_issue_tracker=Użyj wbudowanego dziennika zgłoszeń
+settings.use_external_issue_tracker=Użyj zewnętrznego dziennika zgłoszeń
+settings.external_tracker_url=URL zewnętrznego dziennika zgłoszeń
 settings.external_tracker_url_error=Adres URL zewnętrznego śledzenia zgłoszeń nie jest poprawnym adresem URL.
 settings.external_tracker_url_desc=Odwiedzający są przekierowywani do adresu URL zewnętrznego systemu śledzenia zgłoszeń po kliknięciu w zakładkę zgłoszeń.
-settings.tracker_url_format=Format adresu URL zewnętrznego systemu śledzenia zgłoszeń
+settings.tracker_url_format=Format adresu URL zewnętrznego dziennika zgłoszeń
 settings.tracker_url_format_error=Adres URL zewnętrznego systemu śledzenia zgłoszeń nie jest poprawnym adresem URL.
-settings.tracker_issue_style=Format numerowania dla zewnętrznego systemu śledzenia zgłoszeń
+settings.tracker_issue_style=Format numerowania dla zewnętrznego dziennika zgłoszeń
 settings.tracker_issue_style.numeric=Numeryczny
 settings.tracker_issue_style.alphanumeric=Alfanumeryczne
 settings.tracker_url_format_desc=Użyj zamienników <code>{user}</code>, <code>{repo}</code> i <code>{index}</code> dla nazwy użytkownika, nazwy repozytorium i numeru porządkowego zgłoszenia.
 settings.enable_timetracker=Włącz śledzenie czasu
 settings.allow_only_contributors_to_track_time=Zezwalaj wyłącznie współpracownikom na śledzenie czasu
-settings.pulls_desc=Włącz Pull Requesty w repozytorium
+settings.pulls_desc=Włącz pull requesty w repozytorium
 settings.pulls.ignore_whitespace=Ignoruj znaki białe w konfliktach
 settings.projects_desc=Włącz projekty w repozytorium
 settings.admin_settings=Ustawienia administratora
@@ -1794,7 +1895,7 @@ settings.trust_model.committer.long=Committer: Ufaj podpisom zgodnym z committer
 settings.wiki_delete=Usuń dane Wiki
 settings.wiki_delete_desc=Usunięcie danych wiki jest nieodwracalne.
 settings.wiki_delete_notices_1=- Ta operacja usunie i wyłączy wiki repozytorium %s.
-settings.confirm_wiki_delete=Usuń dane Wiki
+settings.confirm_wiki_delete=Usuń dane wiki
 settings.wiki_deletion_success=Dane wiki repozytorium zostały usunięte.
 settings.delete=Usuń to repozytorium
 settings.delete_desc=Usunięcie repozytorium jest trwałe i nieodwracalne.
@@ -1804,7 +1905,7 @@ settings.delete_notices_fork_1=- Forki tego repozytorium będą niezależne po j
 settings.deletion_success=Repozytorium zostało usunięte.
 settings.update_settings_success=Ustawienia repozytorium zostały zaktualizowane.
 settings.confirm_delete=Usuń repozytorium
-settings.add_collaborator=Dodaj
+settings.add_collaborator=Dodaj współpracownika
 settings.add_collaborator_success=Dodano użytkownika.
 settings.add_collaborator_inactive_user=Nie możesz dodać nieaktywnego użytkownika jako współpracownika.
 settings.add_collaborator_duplicate=Współpracownik został już dodany do tego repozytorium.
@@ -1827,7 +1928,7 @@ settings.remove_team_success=Dostęp zespołu do repozytorium został usunięty.
 settings.add_webhook=Dodaj webhooka
 settings.add_webhook.invalid_channel_name=Nazwa kanału Webhooka nie może być pusta i nie może zawierać jedynie znaku #.
 settings.hooks_desc=Webhooki automatycznie tworzą zapytania HTTP POST do serwera, kiedy następują pewne zdarzenia w Forgejo. Przeczytaj o tym więcej w <a target="_blank" rel="noopener noreferrer" href="%s">przewodniku o Webhookach</a>.
-settings.webhook_deletion=Usuń Webhooka
+settings.webhook_deletion=Usuń webhooka
 settings.webhook_deletion_desc=Usunięcie Webhooka wykasuje jego ustawienia i historię dostaw. Kontynuować?
 settings.webhook_deletion_success=Webhook został usunięty.
 settings.webhook.test_delivery=Testuj dostawę
@@ -1841,7 +1942,7 @@ settings.githook_edit_desc=Jeśli hook jest nieaktywny, zaprezentowana zostanie
 settings.githook_name=Nazwa hooka
 settings.githook_content=Treść hooka
 settings.update_githook=Zaktualizuj hook
-settings.add_webhook_desc=Forgejo wyśle żądanie <code>POST</code> z określonym typem zawartości do docelowego adresu URL. Przeczytaj o tym więcej w <a target="_blank" rel="noopener noreferrer" href="%s">przewodniku o Webhookach</a>.
+settings.add_webhook_desc=Forgejo wyśle żądanie <code>POST</code> z określonym typem zawartości do docelowego adresu URL. Przeczytaj o tym więcej w <a target="_blank" rel="noopener noreferrer" href="%s">przewodniku o webhookach</a>.
 settings.payload_url=Adres docelowy URL
 settings.http_method=Metoda HTTP
 settings.content_type=Typ zawartości POST
@@ -1852,7 +1953,7 @@ settings.slack_color=Kolor
 settings.discord_username=Nazwa użytkownika
 settings.discord_icon_url=Adres URL ikony
 settings.event_desc=Wywołaj przy:
-settings.event_push_only=Wydarzeniach przepchnięcia
+settings.event_push_only=Wydarzeniach wypchnięcia
 settings.event_send_everything=Wszystkich wydarzeniach
 settings.event_choose=Niestandardowych wydarzeniach…
 settings.event_header_repository=Zdarzenia repozytorium
@@ -1870,39 +1971,39 @@ settings.event_push_desc=Wypchnięcie git do repozytorium.
 settings.event_repository=Repozytorium
 settings.event_repository_desc=Repozytorium stworzone lub usunięte.
 settings.event_header_issue=Zdarzenia zgłoszeń
-settings.event_issues=Zgłoszenia
+settings.event_issues=Modyfikacje
 settings.event_issues_desc=Zgłoszenie otwarte, zamknięte, ponownie otwarte lub zmodyfikowane.
-settings.event_issue_assign=Zgłoszenie przypisane
+settings.event_issue_assign=Przypisania
 settings.event_issue_assign_desc=Zgłoszenie przypisane bądź nieprzypisane.
-settings.event_issue_label=Zgłoszenie oznaczone
-settings.event_issue_label_desc=Etykieta zgłoszenia zaktualizowana lub usunięta.
-settings.event_issue_milestone=Ustawiono cel zgłoszenia
-settings.event_issue_milestone_desc=Ustawiono lub usunięto cel zgłoszenia.
-settings.event_issue_comment=Komentarz w zgłoszeniu
+settings.event_issue_label=Etykiety
+settings.event_issue_label_desc=Etykiety zgłoszeń zaktualizowane lub usunięte.
+settings.event_issue_milestone=Kamienie milowe
+settings.event_issue_milestone_desc=Dodano, usunięto lub zmodyfikowano kamień milowy.
+settings.event_issue_comment=Komentarze
 settings.event_issue_comment_desc=Komentarz w zgłoszeniu stworzony, edytowany lub usunięty.
-settings.event_header_pull_request=Zdarzenia Pull Requestów
-settings.event_pull_request=Pull Request
+settings.event_header_pull_request=Zdarzenia pull requestów
+settings.event_pull_request=Modyfikacje
 settings.event_pull_request_desc=Pull request otwarty, zamknięty, ponownie otwarty lub zmodyfikowany.
-settings.event_pull_request_assign=Pull Request przypisany
+settings.event_pull_request_assign=Przypisania
 settings.event_pull_request_assign_desc=Pull Request przypisany bądz nieprzypisany.
-settings.event_pull_request_label=Pull Request zaetykietowany
-settings.event_pull_request_label_desc=Etykieta pull requesta zaktualizowana lub usunięta.
-settings.event_pull_request_milestone=Ustawiono cel Pull Requesta
-settings.event_pull_request_milestone_desc=Ustawiono lub usunięto cel pull requesta.
-settings.event_pull_request_comment=Pull Request skomentowany
+settings.event_pull_request_label=Etykiety
+settings.event_pull_request_label_desc=Etykiety pull requestów zaktualizowane lub usunięte.
+settings.event_pull_request_milestone=Kamienie milowe
+settings.event_pull_request_milestone_desc=Ustawiono lub usunięto kamień milowy pull requesta.
+settings.event_pull_request_comment=Komentarze
 settings.event_pull_request_comment_desc=Komentarz pull requestu stworzony, edytowany lub usunięty.
-settings.event_pull_request_review=Pull Request zrecenzowany
+settings.event_pull_request_review=Recenzje
 settings.event_pull_request_review_desc=Pull request zatwierdzony, odrzucony lub zrecenzowany.
-settings.event_pull_request_sync=Pull Request Zsynchronizowany
-settings.event_pull_request_sync_desc=Pull request zsynchronizowany.
+settings.event_pull_request_sync=Synchronizacja
+settings.event_pull_request_sync_desc=Gałąź zaktualizowana automatycznie z gałęzią docelową.
 settings.branch_filter=Filtr gałęzi
 settings.active=Aktywne
 settings.active_helper=Informacja o wywołanych wydarzeniach będzie przesłana do tego adresu URL Webhooka.
 settings.add_hook_success=Webhook został dodany.
 settings.update_webhook=Zaktualizuj webhook
 settings.update_hook_success=Webhook został zaktualizowany.
-settings.delete_webhook=Usuń Webhooka
-settings.recent_deliveries=Ostatnie wywołania
+settings.delete_webhook=Usuń webhooka
+settings.recent_deliveries=Ostatnie dostarczenia
 settings.hook_type=Typ hooka
 settings.slack_token=Token
 settings.slack_domain=Domena
@@ -1925,7 +2026,7 @@ settings.protected_branch=Ochrona gałęzi
 settings.protected_branch_can_push=Umożliwić push?
 settings.protected_branch_can_push_yes=Możesz wysyłać
 settings.protected_branch_can_push_no=Nie możesz wysyłać
-settings.branch_protection=`Ochrona gałęzi dla "<b>%s</b>"`
+settings.branch_protection=Reguły ochrony dla gałęzi "<b>%s</b>"
 settings.protect_this_branch=Włącz ochronę gałęzi
 settings.protect_this_branch_desc=Zapobiega usunięciu oraz ogranicza wypychanie i scalanie zmian do tej gałęzi.
 settings.protect_disable_push=Wyłącz wypychanie
@@ -1935,9 +2036,9 @@ settings.protect_enable_push_desc=Każdy użytkownik z uprawnieniem zapisu będz
 settings.protect_whitelist_committers=Wypychanie ograniczone białą listą
 settings.protect_whitelist_committers_desc=Tylko dopuszczeni użytkownicy oraz zespoły będą miały możliwość wypychania zmian do tej gałęzi (oprócz wymuszenia wypchnięcia).
 settings.protect_whitelist_deploy_keys=Dozwolona lista kluczy wdrożeniowych z uprawnieniem zapisu do push'a.
-settings.protect_whitelist_users=Użytkownicy dopuszczeni do pushowania
+settings.protect_whitelist_users=Użytkownicy dopuszczeni do wypychania
 settings.protect_whitelist_search_users=Szukaj użytkowników…
-settings.protect_whitelist_teams=Zespoły dopuszczone do pushowania
+settings.protect_whitelist_teams=Zespoły dopuszczone do wypychania
 settings.protect_whitelist_search_teams=Szukaj zespołów…
 settings.protect_merge_whitelist_committers=Włącz dopuszczenie scalania
 settings.protect_merge_whitelist_committers_desc=Zezwól jedynie dopuszczonym użytkownikom lub zespołom na scalanie Pull Requestów w tej gałęzi.
@@ -1972,13 +2073,13 @@ settings.no_protected_branch=Nie ma chronionych gałęzi.
 settings.edit_protected_branch=Zmień
 settings.protected_branch_required_approvals_min=Wymagane zatwierdzenia nie mogą mieć wartości ujemnej.
 settings.tags=Tagi
-settings.tags.protection=Ochrona Tagów
+settings.tags.protection=Ochrona tagów
 settings.tags.protection.pattern=Wzór tagu
 settings.tags.protection.allowed=Zezwolone
 settings.tags.protection.allowed.users=Dozwoleni użytkownicy
 settings.tags.protection.allowed.teams=Dozwolone zespoły
 settings.tags.protection.allowed.noone=Brak
-settings.tags.protection.create=Chroń tag
+settings.tags.protection.create=Dodaj regułę
 settings.tags.protection.none=Brak chronionych tagów.
 settings.bot_token=Token bota
 settings.chat_id=ID czatu
@@ -2000,7 +2101,7 @@ settings.lfs_findcommits=Znajdź commity
 settings.lfs_lfs_file_no_commits=Nie znaleziono commitów dla tego pliku LFS
 settings.lfs_noattribute=Ta ścieżka nie ma atrybutu do zablokowania w domyślnej gałęzi
 settings.lfs_delete=Usuń plik LFS z OID %s
-settings.lfs_delete_warning=Usunięcie pliku LFS może spowodować błędy typu 'obiekt nie istnieje' przy checkout'cie. Czy chcesz kontynuować?
+settings.lfs_delete_warning=Usunięcie pliku LFS może spowodować błędy typu 'obiekt nie istnieje' przy checkout'cie. Czy jesteś pewien(-na)?
 settings.lfs_findpointerfiles=Znajdź pliki wskaźnika
 settings.lfs_locks=Blokady
 settings.lfs_invalid_locking_path=Nieprawidłowa ścieżka: %s
@@ -2012,7 +2113,7 @@ settings.lfs_locks_no_locks=Brak blokad
 settings.lfs_lock_file_no_exist=Zablokowany plik nie istnieje w domyślnej gałęzi
 settings.lfs_force_unlock=Wymuś odblokowanie
 settings.lfs_pointers.found=Znaleziono %d wskaźników blob - %d powiązanych, %d niepowiązanych (%d brakujących w magazynie danych)
-settings.lfs_pointers.sha=SHA bloba
+settings.lfs_pointers.sha=Hash bloba
 settings.lfs_pointers.oid=OID
 settings.lfs_pointers.inRepo=W repozytorium
 settings.lfs_pointers.exists=Istnieje w magazynie
@@ -2028,8 +2129,8 @@ diff.git-notes=Notatki
 diff.data_not_available=Informacje nt. zmian nie są dostępne
 diff.options_button=Opcje porównania
 diff.show_diff_stats=Pokaż statystyki
-diff.download_patch=Ściągnij plik aktualizacji
-diff.download_diff=Ściągnij plik porównania
+diff.download_patch=Pobierz plik łatki
+diff.download_diff=Pobierz plik zmian
 diff.show_split_view=Widok podzielony
 diff.show_unified_view=Zunifikowany widok
 diff.whitespace_button=Znaki białe
@@ -2055,7 +2156,7 @@ diff.comment.add_single_comment=Dodaj jeden komentarz
 diff.comment.add_review_comment=Dodaj komentarz
 diff.comment.start_review=Rozpocznij recenzję
 diff.comment.reply=Odpowiedz
-diff.review=Recenzuj
+diff.review=Zakończ recenzję
 diff.review.header=Dodaj recenzję
 diff.review.placeholder=Komentarz recenzji
 diff.review.comment=Skomentuj
@@ -2074,7 +2175,7 @@ release.draft=Szkic
 release.prerelease=Wersja wstępna
 release.stable=Stabilna
 release.compare=Porównaj
-release.edit=edytuj
+release.edit=Edytuj
 release.ahead.commits=<strong>%d</strong> commitów
 release.ahead.target=do %s od tego wydania
 release.source_code=Kod źródłowy
@@ -2083,10 +2184,10 @@ release.edit_subheader=Wydania pozwalają na zorganizowanie wersji projektu.
 release.tag_name=Nazwa tagu
 release.target=Cel
 release.tag_helper=Wybierz istniejący tag lub stwórz nowy.
-release.prerelease_desc=Oznacz jako wczesne wydanie
+release.prerelease_desc=Oznacz jako wersja wstępna
 release.prerelease_helper=Oznacz to wydanie jako nieprzeznaczone na użytek produkcyjny.
 release.cancel=Anuluj
-release.publish=Publikuj wersję
+release.publish=Publikuj wydanie
 release.save_draft=Zapisz szkic
 release.edit_release=Zaktualizuj wydanie
 release.delete_release=Usuń wydanie
@@ -2102,7 +2203,7 @@ release.tag_already_exist=Ta nazwa tag'a już istnieje.
 release.downloads=Pliki do pobrania
 release.download_count=Pobrania: %s
 release.add_tag_msg=Użyj tytułu i zawartości wydania jako wiadomości znacznika.
-release.add_tag=Utwórz tylko znacznik
+release.add_tag=Utwórz tag
 
 branch.name=Nazwa gałęzi
 branch.delete_head=Usuń
@@ -2151,7 +2252,7 @@ settings.protect_patterns = Szablony
 default_branch_label = domyślnie
 issues.author = Autor
 commit.operations = Operacje
-commit.revert = Odwróć
+commit.revert = Przywróć
 pull.deleted_branch = (usunięto):%s
 diff.vendored = dostarczono
 from_comment = (komentarz)
@@ -2165,13 +2266,586 @@ pulls.made_using_agit = AGit
 activity.navbar.contributors = Współtwórcy
 diff.image.swipe = Przesuń
 settings.web_hook_name_feishu_only = Feishu
-escape_control_characters = Escape
+escape_control_characters = Zakoduj
 stars = Gwiazdki
 generated = Wygenerowano
 pulls.cmd_instruction_checkout_title = Kontrola
 settings.units.overview = Podsumowanie
 
+rss.must_be_on_branch = Musisz być na gałęzi by mieć dostęp do kanału RSS.
+admin.manage_flags = Zarządzaj flagami
+admin.enabled_flags = Aktywne flagi dla tego repozytorium:
+admin.update_flags = Zaktualizuj flagi
+admin.failed_to_replace_flags = Zmiana flag repozytorium nie powiodła się
+admin.flags_replaced = Flagi repozytorium zmienione
+new_repo_helper = Repozytorium zawiera wszystkie pliki projektu, włączając historię zmian. Hostujesz już jakieś gdzie-indziej? <a href="%s">Migruj repozytorium</a>.
+new_from_template = Użyj szablonu
+new_from_template_description = Możesz wybrać istniejący szablon repozytorium na tej instancji i zastosować jego ustawienia.
+new_advanced = Ustawienia zaawansowane
+new_advanced_expand = Kliknij by rozwinąć
+size_format = %[1]s: %[2]s, %[3]s: %[4]s
+visibility_helper = Ustaw repozytorium jako prywatne
+already_forked = Już utworzyłeś(-aś) fork %s
+fork_to_different_account = Utwórz fork do innego konta
+fork_branch = Gałąź która ma zostać sklonowa do forku
+all_branches = Wszystkie gałęzie
+fork_no_valid_owners = Z tego repozytorium nie można utworzyć forku ponieważ nie posiada poprawnych właścicieli.
+open_with_editor = Otwórz przy pomocy %s
+repo_gitignore_helper_desc = Wybierz które pliki nie będą śledzone z listy szablonowych dla powszechnych języków. Typowe artefakty wygenerowane przed każdy z narzędzi języka są dołączone w .gitignore domyślnie.
+object_format = Format obiektów
+object_format_helper = Format obiektów repozytorium. Nie może zostać zmieniony później. SHA1 jest najbardziej kompatybilny.
+auto_init_description = Zainicjuj historię Git z README oraz opcjonalnie dodaj pliki Licencji oraz .gitignore.
+mirror_interval = Interwał kopii lustrzanej (prawidłowe jednostki czasu to "h", "m", "s"). 0 wyłącza okresową synchronizację. (Minimalny interwał: %s)
+mirror_public_key = Publiczny klucz SSH
+mirror_use_ssh.text = Użyj uwierzytelniania SSH
+mirror_use_ssh.helper = Forgejo będzie wykonywać kopię lustrzaną repozytorium przy użyciu Git przez SSH i utworzy parę kluczy dla ciebie kiedy wybierzesz tę opcję. Musisz najpierw upewnić się, że wygenerowany klucz publiczny jest upoważniony do wypychania na repozytorium docelowe. Nie możesz korzystać z autoryzacji opartej na haśle przy wyborze tej opcji.
+mirror_use_ssh.not_available = Uwierzytelnianie SSH nie jest dostępne.
+mirror_denied_combination = Nie można użyć klucza publicznego i uwierzytelniania na podstawie hasła razem.
+mirror_sync_on_commit = Synchronizuj kiedy commity są wypychane
+mirror_address_desc = Wprowadź wymagane dane uwierzytelniające w seksji Autoryzacja.
+mirror_address_url_invalid = Przekazany URL nie jest poprawny. Musisz zakodować wszystkie komponenty URL poprawnie.
+mirror_address_protocol_invalid = Wprowadzony URL jest nieprawidłowy. Tylko lokacje http(s):// lub git:// mogą zostać użyte do kopii lustrzanych.
+mirror_lfs_desc = Aktywuj kopie lustrzane danych LFS.
+stars_remove_warning = Ta operacja usunie wszystkie otrzymane gwiazdy tego repozytorium.
+blame_prior = Zobacz blame przed tą zmianą
+blame.ignore_revs = Pominięto zmiany w <a href="%s">.git-blame-ignore-revs</a>. Kliknij <a href="%s">tutaj by ominąć</a> i zobaczyć normalny widok blame.
+blame.ignore_revs.failed = Nie udało się pominąć zmian w <a href="%s">.git-blame-ignore-revs</a>.
+author_search_tooltip = Pokazuje maksymalnie 30 użytkowników
+summary_card_alt = Karta podsumowania repozytorium %s
+tree_path_not_found_commit = Ścieża %[1]s nie istnieje w commicie %[2]s
+tree_path_not_found_branch = Ścieżka %[1]s nie istnieje w gałęzi %[2]s
+tree_path_not_found_tag = Ścieża %[1]s nie istnieje w tagu %[2]s
+transfer.no_permission_to_accept = Nie masz uprawnień by zaakceptować ten transfer.
+transfer.no_permission_to_reject = Nie masz uprawnień by odrzucić ten transfer.
+template.git_hooks_tooltip = W tym momencie nie można modyfikować ani usuwać hooków Gita które zostały już dodane. Wybierz tę opcję tylko jeżeli ufasz szablonowi repozytorium.
+archive.title_date = To repozytorium zostało zarchiwizone w %s. Możesz podglądać pliki i sklonować je, ale nie możesz wypychać, otwierać zgłoszeń oraz pull requestów.
+form.name_reserved = Nazwa repozytorium "%s" jest zarezerwowana.
+form.name_pattern_not_allowed = Wzór "%s" nie jest dozwolony w nazwie repozytorium.
+form.string_too_long = Podany ciąg znaków jest dłuższy niż %d znaków.
+migrate_options_mirror_helper = To repozytorium będzie kopią lustrzaną
+migrate_options_lfs_endpoint.placeholder = Jeśli pozostawione puste, endpoint będzie uzyskany z URL clone
+migrate.github_token_desc = Możesz wprowadzić tutaj jeden lub więcej tokenów oddzielonych przecinkiem by przeprowadzić migrację szybciej w związku z ograniczeniem GitHub API. OSTRZEŻENIE: Nadużywanie tej funkcjonalności może naruszyć politykę dostawcy usług i doprowadzić do zablokowania konta.
+migrate.invalid_local_path = Ścieżka lokalna jest niepoprawna. Nie istnieje lub nie jest katalogiem.
+migrate.migrating_failed.error = Nie udało się migrować: %s
+migrate.forgejo.description = Migruj dane z codeberg.org lub innych instancji Forgejo.
+migrate.cancel_migrating_title = Anuluj migrację
+migrate.cancel_migrating_confirm = Czy chcesz anulować tę migrację?
+subscribe.issue.guest.tooltip = Zaloguj się by subskrybować to zgłoszenie.
+subscribe.pull.guest.tooltip = Zaloguj się by subskrybować ten pull request.
+more_operations = Więcej operacji
+cite_this_repo = Cytuj to repozytorium
+broken_message = Dane Git powiązane z tym repozytorium nie mogą zostać odczytane. Skontaktuj się z administratorem tej instacji lub usuń to repozytorium.
+project = Projekty
+n_commit_one = %s commit
+n_commit_few = %s commity
+n_branch_one = %s gałąź
+n_branch_few = %s gałęzie
+n_tag_one = %s tag
+n_tag_few = %s tagi
+n_release_one = %s wydanie
+n_release_few = %s wydań
+file_follow = Podążaj za dowiązaniem
+invisible_runes_header = `Ten plik zawiera niewidoczne znaki Unicode`
+invisible_runes_description = `Ten plik zawiera niewidoczne znaki Unicode które są nierozróżnialne dla ludzi, ale mogą być przetwarzane w inny sposób przez komputer. Jeśli uważasz, że to jest zamierzone, możesz bezpiecznie zignorować to ostrzeżenie. Użyj klawisza Escape by je wyświetlić.`
+ambiguous_runes_header = `Ten plik zawiera niejednoznaczne znaki Unicode`
+ambiguous_runes_description = `Ten plik zawiera znaki Unicode które mogą być pomylone z innymi znakami. Jeśli uważasz, że to jest zamierzone, możesz bezpiecznie zignorować to ostrzeżenie. Użyj klawisza Escape by je wyświetlić.`
+invisible_runes_line = `Ta linia zawiera niewidoczne znaki Unicode`
+ambiguous_runes_line = `Ta linia zawiera niejednoznaczne znaki Unicode`
+ambiguous_character = `%[1]c [U+%04[1]X] może być pomylone z %[2]c [U+%04[2]X]`
+unescape_control_characters = Zdekoduj
+view_git_blame = Zobacz git blame
+executable_file = Plik wykonywalny
+vendored = Dołączone
+commit.contained_in = Ten commit jest zawarty w:
+commit.contained_in_default_branch = Ten commit jest częścią gałęzi domyślnej
+commit.load_referencing_branches_and_tags = Wczytaj gałęzie i tagi odnoszące się do tego commitu
+no_eol.text = Brak znaku końca linii
+no_eol.tooltip = Ten plik nie zawiera na końcowego znaku końca linii.
+editor.add_file = Dodaj plik
+editor.file_delete_success = Plik "%s" został usunięty.
+editor.add_tmpl.filename = nazwa pliku
+editor.add = Dodaj %s
+editor.update = Aktualizuj %s
+editor.delete = Usuń %s
+editor.patch = Zastosuj patch
+editor.fail_to_apply_patch = Nie udało się zastosować patcha "%s"
+editor.new_patch = Nowy patch
+editor.signoff_desc = Dodaj dopisek Signed-off-by w imieniu autora commita na końcu wiadomości commita.
+editor.new_branch_name = Nazwij nową gałąź dla tego commita
+editor.filename_is_invalid = Nazwa pliku jest nieprawidłowa: "%s".
+editor.invalid_commit_mail = Nieprawidłowy mail do utworzenia commita.
+editor.branch_does_not_exist = Gałąź "%s" nie istnieje w tym repozytorium.
+editor.branch_already_exists = Gałąź "%s" już istnieje w tym repozytorium.
+editor.directory_is_a_file = Nazwa katalogu "%s" jest już użyta jako nazwa pliku w tym repozytorium.
+editor.file_is_a_symlink = `"%s" jest dowiązaniem symbolicznym. Dowiązania symboliczne nie mogą być edytowane w edytorze przeglądarkowym`
+editor.filename_is_a_directory = Nazwa pliku "%s" jest już użyta jako nazwa katalogu w tym repozytorium.
+editor.file_editing_no_longer_exists = Edytowany plik, "%s", już nie istnieje w tym repozytorium.
+editor.file_deleting_no_longer_exists = Usuwany plik, "%s", już nie istnieje w tym repozytorium.
+editor.file_already_exists = Plik o nazwie "%s" już istnieje w tym repozytorium.
+editor.commit_id_not_matching = Plik został zmieniony podczas twojej edycji. Utwórz commit na nowej gałęzi, a następnie scal.
+editor.push_out_of_date = To wypchnięcie wygląda na nieaktualne.
+editor.fail_to_update_file = Nie udało się zaktualizować/utworzyć pliku "%s".
+editor.push_rejected_no_message = Zmiana została odrzucona przez serwer bez wiadomości. Proszę sprawdź hooki Git.
+editor.push_rejected = Zmiana została odrzucona przez serwer. Proszę sprawdź hooki Git.
+editor.unable_to_upload_files = Nie udało się wgrać plików do "%s", błąd: %v
+editor.upload_file_is_locked = Plik "%s" jest zablokowany przez %s.
+editor.upload_files_to_dir = Wgraj pliki do "%s"
+editor.cannot_commit_to_protected_branch = Nie można dodać commita do gałęzi chronionej "%s".
+editor.cherry_pick = Cherry-pick %s na:
+editor.revert = Przywróć %s na:
+editor.commit_email = Email commitu
+commits.no_commits = Brak wspólnych commitów. "%s" i "%s" mają zupełnie inne historie.
+commits.nothing_to_compare = Te gałęzie są takie same.
+commits.search.tooltip = Możesz rozpocząć słowa kluczowe z "author:", "committer:","after:", lub "before:", np. "revert author:Alice before:2019-01-13".
+commits.search_branch = Ta gałąź
+commits.browse_further = Przeglądaj dalej
+commits.renamed_from = Zmieniono nazwę z %s
+commits.ssh_key_fingerprint = Odcisk klucza SSH
+commits.view_path = Zobacz w tym punkcie w historii
+commit.revert-header = Przywrócenie: %s
+commit.revert-content = Wybierz gałąź na której wykonać przywrócenie:
+commit.cherry-pick = Cherry-pick
+commit.cherry-pick-header = Cherry-pick: %s
+commit.cherry-pick-content = Wybierz gałąź na której wykonać cherry-pick:
+ext_issues = Zewnętrzne zgłoszenia
+projects.desc = Zarządzaj zgłoszeniami i pullami w panelu projektu.
+projects.create_success = Projekt "%s" został utworzony.
+projects.edit_success = Projekt "%s" został zaktualizowany.
+projects.column.edit = Edytuj kolumnę
+projects.column.new_submit = Utwórz kolumnę
+projects.column.new = Nowa kolumna
+projects.column.set_default = Ustaw jako domyślną
+projects.column.set_default_desc = Ustaw tę kolumnę jako domyślną dla niekategoryzowanych zgłoszeń i pullów
+projects.column.delete = Usuń kolumnę
+projects.column.deletion_desc = Usunięcie kolumny projekty przeniesie wszystkie powiązane zgłoszenia do kolumny domyślnej. Kontynuować?
+projects.column.assigned_to = Przypisane do
+projects.card_type.desc = Podgląd karty
+projects.card_type.images_and_text = Obrazy i tekst
+projects.card_type.text_only = Tylko tekst
+issues.new.assign_to_me = Przypisz do mnie
+issues.edit.already_changed = Nie można zapisać zmian zgłoszenia. Wygląda na to, że zawartość została już zmieniona przez innego użytkownika. Proszę odśwież stronę i spróbuj edytować ponownie by uniknąć nadpisania ich zmian
+issues.choose.ignore_invalid_templates = Nieprawidłowe szablony zostały zignorowane
+issues.choose.invalid_templates = %v nieprawidłowy(-e) szablon(y) znaleziony(-e)
+issues.choose.invalid_config = Konfiguracja zgłoszeń zawiera błędy:
+issues.label_templates.fail_to_load_file = Nie udało się załadować pliku szablonu etykiet "%s": %v
+issues.change_ref_at = `zmienił(a) odniesienie z <b><strike>%s</strike></b> na <b>%s</b> %s`
+issues.remove_ref_at = `usunął(-ęła) odniesienie <b>%s</b> %s`
+issues.add_ref_at = `dodał(a) odniesienie <b>%s</b> %s`
+issues.filter_label_select_no_label = Brak etykiety
+issues.filter_milestone_all = Wszystkie kamienie milowe
+issues.filter_milestone_none = Brak kamieni milowych
+issues.filter_milestone_open = Otwarte kamienie milowe
+issues.filter_milestone_closed = Zamknięte kamienie milowe
+issues.filter_project_all = Wszystkie projekty
+issues.filter_poster_no_select = Wszyscy autorzy
+issues.filter_type.review_requested = Poproszono o recenzję
+issues.filter_type.reviewed_by_you = Recenzowane przez ciebie
+issues.filter_sort.relevance = Trafność
+issues.action_check = Zaznacz/Odznacz
+issues.action_check_all = Zaznacz/Odznacz wszystkie elementy
+pulls.merged_by = przez <a href="%[2]s">%[3]s</a> został scalony %[1]s
+pulls.merged_by_fake = przez %[2]s został scalony %[1]s
+issues.closed_by = przez <a href="%[2]s">%[3]s</a> został zamknięty %[1]s
+issues.opened_by_fake = otworzony %[1]s przez %[2]s
+issues.closed_by_fake = przez %[2]s został zamknięty %[1]s
+issues.all_title = Wszystkie
+issues.num_comments_1 = %d komentarz
+issues.num_reviews_one = %d recenzja
+issues.num_reviews_few = %d recenzje
+issues.reaction.add = Dodaj reakcję
+issues.reaction.alt_few = %[1]s dodał(a) reakcję %[2]s.
+issues.reaction.alt_many = %[1]s i %[2]d więcej dodali reakcję %[3]s.
+issues.reaction.alt_remove = Usuń reakcję %[1]s z komentarza.
+issues.reaction.alt_add = Dodaj reakcję %[1]s do komentarza.
+issues.context.menu = Menu komentarza
+issues.context.reference_issue = Odniesienie w nowym zgłoszeniu
+issues.no_content = Opis zgłoszenia jest pusty.
+issues.close = Zamknij zgłoszenie
+issues.comment_pull_merged_at = scalił commit %[1]s do %[2]s %[3]s
+issues.comment_manually_pull_merged_at = ręcznie scalił commit %[1]s do %[2]s %[3]s
+issues.author.tooltip.issue = Ten użytkownik jest autorem tego zgłoszenia.
+issues.author.tooltip.pr = Ten użytkownik jest autorem tego pull requesta.
+issues.role.owner_helper = Ten użytkownik jest właścicielem tego repozytorium.
+issues.role.member_helper = Ten użytkownik jest członkiem organizacji która jest właścicielem tego repozytorium.
+issues.role.collaborator_helper = Ten użytkownik został zaproszony do współpracy nad tym repozytorium.
+issues.role.first_time_contributor = Kontrybutor pierwszy raz
+issues.role.first_time_contributor_helper = To jest pierwsza kontrybucja tego użytkownika w tym repozytorium.
+issues.role.contributor = Kontrybutor
+issues.role.contributor_helper = Ten użytkownik już wcześniej dodał commity do tego repozytorium.
+issues.is_stale = Zostały wniesione zmiany do tego pull requesta od momentu tej recenzji
+issues.dismiss_review = Odrzuć recenzję
+issues.dismiss_review_warning = Czy jesteś pewien(-na), że chcesz odrzucić tę recenzję?
+issues.label_exclusive = Wykluczająca
+issues.label_archive = Zarchiwizuj etykietę
+issues.label_archived_filter = Pokaż zarchiwizowane etykiety
+issues.label_archive_tooltip = Zarchiwizowane etykiety są wyłączone domyślnie z sugestii kiedy korzysta się szukania po etykietach.
+issues.label_exclusive_desc = Nazwij etykietę <code>scope/item</code> by wzajemnie wykluczała się z innymi etykietami <code>scope/</code>.
+issues.label_exclusive_warning = Wszystkie kolidujące etykiety z zakresem będą usunięte podczas edycji etykiet zgłoszenia lub pull requestu.
+issues.archived_label_description = (Zarchiwizowano) %s
+issues.num_participants_one = %d uczestnik
+issues.unpin_issue = Odepnij zgłoszenie
+issues.max_pinned = Nie możesz przypiąć więcej zgłoszeń
+issues.pin_comment = przypiął to %s
+issues.unpin_comment = odpiął to %s
+issues.delete.title = Usunąć to zgłoszenie?
+issues.delete.text = Czy na pewno chcesz usunąć to zgłoszenie? (Ta akcja permanentnie usunie całą treść. Rozważ zamknięcie zgłoszenia, jeśli zamierzasz pozostawić je zarchiwizowane)
+issues.start_tracking_short = Wystartuj zegar
+issues.tracking_already_started = `Już włączyłeś(-aś) śledzenie czasu na <a href="%s">innym zgłoszeniu</a>!`
+issues.stop_tracking = Zatrzymaj zegar
+issues.cancel_tracking_history = `anulował(a) śledzenie czasu %s`
+issues.force_push_codes = `wymusił(a) wypchnięcie %[1]s z <a class="%[7]s" href="%[3]s"><code>%[2]s</code></a> do <a class="%[7]s" href="%[5]s"><code>%[4]s</code></a> %[6]s`
+issues.due_date_modified = zmienił termin realizacji z %[2]s na %[1]s %[3]s
+issues.dependency.issue_no_dependencies = Brak ustawionych zależności.
+issues.dependency.pr_no_dependencies = Brak ustawionych zależności.
+issues.dependency.no_permission_1 = Nie masz uprawnień do odczytu %d zależności
+issues.dependency.no_permission_n = Nie masz uprawnień do odczytu %d zależności
+issues.dependency.no_permission.can_remove = Nie masz uprawnień do odczytu tej zależności, ale możesz usunąć tę zależność
+issues.dependency.pr_closing_blockedby = Zamknięcie tego pull requesta jest zablokowane przez następujące zgłoszenia
+issues.dependency.issue_closing_blockedby = Zamknięcie tego zgłoszenia jest blokowane przez następujące zgłoszenia
+issues.dependency.issue_batch_close_blocked = Nie można zamknąć wybranych zgłoszeń, ponieważ zgłoszenie #%d nadal ma otwarte zależności
+issues.review.dismissed = odrzucił recenzję %s %s
+issues.review.add_review_requests = poprosił o recenzje od %[1]s %[2]s
+issues.review.remove_review_requests = cofnął prośby o recenzje do %[1]s %[2]s
+issues.review.add_remove_review_requests = poprosił o recenzje od %[1]s i cofnął prośby o recenzje od %[2]s %[3]s
+issues.review.pending.tooltip = Ten komentarz bieżąco nie jest widoczny dla pozostałych użytkownik. By dodać twoje oczekujące komentarze, wybierz "%s" -> "%s/%s/%s" na górze strony.
+issues.review.outdated_description = Treść została zmieniona od momentu kiedy ten komentarz został utworzony
+issues.review.option.show_outdated_comments = Pokaż przedawnione komentarze
+issues.review.option.hide_outdated_comments = Ukryj przedawnione komentarze
+issues.content_history.delete_from_history_confirm = Usunąć z historii?
+issues.reference_link = Odniesienie: %s
+issues.blocked_by_user = Nie możesz utworzyć zgłoszeń w tym repozytorium ponieważ jesteś zablokowany(-a) przez właściciela repozytorium.
+issues.comment.blocked_by_user = Nie możesz utworzyć komentarza do tego zgłoszenia ponieważ jesteś zablokowany(-a) przez właściciela repozytorium lub autora zgłoszenia.
+issues.summary_card_alt = Podsumowanie karty zgłoszenia zatytułowanego "%s" w repozytorium %s
+pulls.view = Zobacz pull request
+pulls.edit.already_changed = Nie można zapisać zmian pull requestu. Wygląda na to, że zawartość została już zmieniona przez innego użytkownika. Proszę odśwież stronę i spróbuj edytować ponownie by uniknąć nadpisania ich zmian
+pulls.sign_in_require = <a href="%s">Zaloguj się</a> by utworzyć nowy pull request.
+pulls.allow_edits_from_maintainers = Zezwalaj na zmiany przez opiekunów
+pulls.allow_edits_from_maintainers_desc = Użytkownicy z uprawnieniem zapisu do gałęzi głównej mogą również wypychać do tej gałęzi
+pulls.allow_edits_from_maintainers_err = Aktualizowanie nie powiodło się
+pulls.has_viewed_file = Zobaczone
+pulls.has_changed_since_last_review = Zmiany od twojej ostatniej recenzji
+pulls.viewed_files_label = %[1]d / %[2]d plików zobaczonych
+pulls.expand_files = Rozwiń wszystkie pliki
+pulls.collapse_files = Zwiń wszystkie pliki
+pulls.switch_comparison_type = Zmień rodzaj porównania
+pulls.switch_head_and_base = Zmień head i bazę
+pulls.show_all_commits = Pokaż wszystkie commity
+pulls.show_changes_since_your_last_review = Pokaż zmiany od ostatniej twojej recenzji
+pulls.showing_only_single_commit = Pokazywane tylko zmiany commita %[1]s
+pulls.showing_specified_commit_range = Pokazywane tylko zmiany między %[1]s..%[2]s
+pulls.select_commit_hold_shift_for_range = Wybierz commit. Przytrzymaj shift i kliknij by wybrać zakres
+pulls.review_only_possible_for_full_diff = Recenzja jest tylko możliwe przy wyświetlaniu pełnych zmian
+pulls.filter_changes_by_commit = Filtruj commitem
+pulls.nothing_to_compare_have_tag = Wybrana gałąź/tag są takie same.
+pulls.has_pull_request = `Pull request między tymi gałęziami już istnieje: <a href="%[1]s">%[2]s#%[3]d</a>`
+pulls.merged_success = Pull request scalony pomyślnie i zamknięty
+pulls.closed = Pull request zamknięty
+pulls.merged_info_text = Gałąź %s może teraz zostać usunięta.
+pulls.cannot_merge_work_in_progress = Ten pull request jest oznaczony jako praca w toku.
+pulls.ready_for_review = Gotów do recenzji?
+pulls.is_ancestor = Ta gałąź jest już częścią gałęzi docelowej. Nie ma nic do scalenia.
+pulls.is_empty = Zmiany na tej gałęzi są już częścią gałęzi docelowej. Commit będzie pusty.
+pulls.blocked_by_approvals = Ten pull request nie ma wystarczająco zatwierdzeń. %d z %d zatwierdzeń udzielonych.
+pulls.blocked_by_rejection = Ten pull request ma prośbę o zmiany od oficjalnego recenzenty.
+pulls.blocked_by_official_review_requests = Ten pull request jest zablokowany ponieważ nie posiada zatwierdzenia od jednego lub więcej oficjalnych recenzentów.
+pulls.blocked_by_outdated_branch = Ten pull request jest zablokowany ponieważ jest przedawniony.
+pulls.blocked_by_changed_protected_files_1 = Ten pull request jest zablokowany ponieważ wprowadza zmiany do chronionego pliku:
+pulls.blocked_by_changed_protected_files_n = Ten pull request jest zablokowany ponieważ wprowadza zmiany do chronionych plików:
+pulls.wrong_commit_id = Identyfikator commitu musi być identyfikatorem commitu na gałęzi docelowej
+pulls.blocked_by_user = Nie możesz utworzyć pull requesta w tym repozytorium ponieważ jesteś zablokowany(-a) przez właściciela repozytorium.
+pulls.merge_pull_request = Utwórz commit scalający
+pulls.rebase_merge_pull_request = Zmiana bazy, potem fast-forward
+pulls.rebase_merge_commit_pull_request = Zmiana bazy, potem utwórz commit scalający
+pulls.squash_merge_pull_request = Utwórz squash commit
+pulls.fast_forward_only_merge_pull_request = Tylko fast-forward
+pulls.merge_commit_id = Identyfikator commita scalającego
+pulls.head_out_of_date = Scalanie nie powiodło się: W trakcie generowanie scalania, head został zaktualizowany. Wskazówka: Spróbuj ponownie.
+pulls.has_merged = Niepowodzenie: Pull request został scalony, nie możesz scalić ponownie lub zmienić gałęzi docelowej.
+pulls.push_rejected = Wypchnięcie nie powiodło się: Wypchnięcie zostało odrzucone. Sprawdź hooki Git dla tego repozytorium.
+pulls.push_rejected_no_message = Wypchnięcie nie powiodło się: Wypchnięcie zostało odrzucone, ale nie otrzymano zdalnej wiadomości. Sprawdź hooki Git dla tego repozytorium.=
+pulls.status_checks_hide_all = Ukryj wszystkie kontrole
+pulls.status_checks_show_all = Pokaż wszystkie kontrole
+pulls.close = Zamknij pull request
+pulls.commit_ref_at = `odniósł się do tego pull requesta z commita <a id="%[1]s" href="#%[1]s">%[2]s</a>`
+pulls.cmd_instruction_hint = Zobacz instrukcje wiersza poleceń
+pulls.cmd_instruction_checkout_desc = Ze swojego repozytorium projektu, utwórz nową gałąź i przetestuj zmiany.
+pulls.cmd_instruction_merge_title = Scal
+pulls.cmd_instruction_merge_desc = Scal zmiany i zaktualizuj na Forgejo.
+pulls.cmd_instruction_merge_warning = <b>Ostrzeżenie:</b> Ustawienie "Autodetekcja ręcznego scalenia" nie zostało włączone dla tego repozytorium, będziesz musiał oznaczyć ten pull request jako ręcznie scalony.
+pulls.clear_merge_message = Wyczyść wiadomość scalenia
+pulls.clear_merge_message_hint = Wyczyszczenie wiadomości scalenia usunie tylko treść wiadomości commitu pozostawiając wygenerowane przez git dopiski takie jak "Co-Authored-By ...".
+pulls.reopen_failed.head_branch = Pull request nie może zostać ponownie otworzony, ponieważ head gałęzi już nie istnieje.
+pulls.reopen_failed.base_branch = Pull request nie może zostać ponownie otworzony, ponieważ baza gałęzi już nie istnieje.
+pulls.agit_explanation = Utworzone przy użyciu procesu pracy AGit. AGit pozwala współpracownikom proponować zmiany używając "git push" bez potrzeby tworzenia forku lub nowej gałęzi.
+pulls.auto_merge_button_when_succeed = (Kiedy wszystkie weryfikacje odniosą sukces)
+pulls.auto_merge_when_succeed = Automatycznie scal kiedy wszystkie weryfikacje odniosą sukces
+pulls.auto_merge_newly_scheduled = Pull request został zaplanowany do scalenia kiedy wszystkie weryfikacje odniosą sukces.
+pulls.auto_merge_has_pending_schedule = %[1]s zaplanował by ten pull request został automatycznie scalony kiedy wszystkie weryfikacje odniosą sukces %[2]s.
+pulls.auto_merge_cancel_schedule = Anuluj automatyczne scalenie
+pulls.auto_merge_not_scheduled = Ten pull request nie jest zaplanowany do automatycznego scalenia.
+pulls.auto_merge_canceled_schedule = Automatyczne scalenie było anulowane dla tego pull requestu.
+pulls.auto_merge_newly_scheduled_comment = `zaplanował(a) ten pull request do automatycznego scalenia kiedy wszystkie weryfikacje odniosą sukces %[1]s`
+pulls.auto_merge_canceled_schedule_comment = `anulował(a) automatyczne scalenie tego pull requestu kiedy wszystkie weryfikacje odniosą sukces %[1]s`
+pulls.delete_after_merge.head_branch.is_default = Head gałęzi który chcesz usunąć jest gałęzią domyślną i nie może zostać usunięty.
+pulls.delete_after_merge.head_branch.is_protected = Head gałęzi który chcesz usunąć jest gałęzią chronioną i nie może zostać usunięty.
+pulls.delete_after_merge.head_branch.insufficient_branch = Nie masz uprawnień by usunąć head gałęzi.
+pulls.delete.title = Usunąć ten pull request?
+pulls.delete.text = Czy na pewno chcesz usunąć ten pull request? (Ta akcja permanentnie usunie całą treść. Zamiast tego rozważ jego zamknięcie, jeżeli masz zamiar zostawić go zarchiwizowanego)
+pulls.recently_pushed_new_branches = Wypchnąłeś(-ęłaś) na gałąź <a href="%[3]s"><strong>%[1]s</strong></a> %[2]s
+comments.edit.already_changed = Nie można zapisać zmian komentarza. Wygląda na to, że zawartość została już zmieniona przez innego użytkownika. Proszę odśwież stronę i spróbuj edytować ponownie by uniknąć nadpisania ich zmian
+milestones.update_ago = Zaktualizowano %s
+milestones.new_subheader = Kamienie milowe mogą pomóc organizować zgłoszenia i śledzić ich postęp.
+milestones.create_success = Kamień milowy "%s" został utworzony.
+milestones.edit_success = Kamień milowy "%s" został zaktualizowany.
+milestones.filter_sort.name = Nazwa
+milestones.filter_sort.earliest_due_data = Najbliższy termin realizacji
+milestones.filter_sort.latest_due_date = Najdalszy termin realizacji
+signing.will_sign = Ten commit zostanie podpisany kluczem "%s".
+signing.wont_sign.error = Wystąpił błąd podczas sprawdzenia czy commit mógł zostać podpisany.
+signing.wont_sign.nokey = Ta instancja nie posiada klucza do podpisania tego commita.
+signing.wont_sign.never = Commity nie są nigdy podpisywane.
+signing.wont_sign.always = Commity są zawsze podpisywane.
+signing.wont_sign.pubkey = Ten commit nie będzie podpisany ponieważ nie posiadasz żadnego klucza publicznego powiązanego z twoim kontem.
+signing.wont_sign.twofa = Musisz mieć włączone uwierzytelnianie dwuskładnikowe by móc podpisywać commity.
+signing.wont_sign.parentsigned = Ten commit nie będzie podpisany ponieważ commit rodzic nie jest podpisany.
+signing.wont_sign.basesigned = To scalenie nie będzie podpisane ponieważ commit bazowy nie jest podpisany.
+signing.wont_sign.headsigned = To scalenie nie będzie podpisane ponieważ head commit nie jest podpisany.
+signing.wont_sign.commitssigned = To scalenie nie będzie podpisane ponieważ wszystkie powiązane commity nie są podpisane.
+signing.wont_sign.approved = To scalenie nie będzie podpisane ponieważ pull request nie został zatwierdzony.
+signing.wont_sign.not_signed_in = Nie jesteś zalogowany(-a).
+ext_wiki = Zewnętrzna Wiki
+wiki.page_title = Tytuł strony
+wiki.page_content = Treść strony
+wiki.delete_page_notice_1 = Usunięcie strony wiki "%s" nie może zostać cofnięte. Kontynuować?
+wiki.reserved_page = Strona wiki o nazwie "%s" jest zarezerwowana.
+wiki.page_name_desc = Wprowadź nazwę dla tej strony Wiki. Niektóre ze specjalnych nazw to: "Home", "_Sidebar" i "_Footer".
+wiki.original_git_entry_tooltip = Zobacz oryginalny plik Git zamiast korzystać z przyjaznych linków.
+wiki.search = Szukaj na wiki
+wiki.no_search_results = Brak wyników
+activity.navbar.pulse = Puls
+activity.navbar.code_frequency = Częstotliwość kodu
+activity.navbar.recent_commits = Ostatnie commity
+activity.title.issues_closed_from = %s zamknięte przez %s
+activity.published_prerelease_label = Wersja Wstępna
+activity.published_tag_label = Tag
+activity.commit = Aktywność commitów
+contributors.contribution_type.filter_label = Rodzaj kontrybucji:
+contributors.contribution_type.additions = Dodania
+contributors.contribution_type.deletions = Usunięcia
+settings.federation_settings = Ustawienia Federacji
+settings.federation_apapiurl = URL federacji tego repozytorium. Skopiuj i wklej do Ustawień Federacji innego repozytorium jako URL Śledzonego Repozytorium.
+settings.federation_following_repos = URLe Podążanych Repozytoriów. Rozdzielone ";", bez znaków białych.
+settings.federation_not_enabled = Federacja nie jest włączona na twojej instancji.
+settings.mirror_settings.docs = Skonfiguruj swoje repozytorium by automatycznie synchronizowało commity, tagi i gałęzie z innym repozytorium.
+settings.mirror_settings.docs.disabled_pull_mirror.instructions = Ustaw swój projekt żeby automatycznie wypychał commity, tagi i gałęzie do innego repozytorium. Kopie lustrzane typu pull zostały wyłączone przez twojego administratora strony.
+settings.mirror_settings.docs.disabled_push_mirror.instructions = Skonfiguruj swój projekt żeby automatycznie pullował commity, tagi i gałęzie z innego repozytorium.
+settings.mirror_settings.docs.disabled_push_mirror.pull_mirror_warning = W tym momencie, ta akcja może zostać wykonana tylko poprzez menu "Nowa Migracja". Po więcej informacji, proszę sprawdź:
+settings.mirror_settings.docs.disabled_push_mirror.info = Wypychające kopie lustrzane zostały wyłączone przez twojego administratora strony.
+settings.mirror_settings.docs.no_new_mirrors = Twoje repozytorium wykonuje kopie lustrzane do lub z innego repozytorium. Proszę miej na uwadze, że nie możesz utworzyć nowych kopii lustrzanych w tym momencie.
+settings.mirror_settings.docs.can_still_use = Mimo, że nie możesz modyfikować istniejących kopii lustrzanych lub utworzyć nowych, nadal możesz korzystać z bieżącej kopii lustrzanej.
+settings.mirror_settings.docs.pull_mirror_instructions = By skonfigurować kopię lustrzaną typu pull, proszę sprawdź:
+settings.mirror_settings.docs.more_information_if_disabled = Możesz dowiedzieć się więcej o wypychających i pobierających kopiach lustrzanych tutaj:
+settings.mirror_settings.docs.doc_link_title = W jaki sposób mogę utworzyć kopie lustrzane repozytoriów?
+settings.mirror_settings.docs.doc_link_pull_section = sekcja "Pulling from a remote repository" w dokumentacji.
+settings.mirror_settings.docs.pulling_remote_title = Pobieranie ze zdalnego repozytorium
+settings.mirror_settings.pushed_repository = Wypchnięte repozytorium
+settings.mirror_settings.push_mirror.add = Dodaj wypychającą kopię lustrzaną
+settings.mirror_settings.push_mirror.edit_sync_time = Edytuj interwał synchronizacji kopii lustrzanej
+settings.mirror_settings.push_mirror.none_ssh = Brak
+settings.units.units = Jednostki
+settings.units.add_more = Włącz więcej
+settings.mirror_settings.push_mirror.copy_public_key = Skopiuj klucz publiczny
+settings.pull_mirror_sync_in_progress = W tym momencie zmiany są pobierane z repozytorium zdalnego %s.
+settings.pull_mirror_sync_quota_exceeded = Limit przekroczony, zmiany niepobrane.
+settings.push_mirror_sync_in_progress = W tym momencie zmiany są wypychane do repozytorium zdalnego %s.
+settings.update_mirror_settings = Aktualizuj ustawienia kopii lustrzanej
+settings.branches.switch_default_branch = Zmień domyślną gałąź
+settings.branches.add_new_rule = Dodaj nową regułę
+settings.wiki_globally_editable = Pozwól każdemu edytować wiki
+settings.tracker_issue_style.regexp = Wyrażenie Regularne
+settings.tracker_issue_style.regexp_pattern = Wzór Wyrażenia Regularnego
+settings.tracker_issue_style.regexp_pattern_desc = Pierwsza odnaleziona grupa będzie użyta zamiast <code>{index}</code>.
+settings.pulls.enable_autodetect_manual_merge = Włącz automatyczne wykrycie ręcznego scalenia (Uwaga: W niektórych specjalnych przypadkach wykrycie będzie nieprawidłowe)
+settings.pulls.allow_rebase_update = Włącz aktualizowanie gałęzi pull requesta przez zmianę bazy
+settings.default_update_style_desc = Domyślny styl aktualizacji użyty do aktualizowania pull requestów które są w tyle za gałęzią główną.
+settings.pulls.default_delete_branch_after_merge = Usuń domyślnie gałąź pull requesta po scaleniu
+settings.pulls.default_allow_edits_from_maintainers = Pozwól domyślnie na edycje przez opiekunów
+settings.releases_desc = Włącz wydania repozytorium
+settings.packages_desc = Włącz rejestr pakietów repozytorium
+settings.actions_desc = Włącz zintegrowane procesy CI/CD z Forgejo Actions
+settings.admin_code_indexer = Indekser kodu
+settings.admin_stats_indexer = Indekser statystyk kodu
+settings.admin_indexer_commit_sha = Ostatni zaindeksowany commit
+settings.reindex_button = Dodaj do kolejki ponownego indeksowania
+settings.reindex_requested = Ponowne indeksowanie zażądane
+settings.new_owner_blocked_doer = Zostałeś(-aś) zablokowany przez nowego właściciela.
+settings.transfer.button = Przenieś właścicielstwo
+settings.transfer.modal.title = Przenieś właścicielstwo
+settings.transfer_abort_success = Transfer repozytorium do %s pomyślnie anulowany.
+settings.enter_repo_name = Wprowadź właściciela i nazwę repozytorium dokładnie jak pokazane:
+settings.confirmation_string = Ciąg potwierdzający
+settings.transfer_quota_exceeded = Nowy właściciel (%s) przekracza limit. Repozytorium nie zostało przekazane.
+settings.trust_model.committer.desc = Prawidłowe podpisy będą oznaczone jako "zaufane" tylko jeśli pasują do autora commitu, w innym wypadku będą oznaczone jako "niedopasowane". To zmusza Forgejo do bycia autorem commita dla podpisanych commitów, z rzeczywistym autorem commita oznaczonym w dopiskach Co-authored-by: i Co-commited-by: w commicie. Domyślny klucz Forgejo musi pasować do Użytkownika w bazie danych.
+settings.trust_model.collaboratorcommitter = Współpracownik+Commitujący
+settings.trust_model.collaboratorcommitter.long = Współpracownik+Commitujący: Ufaj podpisom współpracownik które pasują do commitującego
+settings.trust_model.collaboratorcommitter.desc = Prawidłowe podpisy współpracowników tego repozytorium będą oznaczone jako "zaufane" tylko jeśli pasują do autora commitu, w innym wypadku będą oznaczone jako "niedopasowane". To zmusza Forgejo do bycia autorem commita dla podpisanych commitów, z rzeczywistym autorem commita oznaczonym w dopiskach Co-authored-by: i Co-commited-by: w commicie. Domyślny klucz Forgejo musi pasować do Użytkownika w bazie danych.
+settings.wiki_rename_branch_main = Normalizuj nazwę gałęzi Wiki
+settings.wiki_rename_branch_main_desc = Zmień gałąź używaną wewnętrznie przez Wiki jako "%s". Ta zmiana jest permanentna i nie może zostać cofnięta.
+settings.wiki_rename_branch_main_notices_1 = Ta operacja <strong>NIE MOŻE</strong> zostać cofnięta.
+settings.wiki_rename_branch_main_notices_2 = To permanentnie zmieni nazwę wewnętrznej gałęzi wiki dla repozytorium %s. Istniejące checkouty będą musiały zostać zaktualizowane.
+settings.wiki_branch_rename_success = Gałąź wiki dla repozytorium została znormalizowana pomyślnie.
+settings.wiki_branch_rename_failure = Nie udało się znormalizować nazwy gałęzi wiki dla repozytorium.
+settings.confirm_wiki_branch_rename = Zmień gałąź wiki
+settings.update_settings_no_unit = Repozytorium powinno pozwalać na jakąkolwiek interakcję.
+settings.add_collaborator_owner = Nie można dodać właściciela jako współpracownika.
+settings.add_collaborator_blocked_our = Nie można dodać współpracownika, ponieważ właściciel repozytorium go zablokował.
+settings.add_collaborator_blocked_them = Nie można dodać współpracownika, ponieważ zablokował on właściciela repozytorium.
+settings.add_webhook.invalid_path = Ścieżka nie może zawierać części która jest "." lub ".." lub pustym ciągiem znaków. Nie może rozpoczynać się i kończyć ukośnikiem.
+settings.webhook.test_delivery_desc_disabled = By przetestować webhook z przykładowym wydarzeniem, aktywuj go.
+settings.webhook.replay.description = Uruchom ponownie ten webhook.
+settings.webhook.replay.description_disabled = By uruchomić ponownie ten webhook, aktywuj go.
+settings.webhook.delivery.success = Wydarzenie zostało dodane do kolejki doręczeń. Może to zająć kilka sekund zanim pojawi się w historii doręczeń.
+settings.githooks_desc = Hooki Git są częścią samego Git. Możesz edytować pliki hooków poniżej by skonfigurować własne operacje.
+settings.discord_icon_url.exceeds_max_length = URL ikony musi mieć mniej lub równo 2048 znaków
+settings.event_wiki_desc = Strona wiki została utworzona, zmieniono jej nazwę, edytowano lub usunięto.
+settings.event_pull_request_review_request = Prośby o recenzję
+settings.event_pull_request_review_request_desc = Recenzja pull requesta została poproszona lub prośba o recenzję została usunięta.
+settings.event_pull_request_approvals = Zatwierdzenia pull requesta
+settings.event_pull_request_merge = Scalenie pull requesta
+settings.event_pull_request_enforcement = Egzekwowanie
+settings.event_package_desc = Pakiet utworzony lub usunięty w repozytorium.
+settings.branch_filter_desc = Biała lista gałęzi na wydarzenia wypchnięcia, tworzenie gałęzi i usuwanie gałęzi, określone wzorem glob. Jeżeli puste lub <code>*</code>, raportowane będą wydarzenia wszystkich gałęzi. Sprawdź składnię w dokumentacji <a href="%[1]s">%[2]s</a>. Przykłady: <code>master</code>, <code>{master,release*}</code>.
+settings.authorization_header = Nagłówek autoryzacji
+settings.authorization_header_desc = Zostanie dołączony jako nagłówek autoryzacji dla żądań kiedy będzie dostępny. Przykłady: %s.
+settings.add_web_hook_desc = Zintegruj <a target="_blank" rel="noreferrer" href="%s">%s</a> ze swoim repozytorium.
+settings.graphql_url = URL GraphQL
+settings.web_hook_name_msteams = Microsoft Teams
+settings.web_hook_name_feishu = Feishu / Lark Suite
+settings.web_hook_name_larksuite_only = Lark Suite
+settings.web_hook_name_wechatwork = WeCom (Wechat Work)
+settings.packagist_username = Nazwa użytkownika Packagist
+settings.packagist_api_token = Token API
+settings.packagist_package_url = URL pakietu Packagist
+settings.web_hook_name_sourcehut_builds = Buildy SourceHut
+settings.sourcehut_builds.manifest_path = Ścieżka manifestu budowy
+settings.sourcehut_builds.visibility = Widoczność pracy
+settings.sourcehut_builds.secrets = Sekrety
+settings.sourcehut_builds.secrets_helper = Uprawnij pracę do budowania sekretów (wymaga przyznania SECRETS:RO)
+settings.sourcehut_builds.access_token_helper = Token dostępu który ma uprawnienie JOBS:RW. Wygeneruj <a target="_blank" rel="noopener noreferrer" href="%s">token builds.sr.ht</a> lub <a target="_blank" rel="noopener noreferrer" href="%s">token builds.sr.ht z dostępem do sekretów</a> na meta.sr.ht.
+settings.add_key_success = Klucz wdrożenia "%s" został dodany.
+settings.protected_branch.save_rule = Zapisz regułę
+settings.protected_branch.delete_rule = Usuń regułę
+settings.protect_new_rule = Dodaj nową regułę ochrony gałęzi
+settings.protect_enable_merge = Włącz scalanie
+settings.protect_enable_merge_desc = Ktokolwiek z uprawnieniem zapisu będzie mógł scalić pull requesta do tej gałęzi.
+settings.protect_status_check_patterns = Wzory weryfikacji stanu
+settings.protect_status_check_patterns_desc = Wprowadź wzory do określenia które weryfikacje muszą przejść zanim gałęzie zostaną scalone do gałęzi która pasuje do reguły. Każda linia określa jeden wzór. Wzory nie mogą być puste.
+settings.protect_invalid_status_check_pattern = Nieprawidłowy wzór weryfikacji stanu: "%s".
+settings.protect_no_valid_status_check_patterns = Brak prawidłowych wzorów weryfikacji stanu.
+settings.ignore_stale_approvals = Ignoruj przestarzałe zatwierdzenia
+settings.ignore_stale_approvals_desc = Nie licz zatwierdzeń które zostały wykonane na starszych commitach (przestarzałe recenzje) do ilości zatwierdzeń które dany pull request posiada. Nie ma znaczenia gdy przestarzałe recenzje są już odrzucone.
+settings.protect_branch_name_pattern = Wzór nazwy gałęzi chronionej
+settings.protect_branch_name_pattern_desc = Wzory nazwy gałęzi chronionej. Zobacz składnię wzorów w <a href="%s">dokumentacji</a>. Przykłady: main, release/**
+settings.protect_protected_file_patterns = Chronione wzory plików (oddzielone przy użyciu średnika ";")
+settings.protect_protected_file_patterns_desc = Chronione pliki nie mogą zostać zmienione bezpośrednio nawet jeśli użytkownik ma prawa do dodawania, edytowania, lub usuwania plików w tej gałęzi. Kilka wzorów może być oddzielone przy użyciu średnika (";"). Zobacz składnię wzorów w dokumentacji <a href="%[1]s">%[2]s</a>. Przykłady: <code>.drone.yml</code>, <code>/docs/**/*.txt</code>.
+settings.protect_unprotected_file_patterns = Niechronione wzory plików (oddzielone przy użyciu średnika ";")
+settings.protect_unprotected_file_patterns_desc = Niechronione pliki które mogą zostać zmienione bezpośrednio jeśli użytkownik jest uprawniony do zapisu, pomijając ograniczenie wypchnięć. Kilka wzorów może być oddzielone przy użyciu średnika (";"). Zobacz składnię wzorów w dokumentacji <a href="%[1]s">%[2]s</a>. Przykłady: <code>.drone.yml</code>, <code>/docs/**/*.txt</code>.
+settings.update_protect_branch_success = Ochrona gałęzi dla reguły "%s" została zaktualizowana.
+settings.remove_protected_branch_success = Ochrona gałęzi dla reguły "%s" została usunięta.
+settings.remove_protected_branch_failed = Usunięcie reguły ochrony gałęzi "%s" nie powiodło się.
+settings.block_on_official_review_requests = Blokuj scalanie przy oficjalnych prośbach o recenzje
+settings.enforce_on_admins = Wymuś tę regułę dla administratorów repozytorium
+settings.enforce_on_admins_desc = Administratorzy repozytorium nie mogą ominąć tej reguły.
+settings.merge_style_desc = Style scalania
+settings.protected_branch_required_rule_name = Wymagana nazwa reguły
+settings.protected_branch_duplicate_rule_name = Już istnieje reguła dla tego zbioru gałęzi
+settings.tags.protection.pattern.description = Możesz użyć pojedynczej nazwy, wzór glob lub wyrażenia regularnego by określić kilka tagów. Przeczytaj więcej w <a target="_blank" rel="noopener" href="%s">przewodniku chronionych tagów</a>.
+settings.thread_id = ID wątku
+settings.archive.text = Zarchiwizowanie tego repo sprawi, że będzie ono w całości tylko do odczytu. Będzie ukryte z pulpitu. Nikt (nawet ty!) nie będzie mógł utworzyć nowych commitów, lub otworzyć jakichkolwiek zgłoszeń lub pull requestów.
+settings.archive.mirrors_unavailable = Kopie lustrzane nie są dostępne dla zarchiwizowanych repozytoriów.
+settings.unarchive.button = Odarchiwizuj repo
+settings.unarchive.header = Odarchiwizuj to repo
+settings.unarchive.text = Odarchiwizowanie repo przywróci możliwość otrzymywania commitów i wypchnięć, jak i również nowych zgłoszeń i pull requestów.
+settings.unarchive.success = Repo zostało odarchiwizowane pomyślnie.
+settings.unarchive.error = Wystąpił błąd podczas próby odarchiwizowania repo. Zobacz więcej szczegółów w logach.
+settings.rename_branch_failed_protected = Nie można zmienić nazwy gałęzi %s ponieważ jest ona gałęzią chronioną.
+settings.rename_branch_failed_exist = Nie można zmienić nazwy gałęzi ponieważ gałąź docelowa %s już istnieje.
+settings.rename_branch_failed_not_exist = Nie można zmienić nazwy gałęzi %s ponieważ taka gałąź nie istnieje.
+settings.rename_branch_success = Zmiana nazwy gałęzi z %s na %s zakończona pomyślnie.
+settings.rename_branch = Zmień nazwę gałęzi
+diff.git-notes.add = Dodaj notatkę
+diff.git-notes.remove-header = Usuń notatkę
+diff.git-notes.remove-body = Ta notatka zostanie usunięta.
+diff.file_suppressed_line_too_long = Diff pliku wstrzymany ponieważ jedna lub więcej linii jest za długa
+diff.too_many_files = Niektóre pliki nie są pokazane ponieważ zbyt wiele plików zostało zmienionych w tym diffie
+diff.show_more = Pokaż więcej
+diff.load = Wczytaj diff
+diff.comment.add_line_comment = Dodaj komentarz do linii
+diff.review.self_reject = Autorzy pull requestów nie mogą poprosić o zmiany na ich własnym pull requeście
+diff.review.self_approve = Autorzy pull requestów nie mogą zatwierdzić ich własnych pull requestów
+diff.image.side_by_side = Obok siebie
+diff.has_escaped = Ta linia ma ukryte znaki Unicode
+diff.show_file_tree = Pokaż drzewo plików
+diff.hide_file_tree = Ukryj drzewo plików
+release.tag_helper_new = Nowy tag. Ten tag będzie utworzony z wydania docelowego.
+release.tag_helper_existing = Istniejący tag.
+release.title = Tytuł wydania
+release.title_empty = Tytuł nie może być pusty.
+release.message = Opisz to wydanie
+release.deletion_desc = Usunięcie wydania tylko usuwa je z Forgejo. Nie wpłynie ono na tag Git, zawartości twojego repozytorium lub jego historii. Kontynuować?
+release.download_count_one = %s pobranie
+release.download_count_few = %s pobrania
+release.hide_archive_links = Ukryj automatycznie wygenerowane archiwa
+release.hide_archive_links_helper = Ukryj automatycznie wygenerowane archiwa kodu źródłowego dla tego wydania. Dla przykładu, jeśli wgrywasz swoje własne.
+release.releases_for = Wydania dla %s
+release.tags_for = Tagi dla %s
+release.system_generated = Ten załącznik jest automatycznie wygenerowany.
+release.type_attachment = Załącznik
+release.type_external_asset = Zewnętrzny zasób
+release.asset_name = Nazwa zasobu
+release.asset_external_url = Zewnętrzny URL
+release.add_external_asset = Dodaj zewnętrzny zasób
+release.invalid_external_url = Nieprawidłowy zewnętrzny URL: "%s"
+release.summary_card_alt = Karta podsumowania wydania zatytułowanego "%s" w repozytorium %s
+branch.already_exists = Gałąź o nazwie "%s" już istnieje.
+branch.delete = Usuń gałąź "%s"
+branch.delete_desc = Usunięcie gałęzi jest permanentne. Mimo, że usunięta gałąź może istnieć przez krótki czas zanim zostanie rzeczywiście usunięta, ta operacja NIE MOŻE zostać cofnięta w większości przypadków. Kontynuować?
+branch.deletion_success = Gałąź "%s" została usunięta.
+branch.deletion_failed = Nie udało się usunąć gałęzi "%s".
+branch.delete_branch_has_new_commits = Gałąź "%s" nie może zostać usunięta ponieważ nowe commity zostały dodane po scaleniu.
+branch.create_from = z "%s"
+branch.create_success = Gałąź "%s" została utworzona.
+branch.branch_already_exists = Gałąź "%s" już istnieje w repozytorium.
+branch.branch_name_conflict = Nazwa gałęzi "%s" koliduje z już istniejącą gałęzią "%s".
+branch.tag_collision = Gałąź "%s" nie może zostać utworzona, ponieważ tag z tą samą nazwą już istnieje w tym repozytorium.
+branch.restore_success = Gałąź "%s" została przywrócona.
+branch.restore_failed = Nie udało się przywrócić gałęzi "%s".
+branch.protected_deletion_failed = Gałąź "%s" jest chroniona. Nie może zostać usunięta.
+branch.default_deletion_failed = Gałąź "%s" jest domyślną gałęzią. Nie może zostać usunięta.
+branch.restore = Przywróć gałąź "%s"
+branch.download = Pobierz gałąź "%s"
+branch.rename = Zmień nazwę gałęzi "%s"
+branch.warning_rename_default_branch = Zmieniasz nazwę domyślnej gałęzi.
+branch.rename_branch_to = Zmień nazwę gałęzi "%s" na:
+branch.new_branch_from = Utwórz nową gałąź z "%s"
+branch.renamed = Nazwa gałęzi %s została zmieniona na %s.
+tag.create_tag_operation = Utwórz tag
+tag.confirm_create_tag = Utwórz tag
+tag.create_tag_from = Utwórz nowy tag z "%s"
+tag.create_success = Tag "%s" został utworzony.
+topic.format_prompt = Tematy muszą zaczynać się od litery lub liczby, mogą zawierać myślniki ("-") i kropki ("."), mogą być długie do 35 znaków. Litery muszą być małe.
+find_file.go_to_file = Szukaj pliku
+find_file.no_matching = Nie znaleziono pasujących plików
+error.broken_git_hook = Hooki Git tego repozytorium zdają się być zepsute. Proszę sprawdź jak je naprawić w <a target="_blank" rel="noreferrer" href="%s">dokumentacji</a>, a następnie wypchnij parę commitów by odświeżyć stan.
+
 [graphs]
+component_loading = Wczytywanie %s...
+component_loading_failed = Nie można wczytać %s
+component_loading_info = To może trochę zająć…
+component_failed_to_load = Wydarzył się niespodziewany błąd.
+code_frequency.what = częstotliwość kodu
+contributors.what = kontrybucje
+recent_commits.what = ostatnie commity
 
 [org]
 org_name_holder=Nazwa organizacji
@@ -2226,21 +2900,21 @@ settings.labels_desc=Dodaj etykiety, które mogą być używane w zgłoszeniach
 
 members.membership_visibility=Widoczność członkostwa:
 members.public=Widoczny
-members.public_helper=ukryj
+members.public_helper=Ukryj
 members.private=Ukryty
-members.private_helper=pokaż
-members.member_role=Rola:
+members.private_helper=Pokaż
+members.member_role=Rola członka:
 members.owner=Właściciel
 members.member=Członek
 members.remove=Usuń
 members.leave=Opuść
-members.leave.detail=Opuścić %s?
+members.leave.detail=Czy jesteś pewien(-na), że chcesz opuścić organizację "%s"?
 members.invite_desc=Dodaj nowego członka do %s:
 members.invite_now=Zaproś teraz
 
 teams.join=Dołącz
 teams.leave=Opuść
-teams.leave.detail=Opuścić %s?
+teams.leave.detail=Czy jesteś pewien(-na), że chcesz opuścić zespół "%s"?
 teams.can_create_org_repo=Tworzenie repozytoriów
 teams.can_create_org_repo_helper=Członkowie mogą tworzyć nowe repozytoria w organizacji. Twórca otrzyma uprawnienia administracyjne do nowego repozytorium.
 teams.read_access=Przeczytane
@@ -2260,7 +2934,7 @@ teams.delete_team_desc=Usunięcie zespołu wycofa dostęp do repozytorium jego c
 teams.delete_team_success=Zespół został usunięty.
 teams.read_permission_desc=Ten zespół udziela dostępu <strong>z odczytem</strong>: członkowie mogą wyświetlać i klonować repozytoria zespołu.
 teams.write_permission_desc=Ten zespół udziela dostępu <strong>z zapisem</strong>: członkowie mogą wyświetlać i wypychać zmiany do repozytoriów zespołu.
-teams.admin_permission_desc=Ten zespół udziela dostępu <strong>administratora</strong>: członkowie mogą wyświetlać i wypychać zmiany oraz dodawać współpracowników do repozytoriów zespołu.
+teams.admin_permission_desc=Ten zespół udziela dostępu <strong>Administratora</strong>: członkowie mogą wyświetlać i wypychać zmiany oraz dodawać współpracowników do repozytoriów zespołu.
 teams.create_repo_permission_desc=Dodatkowo, ten zespół otrzyma uprawnienie <strong>Tworzenie repozytoriów</strong>: jego członkowie mogą tworzyć nowe repozytoria w organizacji.
 teams.repositories=Repozytoria zespołu
 teams.search_repo_placeholder=Szukaj repozytorium…
@@ -2281,6 +2955,25 @@ teams.all_repositories_admin_permission_desc=Ten zespół nadaje uprawnienia <st
 teams.write_access = Zapis
 code = Kod
 
+open_dashboard = Otwórz pulpit
+follow_blocked_user = Nie możesz obserwować tej organizacji ponieważ ta organizacja ciebie zablokowała.
+form.name_reserved = Nazwa organizacji "%s" jest zarezerwowana.
+form.name_pattern_not_allowed = Wzór "%s" nie jest dozwolony w nazwie organizacji.
+settings.email = Email kontaktowy
+settings.visibility.limited = Ograniczona (widoczne tylko dla zalogowanych użytkowników)
+settings.change_orgname_prompt = Uwaga: Zmiana nazwy organizacji zmieni również URL twojej organizacji i udostępni starą nazwę.
+members.remove.detail = Usunąć %[1]s z %[2]s?
+teams.none_access = Brak dostępu
+teams.none_access_helper = Opcja "brak dostępu" dotyczy tylko repozytoriów prywatnych.
+teams.general_access = Niestandardowy dostęp
+teams.general_access_helper = Uprawnienia członków będą określane na podstawie poniższej tabeli uprawnień.
+teams.invite_team_member = Zaproś do %s
+teams.invite_team_member.list = Oczekujące zaproszenia
+teams.add_nonexistent_repo = Repozytorium które próbujesz dodać nie istnieje, proszę je najpierw utworzyć.
+teams.invite.title = Zostałeś(-aś) zaproszony(-a) do dołączenia do zespołu <strong>%s</strong> w organizacji <strong>%s</strong>.
+teams.invite.by = Zaproszony(-a) przez %s
+teams.invite.description = Proszę kliknij przycisk poniżej by dołączyć do zespołu.
+
 [admin]
 dashboard=Pulpit
 users=Konta użytkownika
@@ -2332,8 +3025,8 @@ dashboard.resync_all_hooks=Ponownie synchronizuj hooki pre-receive, update i pos
 dashboard.reinit_missing_repos=Ponownie zainicjalizuj wszystkie brakujące repozytoria Git, dla których istnieją rekordy
 dashboard.sync_external_users=Synchronizuj zewnętrzne dane użytkownika
 dashboard.cleanup_hook_task_table=Oczyść tabelę hook_task
-dashboard.server_uptime=Uptime serwera
-dashboard.current_goroutine=Bieżące Goroutines
+dashboard.server_uptime=Czas pracy serwera
+dashboard.current_goroutine=Bieżące goroutines
 dashboard.current_memory_usage=Bieżące użycie pamięci
 dashboard.total_memory_allocated=Całkowita przydzielona pamięć
 dashboard.memory_obtained=Pamięć uzyskana
@@ -2365,7 +3058,7 @@ dashboard.delete_old_actions=Usuń wszystkie stare akcje z bazy danych
 dashboard.delete_old_actions.started=Usuwanie wszystkich starych akcji z bazy danych rozpoczęte.
 
 users.user_manage_panel=Zarządzanie kontami użytkowników
-users.new_account=Nowy użytkownik
+users.new_account=Utwórz konto użytkownika
 users.name=Nazwa użytkownika
 users.full_name=Imię i nazwisko
 users.activated=Aktywny
@@ -2375,7 +3068,7 @@ users.2fa=2FA
 users.repos=Repozytoria
 users.created=Utworzony
 users.last_login=Ostatnie logowanie
-users.never_login=Nigdy nie zalogował(-a) się
+users.never_login=Nigdy nie zalogował(a) się
 users.send_register_notify=Wyślij użytkownikowi powiadomienie o rejestracji
 users.edit=Edytuj
 users.auth_source=Źródło uwierzytelniania
@@ -2386,12 +3079,12 @@ users.update_profile_success=Konto użytkownika zostało zaktualizowane.
 users.edit_account=Edytuj konto użytkownika
 users.max_repo_creation=Maksymalna ilość repozytoriów
 users.max_repo_creation_desc=(Wpisz -1, aby użyć domyślnego globalnego limitu.)
-users.is_activated=Konto użytkownika jest aktywne
-users.prohibit_login=Wyłącz logowanie
-users.is_admin=Jest administratorem
-users.is_restricted=Jest ograniczone
+users.is_activated=Aktywne konto
+users.prohibit_login=Zawieszone konto
+users.is_admin=Konto administratora
+users.is_restricted=Ograniczone konto
 users.allow_git_hook=Może tworzyć hooki Gita
-users.allow_git_hook_tooltip=Git Hook'i są wykonywane jako użytkownik systemu operacyjnego obsługujący Forgejo i będą miały taki sam poziom dostępu jak host. W rezultacie użytkownicy z tym specjalnym przywilejem Git Hook mogą uzyskać dostęp i modyfikować wszystkie repozytoria Forgejo oraz bazę danych używaną przez Forgejo. W związku z tym są oni również w stanie zdobyć uprawnienia administratora Forgejo.
+users.allow_git_hook_tooltip=Hooki Git są wykonywane jako użytkownik systemu operacyjnego obsługujący Forgejo i będą miały taki sam poziom dostępu jak host. W rezultacie użytkownicy z tym specjalnym przywilejem Git hook mogą uzyskać dostęp i modyfikować wszystkie repozytoria Forgejo oraz bazę danych używaną przez Forgejo. W związku z tym są oni również w stanie zdobyć uprawnienia administratora Forgejo.
 users.allow_import_local=Może importować lokalne repozytoria
 users.allow_create_organization=Może tworzyć organizacje
 users.update_profile=Zaktualizuj konto użytkownika
@@ -2416,7 +3109,7 @@ emails.not_updated=Nie udało się zaktualizować żądanego adresu e-mail: %v
 emails.duplicate_active=Ten e-mail jest już aktywny dla innego użytkownika.
 emails.change_email_header=Aktualizuj właściwości adresu e-mail
 
-orgs.org_manage_panel=Zarządzanie organizacją
+orgs.org_manage_panel=Zarządzanie organizacjami
 orgs.name=Nazwa
 orgs.teams=Zespoły
 orgs.members=Członkowie
@@ -2440,11 +3133,11 @@ packages.type=Typ
 packages.repository=Repozytorium
 packages.size=Rozmiar
 
-defaulthooks=Domyślne Webhooki
+defaulthooks=Domyślne webhooki
 defaulthooks.add_webhook=Dodaj domyślny Webhook
 defaulthooks.update_webhook=Zaktualizuj domyślny Webhook
 
-systemhooks=Webhooki Systemowe
+systemhooks=Webhooki systemowe
 systemhooks.add_webhook=Dodaj Webhook Systemowy
 systemhooks.update_webhook=Aktualizuj Webhook Systemowy
 
@@ -2469,7 +3162,7 @@ auths.attribute_username=Atrybut nazwy użytkownika
 auths.attribute_username_placeholder=Pozostaw puste, aby użyć nazwy użytkownika wprowadzonej w Forgejo.
 auths.attribute_name=Atrybut imienia
 auths.attribute_surname=Atrybut nazwiska
-auths.attribute_mail=Atrybut adresu e-mail
+auths.attribute_mail=Atrybut adresu email
 auths.attribute_ssh_public_key=Atrybut publicznego klucza SSH
 auths.attributes_in_bind=Pobierz atrybuty w kontekście Bind DN
 auths.allow_deactivate_all=Zezwól na pusty wynik wyszukiwania, aby zdezaktywować wszystkich użytkowników
@@ -2478,7 +3171,7 @@ auths.search_page_size=Rozmiar strony
 auths.filter=Filtr użytkownika
 auths.admin_filter=Filtr administratora
 auths.restricted_filter=Filtr ograniczenia
-auths.restricted_filter_helper=Pozostaw puste, aby nie ustawiać żadnych użytkowników jako ograniczonych. Użyj gwiazdki ('*'), aby ustawić wszystkich użytkowników, którzy nie pasują do Filtra Administratora jako ograniczonych.
+auths.restricted_filter_helper=Pozostaw puste, aby nie ustawiać żadnych użytkowników jako ograniczonych. Użyj gwiazdki ('*'), aby ustawić wszystkich użytkowników, którzy nie pasują do filtra Administratora jako ograniczonych.
 auths.ms_ad_sa=Atrybuty wyszukiwania MS AD
 auths.smtp_auth=Typ uwierzytelnienia SMTP
 auths.smtphost=Serwer SMTP
@@ -2488,7 +3181,7 @@ auths.allowed_domains_helper=Pozostaw puste, aby zezwolić na wszystkie domeny.
 auths.skip_tls_verify=Pomiń weryfikację protokołu TLS
 auths.disable_helo=Wyłącz HELO
 auths.pam_service_name=Nazwa usługi PAM
-auths.pam_email_domain=Domena e-mail PAM (opcjonalna)
+auths.pam_email_domain=Domena email PAM (opcjonalna)
 auths.oauth2_provider=Dostawca OAuth2
 auths.oauth2_icon_url=Adres URL Ikony
 auths.oauth2_clientID=ID klienta (klucz)
@@ -2538,9 +3231,9 @@ auths.deletion_success=Źródło uwierzytelniania zostało usunięte.
 auths.login_source_of_type_exist=Źródło uwierzytelniania tego typu już istnieje.
 
 config.server_config=Konfiguracja serwera
-config.app_name=Tytuł strony
+config.app_name=Tytuł instancji
 config.app_ver=Wersja Forgejo
-config.app_url=Podstawowy adres URL Forgejo
+config.app_url=Podstawowy adres URL
 config.custom_conf=Ścieżka do pliku konfiguracyjnego
 config.custom_file_root_path=Ścieżka główna plików niestandardowych
 config.offline_mode=Tryb lokalny
@@ -2588,16 +3281,16 @@ config.enable_openid_signup=Włącz samodzielną rejestrację za pomocą OpenID
 config.enable_openid_signin=Włącz logowanie za pomocą OpenID
 config.show_registration_button=Pokazuj przycisk rejestracji
 config.require_sign_in_view=Wymagaj zalogowania w celu wyświetlania stron
-config.mail_notify=Włącz powiadomienia e-mail
+config.mail_notify=Włącz powiadomienia email
 config.enable_captcha=Włącz CAPTCHA
 config.active_code_lives=Ważność kodów aktywacyjnych
 config.reset_password_code_lives=Czas wygaśnięcia kodu przywracania konta
-config.default_keep_email_private=Domyślne ukrywanie adresów e-mail
+config.default_keep_email_private=Domyślne ukrywanie adresów email
 config.default_allow_create_organization=Domyślnie zezwalaj na tworzenie organizacji
 config.enable_timetracking=Włącz śledzenie czasu
 config.default_enable_timetracking=Domyślnie włącz śledzenie czasu
 config.default_allow_only_contributors_to_track_time=Zezwalaj wyłącznie współpracownikom na śledzenie czasu
-config.no_reply_address=Ukryta domena e-mail
+config.no_reply_address=Ukryta domena email
 config.default_visibility_organization=Domyślna widoczność dla nowych organizacji
 config.default_enable_dependencies=Domyślne włączanie zależności zgłoszeń
 
@@ -2638,19 +3331,19 @@ config.cookie_life_time=Czas ważności ciasteczka
 config.picture_config=Konfiguracja obrazu i awataru
 config.picture_service=Usługa obrazów
 config.disable_gravatar=Wyłącz Gravatar
-config.enable_federated_avatar=Włącz sfederowane awatary
+config.enable_federated_avatar=Włącz federowane awatary
 
 config.git_config=Konfiguracja Git
-config.git_disable_diff_highlight=Wyłączyć wyróżnianie składni diff
-config.git_max_diff_lines=Maksymalna liczba linii diff (dla pojedynczego pliku)
-config.git_max_diff_line_characters=Maksymalna liczba znaków diff (dla pojedynczego pliku)
-config.git_max_diff_files=Maksymalna liczba plików diff (które zostaną wyświetlone)
+config.git_disable_diff_highlight=Wyłącz wyróżnianie składni diff
+config.git_max_diff_lines=Maksymalna liczba linii diff na plik
+config.git_max_diff_line_characters=Maksymalna liczba znaków diff na linię
+config.git_max_diff_files=Maksymalna liczba plików diff
 config.git_gc_args=Argumenty GC
 config.git_migrate_timeout=Limit czasu migracji
 config.git_mirror_timeout=Limit czasu aktualizacji kopii lustrzanej
 config.git_clone_timeout=Limit czasu operacji klonowania
 config.git_pull_timeout=Limit czasu dla operacji pull
-config.git_gc_timeout=Limit czasu usuwania śmieci
+config.git_gc_timeout=Limit czasu operacji GC
 
 config.log_config=Konfiguracja dziennika
 config.disabled_logger=Wyłączone
@@ -2679,8 +3372,8 @@ monitor.queue.name=Nazwa
 monitor.queue.type=Typ
 monitor.queue.exemplar=Przykładowy typ
 monitor.queue.numberworkers=Liczba procesów pracujących
-monitor.queue.maxnumberworkers=Maksymalna liczba procesów pracujących
-monitor.queue.settings.title=Ustawienia Puli
+monitor.queue.maxnumberworkers=Maksymalna Liczba procesów pracujących
+monitor.queue.settings.title=Ustawienia puli
 monitor.queue.settings.maxnumberworkers=Maksymalna liczba procesów pracujących
 monitor.queue.settings.maxnumberworkers.placeholder=Obecnie %[1]d
 monitor.queue.settings.maxnumberworkers.error=Maksymalna liczba procesów pracujących musi być liczbą
@@ -2688,7 +3381,7 @@ monitor.queue.settings.submit=Aktualizuj ustawienia
 monitor.queue.settings.changed=Zaktualizowano ustawienia
 
 notices.system_notice_list=Powiadomienia systemu
-notices.view_detail_header=Pokaż szczegóły powiadomienia
+notices.view_detail_header=Szczegóły powiadomienia
 notices.select_all=Wybierz wszystkie
 notices.deselect_all=Odznacz wszystkie
 notices.inverse_selection=Odwróć wybór
@@ -2719,6 +3412,56 @@ config_summary = Podsumowanie
 config_settings = Ustawienia
 
 
+identity_access = Tożsamość i dostęp
+assets = Zasoby kodu
+settings = Ustawienia administratora
+dashboard.new_version_hint = Forgejo %s jest już dostępne, w tej chwili korzystasz z %s. Sprawdź szczegóły na <a target="_blank" rel="noreferrer" href="%s">blogu</a>.
+dashboard.task.cancelled = Zadanie: %[1]s anulowane: %[3]s
+dashboard.cron.cancelled = Cron: %[1]s anulowany: %[3]s
+dashboard.sync_repo_branches = Synchronizuj pominięte gałęzie z danych Git do bazy danych
+dashboard.sync_repo_tags = Synchronizuj tagi z danych Git do bazy danych
+dashboard.cleanup_packages = Wyczyść przedawnione pakiety
+dashboard.cleanup_actions = Wyczyść przedawnione logi i artefakty z akcji
+dashboard.delete_old_system_notices = Usuń wszystkie stare powiadomienia systemowe z bazy danych
+dashboard.gc_lfs = Wywołaj GC na metaobiektach LFS
+dashboard.stop_zombie_tasks = Zatrzymaj zadania zombi akcji
+dashboard.stop_endless_tasks = Zatrzymaj niekończące się zadania akcji
+dashboard.cancel_abandoned_jobs = Anuluj porzucone prace akcji
+dashboard.sync_branch.started = Synchronizacja gałęzi rozpoczęta
+dashboard.sync_tag.started = Synchronizacja tagu rozpoczęta
+dashboard.rebuild_issue_indexer = Przebuduj indekser zgłoszeń
+users.reserved = Zarezerwowane
+users.new_success = Konto użytkownika "%s" zostało utworzone.
+users.activated.description = Zakończenie weryfikacji email. Właściciel nieaktywowanego konta nie będzie mógł się zalogować dopóki weryfikacja email nie została zakończona.
+users.block.description = Zablokuj użytkownikowi możliwości interakcji z tym serwisem przez jego konto i zabroń logowania się.
+users.admin.description = Nadaj temu użytkownikowi pełen dostęp do wszystkich funkcji administracyjnych dostępnych przez interfejs przeglądarkowy lub API.
+users.restricted.description = Zezwól tylko na interakcje z repozytoriami i organizacjami do których ten użytkownik został dodany jako współpracownik. To uniemożliwia dostęp do publicznych repozytoriów na tej instancji.
+users.local_import.description = Zezwól na importowanie repozytoriów z lokalnego systemu plików serwera. To może być problemem zabezpieczeń.
+users.organization_creation.description = Zezwól na tworzenie nowych organizacji.
+users.cannot_delete_self = Nie możesz usunąć sam(a) siebie
+users.purge = Pozbądź się użytkownika
+users.purge_help = Wymusza usunięcie użytkownika razem z jakimikolwiek repozytoriami, organizacjami, oraz pakietami których ten użytkownik jest właścicielem. Wszystkie komentarze i zgłoszenia przez tego użytkownika również zostaną usunięte.
+users.still_own_packages = Ten użytkownik nadal jest właścicielem jednego lub więcej pakietów, usuń najpierw te pakiety.
+users.list_status_filter.not_admin = Nie administrator
+users.list_status_filter.not_restricted = Nie ograniczony
+users.list_status_filter.is_prohibit_login = Zabroń logowania
+users.list_status_filter.not_prohibit_login = Zezwól na logowanie
+users.list_status_filter.is_2fa_enabled = 2FA włączone
+users.list_status_filter.not_2fa_enabled = 2FA wyłączone
+users.details = Szczegóły użytkownika
+emails.change_email_text = Czy jesteś pewien(-na), że chcesz zaktualizować ten adres email?
+emails.delete = Usuń Email
+emails.delete_desc = Czy jesteś pewien(-na), że chcesz usunąć ten adres email?
+emails.deletion_success = Adres email został usunięty.
+emails.delete_primary_email_error = Nie możesz usunąć głównego adresu email.
+repos.lfs_size = Wielkość LFS
+packages.package_manage_panel = Zarządzaj pakietami
+packages.total_size = Wielkość całkowita: %s
+packages.unreferenced_size = Nieodniesiona wielkość: %s
+packages.cleanup = Wyczyść przedawnione dane
+packages.cleanup.success = Pomyślnie wyczyszczono przedawnione dane
+defaulthooks.desc = Webhooki automatycznie wykonują żądania HTTP POST do serwera kiedy pewne wydarzenia Forgejo zostają wywołane. Webhooki zdefiniowane tutaj są domyślne i będą kopiowane do wszystkich nowych repozytoriów. Przeczytaj więcej w <a target="_blank" rel="noopener" href="%s">przewoniku webhooków</a>.
+
 [action]
 create_repo=tworzy repozytorium <a href="%s">%s</a>
 rename_repo=zmienia nazwę repozytorium <code>%[1]s</code> na <a href="%[2]s">%[3]s</a>
@@ -2775,8 +3518,8 @@ error.extract_sign=Nie udało się wyłuskać podpisu
 error.generate_hash=Nie udało się wygenerować skrótu dla commitu
 error.no_committer_account=Brak konta powiązanego z adresem e-mail autora
 error.no_gpg_keys_found=Nie znaleziono w bazie danych klucza dla tego podpisu
-error.not_signed_commit=Commit nie podpisany
-error.failed_retrieval_gpg_keys=Nie udało się odzyskać żadnego klucza powiązanego z kontem autora
+error.not_signed_commit=Commit niepodpisany
+error.failed_retrieval_gpg_keys=Nie udało się uzyskać żadnego klucza powiązanego z kontem autora
 error.probable_bad_signature=OSTRZEŻENIE! Pomimo istnienia klucza z takim ID w bazie, nie weryfikuje on tego commita! Ten commit jest PODEJRZANY.
 error.probable_bad_default_signature=OSTRZEŻENIE! Pomimo, że domyślny klucz posiada to ID, nie weryfikuje on tego commita! Ten commit jest PODEJRZANY.
 
@@ -2818,9 +3561,24 @@ container.labels.value = Wartość
 npm.dependencies = Zależności
 rpm.repository.architectures = Architektury
 
+owner.settings.chef.keypair.description = Para kluczy jest konieczna do uwierzytelnienia do rejestru Chef. Jeżeli wygenerowałeś(-aś) parę kluczy wcześniej, generowanie nowej pary kluczy porzuci starą parę kluczy.
+
 [secrets]
 secrets = Sekrety
 
+description = Sekrety będą przekazane pewnym akcjom, nie mogą być odczytane inaczej.
+none = Nie ma jeszcze sekretów.
+creation = Dodaj Sekret
+creation.name_placeholder = wielkość liter nie ma znaczenia, tylko znaki alfanumeryczne i znak podkreślenia, nie może zaczynać się od GITEA_ lub GITHUB_
+creation.value_placeholder = Wprowadź dowolną treść. Białe znaki na początku i końcu będą pominięte.
+creation.success = Secret "%s" został dodany.
+creation.failed = Dodanie sekretu nie powiodło się.
+deletion = Usuń sekret
+deletion.description = Usunięcie sekretu jest permanentne i nie może zostać cofnięte. Kontynuować?
+deletion.success = Sekret został usunięty.
+deletion.failed = Nie udało się usunąć sekretu.
+management = Zarządzaj sekretami
+
 [actions]
 runners.name=Nazwa
 runners.owner_type=Typ
@@ -2854,7 +3612,53 @@ status.blocked = Zablokowano
 
 
 
+actions = Akcje
+runners = Runnery
+runners.runner_manage_panel = Zarządzaj runnerami
+runners.new = Utwórz nowy runner
+runners.new_notice = Jak uruchomić runner
+runners.last_online = Ostatni czas online
+runners.runner_title = Runner
+runners.task_list = Ostatnie zadania w tym runnerze
+runners.task_list.no_tasks = Nie ma jeszcze zadań.
+runners.edit_runner = Edytuj Runnera
+runners.update_runner = Aktualizuj zmiany
+runners.update_runner_success = Runner zaktualizowany pomyślnie
+runners.update_runner_failed = Nie udało się zaktualizować runnera
+runners.delete_runner = Usuń ten runner
+runners.delete_runner_success = Runner usunięty pomyślnie
+runners.delete_runner_failed = Nie udało się usunąć runnera
+runners.delete_runner_header = Potwierdź usunięcie tego runnera
+runners.delete_runner_notice = Jeżeli zadanie nadal jest wykonywane przez ten runner, zostanie ono zakończone i oznaczone jako niepowodzenie. Może to przerwać proces pracy.
+runners.none = Brak dostępnych runnerów
+runners.reset_registration_token = Resetuj token rejestracji
+runners.reset_registration_token_success = Rejestracja tokenu resetu runnera pomyślna
+runs.no_matching_online_runner_helper = Brak pasujących runnerów online z etykietą: %s
+runs.no_results = Brak pasujących wyników.
+runs.no_workflows.help_write_access = Nie wiesz jak zacząć z Forgejo Actions? Sprawdź <a target="_blank" rel="noopener noreferrer" href="%s">szybki start w dokumentacji użytkownika</a> i napisz swój pierwszy proces pracy, a następnie <a target="_blank" rel="noopener noreferrer" href="%s">skonfiguruj runnera Forgejo</a> by wykonywał twoje zadania.
+runs.no_workflows.help_no_write_access = By dowiedzieć się o Forgejo Actions, zobacz <a target="_blank" rel="noopener noreferrer" href="%s">dokumentację</a>.
+runs.empty_commit_message = (pusta wiadomość commita)
+runs.expire_log_message = Logi zostały oczyszczone ponieważ były za stare.
+variables.management = Zarządzaj zmiennymi
+variables.creation = Dodaj zmienną
+variables.none = Nie ma jeszcze zmiennych.
+variables.deletion = Usuń zmienną
+variables.deletion.description = Usunięcie zmiennej jest permanentne i nie może zostać cofnięte. Kontynuować?
+variables.description = Zmienne będą przekazane pewnym akcjom, nie mogą być odczytane inaczej.
+variables.id_not_exist = Zmienna o ID %d nie istnieje.
+variables.edit = Edytuj Zmienną
+variables.deletion.failed = Nie udało się usunąć zmiennej.
+variables.deletion.success = Zmienna została usunięta.
+variables.creation.failed = Nie udało się dodać zmiennej.
+variables.creation.success = Zmienna "%s" została dodana.
+variables.update.failed = Nie udało się zmienić zmiennej.
+variables.update.success = Zmienna została zmieniona.
+
 [projects]
+deleted.display_name = Projekt usunięty
+type-1.display_name = Projekt osobisty
+type-2.display_name = Projekt repozytorium
+type-3.display_name = Projekt organizacji
 
 [git.filemode]
 symbolic_link=Dowiązanie symboliczne
@@ -2864,6 +3668,9 @@ directory = Katalog
 
 
 
+changed_filemode = %[1]s → %[2]s
+normal_file = Zwykły plik
+
 [search]
 search = Wyszukaj...
 type_tooltip = Typ wyszukiwania
@@ -2889,8 +3696,36 @@ milestone_kind = Wyszukaj kamienie milowe...
 union_tooltip = Uwzględnij wyniki pasujące do dowolnego słowa kluczowego oddzielonego spacjami
 exact = Dokładnie
 exact_tooltip = Uwzględniaj tylko wyniki pasujące do wyszukiwanego hasła
-issue_kind = Wyszukaj problemy...
+issue_kind = Wyszukaj zgłoszenia...
 pull_kind = Wyszukaj pull requesty...
 union = Unia
 regexp = RegExp
 regexp_tooltip = Interpretuj wyszukiwane hasło jako wyrażenie regularne
+
+[repo.permissions]
+code.read = <b>Odczyt:</b> Dostęp i klonowanie kodu repozytorium.
+code.write = <b>Zapis:</b> Wypychanie do repozytorium, tworzenie gałęzi i tagów.
+issues.read = <b>Odczyt:</b> Odczyt i tworzenie zgłoszeń i komentarzy.
+issues.write = <b>Zapis:</b> Zamykanie zgłoszeń i zarządzanie metadanymi takimi jak etykiety, kamienie milowe, osoby przypisane, terminy i zależności.
+pulls.read = <b>Odczyt:</b> Czytanie i tworzenie pull requestów.
+pulls.write = <b>Zapis:</b> Zamykanie pull requestów i zarządzanie metadanymi takimi jak etykiety, kamienie milowe, osoby przypisane, terminy i zależności.
+releases.read = <b>Odczyt:</b> Czytanie i pobieranie wydań.
+releases.write = <b>Zapis:</b> Publikowanie, edycja i usuwanie wydań oraz ich zasobów.
+wiki.read = <b>Odczyt:</b> Czytanie zintegrowanej wiki oraz jej historii.
+wiki.write = <b>Zapis:</b> Tworzenie, edycja i usuwanie stron ze zintegrowanej wiki.
+projects.read = <b>Odczyt:</b> Dostęp do plansz projektu repozytorium.
+projects.write = <b>Zapis:</b> Tworzenie projektów i kolumn oraz ich edycja.
+packages.read = <b>Odczyt:</b> Podgląd i pobieranie pakietów przypisanych do repozytorium.
+packages.write = <b>Zapis:</b> Publikowanie i usuwanie pakietów przypisanych do repozytorium.
+actions.read = <b>Odczyt:</b> Podgląd zintegrowanych procesów CI/CD i ich logów.
+actions.write = <b>Zapis:</b> Ręczne wywołanie, restart, anulowanie lub zatwierdzenie oczekujących procesów CI/CD.
+ext_issues = Dostęp do linku kierującego do zewnętrznego dziennika zgłoszeń. Uprawnienia są zarządzane zewnętrznie.
+ext_wiki = Dostęp do linku kierującego do zewnętrznej wiki. Uprawnienia są zarządzane zewnętrznie.
+
+[markup]
+filepreview.line = Linia %[1]d w %[2]s
+filepreview.lines = Linie %[1]d do %[2]d w %[3]s
+filepreview.truncated = Podgląd został przycięty
+
+[translation_meta]
+test = Litwo, Ojczyzno moja! ty jesteś jak zdrowie; ile cię trzeba cenić, ten tylko się dowie, kto cię stracił. Dziś piękność twą w całej ozdobie widzę i opisuję, bo tęsknię po tobie.
diff --git a/options/locale/locale_pt-BR.ini b/options/locale/locale_pt-BR.ini
index 31594ee437..22802418d9 100644
--- a/options/locale/locale_pt-BR.ini
+++ b/options/locale/locale_pt-BR.ini
@@ -1222,7 +1222,7 @@ migrate.migrating_failed_no_addr=A migração falhou.
 migrate.github.description=Migre dados do servidor github.com ou GitHub Enterprise.
 migrate.git.description=Migrar um repositório somente de qualquer serviço Git.
 migrate.gitlab.description=Migrar dados de gitlab.com ou de outras instâncias do GitLab.
-migrate.gitea.description=Migrar dados de gitea.com ou de outras instâncias do Gitea/Forgejo.
+migrate.gitea.description=Migrar dados de gitea.com ou de outras instâncias do Gitea.
 migrate.gogs.description=Migrar dados de notabug.org ou de outras instâncias do Gogs.
 migrate.onedev.description=Migrar dados de code.onedev.io ou de outras instâncias do OneDev.
 migrate.codebase.description=Migrar dados de codebasehq.com.
@@ -2869,6 +2869,8 @@ issues.reaction.alt_add = Adicionar reação %[1]s ao comentário.
 issues.context.menu = Menu de comentário
 release.summary_card_alt = Cartão de resumo de um release intitulado "%s" no repositório %s
 
+editor.commit_email = Email de commit
+
 [graphs]
 component_loading = Carregando %s...
 component_loading_failed = Não foi possível carregar o(a) %s
diff --git a/options/locale/locale_pt-PT.ini b/options/locale/locale_pt-PT.ini
index 95f4c83889..8e30b897b0 100644
--- a/options/locale/locale_pt-PT.ini
+++ b/options/locale/locale_pt-PT.ini
@@ -1233,7 +1233,7 @@ migrate.migrating_failed_no_addr=A migração falhou.
 migrate.github.description=Migrar dados do github.com ou do GitHub Enterprise server.
 migrate.git.description=Migrar um repositório somente de qualquer serviço Git.
 migrate.gitlab.description=Migrar dados de gitlab.com ou de outras instâncias do GitLab.
-migrate.gitea.description=Migrar dados de gitea.com ou de outras instâncias do Gitea/Forgejo.
+migrate.gitea.description=Migrar dados de gitea.com ou de outras instâncias do Gitea.
 migrate.gogs.description=Migrar dados de notabug.org ou de outras instâncias do Gogs.
 migrate.onedev.description=Migrar dados de code.onedev.io ou de outras instâncias do OneDev.
 migrate.codebase.description=Migrar dados de codebasehq.com.
@@ -2870,6 +2870,8 @@ pulls.sign_in_require = <a href="%s">Inicie sessão</a> para criar um novo pedid
 settings.default_update_style_desc = Estilo de atualização predefinido utilizado para atualizar pedidos de integração que estão atrasados em relação ao ramo base.
 release.summary_card_alt = Cartão de resumo de um lançamento com o título "%s" no repositório %s
 
+editor.commit_email = Endereço de email do cometimento
+
 [graphs]
 component_loading=A carregar %s...
 component_loading_failed=Não foi possível carregar %s
@@ -3537,7 +3539,7 @@ notices.delete_success=As notificações do sistema foram eliminadas.
 
 self_check.no_problem_found=Nenhum problema encontrado até agora.
 self_check.database_collation_mismatch=Supor que a base de dados usa a colação: %s
-self_check.database_collation_case_insensitive=A base de dados está a usar a colação %s, que é insensível à diferença entre maiúsculas e minúsculas. Embora o Gitea possa trabalhar com ela, pode haver alguns casos raros que não funcionem como esperado.
+self_check.database_collation_case_insensitive=A base de dados está a usar a colação %s, que é insensível à diferença entre maiúsculas e minúsculas. Embora o Forgejo possa trabalhar com ela, pode haver alguns casos raros que não funcionem como esperado.
 self_check.database_inconsistent_collation_columns=A base de dados está a usar a colação %s, mas estas colunas estão a usar colações diferentes. Isso poderá causar alguns problemas inesperados.
 self_check.database_fix_mysql=Para utilizadores do MySQL/MariaDB, pode usar o comando "forgejo doctor convert" para resolver os problemas de colação. Também pode resolver o problema com comandos SQL "ALTER ... COLLATE ..." aplicados manualmente.
 config_summary = Resumo
diff --git a/options/locale/locale_ru-RU.ini b/options/locale/locale_ru-RU.ini
index 2b723d1e43..83093fa573 100644
--- a/options/locale/locale_ru-RU.ini
+++ b/options/locale/locale_ru-RU.ini
@@ -2871,6 +2871,8 @@ issues.reaction.alt_add = Добавить реакцию %[1]s к этому к
 issues.context.menu = Меню комментария
 release.summary_card_alt = Карточка со сводкой о выпуске «%s» в репозитории %s
 
+editor.commit_email = Эл. почта автора
+
 [graphs]
 component_loading_failed = Не удалось загрузить %s
 component_failed_to_load = Случилась непредвиденная ошибка.
@@ -3696,7 +3698,7 @@ dependency.version=Версия
 alpine.registry=Настройте этот реестр, добавив URL в файл <code>/etc/apk/repositories</code>:
 alpine.registry.key=Загрузите публичный ключ RSA реестра в каталог <code>/etc/apk/keys/</code> для проверки подписи индекса:
 alpine.registry.info=Выберите $branch и $repository из списка ниже.
-alpine.install=Чтобы установить пакет, выполните следующую команду:
+alpine.install=Для установки пакета выполните следующую команду:
 alpine.repository=О репозитории
 alpine.repository.branches=Ветви
 alpine.repository.repositories=Репозитории
@@ -3704,7 +3706,7 @@ alpine.repository.architectures=Архитектуры
 cargo.registry=Настройте этот реестр в файле конфигурации Cargo (например, <code>~/.cargo/config.toml</code>):
 cargo.install=Чтобы установить пакет с помощью Cargo, выполните следующую команду:
 chef.registry=Настройте этот реестр в своём файле <code>~/.chef/config.rb</code>:
-chef.install=Чтобы установить пакет, выполните следующую команду:
+chef.install=Для установки пакета выполните следующую команду:
 composer.registry=Настройте этот реестр в файле <code>~/.composer/config.json</code>:
 composer.install=Чтобы установить пакет с помощью Composer, выполните следующую команду:
 composer.dependencies=Зависимости
@@ -3724,10 +3726,10 @@ container.labels=Метки
 container.labels.key=Ключ
 container.labels.value=Значение
 cran.registry=Настройте этот реестр в файле <code>Rprofile.site</code>:
-cran.install=Чтобы установить пакет, выполните следующую команду:
+cran.install=Для установки пакета выполните следующую команду:
 debian.registry=Добавьте реестр командой:
 debian.registry.info=Выберите $distribution и $component из списка ниже.
-debian.install=Чтобы установить пакет, выполните следующую команду:
+debian.install=Для установки пакета выполните следующую команду:
 debian.repository=О репозитории
 debian.repository.distributions=Дистрибутивы
 debian.repository.components=Компоненты
@@ -3735,7 +3737,7 @@ debian.repository.architectures=Архитектуры
 generic.download=Скачать пакет из командной строки:
 go.install=Установите пакет из командной строки:
 helm.registry=Добавьте реестр командой:
-helm.install=Чтобы установить пакет, выполните следующую команду:
+helm.install=Для установки пакета выполните следующую команду:
 maven.registry=Настройте реестр в файле <code>pom.xml</code> вашего проекта:
 maven.install=Чтобы использовать пакет, включите в блок <code>dependencies</code> в файле <code>pom.xml</code> следующее:
 maven.install2=Выполнить через командную строку:
@@ -3757,7 +3759,7 @@ pypi.install=Чтобы установить пакет с помощью pip, 
 rpm.registry=Добавьте реестр командой:
 rpm.distros.redhat=на дистрибутивах семейства RedHat
 rpm.distros.suse=на дистрибутивах семейства SUSE
-rpm.install=Чтобы установить пакет, выполните следующую команду:
+rpm.install=Для установки пакета выполните следующую команду:
 rpm.repository = О репозитории
 rpm.repository.architectures = Архитектуры
 rubygems.install=Чтобы установить пакет с помощью gem, выполните следующую команду:
diff --git a/options/locale/locale_si-LK.ini b/options/locale/locale_si-LK.ini
index ac7627ca80..e52e5bcaf9 100644
--- a/options/locale/locale_si-LK.ini
+++ b/options/locale/locale_si-LK.ini
@@ -821,7 +821,7 @@ migrate.migrating_failed=<b>%s</b> සිට සංක්රමණය වීම
 migrate.migrating_failed_no_addr=සංක්රමණය අසාර්ථකයි.
 migrate.git.description=ඕනෑම Git සේවාවකින් පමණක් ගබඩාවක් සංක්රමණය කරන්න.
 migrate.gitlab.description=gitlab.com හෝ වෙනත් GitLab අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.
-migrate.gitea.description=Gitea.com හෝ වෙනත් Gitea/Forgejo අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.
+migrate.gitea.description=Gitea.com හෝ වෙනත් Gitea අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.
 migrate.gogs.description=notabug.org හෝ වෙනත් Gogs අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.
 migrate.onedev.description=code.onedev.io හෝ වෙනත් OnedeV අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.
 migrate.gitbucket.description=GitBucket අවස්ථා වලින් දත්ත සංක්රමණය කරන්න.
diff --git a/options/locale/locale_sk-SK.ini b/options/locale/locale_sk-SK.ini
index bd2ce203dd..3e5b4a63f6 100644
--- a/options/locale/locale_sk-SK.ini
+++ b/options/locale/locale_sk-SK.ini
@@ -176,7 +176,7 @@ string.desc=Z - A
 
 [error]
 occurred=Vyskytla sa chyba
-report_message=Ak si myslíte, že ide o chybu Gitea, vyhľadajte problémy na <a href="%s" target="_blank">GitHub-e</a> alebo v prípade potreby otvorte nový problém.
+report_message=Ak si myslíte, že ide o chybu Forgejo, vyhľadajte problémy na <a href="%s" target="_blank">Codeberg-e</a> alebo v prípade potreby otvorte nový problém.
 missing_csrf=Nesprávna žiadosť: neprítomný CSFR token
 invalid_csrf=Nesprávna žiadosť: nesprávny CSFR token
 not_found=Nebolo možné nájsť cieľ.
diff --git a/options/locale/locale_sr-SP.ini b/options/locale/locale_sr-SP.ini
index 3021b48781..56c1a7e650 100644
--- a/options/locale/locale_sr-SP.ini
+++ b/options/locale/locale_sr-SP.ini
@@ -62,7 +62,7 @@ federated_avatar_lookup_popup=Омогућите federated avatars lookup да 
 enable_captcha_popup=Тражи Captcha приликом регистрације корисника.
 admin_password=Лозинка
 confirm_password=Потврдите лозинку
-install_btn_confirm=Успостави Gitea
+install_btn_confirm=Успостави Forgejo
 test_git_failed=Команда 'git' није успела: %v
 
 [home]
diff --git a/options/locale/locale_tr-TR.ini b/options/locale/locale_tr-TR.ini
index 82476d4ae8..49b52c3ea0 100644
--- a/options/locale/locale_tr-TR.ini
+++ b/options/locale/locale_tr-TR.ini
@@ -1202,7 +1202,7 @@ migrate.migrating_failed_no_addr=Göç başarısız oldu.
 migrate.github.description=Github.com veya diğer Github sunucularından veri aktar.
 migrate.git.description=Herhangi bir Git hizmetinden sadece bir depoyu aktar.
 migrate.gitlab.description=Gitlab.com veya diğer Gitlab sunucularından veri aktar.
-migrate.gitea.description=Gitea.com veya diğer Gitea/Forgejo sunucularından veri aktar.
+migrate.gitea.description=Gitea.com veya diğer Gitea sunucularından veri aktar.
 migrate.gogs.description=Notabug.org veya diğer Gogs sunucularından veri aktar.
 migrate.onedev.description=Code.onedev.io ve diğer OneDev sunucularından veri aktar.
 migrate.codebase.description=Codebasehq.com sitesinden veri aktar.
@@ -1912,7 +1912,7 @@ pulls.cmd_instruction_hint=`Komut satırı talimatlarını görüntüleyin.`
 pulls.cmd_instruction_checkout_title=Çekme
 pulls.cmd_instruction_checkout_desc=Proje deponuzdan yeni bir dalı çekin ve değişiklikleri test edin.
 pulls.cmd_instruction_merge_title=Birleştir
-pulls.cmd_instruction_merge_desc=Değişiklikleri birleştirin ve Gitea'da güncelleyin.
+pulls.cmd_instruction_merge_desc=Değişiklikleri birleştirin ve Forgejo güncelleyin.
 pulls.clear_merge_message=Birleştirme iletilerini temizle
 pulls.clear_merge_message_hint=Birleştirme iletisini temizlemek sadece işleme ileti içeriğini kaldırır ama üretilmiş "Co-Authored-By …" gibi git fragmanlarını korur.
 
@@ -3032,12 +3032,12 @@ packages.size=Boyut
 packages.published=Yayınlandı
 
 defaulthooks=Varsayılan Web İstemcileri
-defaulthooks.desc=Web İstemcileri, belirli Gitea olayları tetiklendiğinde otomatik olarak HTTP POST isteklerini sunucuya yapar. Burada tanımlanan Web İstemcileri varsayılandır ve tüm yeni depolara kopyalanır. <a target="_blank" rel="noopener" href="%s">web istemcileri kılavuzunda</a> daha fazla bilgi edinin.
+defaulthooks.desc=Web İstemcileri, belirli Forgejo olayları tetiklendiğinde otomatik olarak HTTP POST isteklerini sunucuya yapar. Burada tanımlanan Web İstemcileri varsayılandır ve tüm yeni depolara kopyalanır. <a target="_blank" rel="noopener" href="%s">web istemcileri kılavuzunda</a> daha fazla bilgi edinin.
 defaulthooks.add_webhook=Varsayılan Web İstemcisi Ekle
 defaulthooks.update_webhook=Varsayılan Web İstemcisini Güncelle
 
 systemhooks=Sistem Web İstemcileri
-systemhooks.desc=Belirli Gitea olayları tetiklendiğinde Web istemcileri otomatik olarak bir sunucuya HTTP POST istekleri yapar. Burada tanımlanan web istemcileri sistemdeki tüm depolar üzerinde çalışır, bu yüzden lütfen bunun olabilecek tüm performans sonuçlarını göz önünde bulundurun. <a target="_blank" rel="noopener" href="%s">web istemcileri kılavuzunda</a> daha fazla bilgi edinin.
+systemhooks.desc=Belirli Forgejo olayları tetiklendiğinde Web istemcileri otomatik olarak bir sunucuya HTTP POST istekleri yapar. Burada tanımlanan web istemcileri sistemdeki tüm depolar üzerinde çalışır, bu yüzden lütfen bunun olabilecek tüm performans sonuçlarını göz önünde bulundurun. <a target="_blank" rel="noopener" href="%s">web istemcileri kılavuzunda</a> daha fazla bilgi edinin.
 systemhooks.add_webhook=Sistem Web İstemcisi Ekle
 systemhooks.update_webhook=Sistem Web İstemcisi Güncelle
 
diff --git a/options/locale/locale_uk-UA.ini b/options/locale/locale_uk-UA.ini
index b04cca5779..52303c2d6b 100644
--- a/options/locale/locale_uk-UA.ini
+++ b/options/locale/locale_uk-UA.ini
@@ -23,7 +23,7 @@ toc=Зміст
 licenses=Ліцензії
 return_to_forgejo=Повернутися до Forgejo
 
-username=Ім'я кристувача
+username=Ім'я користувач_ки
 email=Адреса електронної пошти
 password=Пароль
 access_token=Токен доступу
@@ -673,6 +673,10 @@ admin_cannot_delete_self = Ви не можете видалити себе, я
 
 email_domain_is_not_allowed = Домен адреси електронної пошти <b>%s</b> конфліктує з EMAIL_DOMAIN_ALLOWLIST або EMAIL_DOMAIN_BLOCKLIST. Перевірте, чи ви правильно вказали адресу електронної пошти.
 
+still_own_repo = Вашому обліковому запису належать один чи більше репозиторіїв. Спершу видаліть або передайте їх.
+org_still_own_repo = Цій організації досі належать один чи більше репозиторіїв. Спершу видаліть або передайте їх.
+required_prefix = Потрібно почати з «%s»
+
 [user]
 change_avatar=Змінити свій аватар…
 repositories=Репозиторії
@@ -712,6 +716,11 @@ following.title.few = Відстежувані
 form.name_reserved = Ім'я користувача «%s» зарезервовано.
 form.name_chars_not_allowed = Ім'я користувача «%s» містить неприпустимі символи.
 
+public_activity.visibility_hint.self_public = Вашу діяльність бачитимуть усі, за винятком взаємодій у приватних просторах. <a href="%s">Налаштувати</a>.
+public_activity.visibility_hint.self_private = Вашу діяльність бачитимете лише ви й адміністрація сервера. <a href="%s">Налаштувати</a>.
+public_activity.visibility_hint.admin_private = Цю дію видно адміністрації, зокрема вам, але користувач_ка бажає залишити її приватною.
+public_activity.visibility_hint.self_private_profile = Вашу діяльність видно лише вам і адміністрації сервера, оскільки ваш профіль приватний. <a href="%s">Налаштувати</a>.
+
 [settings]
 profile=Профіль
 account=Обліковий запис
@@ -904,7 +913,7 @@ revoke_oauth2_grant_description=Скасування доступу для ці
 
 twofa_desc=Двофакторна автентифікація підвищує безпеку вашого облікового запису.
 twofa_is_enrolled=Ваш обліковий запис на даний час <strong>використовує</strong> двофакторну автентифікацію.
-twofa_not_enrolled=Ваш обліковий запис наразі не використовує двофакторну автентифікаціїю.
+twofa_not_enrolled=Ваш обліковий запис наразі не використовує двофакторну автентифікацію.
 twofa_disable=Вимкнути двофакторну автентифікацію
 twofa_scratch_token_regenerate=Перестворити токен одноразового пароля
 twofa_enroll=Увімкнути двофакторну автентифікацію
@@ -966,7 +975,7 @@ webauthn_delete_key = Видалити ключ безпеки
 webauthn_key_loss_warning = Якщо ви втратите ключ безпеки, то втратите доступ до вашого облікового запису.
 webauthn_register_key = Додати ключ безпеки
 webauthn_nickname = Псевдонім
-webauthn_desc = Ключі безпеки це апаратні пристрої, що містять криптографічні ключі. Вони можуть використовуватись для двократної автентифікації. Ключі безпеки мають підтримувати стандарт <a rel="noreferrer" target="_blank" href="%s">WebAuthn Authenticator</a>.
+webauthn_desc = Ключі безпеки — це апаратні пристрої, що містять криптографічні ключі. Вони можуть використовуватись для двофакторної автентифікації. Ключі безпеки мають підтримувати стандарт <a rel="noreferrer" target="_blank" href="%s">WebAuthn Authenticator</a>.
 revoke_oauth2_grant_success = Доступ відкликано успішно.
 twofa_recovery_tip = Якщо ви втратите ваш пристрій, ви зможете використати одноразовий код відновлення, щоб знову отримати доступ до свого облікового запису.
 webauthn_delete_key_desc = Якщо ви видалите ключ безпеки, ви більше не зможете з ним зайти. Продовжити?
@@ -1015,6 +1024,18 @@ blocked_since = Заблокований з %s
 
 change_username_redirect_prompt = Старе ім'я користувача буде перенаправленням, поки хтось не присвоїть ім'я собі.
 
+webauthn = Двофакторний вхід (ключі безпеки)
+change_username_prompt = Зауважте, зміна користувацького імені також змінює URL-адресу вашого облікового запису.
+hidden_comment_types_description = Позначені тут типи коментарів не буде показано на сторінках завдань. Наприклад, якщо тут позначена «Мітка», то всі коментарі «<user> додає/вилучає <label>» буде вилучено.
+comment_type_group_deadline = Крайній термін
+comment_type_group_lock = Стан блокування
+keep_activity_private.description = Вашу <a href="%s">загальнодоступну діяльність</a> буде видно лише вам і адміністрації сервера.
+oauth2_confidential_client = Конфіденційний клієнт. Оберіть, якщо програма зберігає секрет конфіденційним, наприклад якщо це вебзастосунок. Не обирайте для стільничних і мобільних програм.
+oauth2_redirect_uris = URI-адреси переспрямувань. Пишіть кожну з нового рядка.
+webauthn_alternative_tip = Можливо, ви бажаєте налаштувати додатковий спосіб входу.
+user_unblock_success = Користувач_ку успішно розблоковано.
+user_block_success = Користувач_ку успішно заблоковано.
+
 [repo]
 owner=Власник
 owner_helper=Деякі організації можуть не відображатися у випадаючому списку через максимальну кількість репозиторііїв.
@@ -1152,7 +1173,7 @@ migrate.migrating_failed=Міграція із <b>%s</b> не вдалася.
 migrate.migrating_failed_no_addr=Міграція не вдалася.
 migrate.git.description=Перенесення лише репозиторію з будь-якої служби Git.
 migrate.gitlab.description=Перенести дані з gitlab.com та інших екземплярів GitLab.
-migrate.gitea.description=Перенести дані з gitea.com та інших екземплярів Gitea/Forgejo.
+migrate.gitea.description=Перенести дані з gitea.com та інших екземплярів Gitea.
 migrate.gogs.description=Перенести дані з notabug.org та інших екземплярів Gogs.
 migrate.onedev.description=Перенести дані з code.onedev.io та інших екземплярів OneDev.
 migrate.codebase.description=Перенести дані з codebasehq.com.
@@ -2484,6 +2505,13 @@ form.name_pattern_not_allowed = Шаблон «%s» не допускаєтьс
 wiki.reserved_page = Назву вікі-сторінки «%s» зарезервовано.
 settings.wiki_rename_branch_main_desc = Перейменувати внутрішню гілку, яка використовується у вікі, на «%s». Ця зміна є остаточною і її неможливо скасувати.
 
+open_with_editor = Відкрити в %s
+mirror_public_key = Відкритий SSH-ключ
+mirror_use_ssh.text = Входити через SSH
+stars = Зірки
+activity.navbar.pulse = Пульс
+activity.navbar.code_frequency = Частота кодування
+
 [graphs]
 contributors.what = внески
 component_loading_info = Це може зайняти деякий час…
@@ -2492,6 +2520,8 @@ component_loading_failed = Не вдалося завантажити %s
 recent_commits.what = нещодавні коміти
 component_failed_to_load = Сталася несподівана помилка.
 
+code_frequency.what = частота кодування
+
 [org]
 org_name_holder=Назва організації
 org_full_name_holder=Повна назва організації
diff --git a/options/locale/locale_zh-CN.ini b/options/locale/locale_zh-CN.ini
index 16490accef..e809795fd9 100644
--- a/options/locale/locale_zh-CN.ini
+++ b/options/locale/locale_zh-CN.ini
@@ -1231,7 +1231,7 @@ migrate.migrating_failed_no_addr=迁移失败。
 migrate.github.description=从 github.com 或 GitHub Enterprise 服务器迁移数据。
 migrate.git.description=从任意 Git 服务迁移仓库。
 migrate.gitlab.description=从 gitlab.com 或其他 GitLab 实例迁移数据。
-migrate.gitea.description=从 gitea.com 或其他 Gitea/Forgejo 实例迁移数据。
+migrate.gitea.description=从 gitea.com 或其他 Gitea 实例迁移数据。
 migrate.gogs.description=从 notabug.org 或其他 Gogs 实例迁移数据。
 migrate.onedev.description=从 code.onedev.io 或其他 OneDev 实例迁移数据。
 migrate.codebase.description=从 codebasehq.com 迁移数据。
@@ -3539,7 +3539,7 @@ notices.op=操作
 notices.delete_success=系统通知已被删除。
 self_check.no_problem_found=尚未发现问题。
 self_check.database_collation_mismatch=期望数据库使用的校验方式：%s
-self_check.database_collation_case_insensitive=数据库正在使用一个校验 %s, 这是一个不敏感的校验. 虽然Gitea可以与它合作，但可能有一些罕见的情况不如预期的那样起作用。
+self_check.database_collation_case_insensitive=数据库正在使用排序规则%s，这是一个不敏感的排序规则。虽然Forgejo可以与其一同工作，但可能有一些罕见的情况存在问题。
 self_check.database_inconsistent_collation_columns=数据库正在使用%s的排序规则，但是这些列使用了不匹配的排序规则。这可能会造成一些意外问题。
 self_check.database_fix_mysql=对于 MySQL/MariaDB 用户，您可以使用“forgejo doctor convert”命令来修复排序规则问题，或者您也可以手动通过“ALTER ... COLLATE ...” SQL 修复该问题。
 auths.tips.gmail_settings = Gmail 设置：
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index 5caafacce1..720267f7d2 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -167,6 +167,8 @@ new_org.link = 新組織
 new_repo.title = 新儲存庫
 new_migrate.link = 新遷移
 
+copy_path = 複製路徑
+
 [aria]
 navbar=導航列
 footer=頁尾
@@ -198,6 +200,15 @@ buttons.enable_monospace_font=啟用等寬字型
 buttons.disable_monospace_font=停用等寬字型
 buttons.switch_to_legacy.tooltip = 使用舊版編輯器
 
+buttons.indent.tooltip = 使項目縮排一層
+buttons.unindent.tooltip = 使項目取消縮排一層
+buttons.new_table.tooltip = 新增表格
+table_modal.header = 新增表格
+table_modal.placeholder.header = 表頭
+table_modal.placeholder.content = 內容
+table_modal.label.rows = 列
+table_modal.label.columns = 欄
+
 [filter]
 string.asc=A - Z
 string.desc=Z - A
@@ -221,6 +232,8 @@ license=開放原始碼
 license_desc=取得 <a target="_blank" rel="noopener noreferrer" href="%[1]s">Forgejo</a> ！成為一名<a target="_blank" rel="noopener noreferrer" href="%[2]s">貢獻者</a>和我們一起讓 Forgejo 更好，快點加入我們吧！
 install_desc = 輕鬆使用您平台的<a target="_blank" rel="noopener noreferrer" href="%[1]s">可執行檔</a>，使用 <a target="_blank" rel="noopener noreferrer" href="%[2]s">Docker 部署</a>，抑或是<a target="_blank" rel="noopener noreferrer" href="%[3]s">軟體包</a>。
 
+platform_desc = Forgejo 已確認可以在 Linux 和 FreeBSD 等自由作業系統和不同的中央處理器架構上運作。選擇你所愛的！
+
 [install]
 install=安裝頁面
 title=初始組態
@@ -246,13 +259,13 @@ err_empty_db_path=SQLite3 資料庫路徑不可以為空。
 no_admin_and_disable_registration=您不能夠在未建立管理員帳號的情況下禁止自助註冊。
 err_empty_admin_password=管理員密碼不能為空。
 err_empty_admin_email=管理員信箱不能為空。
-err_admin_name_is_reserved=無效的管理員帳號名稱，帳號名稱已被保留
+err_admin_name_is_reserved=無效的管理員使用者名稱，使用者名稱已保留
 err_admin_name_pattern_not_allowed=無效的管理員帳號名稱，該名稱符合被保留式樣
-err_admin_name_is_invalid=無效的管理員帳號名稱
+err_admin_name_is_invalid=無效的管理員使用者名稱
 
 general_title=一般設定
 app_name=站點標題
-app_name_helper=您可以在此輸入您的公司名稱。
+app_name_helper=在此輸入你的站點名稱。它將顯示在每個頁面上。
 repo_path=儲存庫根目錄
 repo_path_helper=所有遠端 Git 儲存庫會儲存到此目錄。
 lfs_path=Git LFS 根目錄
@@ -283,21 +296,21 @@ server_service_title=伺服器和第三方服務設定
 offline_mode=啟用本地模式
 offline_mode.description=停用第三方內容傳遞網路並在本地提供所有資源。
 disable_gravatar=停用 Gravatar
-disable_gravatar.description=停用 Gravatar 和第三方大頭貼服務。若使用者在未本地上傳大頭貼，將使用預設的大頭貼。
+disable_gravatar.description=停用 Gravatar 或其他第三方大頭貼來源。除非使用者將自己的大頭貼上傳至站點，否則將使用預設的大頭貼作為使用者的大頭貼。
 federated_avatar_lookup=啟用聯邦式大頭貼
-federated_avatar_lookup.description=啟用 Libravatar 提供的聯邦式大頭貼查詢服務。
+federated_avatar_lookup.description=使用 Libravatar 尋找大頭貼。
 disable_registration=停用自助註冊
-disable_registration.description=禁止使用者自助註冊，只有管理員可以新增帳號。
-allow_only_external_registration.description=只允許從外部服務註冊
+disable_registration.description=只有站點管理員才能建立新的使用者帳號。強烈建議保持註冊處於停用狀態，除非你打算運作公共站點並準備處理大量垃圾帳號。
+allow_only_external_registration.description=使用者只能使用配置的外部服務來建立新帳號。
 openid_signin=啟用 OpenID 登入
-openid_signin.description=啟用 OpenID 登入。
+openid_signin.description=允許使用者透過 OpenID 登入。
 openid_signup=啟用 OpenID 自助註冊
-openid_signup.description=啟用使用 OpenID 的自助註冊。
+openid_signup.description=如果啟用了自助註冊，則允許使用者透過 OpenID 建立帳號。
 enable_captcha=啟用註冊驗證碼
-enable_captcha.description=要求在用戶註冊時輸入驗證碼。
+enable_captcha.description=要求使用者通過 CAPTCHA 才能建立帳號。
 require_sign_in_view=需要登入才能瀏覽站點內容
-require_sign_in_view.description=僅有已登入的使用者能存取頁面。訪客只會看到登入和註冊頁面。
-admin_setting.description=您不需要建立管理員帳號。 第一個註冊的使用者將自動成為管理員。
+require_sign_in_view.description=將內容存取限制為已登入的使用者。訪客只能存取驗證頁面。
+admin_setting.description=建立管理員帳號是選擇性的。第一個註冊的使用者將自動成為管理員。
 admin_title=管理員帳號設定
 admin_name=管理員帳號名稱
 admin_password=密碼
@@ -317,11 +330,11 @@ save_config_failed=儲存設定失敗：%v
 invalid_admin_setting=管理員帳號設定無效：%v
 invalid_log_root_path=日誌根目錄設定無效：%v
 default_keep_email_private=預設隱藏電子信箱
-default_keep_email_private.description=預設隱藏新使用者帳號的電子信箱。
+default_keep_email_private.description=預設為新使用者啟用電子郵件地址隱藏，以使這些資訊不會在註冊後立即洩露。
 default_allow_create_organization=預設允許建立組織
-default_allow_create_organization.description=預設允許新使用者帳號建立組織。
+default_allow_create_organization.description=預設允許新使用者建立組織。當此選項停用時，管理員必須授予新使用者建立組織的權限。
 default_enable_timetracking=預設啟用時間追蹤
-default_enable_timetracking.description=預設啟用新存儲庫的時間追蹤。
+default_enable_timetracking.description=預設允許新儲存庫使用時間追蹤功能。
 no_reply_address=隱藏電子信箱域名
 no_reply_address_helper=隱藏電子信箱的域名。例如，如果隱藏的電子信箱域名設定為「noreply.example.org」，帳號「joe」將以「joe@noreply.example.org」的身分登入到 Git 中。
 password_algorithm=密碼雜湊演算法
@@ -342,7 +355,7 @@ allow_only_external_registration = 僅允許透過外部服務註冊
 [home]
 uname_holder=帳號名稱或電子信箱
 password_holder=密碼
-switch_dashboard_context=切換儀錶版帳號
+switch_dashboard_context=切換儀錶板內容
 my_repos=儲存庫
 show_more_repos=顯示更多儲存庫…
 collaborative_repos=參與協作的儲存庫
@@ -403,13 +416,13 @@ remember_me=記住這台裝置
 forgot_password_title=忘記密碼
 forgot_password=忘記密碼？
 sign_up_now=還沒有帳號？馬上註冊。
-confirmation_mail_sent_prompt=已寄送新的確認信至 <b>%s</b>。請在 %s 內檢查您的收件匣並完成註冊手續。如果該 email 不正確，您可以在登入後再請求一封新的確認信到另一個地址。
+confirmation_mail_sent_prompt=新的確認電子郵件已傳送至 <b>%s</b>。要完成註冊過程，請檢查你的收件匣並在接下來的 %s 內按照提供的連結完成註冊手續。如果電子郵件不正確，你可以再登入並請求另一封新的確認電子郵件傳送至其他電子信箱。
 must_change_password=更新您的密碼
 allow_password_change=要求使用者更改密碼（建議）
-reset_password_mail_sent_prompt=已發送確認信至 <b>%s</b>。請在 %s 內檢查您的收件匣並完成帳號復原手續。
+reset_password_mail_sent_prompt=確認電子郵件已傳送至 <b>%s</b>。要完成帳號復原步驟，請檢查你的收件匣並在接下來的 %s 內按照提供的連結進行操作。
 active_your_account=啟用您的帳號
 account_activated=帳號已啟用
-prohibit_login=已被禁止登入
+prohibit_login=帳號已停權
 resent_limit_prompt=您剛剛已經請求發送驗證電子郵件，請等待 3 分鐘後再試一次。
 has_unconfirmed_mail=%s 您好，您有一個尚未被確認的信箱地址（<b>%s</b>）。如果您還沒收到確認信或需要一封新的，請點擊下方的按鈕。
 resend_mail=點擊此處來重新發送確認郵件
@@ -449,7 +462,7 @@ email_domain_blacklisted=您無法使用您的電子信箱註冊帳號。
 authorize_application=授權應用程式
 authorize_redirect_notice=如果您授權此應用程式，您將會被轉址至 %s。
 authorize_application_created_by=此應用程式是由 %s 建立的。
-authorize_application_description=如果您允許，它將能夠讀取和修改您的所有帳號資訊，包括私有儲存庫和組織。
+authorize_application_description=如果你授予存取權限，它將能夠存取和寫入你的所有帳號資訊，包括私人儲存庫和組織。
 authorize_title=授權「%s」存取您的帳號？
 authorization_failed=授權失效
 sspi_auth_failed=SSPI 認證失敗
@@ -460,7 +473,7 @@ change_unconfirmed_email = 如果您在註冊帳號時寫錯了信箱地址，
 change_unconfirmed_email_error = 無法更改信箱地址：%v
 tab_signup = 註冊
 last_admin = 您無法刪除最後一個管理員。必須至少有一個管理員。
-prohibit_login_desc = 您的帳號被禁止登入，請連絡網站管理員。
+prohibit_login_desc = 你的帳號已被暫停與站點互動。聯絡站點管理員以重新獲得存取權限。
 sign_up_successful = 已成功建立帳號。歡迎！
 invalid_code_forgot_password = 您的確認代碼無效或已過期。點擊<a href="%s">這裡</a>來開始一個新的連線階段。
 reset_password_wrong_user = 您以 %s 登入，但是帳號復原連結是給 %s 的
@@ -474,6 +487,9 @@ sign_up_button = 馬上註冊。
 sign_in_openid = 使用 OpenID 繼續
 back_to_sign_in = 返回登入頁面
 
+unauthorized_credentials = 憑證不正確或已過期。重試你的命令或查看 %s 以獲取更多資訊
+use_onetime_code = 使用一次性代碼
+
 [mail]
 view_it_on=在 %s 上查看
 reply=或是直接回覆此電子郵件
@@ -553,6 +569,12 @@ account_security_caution.text_1 = 如果這是您，那您可以安全的忽略
 account_security_caution.text_2 = 如果這不是您，您的帳號已被盜用。請連絡網站管理員。
 totp_disabled.text_1 = 你帳號上的基於時間的一次性密碼（TOTP）剛剛已停用。
 
+totp_disabled.no_2fa = 沒有再配置其他 2FA 方法，這表示不再需要使用 2FA 登入你的帳號。
+removed_security_key.no_2fa = 沒有再配置其他 2FA 方法，這表示不再需要使用 2FA 登入你的帳號。
+totp_enrolled.subject = 你已啟動 TOTP 作為 2FA 方法
+totp_enrolled.text_1.no_webauthn = 你剛剛為你的帳號啟用了 TOTP。這意味著將來每次登入你的帳號時，你都必須使用 TOTP 作為 2FA 方法。
+totp_enrolled.text_1.has_webauthn = 你剛剛為你的帳號啟用了 TOTP。這意味著將來每次登入你的帳號時，你可以使用 TOTP 作為 2FA 方法或使用任何安全金鑰。
+
 [modal]
 yes=是
 no=否
@@ -690,20 +712,26 @@ joined_on = 於 %s 註冊
 show_on_map = 在地圖上顯示這個地點
 settings = 使用者設定
 block_user = 封鎖使用者
-block_user.detail_1 = 該使用者已停止追踪您。
-block_user.detail_2 = 這個使用者無法對您的儲存庫、您提出的問題或發表的留言做出任何操作。
+block_user.detail_1 = 你們將停止互相關注，並且無法互相關注。
+block_user.detail_2 = 此使用者將無法與你擁有的儲存庫或由你建立的問題和評論進行互動。
 followers_one = %d 位追蹤者
 following_one = 追蹤 %d 個人
-block_user.detail_3 = 該使用者無法將您加為協作者，您也無法將其加為協作者。
+block_user.detail_3 = 你們將無法互相新增為儲存庫協作者。
 follow_blocked_user = 因為這個使用者封鎖您或被您封鎖，您不能追蹤此使用者。
 block = 封鎖
 unblock = 解除封鎖
-block_user.detail = 請注意，封鎖此使用者將會導致以下結果。例如：
+block_user.detail = 請注意，封鎖使用者還有其它影響，例如：
 followers.title.one = 位追蹤者
 followers.title.few = 位追蹤者
 following.title.one = 關注中
 following.title.few = 關注中
 
+public_activity.visibility_hint.self_public = 除私人空間的互動外，你的活動對所有人都可見。<a href="%s">配置</a>。
+public_activity.visibility_hint.admin_public = 每個人都可以看到此活動，但作為管理員，你還可以看到私人空間中的互動。
+public_activity.visibility_hint.self_private = 你的活動僅對你和站點管理員可見。<a href="%s">配置</a>。
+public_activity.visibility_hint.admin_private = 由於你是管理員，因此你可以看到此活動，但使用者希望將其保持私密。
+public_activity.visibility_hint.self_private_profile = 由於你的個人資料是私密的，因此只有你和站點管理員可以看到你的活動。<a href="%s">配置</a>。
+
 [settings]
 profile=個人資料
 account=帳號
@@ -977,9 +1005,9 @@ hints = 提示
 update_hints = 更新提示
 update_hints_success = 提示已被更改。
 added_on = 於 %s 新增
-biography_placeholder = 和我們介紹一下您自己吧！（您可以使用 Markdown）
+biography_placeholder = 向別人簡單介紹一下自己！（支援 Markdown）
 location_placeholder = 與其他人分享您粗略的地理位置
-profile_desc = 管理其他人如何看到您的個人資料。通知、密碼復原和網頁上的 Git 操作會使用您的主要電子信箱。
+profile_desc = 關於你
 hidden_comment_types.ref_tooltip = 註記哪些問題／提交／… 提及了此問題
 keep_activity_private = 隱藏個人頁面中的活動資料
 uploaded_avatar_is_too_big = 上傳檔案的大小 （%d KiB）超過了上限 （%d KiB ）。
@@ -1033,6 +1061,8 @@ authorized_oauth2_applications_description = 您已授權給這些第三方應
 language.localization_project = 幫助我們翻譯 Forgejo 至您的語言！<a href="%s">了解更多</a>。
 language.description = 這個語言會被儲存至您的帳號，並被用作您登入後的預設語言。
 
+pronouns_custom_label = 自訂代名詞
+
 [repo]
 owner=所有者
 owner_helper=組織可能因為儲存庫數量上限而未列入此選單。
@@ -1040,7 +1070,7 @@ repo_name=儲存庫名稱
 repo_name_helper=好的儲存庫名稱通常是簡短的、好記的、且獨特的。
 repo_size=儲存庫大小
 template=範本
-template_select=選擇範本。
+template_select=選擇範本
 template_helper=將儲存庫設為範本
 template_description=儲存庫範本讓使用者可新增相同目錄結構、檔案以及設定的儲存庫。
 visibility=瀏覽權限
@@ -1063,17 +1093,17 @@ generate_from=產生自
 repo_desc=描述
 repo_desc_helper=輸入簡介 (選用)
 repo_lang=儲存庫語言
-repo_gitignore_helper=選擇 .gitignore 範本。
+repo_gitignore_helper=選擇 .gitignore 範本
 repo_gitignore_helper_desc=從常見語言範本清單中挑選忽略追蹤的檔案。預設情況下各種語言建置工具產生的特殊檔案都包含在 .gitignore 中。
 issue_labels=標籤
-issue_labels_helper=選擇問題標籤集。
+issue_labels_helper=選擇標籤集
 license=授權條款
-license_helper=請選擇授權條款檔案。
+license_helper=選擇授權條款檔案
 license_helper_desc=授權條款定義了他人使用您原始碼的允許和禁止事項。不確定哪個適用於您的專案？查看<a target="_blank" rel="noopener noreferrer" href="%s">選擇授權條款。</a>
 readme=讀我檔案
-readme_helper=選擇讀我檔案範本。
+readme_helper=選擇讀我檔案範本
 readme_helper_desc=這是您能為專案撰寫完整描述的地方。
-auto_init=初始化儲存庫（加入 .gitignore、授權條款、讀我檔案）
+auto_init=初始化儲存庫
 trust_model_helper=選擇簽署驗證的信任模型。可用的選項:
 trust_model_helper_collaborator=協作者: 信任協作者的簽署
 trust_model_helper_committer=提交者: 信任與提交者相符的簽署
@@ -1089,7 +1119,7 @@ mirror_interval_invalid=鏡像週期無效。
 mirror_sync_on_commit=推送提交後進行同步
 mirror_address=從 URL 拓製
 mirror_address_desc=在授權資訊中填入必要的資料。
-mirror_lfs=Large File Storage (LFS)
+mirror_lfs=大檔案儲存（LFS）
 mirror_lfs_desc=啟動 LFS 檔案的鏡像功能。
 mirror_lfs_endpoint=LFS 端點
 mirror_lfs_endpoint_desc=同步將會嘗試使用 Clone URL 來<a target="_blank" rel="noopener noreferrer" href="%s">確認 LFS 伺服器</a>。如果存儲庫的 LFS 資料放在其他地方，您也可以指定自訂的端點。
@@ -1257,7 +1287,7 @@ ambiguous_runes_line=`這一行有易混淆的 Unicode 字元`
 ambiguous_character=`%[1]c [U+%04[1]X] 容易與 %[2]c [U+%04[2]X] 混淆`
 
 escape_control_characters=Escape
-unescape_control_characters=Unescape
+unescape_control_characters=取消轉義
 file_copy_permalink=複製永久連結
 view_git_blame=檢視 Git Blame
 video_not_supported_in_browser=您的瀏覽器不支援 HTML5 的「video」標籤。
@@ -1371,7 +1401,7 @@ commitstatus.failure=失敗
 commitstatus.pending=待處理
 commitstatus.success=成功
 
-ext_issues=存取外部問題
+ext_issues=外部問題
 ext_issues.desc=連結到外部問題追蹤器。
 
 projects=專案
@@ -1591,7 +1621,7 @@ issues.attachment.open_tab=`在新分頁中查看「%s」`
 issues.attachment.download=`點擊下載「%s」`
 issues.subscribe=訂閱
 issues.unsubscribe=取消訂閱
-issues.unpin_issue=取消固定問題
+issues.unpin_issue=取消釘選問題
 issues.max_pinned=您不能固定更多問題
 issues.pin_comment=固定於 %s
 issues.unpin_comment=取消固定於 %s
@@ -1617,13 +1647,13 @@ issues.comment_on_locked=您無法在已鎖定的問題上留言。
 issues.delete=刪除
 issues.delete.title=刪除此問題？
 issues.delete.text=您真的要刪除此問題嗎？(這將會永久移除所有內容。若您還想保留，請考慮改為關閉它。)
-issues.tracker=時間追蹤
-issues.start_tracking_short=開始計時
+issues.tracker=時間追蹤器
+issues.start_tracking_short=開始計時器
 issues.start_tracking=開始時間追蹤
 issues.start_tracking_history=`開始工作 %s`
 issues.tracker_auto_close=當這個問題被關閉時，自動停止計時器
 issues.tracking_already_started=`您已在<a href="%s">另一個問題</a>上開始時間追蹤！`
-issues.stop_tracking=停止計時
+issues.stop_tracking=停止計時器
 issues.stop_tracking_history=`結束工作 %s`
 issues.cancel_tracking=捨棄
 issues.add_time=手動新增時間
@@ -1723,9 +1753,9 @@ compare.compare_base=基底分支
 compare.compare_head=比較
 
 pulls.desc=啟用合併請求和程式碼審核。
-pulls.new=建立合併請求
+pulls.new=新合併請求
 pulls.view=檢視合併請求
-pulls.compare_changes=建立合併請求
+pulls.compare_changes=新合併請求
 pulls.allow_edits_from_maintainers=允許維護者編輯
 pulls.allow_edits_from_maintainers_desc=對基底分支有寫入權限的使用者也可以推送到此分支
 pulls.allow_edits_from_maintainers_err=更新失敗
@@ -1870,7 +1900,7 @@ milestones.filter_sort.most_issues=問題由多到少
 milestones.filter_sort.least_issues=問題由少到多
 
 
-ext_wiki=存取外部 Wiki
+ext_wiki=外部 Wiki
 ext_wiki.desc=連結外部 Wiki。
 
 wiki=Wiki
@@ -1911,10 +1941,10 @@ activity.period.yearly=1 年
 activity.overview=概覽
 activity.active_prs_count_1=<strong>%d</strong> 個合併請求
 activity.active_prs_count_n=<strong>%d</strong> 個合併請求
-activity.merged_prs_count_1=合併
-activity.merged_prs_count_n=合併
-activity.opened_prs_count_1=提出合併請求
-activity.opened_prs_count_n=提出合併請求
+activity.merged_prs_count_1=已合併合併請求
+activity.merged_prs_count_n=已合併合併請求
+activity.opened_prs_count_1=已提出合併請求
+activity.opened_prs_count_n=已提出合併請求
 activity.title.user_1=%d 位使用者
 activity.title.user_n=%d 位使用者
 activity.title.prs_1=%d 個合併請求
@@ -1939,8 +1969,8 @@ activity.title.unresolved_conv_1=%d 個未解決的對話
 activity.title.unresolved_conv_n=%d 個未解決的對話
 activity.unresolved_conv_desc=這些最近更改的問題和合併請求尚未解決。
 activity.unresolved_conv_label=開放
-activity.title.releases_1=%d 個版本
-activity.title.releases_n=%d 個版本
+activity.title.releases_1=%d 個發行
+activity.title.releases_n=%d 個發行
 activity.title.releases_published_by=%[2]s發布了 %[1]s
 activity.published_release_label=發行
 activity.no_git_activity=在此期間內沒有任何提交動態。
@@ -2004,12 +2034,12 @@ settings.sync_mirror=立即同步
 settings.site=網站
 settings.update_settings=儲存設定
 settings.branches.update_default_branch=更新預設分支
-settings.branches.add_new_rule=加入新規則
+settings.branches.add_new_rule=增加新規則
 settings.advanced_settings=進階設定
 settings.wiki_desc=啟用儲存庫 Wiki
 settings.use_internal_wiki=使用內建 Wiki
 settings.use_external_wiki=使用外部 Wiki
-settings.external_wiki_url=外部 Wiki 連結
+settings.external_wiki_url=外部 Wiki 網址
 settings.external_wiki_url_error=外部 Wiki 網址不是有效的網址。
 settings.external_wiki_url_desc=點擊百科分頁時，使用者會被轉址至外部百科的 URL。
 settings.issues_desc=啟用儲存庫問題追蹤器
@@ -2077,7 +2107,7 @@ settings.transfer_started=此儲存庫已被標記為待轉移且正在等待「
 settings.transfer_succeed=已轉移儲存庫。
 settings.signing_settings=簽署驗證設定
 settings.trust_model=簽署信任模式
-settings.trust_model.default=預設信任模式
+settings.trust_model.default=預設信任模型
 settings.trust_model.default.desc=使用此 Forgejo 的預設儲存庫信任模式。
 settings.trust_model.collaborator=協作者
 settings.trust_model.collaborator.long=協作者：信任協作者的簽署
@@ -2093,7 +2123,7 @@ settings.wiki_delete_desc=刪除儲存庫 Wiki 資料是永久的且不可還原
 settings.wiki_delete_notices_1=- 這將會永久刪除與停用 %s 的儲存庫 Wiki。
 settings.confirm_wiki_delete=刪除 Wiki 資料
 settings.wiki_deletion_success=已刪除儲存庫的 Wiki 資料。
-settings.delete=刪除本儲存庫
+settings.delete=刪除此儲存庫
 settings.delete_desc=刪除儲存庫是永久的且不可還原。
 settings.delete_notices_1=- 此動作<strong>不可</strong>還原。
 settings.delete_notices_2=- 此操作將永久刪除 <strong>%s</strong> 儲存庫，包括程式碼、問題、留言、Wiki 資料和協作者設定。
@@ -2128,7 +2158,7 @@ settings.hooks_desc=當觸發某些 Forgejo 事件時，Webhook 會自動發出
 settings.webhook_deletion=移除 Webhook
 settings.webhook_deletion_desc=移除 Webhook 將刪除它的設定及傳送記錄，是否繼續？
 settings.webhook_deletion_success=Webhook 已移除。
-settings.webhook.test_delivery=傳送測試資料
+settings.webhook.test_delivery=測試交付
 settings.webhook.test_delivery_desc=使用假事件測試此 Webhook。
 settings.webhook.request=請求
 settings.webhook.response=回應
@@ -2172,30 +2202,30 @@ settings.event_push_desc=推送到儲存庫。
 settings.event_repository=儲存庫
 settings.event_repository_desc=建立或刪除儲存庫。
 settings.event_header_issue=問題事件
-settings.event_issues=問題
+settings.event_issues=修改
 settings.event_issues_desc=建立、編輯、關閉及重新開放問題。
-settings.event_issue_assign=指派問題
+settings.event_issue_assign=指派
 settings.event_issue_assign_desc=指派或取消指派問題。
 settings.event_issue_label=標籤
 settings.event_issue_label_desc=更新或清除問題標籤。
 settings.event_issue_milestone=里程碑
 settings.event_issue_milestone_desc=設定或取消設定問題里程碑。
-settings.event_issue_comment=問題留言
+settings.event_issue_comment=評註
 settings.event_issue_comment_desc=已經建立、編輯或刪除的問題留言。
 settings.event_header_pull_request=合併請求事件
-settings.event_pull_request=合併請求
+settings.event_pull_request=修改
 settings.event_pull_request_desc=建立、編輯、關閉及重新開放合併請求。
-settings.event_pull_request_assign=指派合併請求
+settings.event_pull_request_assign=指派
 settings.event_pull_request_assign_desc=指派或取消指派合併請求。
-settings.event_pull_request_label=合併請求標籤
+settings.event_pull_request_label=標籤
 settings.event_pull_request_label_desc=更新或清除合併請求標籤。
-settings.event_pull_request_milestone=合併請求里程碑
+settings.event_pull_request_milestone=里程碑
 settings.event_pull_request_milestone_desc=設定或取消設定合併請求里程碑。
-settings.event_pull_request_comment=合併請求留言
+settings.event_pull_request_comment=評註
 settings.event_pull_request_comment_desc=建立、編輯或刪除合併請求的留言。
-settings.event_pull_request_review=合併請求審核
+settings.event_pull_request_review=審核
 settings.event_pull_request_review_desc=核准、退回或提出審核留言。
-settings.event_pull_request_sync=合併請求同步
+settings.event_pull_request_sync=同步
 settings.event_pull_request_sync_desc=合併請求同步。
 settings.event_package=軟體包
 settings.event_package_desc=已在儲存庫中建立或刪除軟體包。
@@ -2209,7 +2239,7 @@ settings.add_hook_success=Webhook 新增成功。
 settings.update_webhook=更新 Webhook
 settings.update_hook_success=已成功更新 Webhook 。
 settings.delete_webhook=移除 Webhook
-settings.recent_deliveries=最近傳送記錄
+settings.recent_deliveries=最近交付
 settings.hook_type=Hook 類型
 settings.slack_token=符記
 settings.slack_domain=域名
@@ -2265,35 +2295,35 @@ settings.protect_enable_merge_desc=任何有寫入權限的人都可將合併請
 settings.protect_whitelist_committers=使用白名單控管推送
 settings.protect_whitelist_committers_desc=僅允許白名單內的使用者或團隊推送至該分支(但不可使用force push)。
 settings.protect_whitelist_deploy_keys=將擁有寫入權限的部署金鑰加入白名單。
-settings.protect_whitelist_users=允許推送的使用者：
+settings.protect_whitelist_users=允許推送的使用者
 settings.protect_whitelist_search_users=搜尋使用者...
-settings.protect_whitelist_teams=允許推送的團隊：
+settings.protect_whitelist_teams=允許推送的團隊
 settings.protect_whitelist_search_teams=搜尋團隊...
 settings.protect_merge_whitelist_committers=啟用合併白名單
 settings.protect_merge_whitelist_committers_desc=僅允許白名單內的使用者或團隊將合併請求合併至該分支。
-settings.protect_merge_whitelist_users=允許合併的使用者：
-settings.protect_merge_whitelist_teams=允許合併的團隊：
+settings.protect_merge_whitelist_users=允許合併的使用者
+settings.protect_merge_whitelist_teams=允許合併的團隊
 settings.protect_check_status_contexts=啟用狀態檢查
 settings.protect_check_status_contexts_desc=合併前必須先通過狀態檢查。選擇合併前必須通過的檢查。啟用時，必須先將提交推送到另一個分支，通過狀態檢查後再合併或直接推送到符合規則的分支。如果未選擇任何項目，最一個提交必將成功通過狀態檢查。
 settings.protect_check_status_contexts_list=此儲存庫一週內曾進行過狀態檢查
-settings.protect_required_approvals=需要的核可數量：
+settings.protect_required_approvals=需要的核可數量
 settings.protect_required_approvals_desc=只有在獲得足夠數量的核可後才能進行合併。
 settings.protect_approvals_whitelist_enabled=使用白名單控管審核人員與團隊
 settings.protect_approvals_whitelist_enabled_desc=只有白名單內的使用者與團隊會被計入需要的核可數量。未使用白名單時，將計算任何有寫入權限之人的核可。
-settings.protect_approvals_whitelist_users=審核者白名單：
-settings.protect_approvals_whitelist_teams=審核團隊白名單：
+settings.protect_approvals_whitelist_users=允許的審核者
+settings.protect_approvals_whitelist_teams=允許的審核團隊
 settings.dismiss_stale_approvals=捨棄過時的核可
 settings.dismiss_stale_approvals_desc=當新的提交有修改到合併請求的內容，並被推送到此分支時，將捨棄舊的核可。
 settings.require_signed_commits=僅接受經簽署的提交
 settings.require_signed_commits_desc=拒絕未經簽署或未經驗證的提交推送到此分支。
 settings.protect_branch_name_pattern=受保護的分支名稱式樣
-settings.protect_protected_file_patterns=受保護的檔案式樣 (以分號區隔「;」)：
+settings.protect_protected_file_patterns=受保護檔案的式樣（以半形分號區隔「;」）
 settings.protect_protected_file_patterns_desc=即便使用者有權限新增、修改、刪除此分支的檔案，仍不允許直接修改受保護的檔案。可以用半形分號「;」分隔多個式樣。請於 <a href='%s'>%s</a> 文件查看模式格式。範例: <code>.drone.yml</code>, <code>/docs/**/*.txt</code>。
-settings.protect_unprotected_file_patterns=未受保護的檔案模式 (以分號區隔「;」):
+settings.protect_unprotected_file_patterns=未受保護檔案的式樣（以半形分號區隔「;」）
 settings.protect_unprotected_file_patterns_desc=當使用者有寫入權限時，可繞過推送限制，直接修改未受保護的檔案。可以用半形分號「;」分隔多個模式。請於 <a href='%[1]s'>%[2]s</a> 文件查看模式格式。範例: <code>.drone.yml</code>, <code>/docs/**/*.txt</code>。
 settings.add_protected_branch=啟用保護
 settings.delete_protected_branch=停用保護
-settings.protected_branch_deletion=停用分支保護
+settings.protected_branch_deletion=刪除分支保護
 settings.protected_branch_deletion_desc=停用分支保護將允許有寫入權限的使用者推送至該分支，是否繼續？
 settings.block_rejected_reviews=有退回的審核時阻擋合併
 settings.block_rejected_reviews_desc=如果官方審核人員提出變更請求，即使有足夠的核可也不允許進行合併。
@@ -2312,12 +2342,12 @@ settings.protected_branch_duplicate_rule_name=規則名稱已存在
 settings.protected_branch_required_approvals_min=需要的核可數量不能為負數。
 settings.tags=標籤
 settings.tags.protection=標籤保護
-settings.tags.protection.pattern=標籤格式
+settings.tags.protection.pattern=標籤式樣
 settings.tags.protection.allowed=允許的
 settings.tags.protection.allowed.users=允許的使用者
 settings.tags.protection.allowed.teams=允許的團隊
-settings.tags.protection.allowed.noone=無
-settings.tags.protection.create=保護標籤
+settings.tags.protection.allowed.noone=沒有人
+settings.tags.protection.create=新增規則
 settings.tags.protection.none=沒有受保護的標籤。
 settings.bot_token=Bot 符記
 settings.chat_id=Chat ID
@@ -2325,7 +2355,7 @@ settings.matrix.homeserver_url=Homeserver 網址
 settings.matrix.room_id=聊天室 ID
 settings.matrix.message_type=訊息類型
 settings.archive.button=封存儲存庫
-settings.archive.header=封存本儲存庫
+settings.archive.header=封存此儲存庫
 settings.archive.success=此儲存庫已被封存。
 settings.archive.error=嘗試封存儲存庫時發生錯誤。查看日誌檔以獲得更多資訊。
 settings.archive.error_ismirror=無法封存鏡像儲存庫。
@@ -2351,7 +2381,7 @@ settings.lfs_locks_no_locks=沒有鎖定
 settings.lfs_lock_file_no_exist=已鎖定的檔案不存在於預設分支
 settings.lfs_force_unlock=強制解鎖
 settings.lfs_pointers.found=找到 %d 個 blob 指標 - %d 個已關聯, %d 個未關聯 (%d 個從存放區遺失)
-settings.lfs_pointers.sha=Blob SHA
+settings.lfs_pointers.sha=Blob 哈希值
 settings.lfs_pointers.oid=OID
 settings.lfs_pointers.inRepo=在儲存庫中
 settings.lfs_pointers.exists=存在於存放區
@@ -2384,7 +2414,7 @@ diff.stats_desc=共有 <strong> %d 個檔案被更改</strong>，包括 <strong>
 diff.stats_desc_file=變更 %d 行：新增 %d 行，删除 %d 行
 diff.bin=二進制
 diff.bin_not_shown=未顯示二進位檔案。
-diff.view_file=查看文件
+diff.view_file=檢視檔案
 diff.file_before=之前
 diff.file_after=之後
 diff.file_image_width=寬度
@@ -2403,7 +2433,7 @@ diff.comment.add_single_comment=加入單獨的留言
 diff.comment.add_review_comment=新增留言
 diff.comment.start_review=開始審核
 diff.comment.reply=回覆
-diff.review=審核
+diff.review=完成審核
 diff.review.header=送出審核
 diff.review.placeholder=審核意見
 diff.review.comment=留言
@@ -2424,7 +2454,7 @@ releases.desc=追蹤專案版本和檔案下載。
 release.releases=版本發布
 release.detail=版本詳情
 release.tags=標籤
-release.new_release=發布新版本
+release.new_release=新發行
 release.draft=草稿
 release.prerelease=預發行
 release.stable=穩定
@@ -2445,12 +2475,12 @@ release.title_empty=標題不可為空。
 release.prerelease_desc=標記為 Pre-Release
 release.prerelease_helper=標記此版本不適合生產使用。
 release.cancel=取消
-release.publish=發布版本
+release.publish=發佈發行
 release.save_draft=儲存草稿
-release.edit_release=更新發布
-release.delete_release=刪除發布
+release.edit_release=更新發行
+release.delete_release=刪除發行
 release.delete_tag=刪除標籤
-release.deletion=刪除發布
+release.deletion=刪除發行
 release.deletion_success=已刪除此版本發布。
 release.deletion_tag_desc=即將從儲存庫移除此標籤。儲存庫內容和歷史將保持不變，是否繼續？
 release.deletion_tag_success=已刪除此標籤。
@@ -2461,7 +2491,7 @@ release.tag_already_exist=此標籤名稱已存在。
 release.downloads=下載附件
 release.download_count=下載次數：%s
 release.add_tag_msg=使用此版本的標題和內容作為標籤訊息。
-release.add_tag=只建立標籤
+release.add_tag=建立標籤
 release.releases_for=%s 的版本發佈
 release.tags_for=%s 的標籤
 
@@ -2506,7 +2536,7 @@ topic.manage_topics=管理主題
 topic.done=完成
 topic.count_prompt=您最多能選擇 25 個主題
 
-find_file.go_to_file=移至檔案
+find_file.go_to_file=尋找檔案
 find_file.no_matching=找不到符合的檔案
 
 error.csv.too_large=無法渲染此檔案，因為它太大了。
@@ -2688,7 +2718,7 @@ milestones.filter_sort.name = 名稱
 settings.units.overview = 概覽
 settings.federation_settings = 聯邦設定
 issues.author.tooltip.issue = 這個使用者是這個問題的作者。
-settings.units.add_more = 新增更多...
+settings.units.add_more = 啟用更多
 release.download_count_one = %s 次下載
 release.download_count_few = %s 次下載
 pulls.cmd_instruction_checkout_title = 簽出
@@ -2722,6 +2752,22 @@ n_release_one = %s 發行
 n_release_few = %s 發行
 no_eol.text = 無檔案結尾符
 
+new_from_template = 使用範本
+new_advanced = 進階設定
+new_advanced_expand = 點擊以展開
+mirror_public_key = 公共 SSH 金鑰
+mirror_use_ssh.text = 使用 SSH 驗證
+mirror_use_ssh.helper = 當你選擇此選項時，Forgejo 將透過 Git SSH 鏡像儲存庫並為你建立金鑰對。你必須確保已產生的公鑰已有授權才能推送至目標儲存庫。選擇此選項時，你不能使用基於密碼的授權。
+mirror_use_ssh.not_available = SSH 驗證不可用。
+editor.commit_email = 提交電子信箱
+issues.filter_sort.relevance = 關聯性
+issues.all_title = 全部
+settings.mirror_settings.push_mirror.none_ssh = 無
+settings.event_pull_request_review_request = 審核請求
+settings.protect_patterns = 式樣
+settings.matrix.access_token_helper = 建議為此設定一個專用的 Matrix 帳號。存取符記可以從 Element 網路使用者端（於私人／隱身分頁）> 使用者選單（左上角）> 所有設定 > 幫助和關於 > 進階 > 存取符記（位於 Homeserver 網址正下方）檢索。關閉私人／隱身分頁（登出將使存取符記失效）。
+release.title = 發行標題
+
 [graphs]
 component_loading = 載入中 %s…
 code_frequency.what = 寫程式頻率
@@ -2739,8 +2785,8 @@ teams=團隊
 code=程式碼
 lower_members=名成員
 lower_repositories=個儲存庫
-create_new_team=建立團隊
-create_team=建立新的團隊
+create_new_team=新團隊
+create_team=建立團隊
 org_desc=描述
 team_name=團隊名稱
 team_desc=描述
@@ -2756,7 +2802,7 @@ form.create_org_not_allowed=此帳號禁止建立組織。
 
 settings=設定
 settings.options=組織
-settings.full_name=組織全名
+settings.full_name=全名
 settings.website=官方網站
 settings.location=所在地區
 settings.permission=權限
@@ -2773,7 +2819,7 @@ settings.update_setting_success=組織設定已更新。
 settings.change_orgname_redirect_prompt=舊的名稱被領用前將會轉址至新名稱。
 settings.update_avatar_success=已更新組織的大頭貼。
 settings.delete=刪除組織
-settings.delete_account=刪除這個組織
+settings.delete_account=刪除此組織
 settings.delete_prompt=該組織將被永久刪除。此動作<strong>不可</strong>還原！
 settings.confirm_delete_account=確認刪除
 settings.delete_org_title=刪除組織
@@ -2784,9 +2830,9 @@ settings.labels_desc=在此處新增的標籤可用於此組織下的<strong>所
 
 members.membership_visibility=成員瀏覽權限：
 members.public=可見
-members.public_helper=隱藏
+members.public_helper=設為隱藏
 members.private=隱藏
-members.private_helper=顯示
+members.private_helper=設為顯示
 members.member_role=成員角色：
 members.owner=所有者
 members.member=普通成員
@@ -2804,7 +2850,7 @@ teams.can_create_org_repo=建立儲存庫
 teams.can_create_org_repo_helper=成員可以在組織中新增儲存庫。建立者將自動取得新儲存庫的管理員權限。
 teams.none_access=沒有權限
 teams.none_access_helper=成員無法檢視此單元或對其執行其他動作，這對公開儲存庫沒有影響。
-teams.general_access=一般權限
+teams.general_access=自訂存取
 teams.general_access_helper=成員權限將由下列權限表決定。
 teams.read_access=讀取
 teams.read_access_helper=成員可以查看和 Clone 團隊儲存庫。
@@ -2967,10 +3013,10 @@ users.update_profile_success=已更新使用者帳號。
 users.edit_account=編輯使用者帳號
 users.max_repo_creation=最大儲存庫數量
 users.max_repo_creation_desc=(設定 -1 使用全域預設限制)
-users.is_activated=使用者帳號已啟用
-users.prohibit_login=禁止登入
-users.is_admin=是管理員
-users.is_restricted=受限制的
+users.is_activated=已啟用的帳號
+users.prohibit_login=已停權帳號
+users.is_admin=管理員帳號
+users.is_restricted=受限制的帳號
 users.allow_git_hook=可以建立 Git Hook
 users.allow_git_hook_tooltip=Git Hook 將以和 Forgejo 相同的作業系統使用者執行，並擁有同等的主機存取權限。因此擁有此特殊 Git Hook 權限的使用者可存取和修改所有的 Forgejo 儲存庫和 Forgejo 的資料庫。他們甚至能取得 Forgejo 的管理員權限。
 users.allow_import_local=可以匯入本地儲存庫
@@ -3018,7 +3064,7 @@ orgs.new_orga=新增組織
 
 repos.repo_manage_panel=儲存庫管理
 repos.unadopted=未接管的儲存庫
-repos.unadopted.no_more=找不到其他未接管的儲存庫
+repos.unadopted.no_more=找不到未接管的儲存庫。
 repos.owner=所有者
 repos.name=名稱
 repos.private=私有
@@ -3029,8 +3075,8 @@ repos.issues=問題數
 repos.size=大小
 
 packages.package_manage_panel=軟體包管理
-packages.total_size=總大小: %s
-packages.unreferenced_size=未參考大小: %s
+packages.total_size=總大小：%s
+packages.unreferenced_size=未參考大小：%s
 packages.owner=所有者
 packages.creator=建立者
 packages.name=名稱
@@ -3063,7 +3109,7 @@ auths.host=主機地址
 auths.port=連接埠
 auths.bind_dn=Bind DN
 auths.bind_password=Bind 密碼
-auths.user_base=用戶搜尋基準
+auths.user_base=使用者搜尋基準
 auths.user_dn=用戶 DN
 auths.attribute_username=帳號屬性
 auths.attribute_username_placeholder=留空將使用於 Forgejo 輸入的帳號。
@@ -3074,7 +3120,7 @@ auths.attribute_ssh_public_key=SSH 公鑰屬性
 auths.attribute_avatar=大頭貼屬性
 auths.attributes_in_bind=從 Bind DN 中取得屬性資訊
 auths.allow_deactivate_all=允許在搜尋結果為空白時停用所有使用者帳號
-auths.use_paged_search=使用分頁查詢
+auths.use_paged_search=使用分頁搜尋
 auths.search_page_size=頁面大小
 auths.filter=使用者篩選器
 auths.admin_filter=管理者篩選器
@@ -3091,7 +3137,7 @@ auths.ms_ad_sa=MS AD 搜尋屬性
 auths.smtp_auth=SMTP 驗證類型
 auths.smtphost=SMTP 主機地址
 auths.smtpport=SMTP 連接埠
-auths.allowed_domains=域名白名單
+auths.allowed_domains=允許的域名
 auths.allowed_domains_helper=留白以允許所有域名。以半形逗號「,」分隔多個域名。
 auths.skip_tls_verify=忽略 TLS 驗證
 auths.force_smtps=強制 SMTPS
@@ -3114,7 +3160,7 @@ auths.oauth2_emailURL=電子郵件 URL
 auths.skip_local_two_fa=跳過本地兩步驟驗證
 auths.skip_local_two_fa_helper=保持未設定代表使用兩步驟驗證的本地使用者仍然需要通過兩步驟驗證才能登入
 auths.oauth2_tenant=租戶
-auths.oauth2_scopes=額外的授權範圍 (Scope)
+auths.oauth2_scopes=額外的範圍
 auths.oauth2_required_claim_name=必須填寫 Claim 名稱
 auths.oauth2_required_claim_name_helper=填寫此名稱以限制 Claim 中有此名稱的使用者才能從此來源登入
 auths.oauth2_required_claim_value=必須填寫 Claim 值
@@ -3138,13 +3184,13 @@ auths.sspi_default_language_helper=SSPI 認證方法自動建立之使用者的
 auths.tips=幫助提示
 auths.tips.oauth2.general=OAuth2 認證
 auths.tip.oauth2_provider=OAuth2 提供者
-auths.tip.bitbucket=註冊新的 OAuth 用戶端並加入權限「Account - Read」。網址：%s
+auths.tip.bitbucket=註冊新的 OAuth 使用者端並加入權限「Account - Read」。網址：%s
 auths.tip.nextcloud=在您的站點上，於選單「設定 -> 安全性 -> OAuth 2.0 客戶端」註冊新的 OAuth 客戶端
 auths.tip.dropbox=建立新的 App。網址：%s
 auths.tip.facebook=註冊新的應用程式並新增產品「Facebook 登入」。網址：%s
 auths.tip.github=註冊新的 OAuth 應用程式。網址：%s
 auths.tip.gitlab=註冊新的應用程式。網址：https://gitlab.com/profile/applications
-auths.tip.google_plus=從 Google API 控制台取得 OAuth2 用戶端憑證。網址：%s
+auths.tip.google_plus=從 Google API 控制台取得 OAuth2 使用者端憑證。網址：%s
 auths.tip.openid_connect=使用 OpenID 連接探索 URL (<server>/.well-known/openid-configuration) 來指定節點
 auths.tip.twitter=建立應用程式並確保有啟用「Allow this application to be used to Sign in with Twitter」。網址：%s
 auths.tip.discord=註冊新的應用程式。網址：%s
@@ -3177,15 +3223,15 @@ config.disable_router_log=關閉路由日誌
 config.run_user=以使用者名稱執行
 config.run_mode=執行模式
 config.git_version=Git 版本
-config.repo_root_path=儲存庫目錄
-config.lfs_root_path=LFS 根目錄
+config.repo_root_path=儲存庫根路徑
+config.lfs_root_path=LFS 根路徑
 config.log_file_root_path=日誌路徑
 config.script_type=腳本類型
 config.reverse_auth_user=反向代理認證
 
 config.ssh_config=SSH 設定
 config.ssh_enabled=已啟用
-config.ssh_start_builtin_server=使用內建的伺服器
+config.ssh_start_builtin_server=使用內建伺服器
 config.ssh_domain=SSH 伺服器域名
 config.ssh_port=連接埠
 config.ssh_listen_port=監聽埠
@@ -3211,16 +3257,16 @@ config.db_path=資料庫路徑
 
 config.service_config=服務設定
 config.register_email_confirm=要求註冊時確認電子郵件
-config.disable_register=關閉註冊功能
+config.disable_register=停用自助註冊
 config.allow_only_internal_registration=只允許從 Forgejo 註冊
 config.allow_only_external_registration=只允許從外部服務註冊
-config.enable_openid_signup=啟用 OpenID 註冊
+config.enable_openid_signup=啟用 OpenID 自助註冊
 config.enable_openid_signin=啟用 OpenID 登入
 config.show_registration_button=顯示註冊按鈕
 config.require_sign_in_view=需要登入才能瀏覽頁面
-config.mail_notify=啟用郵件通知
+config.mail_notify=啟用電子郵件通知
 config.enable_captcha=啟用驗證碼
-config.active_code_lives=啟用用戶連結有效期
+config.active_code_lives=啟用使用者連結有效期
 config.reset_password_code_lives=帳號復原碼有效時間
 config.default_keep_email_private=預設隱藏電子信箱
 config.default_allow_create_organization=預設允許新增組織
@@ -3260,7 +3306,7 @@ config.oauth_enabled=啟用服務
 config.cache_config=快取設定
 config.cache_adapter=快取轉接器（adapter）
 config.cache_interval=快取週期
-config.cache_conn=Cache 連接字符串
+config.cache_conn=快取連接
 config.cache_item_ttl=快取項目 TTL
 
 config.session_config=Session 設定
@@ -3297,7 +3343,7 @@ config.xorm_log_sql=記錄 SQL
 config.set_setting_failed=寫入設定值 %s 失敗
 
 
-monitor.cron=Cron 任務
+monitor.cron=定時任務
 monitor.name=名稱
 monitor.schedule=任務安排
 monitor.next=下次執行時間
@@ -3384,6 +3430,11 @@ users.organization_creation.description = 允許建立新組織。
 config.app_slogan = 站點口號
 
 
+self_check = 自助檢查
+config.logger_name_fmt = 日誌：%s
+monitor.queue.review_add = 審閱／增加 Worker
+self_check.database_fix_mysql = 對於 MySQL／MariaDB 的使用者，你可以使用命令「forgejo doctor convert」來修復排序規則問題，或者你也可以手動透過「ALTER ... COLLATE ...」SQL 修復問題。
+
 [action]
 create_repo=建立了儲存庫 <a href="%s">%s</a>
 rename_repo=重新命名儲存庫 <code>%[1]s</code> 為 <a href="%[2]s">%[3]s</a>
@@ -3526,9 +3577,9 @@ conda.install=執行下列命令以使用 Conda 安裝此軟體包：
 container.details.type=映像檔類型
 container.details.platform=平台
 container.pull=透過下列命令拉取映像檔：
-container.digest=摘要:
+container.digest=摘要
 container.multi_arch=作業系統 / 架構
-container.layers=映像檔 Layers
+container.layers=映像檔分層
 container.labels=標籤
 container.labels.key=鍵
 container.labels.value=值
@@ -3590,7 +3641,7 @@ owner.settings.cargo.initialize.success=成功建立了 Cargo 索引。
 owner.settings.cargo.rebuild=重建索引
 owner.settings.cargo.rebuild.error=重建 Cargo 索引失敗: %v
 owner.settings.cargo.rebuild.success=成功重建了 Cargo 索引。
-owner.settings.cleanuprules.title=管理清理規則
+owner.settings.cleanuprules.title=清理規則
 owner.settings.cleanuprules.add=加入清理規則
 owner.settings.cleanuprules.edit=編輯清理規則
 owner.settings.cleanuprules.preview=預覽清理規則
@@ -3635,6 +3686,15 @@ rpm.distros.suse = 在基於 SUSE 的發行版上
 rpm.distros.redhat = 在基於 RedHat 的發行版上
 owner.settings.cargo.rebuild.description = 如果索引與儲存的 Cargo 套件不同步，重建可能會很有用。
 
+registry.documentation = 有關 %s 註冊表的更多資訊，請參閱<a target="_blank" rel="noopener noreferrer" href="%s">文件</a>。
+arch.pacman.helper.gpg = 為 pacman 新增信任憑證：
+arch.pacman.repo.multi = %s 在不同的發行版中具有相同的版本。
+arch.pacman.conf = 將相關發行版和架構的伺服器新增至 <code>/etc/pacman.conf</code>：
+arch.pacman.sync = 使用 pacman 同步軟體包：
+arch.version.groups = 群組
+container.images.title = 映像檔
+debian.registry.info = 從下面的清單中選擇 $distribution 和 $component。
+
 [secrets]
 secrets=Secret
 description=Secret 會被傳給特定的 Action，其他情況無法讀取。
@@ -3653,7 +3713,7 @@ management = 管理秘密
 [actions]
 actions=Actions
 
-unit.desc=管理 Actions
+unit.desc=使用 Forgejo Actions 管理整合的 CI/CD 管道。
 
 status.unknown=未知的
 status.waiting=等待中
@@ -3664,7 +3724,7 @@ status.skipped=已略過
 status.blocked=已阻塞
 
 runners=Runner
-runners.runner_manage_panel=Runner 管理
+runners.runner_manage_panel=管理 Runner
 runners.new=建立 Runner
 runners.new_notice=如何啟動 Runner
 runners.status=狀態
@@ -3751,6 +3811,10 @@ runs.no_workflows.documentation = 有關 Forgejo Actions 的更多資訊，請
 runners.reset_registration_token = 重置註冊符記
 
 
+runs.no_workflows.help_write_access = 不知道如何開始使用 Forgejo Actions？查看<a target="_blank" rel="noopener noreferrer" href="%s">使用者文件中的快速入門</a>來編寫你的第一個工作流程，然後<a target="_blank" rel="noopener noreferrer" href="%s">設定 Forgejo Runner</a>來執行你的工作。
+runs.no_workflows.help_no_write_access = 要了解 Forgejo Actions，請參閱<a target="_blank" rel="noopener noreferrer" href="%s">文件</a>。
+workflow.dispatch.use_from = 使用工作流程自
+
 [projects]
 type-2.display_name = 儲存庫專案
 type-1.display_name = 個人專案
@@ -3794,6 +3858,9 @@ issue_kind = 搜尋問題...
 exact_tooltip = 只包含與搜尋詞完全相符的結合
 pull_kind = 搜尋拉取…
 
+regexp = 正規表示式
+regexp_tooltip = 將搜尋詞解釋為正規表示式
+
 [munits.data]
 eib = EiB
 b = B

From c324910c31ac157ce6dba7b378dea7bbf177964e Mon Sep 17 00:00:00 2001
From: Gusted <postmaster@gusted.xyz>
Date: Sat, 25 Jan 2025 08:51:59 +0100
Subject: [PATCH 077/125] fix(sec): web route delete runner

The web route to delete action runners did not check if the ID that was
given belonged to the context it was requested in, this made it possible
to delete every existing runner of a instance by a authenticated user.

The code was reworked to ensure that the caller of the delete
runner function retrieved the runner by ID and then checks if it belongs
to the context it was requested in, although this is not an optimal
solution it is consistent with the context checking of other code for
runners.
---
 models/actions/runner.go              | 15 +++++----------
 models/actions/runner_test.go         |  2 +-
 routers/web/repo/setting/runners.go   |  2 +-
 routers/web/shared/actions/runners.go | 15 +++++++++++++--
 4 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/models/actions/runner.go b/models/actions/runner.go
index a679d7d989..b24950d014 100644
--- a/models/actions/runner.go
+++ b/models/actions/runner.go
@@ -282,27 +282,22 @@ func UpdateRunner(ctx context.Context, r *ActionRunner, cols ...string) error {
 }
 
 // DeleteRunner deletes a runner by given ID.
-func DeleteRunner(ctx context.Context, id int64) error {
-	runner, err := GetRunnerByID(ctx, id)
-	if err != nil {
-		return err
-	}
-
+func DeleteRunner(ctx context.Context, r *ActionRunner) error {
 	// Replace the UUID, which was either based on the secret's first 16 bytes or an UUIDv4,
 	// with a sequence of 8 0xff bytes followed by the little-endian version of the record's
 	// identifier. This will prevent the deleted record's identifier from colliding with any
 	// new record.
 	b := make([]byte, 8)
-	binary.LittleEndian.PutUint64(b, uint64(id))
-	runner.UUID = fmt.Sprintf("ffffffff-ffff-ffff-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x",
+	binary.LittleEndian.PutUint64(b, uint64(r.ID))
+	r.UUID = fmt.Sprintf("ffffffff-ffff-ffff-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x",
 		b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7])
 
-	err = UpdateRunner(ctx, runner, "UUID")
+	err := UpdateRunner(ctx, r, "UUID")
 	if err != nil {
 		return err
 	}
 
-	_, err = db.DeleteByID[ActionRunner](ctx, id)
+	_, err = db.DeleteByID[ActionRunner](ctx, r.ID)
 	return err
 }
 
diff --git a/models/actions/runner_test.go b/models/actions/runner_test.go
index 26ef4c44c6..2c8d430f94 100644
--- a/models/actions/runner_test.go
+++ b/models/actions/runner_test.go
@@ -34,7 +34,7 @@ func TestDeleteRunner(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	before := unittest.AssertExistsAndLoadBean(t, &ActionRunner{ID: recordID})
 
-	err := DeleteRunner(db.DefaultContext, recordID)
+	err := DeleteRunner(db.DefaultContext, &ActionRunner{ID: recordID})
 	require.NoError(t, err)
 
 	var after ActionRunner
diff --git a/routers/web/repo/setting/runners.go b/routers/web/repo/setting/runners.go
index a47d3b45e2..9dce5d13b7 100644
--- a/routers/web/repo/setting/runners.go
+++ b/routers/web/repo/setting/runners.go
@@ -179,7 +179,7 @@ func RunnerDeletePost(ctx *context.Context) {
 		ctx.ServerError("getRunnersCtx", err)
 		return
 	}
-	actions_shared.RunnerDeletePost(ctx, ctx.ParamsInt64(":runnerid"), rCtx.RedirectLink, rCtx.RedirectLink+url.PathEscape(ctx.Params(":runnerid")))
+	actions_shared.RunnerDeletePost(ctx, ctx.ParamsInt64(":runnerid"), rCtx.OwnerID, rCtx.RepoID, rCtx.RedirectLink, rCtx.RedirectLink+url.PathEscape(ctx.Params(":runnerid")))
 }
 
 func RedirectToDefaultSetting(ctx *context.Context) {
diff --git a/routers/web/shared/actions/runners.go b/routers/web/shared/actions/runners.go
index f38933226b..739d2d246c 100644
--- a/routers/web/shared/actions/runners.go
+++ b/routers/web/shared/actions/runners.go
@@ -142,10 +142,21 @@ func RunnerResetRegistrationToken(ctx *context.Context, ownerID, repoID int64, r
 }
 
 // RunnerDeletePost response for deleting a runner
-func RunnerDeletePost(ctx *context.Context, runnerID int64,
+func RunnerDeletePost(ctx *context.Context, runnerID, ownerID, repoID int64,
 	successRedirectTo, failedRedirectTo string,
 ) {
-	if err := actions_model.DeleteRunner(ctx, runnerID); err != nil {
+	runner, err := actions_model.GetRunnerByID(ctx, runnerID)
+	if err != nil {
+		ctx.ServerError("GetRunnerByID", err)
+		return
+	}
+
+	if !runner.Editable(ownerID, repoID) {
+		ctx.NotFound("Editable", util.NewPermissionDeniedErrorf("no permission to edit this runner"))
+		return
+	}
+
+	if err := actions_model.DeleteRunner(ctx, runner); err != nil {
 		log.Warn("DeleteRunnerPost.UpdateRunner failed: %v, url: %s", err, ctx.Req.URL)
 		ctx.Flash.Warning(ctx.Tr("actions.runners.delete_runner_failed"))
 

From 77db7655e06d724cf397f5c839e2ea707640c53c Mon Sep 17 00:00:00 2001
From: Gusted <postmaster@gusted.xyz>
Date: Sat, 25 Jan 2025 09:26:50 +0100
Subject: [PATCH 078/125] fix(sec): web route update and delete runner
 variables

The web route to update and delete variables of runners did not check if
the ID that was given belonged to the context it was requested in, this
made it possible to update and delete every existing runner variable of
a instance for any authenticated user.

The code has been reworked to always take into account the context of
the request (owner and repository ID).
---
 models/actions/variable.go              | 10 ++++------
 options/locale/locale_en-US.ini         |  1 +
 routers/api/v1/org/action.go            |  2 +-
 routers/api/v1/repo/action.go           |  2 +-
 routers/api/v1/user/action.go           |  2 +-
 routers/web/repo/setting/variables.go   |  4 ++--
 routers/web/shared/actions/variables.go | 24 ++++++++++++++++--------
 services/actions/variables.go           | 17 ++++++++---------
 8 files changed, 34 insertions(+), 28 deletions(-)

diff --git a/models/actions/variable.go b/models/actions/variable.go
index d0f917d923..39cea95c4b 100644
--- a/models/actions/variable.go
+++ b/models/actions/variable.go
@@ -86,7 +86,7 @@ func FindVariables(ctx context.Context, opts FindVariablesOpts) ([]*ActionVariab
 }
 
 func UpdateVariable(ctx context.Context, variable *ActionVariable) (bool, error) {
-	count, err := db.GetEngine(ctx).ID(variable.ID).Cols("name", "data").
+	count, err := db.GetEngine(ctx).ID(variable.ID).Where("owner_id = ? AND repo_id = ?", variable.OwnerID, variable.RepoID).Cols("name", "data").
 		Update(&ActionVariable{
 			Name: variable.Name,
 			Data: variable.Data,
@@ -94,11 +94,9 @@ func UpdateVariable(ctx context.Context, variable *ActionVariable) (bool, error)
 	return count != 0, err
 }
 
-func DeleteVariable(ctx context.Context, id int64) error {
-	if _, err := db.DeleteByID[ActionVariable](ctx, id); err != nil {
-		return err
-	}
-	return nil
+func DeleteVariable(ctx context.Context, variableID, ownerID, repoID int64) (bool, error) {
+	count, err := db.GetEngine(ctx).Table("action_variable").Where("id = ? AND owner_id = ? AND repo_id = ?", variableID, ownerID, repoID).Delete()
+	return count != 0, err
 }
 
 func GetVariablesOfRun(ctx context.Context, run *ActionRun) (map[string]string, error) {
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 4d1ebd62c6..53a47f0c17 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -3894,6 +3894,7 @@ variables.deletion.description = Removing a variable is permanent and cannot be
 variables.description = Variables will be passed to certain actions and cannot be read otherwise.
 variables.id_not_exist = Variable with ID %d does not exist.
 variables.edit = Edit Variable
+variables.not_found = Failed to find the variable.
 variables.deletion.failed = Failed to remove variable.
 variables.deletion.success = The variable has been removed.
 variables.creation.failed = Failed to add variable.
diff --git a/routers/api/v1/org/action.go b/routers/api/v1/org/action.go
index 03a1fa8ccc..390d074ad7 100644
--- a/routers/api/v1/org/action.go
+++ b/routers/api/v1/org/action.go
@@ -450,7 +450,7 @@ func (Action) UpdateVariable(ctx *context.APIContext) {
 	if opt.Name == "" {
 		opt.Name = ctx.Params("variablename")
 	}
-	if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {
+	if _, err := actions_service.UpdateVariable(ctx, v.ID, ctx.Org.Organization.ID, 0, opt.Name, opt.Value); err != nil {
 		if errors.Is(err, util.ErrInvalidArgument) {
 			ctx.Error(http.StatusBadRequest, "UpdateVariable", err)
 		} else {
diff --git a/routers/api/v1/repo/action.go b/routers/api/v1/repo/action.go
index 0c7506b13b..b109497d19 100644
--- a/routers/api/v1/repo/action.go
+++ b/routers/api/v1/repo/action.go
@@ -414,7 +414,7 @@ func (Action) UpdateVariable(ctx *context.APIContext) {
 	if opt.Name == "" {
 		opt.Name = ctx.Params("variablename")
 	}
-	if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {
+	if _, err := actions_service.UpdateVariable(ctx, v.ID, 0, ctx.Repo.Repository.ID, opt.Name, opt.Value); err != nil {
 		if errors.Is(err, util.ErrInvalidArgument) {
 			ctx.Error(http.StatusBadRequest, "UpdateVariable", err)
 		} else {
diff --git a/routers/api/v1/user/action.go b/routers/api/v1/user/action.go
index ec5289fdb0..c34c5950c0 100644
--- a/routers/api/v1/user/action.go
+++ b/routers/api/v1/user/action.go
@@ -228,7 +228,7 @@ func UpdateVariable(ctx *context.APIContext) {
 	if opt.Name == "" {
 		opt.Name = ctx.Params("variablename")
 	}
-	if _, err := actions_service.UpdateVariable(ctx, v.ID, opt.Name, opt.Value); err != nil {
+	if _, err := actions_service.UpdateVariable(ctx, v.ID, ctx.Doer.ID, 0, opt.Name, opt.Value); err != nil {
 		if errors.Is(err, util.ErrInvalidArgument) {
 			ctx.Error(http.StatusBadRequest, "UpdateVariable", err)
 		} else {
diff --git a/routers/web/repo/setting/variables.go b/routers/web/repo/setting/variables.go
index 45b6c0f39a..4fb8c06e84 100644
--- a/routers/web/repo/setting/variables.go
+++ b/routers/web/repo/setting/variables.go
@@ -127,7 +127,7 @@ func VariableUpdate(ctx *context.Context) {
 		return
 	}
 
-	shared.UpdateVariable(ctx, vCtx.RedirectLink)
+	shared.UpdateVariable(ctx, vCtx.OwnerID, vCtx.RepoID, vCtx.RedirectLink)
 }
 
 func VariableDelete(ctx *context.Context) {
@@ -136,5 +136,5 @@ func VariableDelete(ctx *context.Context) {
 		ctx.ServerError("getVariablesCtx", err)
 		return
 	}
-	shared.DeleteVariable(ctx, vCtx.RedirectLink)
+	shared.DeleteVariable(ctx, vCtx.OwnerID, vCtx.RepoID, vCtx.RedirectLink)
 }
diff --git a/routers/web/shared/actions/variables.go b/routers/web/shared/actions/variables.go
index 79c03e4e8c..47f1176f46 100644
--- a/routers/web/shared/actions/variables.go
+++ b/routers/web/shared/actions/variables.go
@@ -39,25 +39,33 @@ func CreateVariable(ctx *context.Context, ownerID, repoID int64, redirectURL str
 	ctx.JSONRedirect(redirectURL)
 }
 
-func UpdateVariable(ctx *context.Context, redirectURL string) {
+func UpdateVariable(ctx *context.Context, ownerID, repoID int64, redirectURL string) {
 	id := ctx.ParamsInt64(":variable_id")
 	form := web.GetForm(ctx).(*forms.EditVariableForm)
 
-	if ok, err := actions_service.UpdateVariable(ctx, id, form.Name, form.Data); err != nil || !ok {
-		log.Error("UpdateVariable: %v", err)
-		ctx.JSONError(ctx.Tr("actions.variables.update.failed"))
+	if ok, err := actions_service.UpdateVariable(ctx, id, ownerID, repoID, form.Name, form.Data); err != nil || !ok {
+		if !ok {
+			ctx.JSONError(ctx.Tr("actions.variables.not_found"))
+		} else {
+			log.Error("UpdateVariable: %v", err)
+			ctx.JSONError(ctx.Tr("actions.variables.update.failed"))
+		}
 		return
 	}
 	ctx.Flash.Success(ctx.Tr("actions.variables.update.success"))
 	ctx.JSONRedirect(redirectURL)
 }
 
-func DeleteVariable(ctx *context.Context, redirectURL string) {
+func DeleteVariable(ctx *context.Context, ownerID, repoID int64, redirectURL string) {
 	id := ctx.ParamsInt64(":variable_id")
 
-	if err := actions_service.DeleteVariableByID(ctx, id); err != nil {
-		log.Error("Delete variable [%d] failed: %v", id, err)
-		ctx.JSONError(ctx.Tr("actions.variables.deletion.failed"))
+	if ok, err := actions_model.DeleteVariable(ctx, id, ownerID, repoID); err != nil || !ok {
+		if !ok {
+			ctx.JSONError(ctx.Tr("actions.variables.not_found"))
+		} else {
+			log.Error("Delete variable [%d] failed: %v", id, err)
+			ctx.JSONError(ctx.Tr("actions.variables.deletion.failed"))
+		}
 		return
 	}
 	ctx.Flash.Success(ctx.Tr("actions.variables.deletion.success"))
diff --git a/services/actions/variables.go b/services/actions/variables.go
index 8dde9c4af5..a5703898ab 100644
--- a/services/actions/variables.go
+++ b/services/actions/variables.go
@@ -31,7 +31,7 @@ func CreateVariable(ctx context.Context, ownerID, repoID int64, name, data strin
 	return v, nil
 }
 
-func UpdateVariable(ctx context.Context, variableID int64, name, data string) (bool, error) {
+func UpdateVariable(ctx context.Context, variableID, ownerID, repoID int64, name, data string) (bool, error) {
 	if err := secret_service.ValidateName(name); err != nil {
 		return false, err
 	}
@@ -41,16 +41,14 @@ func UpdateVariable(ctx context.Context, variableID int64, name, data string) (b
 	}
 
 	return actions_model.UpdateVariable(ctx, &actions_model.ActionVariable{
-		ID:   variableID,
-		Name: strings.ToUpper(name),
-		Data: util.ReserveLineBreakForTextarea(data),
+		ID:      variableID,
+		Name:    strings.ToUpper(name),
+		Data:    util.ReserveLineBreakForTextarea(data),
+		OwnerID: ownerID,
+		RepoID:  repoID,
 	})
 }
 
-func DeleteVariableByID(ctx context.Context, variableID int64) error {
-	return actions_model.DeleteVariable(ctx, variableID)
-}
-
 func DeleteVariableByName(ctx context.Context, ownerID, repoID int64, name string) error {
 	if err := secret_service.ValidateName(name); err != nil {
 		return err
@@ -69,7 +67,8 @@ func DeleteVariableByName(ctx context.Context, ownerID, repoID int64, name strin
 		return err
 	}
 
-	return actions_model.DeleteVariable(ctx, v.ID)
+	_, err = actions_model.DeleteVariable(ctx, v.ID, ownerID, repoID)
+	return err
 }
 
 func GetVariable(ctx context.Context, opts actions_model.FindVariablesOpts) (*actions_model.ActionVariable, error) {

From 5046a10aecb044661398ca49518556fee6baaa33 Mon Sep 17 00:00:00 2001
From: Gusted <postmaster@gusted.xyz>
Date: Sat, 25 Jan 2025 12:16:04 +0100
Subject: [PATCH 079/125] fix(sec): add tests for web route delete runner

Exhaustively test each combination of deleting and updating a action
runner via the web route. Although updating an action runner was not
impacted, its good to have a test nonetheless.
---
 .../TestRunnerModification/action_runner.yml  |  31 +++++
 tests/integration/runner_test.go              | 130 ++++++++++++++++++
 2 files changed, 161 insertions(+)
 create mode 100644 tests/integration/fixtures/TestRunnerModification/action_runner.yml
 create mode 100644 tests/integration/runner_test.go

diff --git a/tests/integration/fixtures/TestRunnerModification/action_runner.yml b/tests/integration/fixtures/TestRunnerModification/action_runner.yml
new file mode 100644
index 0000000000..95599b19bd
--- /dev/null
+++ b/tests/integration/fixtures/TestRunnerModification/action_runner.yml
@@ -0,0 +1,31 @@
+-
+  id: 1001
+  uuid: "43b5d4d3-401b-42f9-94df-a9d45b447b82"
+  name: "User runner"
+  owner_id: 2
+  repo_id: 0
+  deleted: 0
+
+-
+  id: 1002
+  uuid: "bdc77f4f-2b2b-442d-bd44-e808f4306347"
+  name: "Organisation runner"
+  owner_id: 3
+  repo_id: 0
+  deleted: 0
+
+-
+  id: 1003
+  uuid: "9268bc8c-efbf-4dbe-aeb5-945733cdd098"
+  name: "Repository runner"
+  owner_id: 0
+  repo_id: 1
+  deleted: 0
+
+-
+  id: 1004
+  uuid: "fb857e63-c0ce-4571-a6c9-fde26c128073"
+  name: "Global runner"
+  owner_id: 0
+  repo_id: 0
+  deleted: 0
diff --git a/tests/integration/runner_test.go b/tests/integration/runner_test.go
new file mode 100644
index 0000000000..bab2a67230
--- /dev/null
+++ b/tests/integration/runner_test.go
@@ -0,0 +1,130 @@
+// Copyright 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	actions_model "code.gitea.io/gitea/models/actions"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
+	forgejo_context "code.gitea.io/gitea/services/context"
+	"code.gitea.io/gitea/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRunnerModification(t *testing.T) {
+	defer tests.AddFixtures("tests/integration/fixtures/TestRunnerModification")()
+	defer tests.PrepareTestEnv(t)()
+
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	userRunner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 1001, OwnerID: user.ID})
+	userURL := "/user/settings/actions/runners"
+	org := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3, Type: user_model.UserTypeOrganization})
+	orgRunner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 1002, OwnerID: org.ID})
+	orgURL := "/org/" + org.Name + "/settings/actions/runners"
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user.ID})
+	repoRunner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 1003, RepoID: repo.ID})
+	repoURL := "/" + repo.FullName() + "/settings/actions/runners"
+	admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
+	globalRunner := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: 1004}, "owner_id = 0 AND repo_id = 0")
+	adminURL := "/admin/actions/runners"
+
+	adminSess := loginUser(t, admin.Name)
+	adminCSRF := GetCSRF(t, adminSess, "/")
+	sess := loginUser(t, user.Name)
+	csrf := GetCSRF(t, sess, "/")
+
+	test := func(t *testing.T, fail bool, baseURL string, id int64) {
+		defer tests.PrintCurrentTest(t, 1)()
+		t.Helper()
+
+		sess := sess
+		csrf := csrf
+		if baseURL == adminURL {
+			sess = adminSess
+			csrf = adminCSRF
+		}
+
+		req := NewRequestWithValues(t, "POST", baseURL+fmt.Sprintf("/%d", id), map[string]string{
+			"_csrf":       csrf,
+			"description": "New Description",
+		})
+		if fail {
+			sess.MakeRequest(t, req, http.StatusNotFound)
+		} else {
+			sess.MakeRequest(t, req, http.StatusSeeOther)
+			flashCookie := sess.GetCookie(forgejo_context.CookieNameFlash)
+			assert.NotNil(t, flashCookie)
+			assert.EqualValues(t, "success%3DRunner%2Bupdated%2Bsuccessfully", flashCookie.Value)
+		}
+
+		req = NewRequestWithValues(t, "POST", baseURL+fmt.Sprintf("/%d/delete", id), map[string]string{
+			"_csrf": csrf,
+		})
+		if fail {
+			sess.MakeRequest(t, req, http.StatusNotFound)
+		} else {
+			sess.MakeRequest(t, req, http.StatusOK)
+			flashCookie := sess.GetCookie(forgejo_context.CookieNameFlash)
+			assert.NotNil(t, flashCookie)
+			assert.EqualValues(t, "success%3DRunner%2Bdeleted%2Bsuccessfully", flashCookie.Value)
+		}
+	}
+
+	t.Run("User runner", func(t *testing.T) {
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, true, orgURL, userRunner.ID)
+		})
+		t.Run("Repository", func(t *testing.T) {
+			test(t, true, repoURL, userRunner.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, false, userURL, userRunner.ID)
+		})
+	})
+
+	t.Run("Organisation runner", func(t *testing.T) {
+		t.Run("Repository", func(t *testing.T) {
+			test(t, true, repoURL, orgRunner.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, true, userURL, orgRunner.ID)
+		})
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, false, orgURL, orgRunner.ID)
+		})
+	})
+
+	t.Run("Repository runner", func(t *testing.T) {
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, true, orgURL, repoRunner.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, true, userURL, repoRunner.ID)
+		})
+		t.Run("Repository", func(t *testing.T) {
+			test(t, false, repoURL, repoRunner.ID)
+		})
+	})
+
+	t.Run("Global runner", func(t *testing.T) {
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, true, orgURL, globalRunner.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, true, userURL, globalRunner.ID)
+		})
+		t.Run("Repository", func(t *testing.T) {
+			test(t, true, repoURL, globalRunner.ID)
+		})
+		t.Run("Admin", func(t *testing.T) {
+			test(t, false, adminURL, globalRunner.ID)
+		})
+	})
+}

From 5a7d70658dac186c5831ea04c0e19bfbdedd3902 Mon Sep 17 00:00:00 2001
From: Gusted <postmaster@gusted.xyz>
Date: Sat, 25 Jan 2025 13:03:49 +0100
Subject: [PATCH 080/125] fix(sec): web route test edit and delete variable

Exhaustively test each combination of deleting and updating a action
action variable via the web route.
---
 tests/integration/actions_variables_test.go   | 150 ++++++++++++++++++
 .../action_variable.yml                       |  31 ++++
 2 files changed, 181 insertions(+)
 create mode 100644 tests/integration/actions_variables_test.go
 create mode 100644 tests/integration/fixtures/TestActionVariablesModification/action_variable.yml

diff --git a/tests/integration/actions_variables_test.go b/tests/integration/actions_variables_test.go
new file mode 100644
index 0000000000..0179a543dc
--- /dev/null
+++ b/tests/integration/actions_variables_test.go
@@ -0,0 +1,150 @@
+// Copyright 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	actions_model "code.gitea.io/gitea/models/actions"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
+	forgejo_context "code.gitea.io/gitea/services/context"
+	"code.gitea.io/gitea/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestActionVariablesModification(t *testing.T) {
+	defer tests.AddFixtures("tests/integration/fixtures/TestActionVariablesModification")()
+	defer tests.PrepareTestEnv(t)()
+
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	userVariable := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{ID: 1001, OwnerID: user.ID})
+	userURL := "/user/settings/actions/variables"
+	org := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3, Type: user_model.UserTypeOrganization})
+	orgVariable := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{ID: 1002, OwnerID: org.ID})
+	orgURL := "/org/" + org.Name + "/settings/actions/variables"
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1, OwnerID: user.ID})
+	repoVariable := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{ID: 1003, RepoID: repo.ID})
+	repoURL := "/" + repo.FullName() + "/settings/actions/variables"
+	admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{IsAdmin: true})
+	globalVariable := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionVariable{ID: 1004}, "owner_id = 0 AND repo_id = 0")
+	adminURL := "/admin/actions/variables"
+
+	adminSess := loginUser(t, admin.Name)
+	adminCSRF := GetCSRF(t, adminSess, "/")
+	sess := loginUser(t, user.Name)
+	csrf := GetCSRF(t, sess, "/")
+
+	type errorJSON struct {
+		Error string `json:"errorMessage"`
+	}
+
+	test := func(t *testing.T, fail bool, baseURL string, id int64) {
+		defer tests.PrintCurrentTest(t, 1)()
+		t.Helper()
+
+		sess := sess
+		csrf := csrf
+		if baseURL == adminURL {
+			sess = adminSess
+			csrf = adminCSRF
+		}
+
+		req := NewRequestWithValues(t, "POST", baseURL+fmt.Sprintf("/%d/edit", id), map[string]string{
+			"_csrf": csrf,
+			"name":  "glados_quote",
+			"data":  "I'm fine. Two plus two is...ten, in base four, I'm fine!",
+		})
+		if fail {
+			resp := sess.MakeRequest(t, req, http.StatusBadRequest)
+			var error errorJSON
+			DecodeJSON(t, resp, &error)
+			assert.EqualValues(t, "Failed to find the variable.", error.Error)
+		} else {
+			sess.MakeRequest(t, req, http.StatusOK)
+			flashCookie := sess.GetCookie(forgejo_context.CookieNameFlash)
+			assert.NotNil(t, flashCookie)
+			assert.EqualValues(t, "success%3DThe%2Bvariable%2Bhas%2Bbeen%2Bedited.", flashCookie.Value)
+		}
+
+		req = NewRequestWithValues(t, "POST", baseURL+fmt.Sprintf("/%d/delete", id), map[string]string{
+			"_csrf": csrf,
+		})
+		if fail {
+			resp := sess.MakeRequest(t, req, http.StatusBadRequest)
+			var error errorJSON
+			DecodeJSON(t, resp, &error)
+			assert.EqualValues(t, "Failed to find the variable.", error.Error)
+		} else {
+			sess.MakeRequest(t, req, http.StatusOK)
+			flashCookie := sess.GetCookie(forgejo_context.CookieNameFlash)
+			assert.NotNil(t, flashCookie)
+			assert.EqualValues(t, "success%3DThe%2Bvariable%2Bhas%2Bbeen%2Bremoved.", flashCookie.Value)
+		}
+	}
+
+	t.Run("User variable", func(t *testing.T) {
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, true, orgURL, userVariable.ID)
+		})
+		t.Run("Repository", func(t *testing.T) {
+			test(t, true, repoURL, userVariable.ID)
+		})
+		t.Run("Admin", func(t *testing.T) {
+			test(t, true, adminURL, userVariable.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, false, userURL, userVariable.ID)
+		})
+	})
+
+	t.Run("Organisation variable", func(t *testing.T) {
+		t.Run("Repository", func(t *testing.T) {
+			test(t, true, repoURL, orgVariable.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, true, userURL, orgVariable.ID)
+		})
+		t.Run("Admin", func(t *testing.T) {
+			test(t, true, adminURL, userVariable.ID)
+		})
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, false, orgURL, orgVariable.ID)
+		})
+	})
+
+	t.Run("Repository variable", func(t *testing.T) {
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, true, orgURL, repoVariable.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, true, userURL, repoVariable.ID)
+		})
+		t.Run("Admin", func(t *testing.T) {
+			test(t, true, adminURL, userVariable.ID)
+		})
+		t.Run("Repository", func(t *testing.T) {
+			test(t, false, repoURL, repoVariable.ID)
+		})
+	})
+
+	t.Run("Global variable", func(t *testing.T) {
+		t.Run("Organisation", func(t *testing.T) {
+			test(t, true, orgURL, globalVariable.ID)
+		})
+		t.Run("User", func(t *testing.T) {
+			test(t, true, userURL, globalVariable.ID)
+		})
+		t.Run("Repository", func(t *testing.T) {
+			test(t, true, repoURL, globalVariable.ID)
+		})
+		t.Run("Admin", func(t *testing.T) {
+			test(t, false, adminURL, globalVariable.ID)
+		})
+	})
+}
diff --git a/tests/integration/fixtures/TestActionVariablesModification/action_variable.yml b/tests/integration/fixtures/TestActionVariablesModification/action_variable.yml
new file mode 100644
index 0000000000..925838d0f0
--- /dev/null
+++ b/tests/integration/fixtures/TestActionVariablesModification/action_variable.yml
@@ -0,0 +1,31 @@
+-
+  id: 1001
+  name: GLADOS_QUOTE
+  owner_id: 2
+  repo_id: 0
+  data: ""
+  created_unix: 1737000000
+
+-
+  id: 1002
+  name: GLADOS_QUOTE
+  owner_id: 3
+  repo_id: 0
+  data: ""
+  created_unix: 1737000001
+
+-
+  id: 1003
+  name: GLADOS_QUOTE
+  owner_id: 0
+  repo_id: 1
+  data: ""
+  created_unix: 1737000002
+
+-
+  id: 1004
+  name: GLADOS_QUOTE
+  owner_id: 0
+  repo_id: 0
+  data: ""
+  created_unix: 1737000003

From 77fc232e5b4f2e0b7cd39ee3e5d4aa1d550031bd Mon Sep 17 00:00:00 2001
From: Gusted <postmaster@gusted.xyz>
Date: Wed, 29 Jan 2025 09:47:37 +0100
Subject: [PATCH 081/125] fix(sec): permission check for project issue

- Do an access check when loading issues for a project column, currently
this is not done and exposes the title, labels and existence of a
private issue that the viewer of the project board may not have access
to.
- The number of issues cannot be calculated in a efficient manner
and stored in the database because their number may vary depending on
the visibility of the repositories participating in the project. The
previous implementation used the pre-calculated numbers stored in each
project, which did not reflect that potential variation.
- The code is derived from https://github.com/go-gitea/gitea/pull/22865

(cherry picked from commit 2193afaeb9954a5778f5a47aafd0e6fbbf48d000)
---
 models/issues/issue_project.go | 62 ++++++++++++++++++++++++++++------
 models/project/column.go       | 14 --------
 models/project/issue.go        | 14 --------
 routers/web/org/projects.go    | 15 +++++++-
 routers/web/repo/projects.go   | 15 +++++++-
 templates/projects/list.tmpl   |  4 +--
 templates/projects/view.tmpl   |  2 +-
 7 files changed, 83 insertions(+), 43 deletions(-)

diff --git a/models/issues/issue_project.go b/models/issues/issue_project.go
index 835ea1db52..f606b713cf 100644
--- a/models/issues/issue_project.go
+++ b/models/issues/issue_project.go
@@ -7,8 +7,10 @@ import (
 	"context"
 
 	"code.gitea.io/gitea/models/db"
+	org_model "code.gitea.io/gitea/models/organization"
 	project_model "code.gitea.io/gitea/models/project"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/util"
 )
 
@@ -48,22 +50,29 @@ func (issue *Issue) ProjectColumnID(ctx context.Context) int64 {
 }
 
 // LoadIssuesFromColumn load issues assigned to this column
-func LoadIssuesFromColumn(ctx context.Context, b *project_model.Column) (IssueList, error) {
-	issueList, err := Issues(ctx, &IssuesOptions{
+func LoadIssuesFromColumn(ctx context.Context, b *project_model.Column, doer *user_model.User, org *org_model.Organization, isClosed optional.Option[bool]) (IssueList, error) {
+	issueOpts := &IssuesOptions{
 		ProjectColumnID: b.ID,
 		ProjectID:       b.ProjectID,
 		SortType:        "project-column-sorting",
-	})
+		IsClosed:        isClosed,
+	}
+	if doer != nil {
+		issueOpts.User = doer
+		issueOpts.Org = org
+	} else {
+		issueOpts.AllPublic = true
+	}
+
+	issueList, err := Issues(ctx, issueOpts)
 	if err != nil {
 		return nil, err
 	}
 
 	if b.Default {
-		issues, err := Issues(ctx, &IssuesOptions{
-			ProjectColumnID: db.NoConditionID,
-			ProjectID:       b.ProjectID,
-			SortType:        "project-column-sorting",
-		})
+		issueOpts.ProjectColumnID = db.NoConditionID
+
+		issues, err := Issues(ctx, issueOpts)
 		if err != nil {
 			return nil, err
 		}
@@ -78,10 +87,10 @@ func LoadIssuesFromColumn(ctx context.Context, b *project_model.Column) (IssueLi
 }
 
 // LoadIssuesFromColumnList load issues assigned to the columns
-func LoadIssuesFromColumnList(ctx context.Context, bs project_model.ColumnList) (map[int64]IssueList, error) {
+func LoadIssuesFromColumnList(ctx context.Context, bs project_model.ColumnList, doer *user_model.User, org *org_model.Organization, isClosed optional.Option[bool]) (map[int64]IssueList, error) {
 	issuesMap := make(map[int64]IssueList, len(bs))
 	for i := range bs {
-		il, err := LoadIssuesFromColumn(ctx, bs[i])
+		il, err := LoadIssuesFromColumn(ctx, bs[i], doer, org, isClosed)
 		if err != nil {
 			return nil, err
 		}
@@ -160,3 +169,36 @@ func IssueAssignOrRemoveProject(ctx context.Context, issue *Issue, doer *user_mo
 		})
 	})
 }
+
+// NumIssuesInProjects returns the amount of issues assigned to one of the project
+// in the list which the doer can access.
+func NumIssuesInProjects(ctx context.Context, pl []*project_model.Project, doer *user_model.User, org *org_model.Organization, isClosed optional.Option[bool]) (map[int64]int, error) {
+	numMap := make(map[int64]int, len(pl))
+	for _, p := range pl {
+		num, err := NumIssuesInProject(ctx, p, doer, org, isClosed)
+		if err != nil {
+			return nil, err
+		}
+		numMap[p.ID] = num
+	}
+
+	return numMap, nil
+}
+
+// NumIssuesInProject returns the amount of issues assigned to the project which
+// the doer can access.
+func NumIssuesInProject(ctx context.Context, p *project_model.Project, doer *user_model.User, org *org_model.Organization, isClosed optional.Option[bool]) (int, error) {
+	numIssuesInProject := int(0)
+	bs, err := p.GetColumns(ctx)
+	if err != nil {
+		return 0, err
+	}
+	im, err := LoadIssuesFromColumnList(ctx, bs, doer, org, isClosed)
+	if err != nil {
+		return 0, err
+	}
+	for _, il := range im {
+		numIssuesInProject += len(il)
+	}
+	return numIssuesInProject, nil
+}
diff --git a/models/project/column.go b/models/project/column.go
index 222f448599..f6d6614004 100644
--- a/models/project/column.go
+++ b/models/project/column.go
@@ -57,20 +57,6 @@ func (Column) TableName() string {
 	return "project_board" // TODO: the legacy table name should be project_column
 }
 
-// NumIssues return counter of all issues assigned to the column
-func (c *Column) NumIssues(ctx context.Context) int {
-	total, err := db.GetEngine(ctx).Table("project_issue").
-		Where("project_id=?", c.ProjectID).
-		And("project_board_id=?", c.ID).
-		GroupBy("issue_id").
-		Cols("issue_id").
-		Count()
-	if err != nil {
-		return 0
-	}
-	return int(total)
-}
-
 func (c *Column) GetIssues(ctx context.Context) ([]*ProjectIssue, error) {
 	issues := make([]*ProjectIssue, 0, 5)
 	if err := db.GetEngine(ctx).Where("project_id=?", c.ProjectID).
diff --git a/models/project/issue.go b/models/project/issue.go
index 3361b533b9..984f47ee7c 100644
--- a/models/project/issue.go
+++ b/models/project/issue.go
@@ -34,20 +34,6 @@ func deleteProjectIssuesByProjectID(ctx context.Context, projectID int64) error
 	return err
 }
 
-// NumIssues return counter of all issues assigned to a project
-func (p *Project) NumIssues(ctx context.Context) int {
-	c, err := db.GetEngine(ctx).Table("project_issue").
-		Where("project_id=?", p.ID).
-		GroupBy("issue_id").
-		Cols("issue_id").
-		Count()
-	if err != nil {
-		log.Error("NumIssues: %v", err)
-		return 0
-	}
-	return int(c)
-}
-
 // NumClosedIssues return counter of closed issues assigned to a project
 func (p *Project) NumClosedIssues(ctx context.Context) int {
 	c, err := db.GetEngine(ctx).Table("project_issue").
diff --git a/routers/web/org/projects.go b/routers/web/org/projects.go
index 64d233fc45..6cc2a24c0f 100644
--- a/routers/web/org/projects.go
+++ b/routers/web/org/projects.go
@@ -126,6 +126,19 @@ func Projects(ctx *context.Context) {
 	ctx.Data["PageIsViewProjects"] = true
 	ctx.Data["SortType"] = sortType
 
+	numOpenIssues, err := issues_model.NumIssuesInProjects(ctx, projects, ctx.Doer, ctx.Org.Organization, optional.Some(false))
+	if err != nil {
+		ctx.ServerError("NumIssuesInProjects", err)
+		return
+	}
+	numClosedIssues, err := issues_model.NumIssuesInProjects(ctx, projects, ctx.Doer, ctx.Org.Organization, optional.Some(true))
+	if err != nil {
+		ctx.ServerError("NumIssuesInProjects", err)
+		return
+	}
+	ctx.Data["NumOpenIssuesInProject"] = numOpenIssues
+	ctx.Data["NumClosedIssuesInProject"] = numClosedIssues
+
 	ctx.HTML(http.StatusOK, tplProjects)
 }
 
@@ -332,7 +345,7 @@ func ViewProject(ctx *context.Context) {
 		return
 	}
 
-	issuesMap, err := issues_model.LoadIssuesFromColumnList(ctx, columns)
+	issuesMap, err := issues_model.LoadIssuesFromColumnList(ctx, columns, ctx.Doer, ctx.Org.Organization, optional.None[bool]())
 	if err != nil {
 		ctx.ServerError("LoadIssuesOfColumns", err)
 		return
diff --git a/routers/web/repo/projects.go b/routers/web/repo/projects.go
index f4b027dae1..5826418b63 100644
--- a/routers/web/repo/projects.go
+++ b/routers/web/repo/projects.go
@@ -125,6 +125,19 @@ func Projects(ctx *context.Context) {
 	ctx.Data["IsProjectsPage"] = true
 	ctx.Data["SortType"] = sortType
 
+	numOpenIssues, err := issues_model.NumIssuesInProjects(ctx, projects, ctx.Doer, ctx.Org.Organization, optional.Some(false))
+	if err != nil {
+		ctx.ServerError("NumIssuesInProjects", err)
+		return
+	}
+	numClosedIssues, err := issues_model.NumIssuesInProjects(ctx, projects, ctx.Doer, ctx.Org.Organization, optional.Some(true))
+	if err != nil {
+		ctx.ServerError("NumIssuesInProjects", err)
+		return
+	}
+	ctx.Data["NumOpenIssuesInProject"] = numOpenIssues
+	ctx.Data["NumClosedIssuesInProject"] = numClosedIssues
+
 	ctx.HTML(http.StatusOK, tplProjects)
 }
 
@@ -310,7 +323,7 @@ func ViewProject(ctx *context.Context) {
 		return
 	}
 
-	issuesMap, err := issues_model.LoadIssuesFromColumnList(ctx, columns)
+	issuesMap, err := issues_model.LoadIssuesFromColumnList(ctx, columns, ctx.Doer, nil, optional.None[bool]())
 	if err != nil {
 		ctx.ServerError("LoadIssuesOfColumns", err)
 		return
diff --git a/templates/projects/list.tmpl b/templates/projects/list.tmpl
index b892cff996..6139bd4a3f 100644
--- a/templates/projects/list.tmpl
+++ b/templates/projects/list.tmpl
@@ -49,11 +49,11 @@
 				<div class="group">
 					<div class="flex-text-block">
 						{{svg "octicon-issue-opened" 14}}
-						{{ctx.Locale.PrettyNumber (.NumOpenIssues ctx)}}&nbsp;{{ctx.Locale.Tr "repo.issues.open_title"}}
+						{{ctx.Locale.PrettyNumber (index $.NumOpenIssuesInProject .ID)}}&nbsp;{{ctx.Locale.Tr "repo.issues.open_title"}}
 					</div>
 					<div class="flex-text-block">
 						{{svg "octicon-check" 14}}
-						{{ctx.Locale.PrettyNumber (.NumClosedIssues ctx)}}&nbsp;{{ctx.Locale.Tr "repo.issues.closed_title"}}
+						{{ctx.Locale.PrettyNumber (index $.NumClosedIssuesInProject .ID)}}&nbsp;{{ctx.Locale.Tr "repo.issues.closed_title"}}
 					</div>
 				</div>
 				{{if and $.CanWriteProjects (not $.Repository.IsArchived)}}
diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 08b08b95e5..0e2fc87958 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -70,7 +70,7 @@
 				<div class="project-column-header{{if $canWriteProject}} tw-cursor-grab{{end}}">
 					<div class="ui large label project-column-title tw-py-1">
 						<div class="ui small circular grey label project-column-issue-count">
-							{{.NumIssues ctx}}
+							{{len (index $.IssuesMap .ID)}}
 						</div>
 						<span class="project-column-title-label">{{.Title}}</span>
 					</div>

From 3b4f1b3469160f462b22cddaaecac5f7a251f860 Mon Sep 17 00:00:00 2001
From: Gusted <postmaster@gusted.xyz>
Date: Wed, 29 Jan 2025 11:50:25 +0100
Subject: [PATCH 082/125] fix(sec): add tests for private issues on projects

- Add integration and unit tests to ensure that private issues on
projects are not shown in any way, shape or form when the doer has no
access to it.

(cherry picked from commit 55dcc1d06cb12ddb750a0289fbb6e212f93957a8)
---
 .../fixtures/PrivateIssueProjects/project.yml |  23 ++++
 .../PrivateIssueProjects/project_board.yml    |  17 +++
 .../PrivateIssueProjects/project_issue.yml    |  11 ++
 models/fixtures/team_unit.yml                 |   7 ++
 models/issues/issue_project_test.go           | 100 ++++++++++++++++++
 tests/integration/private_project_test.go     |  84 +++++++++++++++
 6 files changed, 242 insertions(+)
 create mode 100644 models/fixtures/PrivateIssueProjects/project.yml
 create mode 100644 models/fixtures/PrivateIssueProjects/project_board.yml
 create mode 100644 models/fixtures/PrivateIssueProjects/project_issue.yml
 create mode 100644 models/issues/issue_project_test.go
 create mode 100644 tests/integration/private_project_test.go

diff --git a/models/fixtures/PrivateIssueProjects/project.yml b/models/fixtures/PrivateIssueProjects/project.yml
new file mode 100644
index 0000000000..cf63e4e413
--- /dev/null
+++ b/models/fixtures/PrivateIssueProjects/project.yml
@@ -0,0 +1,23 @@
+-
+  id: 1001
+  title: Org project that contains private issues
+  owner_id: 3
+  repo_id: 0
+  is_closed: false
+  creator_id: 2
+  board_type: 1
+  type: 3
+  created_unix: 1738000000
+  updated_unix: 1738000000
+
+-
+  id: 1002
+  title: User project that contains private issues
+  owner_id: 2
+  repo_id: 0
+  is_closed: false
+  creator_id: 2
+  board_type: 1
+  type: 1
+  created_unix: 1738000000
+  updated_unix: 1738000000
diff --git a/models/fixtures/PrivateIssueProjects/project_board.yml b/models/fixtures/PrivateIssueProjects/project_board.yml
new file mode 100644
index 0000000000..3f1fe1e705
--- /dev/null
+++ b/models/fixtures/PrivateIssueProjects/project_board.yml
@@ -0,0 +1,17 @@
+-
+  id: 1001
+  project_id: 1001
+  title: Triage
+  creator_id: 2
+  default: true
+  created_unix: 1738000000
+  updated_unix: 1738000000
+
+-
+  id: 1002
+  project_id: 1002
+  title: Triage
+  creator_id: 2
+  default: true
+  created_unix: 1738000000
+  updated_unix: 1738000000
diff --git a/models/fixtures/PrivateIssueProjects/project_issue.yml b/models/fixtures/PrivateIssueProjects/project_issue.yml
new file mode 100644
index 0000000000..222b2e5f71
--- /dev/null
+++ b/models/fixtures/PrivateIssueProjects/project_issue.yml
@@ -0,0 +1,11 @@
+-
+  id: 1001
+  issue_id: 6
+  project_id: 1001
+  project_board_id: 1001
+
+-
+  id: 1002
+  issue_id: 7
+  project_id: 1002
+  project_board_id: 1002
diff --git a/models/fixtures/team_unit.yml b/models/fixtures/team_unit.yml
index de0e8d738b..e8f8d0e422 100644
--- a/models/fixtures/team_unit.yml
+++ b/models/fixtures/team_unit.yml
@@ -1,42 +1,49 @@
 -
   id: 1
   team_id: 1
+  org_id: 3
   type: 1
   access_mode: 4
 
 -
   id: 2
   team_id: 1
+  org_id: 3
   type: 2
   access_mode: 4
 
 -
   id: 3
   team_id: 1
+  org_id: 3
   type: 3
   access_mode: 4
 
 -
   id: 4
   team_id: 1
+  org_id: 3
   type: 4
   access_mode: 4
 
 -
   id: 5
   team_id: 1
+  org_id: 3
   type: 5
   access_mode: 4
 
 -
   id: 6
   team_id: 1
+  org_id: 3
   type: 6
   access_mode: 4
 
 -
   id: 7
   team_id: 1
+  org_id: 3
   type: 7
   access_mode: 4
 
diff --git a/models/issues/issue_project_test.go b/models/issues/issue_project_test.go
new file mode 100644
index 0000000000..6ebc803722
--- /dev/null
+++ b/models/issues/issue_project_test.go
@@ -0,0 +1,100 @@
+// Copyright 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package issues_test
+
+import (
+	"testing"
+
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/issues"
+	"code.gitea.io/gitea/models/organization"
+	"code.gitea.io/gitea/models/project"
+	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/optional"
+	"code.gitea.io/gitea/tests"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrivateIssueProjects(t *testing.T) {
+	defer tests.AddFixtures("models/fixtures/PrivateIssueProjects/")()
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	t.Run("Organization project", func(t *testing.T) {
+		org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
+		orgProject := unittest.AssertExistsAndLoadBean(t, &project.Project{ID: 1001, OwnerID: org.ID})
+		column := unittest.AssertExistsAndLoadBean(t, &project.Column{ID: 1001, ProjectID: orgProject.ID})
+
+		t.Run("Authenticated user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			issueList, err := issues.LoadIssuesFromColumn(db.DefaultContext, column, user2, org, optional.None[bool]())
+			require.NoError(t, err)
+			assert.Len(t, issueList, 1)
+			assert.EqualValues(t, 6, issueList[0].ID)
+
+			issuesNum, err := issues.NumIssuesInProject(db.DefaultContext, orgProject, user2, org, optional.None[bool]())
+			require.NoError(t, err)
+			assert.EqualValues(t, 1, issuesNum)
+
+			issuesNum, err = issues.NumIssuesInProject(db.DefaultContext, orgProject, user2, org, optional.Some(true))
+			require.NoError(t, err)
+			assert.EqualValues(t, 0, issuesNum)
+
+			issuesNum, err = issues.NumIssuesInProject(db.DefaultContext, orgProject, user2, org, optional.Some(false))
+			require.NoError(t, err)
+			assert.EqualValues(t, 1, issuesNum)
+		})
+
+		t.Run("Anonymous user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			issueList, err := issues.LoadIssuesFromColumn(db.DefaultContext, column, nil, org, optional.None[bool]())
+			require.NoError(t, err)
+			assert.Empty(t, issueList)
+
+			issuesNum, err := issues.NumIssuesInProject(db.DefaultContext, orgProject, nil, org, optional.None[bool]())
+			require.NoError(t, err)
+			assert.EqualValues(t, 0, issuesNum)
+		})
+	})
+
+	t.Run("User project", func(t *testing.T) {
+		userProject := unittest.AssertExistsAndLoadBean(t, &project.Project{ID: 1002, OwnerID: user2.ID})
+		column := unittest.AssertExistsAndLoadBean(t, &project.Column{ID: 1002, ProjectID: userProject.ID})
+
+		t.Run("Authenticated user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			issueList, err := issues.LoadIssuesFromColumn(db.DefaultContext, column, user2, nil, optional.None[bool]())
+			require.NoError(t, err)
+			assert.Len(t, issueList, 1)
+			assert.EqualValues(t, 7, issueList[0].ID)
+
+			issuesNum, err := issues.NumIssuesInProject(db.DefaultContext, userProject, user2, nil, optional.None[bool]())
+			require.NoError(t, err)
+			assert.EqualValues(t, 1, issuesNum)
+
+			issuesNum, err = issues.NumIssuesInProject(db.DefaultContext, userProject, user2, nil, optional.Some(true))
+			require.NoError(t, err)
+			assert.EqualValues(t, 0, issuesNum)
+
+			issuesNum, err = issues.NumIssuesInProject(db.DefaultContext, userProject, user2, nil, optional.Some(false))
+			require.NoError(t, err)
+			assert.EqualValues(t, 1, issuesNum)
+		})
+
+		t.Run("Anonymous user", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			issueList, err := issues.LoadIssuesFromColumn(db.DefaultContext, column, nil, nil, optional.None[bool]())
+			require.NoError(t, err)
+			assert.Empty(t, issueList)
+
+			issuesNum, err := issues.NumIssuesInProject(db.DefaultContext, userProject, nil, nil, optional.None[bool]())
+			require.NoError(t, err)
+			assert.EqualValues(t, 0, issuesNum)
+		})
+	})
+}
diff --git a/tests/integration/private_project_test.go b/tests/integration/private_project_test.go
new file mode 100644
index 0000000000..1a4adb4366
--- /dev/null
+++ b/tests/integration/private_project_test.go
@@ -0,0 +1,84 @@
+// Copyright 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	org_model "code.gitea.io/gitea/models/organization"
+	project_model "code.gitea.io/gitea/models/project"
+	"code.gitea.io/gitea/models/unittest"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPrivateIssueProject(t *testing.T) {
+	defer tests.AddFixtures("models/fixtures/PrivateIssueProjects/")()
+	defer tests.PrepareTestEnv(t)()
+
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	sess := loginUser(t, user2.Name)
+
+	test := func(t *testing.T, sess *TestSession, username string, projectID int64, hasAccess bool) {
+		t.Helper()
+		defer tests.PrintCurrentTest(t, 1)()
+
+		// Test that the projects overview page shows the correct open and close issues.
+		req := NewRequestf(t, "GET", "%s/-/projects", username)
+		resp := sess.MakeRequest(t, req, http.StatusOK)
+
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		openCloseStats := htmlDoc.Find(".milestone-toolbar .group").First().Text()
+		if hasAccess {
+			assert.Contains(t, openCloseStats, "1\u00a0Open")
+		} else {
+			assert.Contains(t, openCloseStats, "0\u00a0Open")
+		}
+		assert.Contains(t, openCloseStats, "0\u00a0Closed")
+
+		// Check that on the project itself the issue is not shown.
+		req = NewRequestf(t, "GET", "%s/-/projects/%d", username, projectID)
+		resp = sess.MakeRequest(t, req, http.StatusOK)
+
+		htmlDoc = NewHTMLParser(t, resp.Body)
+		htmlDoc.AssertElement(t, ".project-column .issue-card", hasAccess)
+
+		// And that the issue count is correct.
+		issueCount := strings.TrimSpace(htmlDoc.Find(".project-column-issue-count").Text())
+		if hasAccess {
+			assert.EqualValues(t, "1", issueCount)
+		} else {
+			assert.EqualValues(t, "0", issueCount)
+		}
+	}
+
+	t.Run("Organization project", func(t *testing.T) {
+		org := unittest.AssertExistsAndLoadBean(t, &org_model.Organization{ID: 3})
+		orgProject := unittest.AssertExistsAndLoadBean(t, &project_model.Project{ID: 1001, OwnerID: org.ID})
+
+		t.Run("Authenticated user", func(t *testing.T) {
+			test(t, sess, org.Name, orgProject.ID, true)
+		})
+
+		t.Run("Anonymous user", func(t *testing.T) {
+			test(t, emptyTestSession(t), org.Name, orgProject.ID, false)
+		})
+	})
+
+	t.Run("User project", func(t *testing.T) {
+		userProject := unittest.AssertExistsAndLoadBean(t, &project_model.Project{ID: 1002, OwnerID: user2.ID})
+
+		t.Run("Authenticated user", func(t *testing.T) {
+			test(t, sess, user2.Name, userProject.ID, true)
+		})
+
+		t.Run("Anonymous user", func(t *testing.T) {
+			test(t, emptyTestSession(t), user2.Name, userProject.ID, false)
+		})
+	})
+}

From 3c7f5982300b2fe2617ba7260bcbfb1976153ed0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 22 Nov 2024 16:38:23 +0100
Subject: [PATCH 083/125] Run testing workflow unconditionally

---
 .forgejo/workflows/testing.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 784bc45736..c2918c757e 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -10,7 +10,6 @@ on:
 
 jobs:
   backend-checks:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     container:
       image: 'data.forgejo.org/oci/node:20-bookworm'
@@ -27,7 +26,6 @@ jobs:
       - run: su forgejo -c 'make --always-make -j$(nproc) lint-backend tidy-check swagger-check fmt-check swagger-validate' # ensure the "go-licenses" make target runs
       - uses: ./.forgejo/workflows-composite/build-backend
   frontend-checks:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     container:
       image: 'data.forgejo.org/oci/node:20-bookworm'
@@ -176,7 +174,6 @@ jobs:
           TAGS: bindata
           TEST_REDIS_SERVER: cacher:${{ matrix.cacher.port }}
   test-mysql:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs: [backend-checks, frontend-checks]
     container:
@@ -207,7 +204,6 @@ jobs:
         env:
           USE_REPO_TEST_DIR: 1
   test-pgsql:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs: [backend-checks, frontend-checks]
     container:
@@ -246,7 +242,6 @@ jobs:
           USE_REPO_TEST_DIR: 1
           TEST_LDAP: 1
   test-sqlite:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs: [backend-checks, frontend-checks]
     container:
@@ -269,14 +264,11 @@ jobs:
           TEST_TAGS: sqlite sqlite_unlock_notify
           USE_REPO_TEST_DIR: 1
   security-check:
-    if: vars.ROLE == 'forgejo-coding' || vars.ROLE == 'forgejo-testing'
     runs-on: docker
     needs:
       - test-sqlite
       - test-pgsql
       - test-mysql
-      - test-remote-cacher
-      - test-unit
     container:
       image: 'data.forgejo.org/oci/node:20-bookworm'
       options: --tmpfs /tmp:exec,noatime

From 2771c2e591c94d89f71199f0bb12da868dadd05b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 30 Apr 2024 12:33:18 +0200
Subject: [PATCH 084/125] Fix name in package-lock.json

The frontend-checks job started failing because the declared name does
not match the repository name.
---
 package-lock.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package-lock.json b/package-lock.json
index 7b1c1ce6b3..9088ea0fb1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,5 +1,5 @@
 {
-  "name": "forgejo",
+  "name": "forgejo-aneksajo",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

From 1d01b582277d5b74fd5f0b3537afd99e3c3c1ad2 Mon Sep 17 00:00:00 2001
From: Nick Guenther <nick.guenther@polymtl.ca>
Date: Sat, 30 Jul 2022 21:45:03 -0400
Subject: [PATCH 085/125] git-annex support

[git-annex](https://git-annex.branchable.com/) is a more complicated cousin to
git-lfs, storing large files in an optional-download side content.  Unlike lfs,
it allows mixing and matching storage remotes, so the content remote(s) doesn't
need to be on the same server as the git remote, making it feasible to scatter
a collection across cloud storage, old harddrives, or anywhere else storage can
be scavenged.  Since this can get complicated, fast, it has a content-tracking
database (`git annex whereis`) to help find everything later.

The use-case we imagine for including it in Gitea is just the simple case, where
we're primarily emulating git-lfs: each repo has its large content at the same URL.

Our motivation is so we can self-host https://www.datalad.org/ datasets, which
currently are only hostable by fragilely scrounging together cloud storage --
and having to manage all the credentials associated with all the pieces -- or at
https://openneuro.org which is fragile in its own ways.

Supporting git-annex also allows multiple Gitea instance to be annex remotes for
each other, mirroring the content or otherwise collaborating the split up the
hosting costs.

Enabling
--------

TODO

HTTP
----

TODO

Permission Checking
-------------------

This tweaks the API in routers/private/serv.go to expose the calling user's
computed permission, instead of just returning HTTP 403.

This doesn't fit in super well. It's the opposite from how the git-lfs support is
done, where there's a complete list of possible subcommands and their matching
permission levels, and then the API compares the requested with the actual level
and returns HTTP 403 if the check fails.

But it's necessary. The main git-annex verbs, 'git-annex-shell configlist' and
'git-annex-shell p2pstdio' are both either read-only or read-write operations,
depending on the state on disk on either end of the connection and what the user
asked it to ask for, with no way to know before git-annex examines the situation.
So tell the level via GIT_ANNEX_READONLY and trust it to handle itself.

In the older Gogs version, the permission was directly read in cmd/serv.go:

```
mode, err = db.UserAccessMode(user.ID, repo)
```
- https://github.com/G-Node/gogs/blob/966e925cf320beff768b192276774d9265706df5/internal/cmd/serv.go#L334

but in Gitea permission enforcement has been centralized in the API layer.
(perhaps so the cmd layer can avoid making direct DB connections?)

Deletion
--------

git-annex has this "lockdown" feature where it tries
really quite very hard to prevent you deleting its
data, to the point that even an rm -rf won't do it:
each file in annex/objects/ is nested inside a
folder with read-only permissions.

The recommended workaround is to run chmod -R +w when
you're sure you actually want to delete a repo. See
https://git-annex.branchable.com/internals/lockdown

So we edit util.RemoveAll() to do just that, so now
it's `chmod -R +w && rm -rf` instead of just `rm -rf`.
---
 cmd/serv.go             | 72 ++++++++++++++++++++++++++++++++++++++---
 modules/private/serv.go |  1 +
 modules/util/remove.go  | 34 ++++++++++++++++++-
 routers/private/serv.go | 12 +++++--
 4 files changed, 110 insertions(+), 9 deletions(-)

diff --git a/cmd/serv.go b/cmd/serv.go
index db67e36fa3..7d16547053 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -38,6 +38,7 @@ import (
 
 const (
 	lfsAuthenticateVerb = "git-lfs-authenticate"
+	gitAnnexShellVerb   = "git-annex-shell"
 )
 
 // CmdServ represents the available serv sub-command.
@@ -79,6 +80,7 @@ var (
 		"git-upload-archive": perm.AccessModeRead,
 		"git-receive-pack":   perm.AccessModeWrite,
 		lfsAuthenticateVerb:  perm.AccessModeNone,
+		gitAnnexShellVerb:    perm.AccessModeNone, // annex permissions are enforced by GIT_ANNEX_SHELL_READONLY, rather than the Gitea API
 	}
 	alphaDashDotPattern = regexp.MustCompile(`[^\w-\.]`)
 )
@@ -212,6 +214,29 @@ func runServ(c *cli.Context) error {
 		}
 	}
 
+	if verb == gitAnnexShellVerb {
+		// if !setting.Annex.Enabled { // TODO: https://github.com/neuropoly/gitea/issues/8
+		if false {
+			return fail(ctx, "Unknown git command", "git-annex request over SSH denied, git-annex support is disabled")
+		}
+
+		if len(words) < 3 {
+			return fail(ctx, "Too few arguments", "Too few arguments in cmd: %s", cmd)
+		}
+
+		// git-annex always puts the repo in words[2], unlike most other
+		// git subcommands; and it sometimes names repos like /~/, as if
+		// $HOME should get expanded while also being rooted. e.g.:
+		//   git-annex-shell 'configlist' '/~/user/repo'
+		//   git-annex-shell 'sendkey' '/user/repo 'key'
+		repoPath = words[2]
+		repoPath = strings.TrimPrefix(repoPath, "/")
+		repoPath = strings.TrimPrefix(repoPath, "~/")
+	}
+
+	// prevent directory traversal attacks
+	repoPath = filepath.Clean("/" + repoPath)[1:]
+
 	rr := strings.SplitN(repoPath, "/", 2)
 	if len(rr) != 2 {
 		return fail(ctx, "Invalid repository path", "Invalid repository path: %v", repoPath)
@@ -225,6 +250,18 @@ func runServ(c *cli.Context) error {
 	// so that username and reponame are not affected.
 	repoPath = strings.ToLower(strings.TrimSpace(repoPath))
 
+	// put the sanitized repoPath back into the argument list for later
+	if verb == gitAnnexShellVerb {
+		// git-annex-shell demands an absolute path
+		absRepoPath, err := filepath.Abs(filepath.Join(setting.RepoRootPath, repoPath))
+		if err != nil {
+			return fail(ctx, "Error locating repoPath", "%v", err)
+		}
+		words[2] = absRepoPath
+	} else {
+		words[1] = repoPath
+	}
+
 	if alphaDashDotPattern.MatchString(reponame) {
 		return fail(ctx, "Invalid repo name", "Invalid repo name: %s", reponame)
 	}
@@ -303,21 +340,46 @@ func runServ(c *cli.Context) error {
 		return nil
 	}
 
-	var gitcmd *exec.Cmd
 	gitBinPath := filepath.Dir(git.GitExecutable) // e.g. /usr/bin
 	gitBinVerb := filepath.Join(gitBinPath, verb) // e.g. /usr/bin/git-upload-pack
 	if _, err := os.Stat(gitBinVerb); err != nil {
 		// if the command "git-upload-pack" doesn't exist, try to split "git-upload-pack" to use the sub-command with git
 		// ps: Windows only has "git.exe" in the bin path, so Windows always uses this way
+		// ps: git-annex-shell and other extensions may not necessarily be in gitBinPath,
+		//     but '{gitBinPath}/git annex-shell' should be able to find them on $PATH.
 		verbFields := strings.SplitN(verb, "-", 2)
 		if len(verbFields) == 2 {
 			// use git binary with the sub-command part: "C:\...\bin\git.exe", "upload-pack", ...
-			gitcmd = exec.CommandContext(ctx, git.GitExecutable, verbFields[1], repoPath)
+			gitBinVerb = git.GitExecutable
+			words = append([]string{verbFields[1]}, words...)
 		}
 	}
-	if gitcmd == nil {
-		// by default, use the verb (it has been checked above by allowedCommands)
-		gitcmd = exec.CommandContext(ctx, gitBinVerb, repoPath)
+
+	// by default, use the verb (it has been checked above by allowedCommands)
+	gitcmd := exec.CommandContext(ctx, gitBinVerb, words[1:]...)
+
+	if verb == gitAnnexShellVerb {
+		// This doesn't get its own isolated section like LFS does, because LFS
+		// is handled by internal Gitea routines, but git-annex has to be shelled out
+		// to like other git subcommands, so we need to build up gitcmd.
+
+		// TODO: does this work on Windows?
+		gitcmd.Env = append(gitcmd.Env,
+			// "If set, disallows running git-shell to handle unknown commands."
+			// - git-annex-shell(1)
+			"GIT_ANNEX_SHELL_LIMITED=True",
+			// "If set, git-annex-shell will refuse to run commands
+			//  that do not operate on the specified directory."
+			// - git-annex-shell(1)
+			fmt.Sprintf("GIT_ANNEX_SHELL_DIRECTORY=%s", words[2]),
+		)
+		if results.UserMode < perm.AccessModeWrite {
+			// "If set, disallows any action that could modify the git-annex repository."
+			// - git-annex-shell(1)
+			// We set this when the backend API has told us that we don't have write permission to this repo.
+			log.Debug("Setting GIT_ANNEX_SHELL_READONLY=True")
+			gitcmd.Env = append(gitcmd.Env, "GIT_ANNEX_SHELL_READONLY=True")
+		}
 	}
 
 	process.SetSysProcAttribute(gitcmd)
diff --git a/modules/private/serv.go b/modules/private/serv.go
index 480a446954..6c7c753cf0 100644
--- a/modules/private/serv.go
+++ b/modules/private/serv.go
@@ -40,6 +40,7 @@ type ServCommandResults struct {
 	UserName    string
 	UserEmail   string
 	UserID      int64
+	UserMode    perm.AccessMode
 	OwnerName   string
 	RepoName    string
 	RepoID      int64
diff --git a/modules/util/remove.go b/modules/util/remove.go
index d1e38faf5f..0f41471fcc 100644
--- a/modules/util/remove.go
+++ b/modules/util/remove.go
@@ -4,7 +4,9 @@
 package util
 
 import (
+	"io/fs"
 	"os"
+	"path/filepath"
 	"runtime"
 	"syscall"
 	"time"
@@ -41,10 +43,40 @@ func Remove(name string) error {
 	return err
 }
 
-// RemoveAll removes the named file or (empty) directory with at most 5 attempts.
+// RemoveAll removes the named file or directory with at most 5 attempts.
 func RemoveAll(name string) error {
 	var err error
+
 	for i := 0; i < 5; i++ {
+		// Do chmod -R +w to help ensure the removal succeeds.
+		// In particular, in the git-annex case, this handles
+		// https://git-annex.branchable.com/internals/lockdown/ :
+		//
+		// > (The only bad consequence of this is that rm -rf .git
+		// > doesn't work unless you first run chmod -R +w .git)
+
+		err = filepath.WalkDir(name, func(path string, d fs.DirEntry, err error) error {
+			// NB: this is called WalkDir but it works on a single file too
+			if err == nil {
+				info, err := d.Info()
+				if err != nil {
+					return err
+				}
+
+				// 0200 == u+w, in octal unix permission notation
+				err = os.Chmod(path, info.Mode()|0o200)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			// try again
+			<-time.After(100 * time.Millisecond)
+			continue
+		}
+
 		err = os.RemoveAll(name)
 		if err == nil {
 			break
diff --git a/routers/private/serv.go b/routers/private/serv.go
index ef3920d359..b42fbc04f4 100644
--- a/routers/private/serv.go
+++ b/routers/private/serv.go
@@ -81,12 +81,14 @@ func ServCommand(ctx *context.PrivateContext) {
 	ownerName := ctx.Params(":owner")
 	repoName := ctx.Params(":repo")
 	mode := perm.AccessMode(ctx.FormInt("mode"))
+	verbs := ctx.FormStrings("verb")
 
 	// Set the basic parts of the results to return
 	results := private.ServCommandResults{
 		RepoName:  repoName,
 		OwnerName: ownerName,
 		KeyID:     keyID,
+		UserMode:  perm.AccessModeNone,
 	}
 
 	// Now because we're not translating things properly let's just default some English strings here
@@ -287,8 +289,10 @@ func ServCommand(ctx *context.PrivateContext) {
 			repo.IsPrivate ||
 			owner.Visibility.IsPrivate() ||
 			(user != nil && user.IsRestricted) || // user will be nil if the key is a deploykey
+			( /*setting.Annex.Enabled && */ len(verbs) > 0 && verbs[0] == "git-annex-shell") || // git-annex has its own permission enforcement, for which we expose results.UserMode
 			setting.Service.RequireSignInView) {
 		if key.Type == asymkey_model.KeyTypeDeploy {
+			results.UserMode = deployKey.Mode
 			if deployKey.Mode < mode {
 				ctx.JSON(http.StatusUnauthorized, private.Response{
 					UserMsg: fmt.Sprintf("Deploy Key: %d:%s is not authorized to %s %s/%s.", key.ID, key.Name, modeString, results.OwnerName, results.RepoName),
@@ -310,9 +314,9 @@ func ServCommand(ctx *context.PrivateContext) {
 				return
 			}
 
-			userMode := perm.UnitAccessMode(unitType)
+			results.UserMode = perm.UnitAccessMode(unitType)
 
-			if userMode < mode {
+			if results.UserMode < mode {
 				log.Warn("Failed authentication attempt for %s with key %s (not authorized to %s %s/%s) from %s", user.Name, key.Name, modeString, ownerName, repoName, ctx.RemoteAddr())
 				ctx.JSON(http.StatusUnauthorized, private.Response{
 					UserMsg: fmt.Sprintf("User: %d:%s with Key: %d:%s is not authorized to %s %s/%s.", user.ID, user.Name, key.ID, key.Name, modeString, ownerName, repoName),
@@ -353,6 +357,7 @@ func ServCommand(ctx *context.PrivateContext) {
 			})
 			return
 		}
+		results.UserMode = perm.AccessModeWrite
 		results.RepoID = repo.ID
 	}
 
@@ -381,13 +386,14 @@ func ServCommand(ctx *context.PrivateContext) {
 			return
 		}
 	}
-	log.Debug("Serv Results:\nIsWiki: %t\nDeployKeyID: %d\nKeyID: %d\tKeyName: %s\nUserName: %s\nUserID: %d\nOwnerName: %s\nRepoName: %s\nRepoID: %d",
+	log.Debug("Serv Results:\nIsWiki: %t\nDeployKeyID: %d\nKeyID: %d\tKeyName: %s\nUserName: %s\nUserID: %d\nUserMode: %d\nOwnerName: %s\nRepoName: %s\nRepoID: %d",
 		results.IsWiki,
 		results.DeployKeyID,
 		results.KeyID,
 		results.KeyName,
 		results.UserName,
 		results.UserID,
+		results.UserMode,
 		results.OwnerName,
 		results.RepoName,
 		results.RepoID)

From 52485edf64f6397aa689493141a1fdc4f85743c5 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Fri, 19 Aug 2022 02:49:18 -0400
Subject: [PATCH 086/125] git-annex tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes https://github.com/neuropoly/gitea/issues/11

Tests:

* `git annex init`
* `git annex copy --from origin`
* `git annex copy --to origin`

over:

* ssh

for:

* the owner
* a collaborator
* a read-only collaborator
* a stranger

in a

* public repo
* private repo

And then confirms:

* Deletion of the remote repo (to ensure lockdown isn't messing with us: https://git-annex.branchable.com/internals/lockdown/#comment-0cc5225dc5abe8eddeb843bfd2fdc382)

------

To support all this:

* Add util.FileCmp()
* Patch withKeyFile() so it can be nested in other copies of itself

-------

Many thanks to Mathieu for giving style tips and catching several bugs,
including a subtle one in util.filecmp() which neutered it.

Co-authored-by: Mathieu Guay-Paquet <mathieu.guay-paquet@polymtl.ca>
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
---
 Makefile                                      |   2 +-
 modules/util/filecmp.go                       |  87 ++
 modules/util/remove.go                        |  37 +-
 .../api_helper_for_declarative_test.go        |  25 +
 tests/integration/git_annex_test.go           | 760 ++++++++++++++++++
 .../git_helper_for_declarative_test.go        |  22 +
 6 files changed, 916 insertions(+), 17 deletions(-)
 create mode 100644 modules/util/filecmp.go
 create mode 100644 tests/integration/git_annex_test.go

diff --git a/Makefile b/Makefile
index a9de57e523..95658a7842 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ self := $(location)
 	@tmpdir=`mktemp --tmpdir -d` ; \
 	echo Using temporary directory $$tmpdir for test repositories ; \
 	USE_REPO_TEST_DIR= $(MAKE) -f $(self) --no-print-directory REPO_TEST_DIR=$$tmpdir/ $@ ; \
-	STATUS=$$? ; rm -r "$$tmpdir" ; exit $$STATUS
+	STATUS=$$? ; chmod -R +w "$$tmpdir" && rm -r "$$tmpdir" ; exit $$STATUS
 
 else
 
diff --git a/modules/util/filecmp.go b/modules/util/filecmp.go
new file mode 100644
index 0000000000..76e7705cc1
--- /dev/null
+++ b/modules/util/filecmp.go
@@ -0,0 +1,87 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package util
+
+import (
+	"bytes"
+	"io"
+	"os"
+)
+
+// Decide if two files have the same contents or not.
+// chunkSize is the size of the blocks to scan by; pass 0 to get a sensible default.
+// *Follows* symlinks.
+//
+// May return an error if something else goes wrong; in this case, you should ignore the value of 'same'.
+//
+// derived from https://stackoverflow.com/a/30038571
+// under CC-BY-SA-4.0 by several contributors
+func FileCmp(file1, file2 string, chunkSize int) (same bool, err error) {
+	if chunkSize == 0 {
+		chunkSize = 4 * 1024
+	}
+
+	// shortcuts: check file metadata
+	stat1, err := os.Stat(file1)
+	if err != nil {
+		return false, err
+	}
+
+	stat2, err := os.Stat(file2)
+	if err != nil {
+		return false, err
+	}
+
+	// are inputs are literally the same file?
+	if os.SameFile(stat1, stat2) {
+		return true, nil
+	}
+
+	// do inputs at least have the same size?
+	if stat1.Size() != stat2.Size() {
+		return false, nil
+	}
+
+	// long way: compare contents
+	f1, err := os.Open(file1)
+	if err != nil {
+		return false, err
+	}
+	defer f1.Close()
+
+	f2, err := os.Open(file2)
+	if err != nil {
+		return false, err
+	}
+	defer f2.Close()
+
+	b1 := make([]byte, chunkSize)
+	b2 := make([]byte, chunkSize)
+	for {
+		n1, err1 := io.ReadFull(f1, b1)
+		n2, err2 := io.ReadFull(f2, b2)
+
+		// https://pkg.go.dev/io#Reader
+		// > Callers should always process the n > 0 bytes returned
+		// > before considering the error err. Doing so correctly
+		// > handles I/O errors that happen after reading some bytes
+		// > and also both of the allowed EOF behaviors.
+
+		if !bytes.Equal(b1[:n1], b2[:n2]) {
+			return false, nil
+		}
+
+		if (err1 == io.EOF && err2 == io.EOF) || (err1 == io.ErrUnexpectedEOF && err2 == io.ErrUnexpectedEOF) {
+			return true, nil
+		}
+
+		// some other error, like a dropped network connection or a bad transfer
+		if err1 != nil {
+			return false, err1
+		}
+		if err2 != nil {
+			return false, err2
+		}
+	}
+}
diff --git a/modules/util/remove.go b/modules/util/remove.go
index 0f41471fcc..f2a61ae467 100644
--- a/modules/util/remove.go
+++ b/modules/util/remove.go
@@ -43,6 +43,26 @@ func Remove(name string) error {
 	return err
 }
 
+// MakeWritable recursively makes the named directory writable.
+func MakeWritable(name string) error {
+	return filepath.WalkDir(name, func(path string, d fs.DirEntry, err error) error {
+		// NB: this is called WalkDir but it works on a single file too
+		if err == nil {
+			info, err := d.Info()
+			if err != nil {
+				return err
+			}
+
+			// 0200 == u+w, in octal unix permission notation
+			err = os.Chmod(path, info.Mode()|0o200)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
 // RemoveAll removes the named file or directory with at most 5 attempts.
 func RemoveAll(name string) error {
 	var err error
@@ -55,22 +75,7 @@ func RemoveAll(name string) error {
 		// > (The only bad consequence of this is that rm -rf .git
 		// > doesn't work unless you first run chmod -R +w .git)
 
-		err = filepath.WalkDir(name, func(path string, d fs.DirEntry, err error) error {
-			// NB: this is called WalkDir but it works on a single file too
-			if err == nil {
-				info, err := d.Info()
-				if err != nil {
-					return err
-				}
-
-				// 0200 == u+w, in octal unix permission notation
-				err = os.Chmod(path, info.Mode()|0o200)
-				if err != nil {
-					return err
-				}
-			}
-			return nil
-		})
+		err = MakeWritable(name)
 		if err != nil {
 			// try again
 			<-time.After(100 * time.Millisecond)
diff --git a/tests/integration/api_helper_for_declarative_test.go b/tests/integration/api_helper_for_declarative_test.go
index dae71ca8ef..5bd8dc5567 100644
--- a/tests/integration/api_helper_for_declarative_test.go
+++ b/tests/integration/api_helper_for_declarative_test.go
@@ -22,6 +22,7 @@ import (
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/services/forms"
 
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -461,3 +462,27 @@ func doAPIAddRepoToOrganizationTeam(ctx APITestContext, teamID int64, orgName, r
 		ctx.Session.MakeRequest(t, req, http.StatusNoContent)
 	}
 }
+
+// generate and activate an ssh key for the user attached to the APITestContext
+// TODO: pick a better name; golang doesn't do method overriding.
+func withCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
+	// we need to have write:public_key to do this step
+	// the easiest way is to create a throwaway ctx that is identical but only has that permission
+	ctxKeyWriter := ctx
+	ctxKeyWriter.Token = getTokenForLoggedInUser(t, ctx.Session, auth.AccessTokenScopeWriteUser)
+
+	keyName := "One of " + ctx.Username + "'s keys: #" + uuid.New().String()
+	withKeyFile(t, keyName, func(keyFile string) {
+		var key api.PublicKey
+
+		doAPICreateUserKey(ctxKeyWriter, keyName, keyFile,
+			func(t *testing.T, _key api.PublicKey) {
+				// save the key ID so we can delete it at the end
+				key = _key
+			})(t)
+
+		defer doAPIDeleteUserKey(ctxKeyWriter, key.ID)(t)
+
+		callback()
+	})
+}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
new file mode 100644
index 0000000000..49f26924e3
--- /dev/null
+++ b/tests/integration/git_annex_test.go
@@ -0,0 +1,760 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package integration
+
+import (
+	"errors"
+	"fmt"
+	"math/rand"
+	"net/url"
+	"os"
+	"path"
+	"regexp"
+	"strings"
+	"testing"
+
+	auth_model "code.gitea.io/gitea/models/auth"
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/perm"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/setting"
+	api "code.gitea.io/gitea/modules/structs"
+	"code.gitea.io/gitea/modules/util"
+	"code.gitea.io/gitea/tests"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Some guidelines:
+//
+// * a APITestContext is an awkward union of session credential + username + target repo
+//   which is assumed to be owned by that username; if you want to target a different
+//   repo, you need to edit its .Reponame or just ignore it and write "username/reponame.git"
+
+func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext, private bool) (err error) {
+	// creating a repo counts as editing the user's profile (is done by POSTing
+	// to /api/v1/user/repos/) -- which means it needs a User-scoped token and
+	// both that and editing need a Repo-scoped token because they edit repositories.
+	rescopedCtx := ctx
+	rescopedCtx.Token = getTokenForLoggedInUser(t, ctx.Session, auth_model.AccessTokenScopeWriteUser, auth_model.AccessTokenScopeWriteRepository)
+	doAPICreateRepository(rescopedCtx, false)(t)
+	t.Cleanup(func() { util.MakeWritable(setting.RepoRootPath) })
+	doAPIEditRepository(rescopedCtx, &api.EditRepoOption{Private: &private})(t)
+
+	repoURL := createSSHUrl(ctx.GitPath(), u)
+
+	// Fill in fixture data
+	withAnnexCtxKeyFile(t, ctx, func() {
+		err = doInitRemoteAnnexRepository(t, repoURL)
+	})
+	if err != nil {
+		return fmt.Errorf("Unable to initialize remote repo with git-annex fixture: %w", err)
+	}
+	return nil
+}
+
+/*
+Test that permissions are enforced on git-annex-shell commands.
+
+	Along the way, test that uploading, downloading, and deleting all work.
+*/
+func TestGitAnnexPermissions(t *testing.T) {
+	/*
+		// TODO: look into how LFS did this
+		if !setting.Annex.Enabled {
+			t.Skip()
+		}
+	*/
+
+	// Each case below is split so that 'clone' is done as
+	// the repo owner, but 'copy' as the user under test.
+	//
+	// Otherwise, in cases where permissions block the
+	// initial 'clone', the test would simply end there
+	// and never verify if permissions apply properly to
+	// 'annex copy' -- potentially leaving a security gap.
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		t.Run("Public", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			ownerCtx := NewAPITestContext(t, "user2", "annex-public", auth_model.AccessTokenScopeWriteRepository)
+
+			// create a public repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, false))
+
+			// double-check it's public
+			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+			require.NoError(t, err)
+			require.False(t, repo.IsPrivate)
+
+			// Remote addresses of the repo
+			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+			// Different sessions, so we can test different permissions.
+			// We leave Reponame blank because we don't actually then later add it according to each case if needed
+			//
+			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+
+			// set up collaborators
+			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+			// tests
+			t.Run("Owner", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Writer", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, writerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Reader", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, readerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Outsider", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, outsiderCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Delete", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				// Delete the repo, make sure it's fully gone
+				doAPIDeleteRepository(ownerCtx)(t)
+				_, statErr := os.Stat(remoteRepoPath)
+				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+			})
+		})
+
+		t.Run("Private", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			ownerCtx := NewAPITestContext(t, "user2", "annex-private", auth_model.AccessTokenScopeWriteRepository)
+
+			// create a private repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, true))
+
+			// double-check it's private
+			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+			require.NoError(t, err)
+			require.True(t, repo.IsPrivate)
+
+			// Remote addresses of the repo
+			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+			// Different sessions, so we can test different permissions.
+			// We leave Reponame blank because we don't actually then later add it according to each case if needed
+			//
+			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+			// Note: there's also full anonymous access, which is only available for public HTTP repos;
+			// it should behave the same as 'outsider' but we (will) test it separately below anyway
+
+			// set up collaborators
+			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+			// tests
+			t.Run("Owner", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Writer", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, writerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+					})
+				})
+			})
+
+			t.Run("Reader", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, readerCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Outsider", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				t.Run("SSH", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+					withAnnexCtxKeyFile(t, ownerCtx, func() {
+						doGitClone(repoPath, repoURL)(t)
+					})
+
+					withAnnexCtxKeyFile(t, outsiderCtx, func() {
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+						})
+					})
+				})
+			})
+
+			t.Run("Delete", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				// Delete the repo, make sure it's fully gone
+				doAPIDeleteRepository(ownerCtx)(t)
+				_, statErr := os.Stat(remoteRepoPath)
+				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+			})
+		})
+	})
+}
+
+/*
+Test that 'git annex init' works.
+
+	precondition: repoPath contains a pre-cloned repo set up by doInitAnnexRepository().
+*/
+func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "init", "cloned-repo").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't `git annex init`: %w", err)
+	}
+
+	// - method 0: 'git config remote.origin.annex-uuid'.
+	//   Demonstrates that 'git annex init' successfully contacted
+	//   the remote git-annex and was able to learn its ID number.
+	readAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "remote.origin.annex-uuid").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't read remote `git config remote.origin.annex-uuid`: %w", err)
+	}
+	readAnnexUUID = strings.TrimSpace(readAnnexUUID)
+
+	match := regexp.MustCompile("^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$").MatchString(readAnnexUUID)
+	if !match {
+		return fmt.Errorf("'git config remote.origin.annex-uuid' should have been able to download the remote's uuid; but instead read '%s'", readAnnexUUID)
+	}
+
+	remoteAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: remoteRepoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't read local `git config annex.uuid`: %w", err)
+	}
+
+	remoteAnnexUUID = strings.TrimSpace(remoteAnnexUUID)
+	match = regexp.MustCompile("^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$").MatchString(remoteAnnexUUID)
+	if !match {
+		return fmt.Errorf("'git annex init' should have been able to download the remote's uuid; but instead read '%s'", remoteAnnexUUID)
+	}
+
+	if readAnnexUUID != remoteAnnexUUID {
+		return fmt.Errorf("'git annex init' should have read the expected annex UUID '%s', but instead got '%s'", remoteAnnexUUID, readAnnexUUID)
+	}
+
+	// - method 1: 'git annex whereis'.
+	//   Demonstrates that git-annex understands the annexed file can be found in the remote annex.
+	annexWhereis, _, err := git.NewCommand(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return fmt.Errorf("Couldn't `git annex whereis large.bin`: %w", err)
+	}
+	// Note: this regex is unanchored because 'whereis' outputs multiple lines containing
+	//       headers and 1+ remotes and we just want to find one of them.
+	match = regexp.MustCompile(regexp.QuoteMeta(remoteAnnexUUID) + " -- .* \\[origin\\]\n").MatchString(annexWhereis)
+	if !match {
+		return errors.New("'git annex whereis' should report large.bin is known to be in [origin]")
+	}
+
+	return nil
+}
+
+func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
+	// NB: this test does something slightly different if run separately from "doAnnexInitTest()":
+	//     "git annex copy" will notice and run "git annex init", silently.
+	//     This shouldn't change any results, but be aware in case it does.
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// verify the file was downloaded
+	localObjectPath, err := annexObjectPath(repoPath, "large.bin")
+	if err != nil {
+		return err
+	}
+	// localObjectPath := path.Join(repoPath, "large.bin") // or, just compare against the checked-out file
+
+	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "large.bin")
+	if err != nil {
+		return err
+	}
+
+	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	if err != nil {
+		return err
+	}
+	if !match {
+		return errors.New("Annexed files should be the same")
+	}
+
+	return nil
+}
+
+func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
+	// NB: this test does something slightly different if run separately from "Init":
+	//     it first runs "git annex init" silently in the background.
+	//     This shouldn't change any results, but be aware in case it does.
+
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "contribution.bin"))
+	if err != nil {
+		return err
+	}
+
+	err = git.AddChanges(repoPath, false, ".")
+	if err != nil {
+		return err
+	}
+
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex another file"})
+	if err != nil {
+		return err
+	}
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--to", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// verify the file was uploaded
+	localObjectPath, err := annexObjectPath(repoPath, "contribution.bin")
+	if err != nil {
+		return err
+	}
+	// localObjectPath := path.Join(repoPath, "contribution.bin") // or, just compare against the checked-out file
+
+	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "contribution.bin")
+	if err != nil {
+		return err
+	}
+
+	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	if err != nil {
+		return err
+	}
+	if !match {
+		return errors.New("Annexed files should be the same")
+	}
+
+	return nil
+}
+
+// ---- Helpers ----
+
+func generateRandomFile(size int, path string) (err error) {
+	// Generate random file
+
+	// XXX TODO: maybe this should not be random, but instead a predictable pattern, so that the test is deterministic
+	bufSize := 4 * 1024
+	if bufSize > size {
+		bufSize = size
+	}
+
+	buffer := make([]byte, bufSize)
+
+	f, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	written := 0
+	for written < size {
+		n := size - written
+		if n > bufSize {
+			n = bufSize
+		}
+		_, err := rand.Read(buffer[:n])
+		if err != nil {
+			return err
+		}
+		n, err = f.Write(buffer[:n])
+		if err != nil {
+			return err
+		}
+		written += n
+	}
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// ---- Annex-specific helpers ----
+
+/*
+Initialize a repo with some baseline annexed and non-annexed files.
+
+	TODO: perhaps this generator could be replaced with a fixture (see
+	integrations/gitea-repositories-meta/ and models/fixtures/repository.yml).
+	However we reuse this template for -different- repos, so maybe not.
+*/
+func doInitAnnexRepository(repoPath string) error {
+	// set up what files should be annexed
+	// in this case, all *.bin  files will be annexed
+	// without this, git-annex's default config annexes every file larger than some number of megabytes
+	f, err := os.Create(path.Join(repoPath, ".gitattributes"))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	// set up git-annex to store certain filetypes via *annex* pointers
+	// (https://git-annex.branchable.com/internals/pointer_file/).
+	// but only when run via 'git add' (see git-annex-smudge(1))
+	_, err = f.WriteString("*                   annex.largefiles=anything\n")
+	if err != nil {
+		return err
+	}
+	_, err = f.WriteString("*.bin  filter=annex\n")
+	if err != nil {
+		return err
+	}
+	f.Close()
+
+	err = git.AddChanges(repoPath, false, ".")
+	if err != nil {
+		return err
+	}
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Configure git-annex settings"})
+	if err != nil {
+		return err
+	}
+
+	// 'git annex init'
+	err = git.NewCommand(git.DefaultContext, "annex", "init", "test-repo").Run(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// add a file to the annex
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "large.bin"))
+	if err != nil {
+		return err
+	}
+	err = git.AddChanges(repoPath, false, ".")
+	if err != nil {
+		return err
+	}
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex a file"})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+/*
+Initialize a remote repo with some baseline annexed and non-annexed files.
+*/
+func doInitRemoteAnnexRepository(t *testing.T, repoURL *url.URL) error {
+	repoPath := path.Join(t.TempDir(), path.Base(repoURL.Path))
+	// This clone is immediately thrown away, which
+	// helps force the tests to be end-to-end.
+	defer util.RemoveAll(repoPath)
+
+	doGitClone(repoPath, repoURL)(t) // TODO: this call is the only reason for the testing.T; can it be removed?
+
+	err := doInitAnnexRepository(repoPath)
+	if err != nil {
+		return err
+	}
+
+	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--content").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+/*
+Find the path in .git/annex/objects/ of the contents for a given annexed file.
+
+	repoPath: the git repository to examine
+	file: the path (in the repo's current HEAD) of the annex pointer
+
+	TODO: pass a parameter to allow examining non-HEAD branches
+*/
+func annexObjectPath(repoPath, file string) (string, error) {
+	// NB: `git annex lookupkey` is more reliable, but doesn't work in bare repos.
+	annexKey, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "show").AddDynamicArguments("HEAD:" + file).RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %w", repoPath, err) // the error from git prints the filename but not repo
+	}
+
+	// There are two formats an annexed file pointer might be:
+	// * a symlink to .git/annex/objects/$HASHDIR/$ANNEX_KEY/$ANNEX_KEY - used by files created with 'git annex add'
+	// * a text file containing /annex/objects/$ANNEX_KEY - used by files for which 'git add' was configured to run git-annex-smudge
+	// This recovers $ANNEX_KEY from either case:
+	annexKey = path.Base(strings.TrimSpace(annexKey))
+
+	contentPath, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(annexKey).RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %s does not seem to be annexed: %w", repoPath, file, err)
+	}
+	contentPath = strings.TrimSpace(contentPath)
+
+	return path.Join(repoPath, contentPath), nil
+}
+
+/* like withKeyFile(), but automatically sets it the account given in ctx for use by git-annex */
+func withAnnexCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
+	_gitAnnexUseGitSSH, gitAnnexUseGitSSHExists := os.LookupEnv("GIT_ANNEX_USE_GIT_SSH")
+	defer func() {
+		// reset
+		if gitAnnexUseGitSSHExists {
+			os.Setenv("GIT_ANNEX_USE_GIT_SSH", _gitAnnexUseGitSSH)
+		}
+	}()
+
+	os.Setenv("GIT_ANNEX_USE_GIT_SSH", "1") // withKeyFile works by setting GIT_SSH_COMMAND, but git-annex only respects that if this is set
+
+	withCtxKeyFile(t, ctx, callback)
+}
diff --git a/tests/integration/git_helper_for_declarative_test.go b/tests/integration/git_helper_for_declarative_test.go
index 83d8177460..1e39b988fd 100644
--- a/tests/integration/git_helper_for_declarative_test.go
+++ b/tests/integration/git_helper_for_declarative_test.go
@@ -42,6 +42,28 @@ func withKeyFile(t *testing.T, keyname string, callback func(string)) {
 		"ssh -o \"UserKnownHostsFile=/dev/null\" -o \"StrictHostKeyChecking=no\" -o \"IdentitiesOnly=yes\" -i \""+keyFile+"\" \"$@\""), 0o700)
 	require.NoError(t, err)
 
+	// reset ssh wrapper afterwards
+	_gitSSH, gitSSHExists := os.LookupEnv("GIT_SSH")
+	defer func() {
+		if gitSSHExists {
+			os.Setenv("GIT_SSH", _gitSSH)
+		}
+	}()
+
+	_gitSSHCommand, gitSSHCommandExists := os.LookupEnv("GIT_SSH_COMMAND")
+	defer func() {
+		if gitSSHCommandExists {
+			os.Setenv("GIT_SSH_COMMAND", _gitSSHCommand)
+		}
+	}()
+
+	_gitSSHVariant, gitSSHVariantExists := os.LookupEnv("GIT_SSH_VARIANT")
+	defer func() {
+		if gitSSHVariantExists {
+			os.Setenv("GIT_SSH_VARIANT", _gitSSHVariant)
+		}
+	}()
+
 	// Setup ssh wrapper
 	t.Setenv("GIT_SSH", path.Join(tmpDir, "ssh"))
 	t.Setenv("GIT_SSH_COMMAND",

From 57de00e5b9669ba2413ecb1283f39381195aac78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 24 May 2024 12:57:45 +0200
Subject: [PATCH 087/125] Adapt patch to upstream changes

Repository creation now expects an objectFormat to be specified for git.
---
 tests/integration/git_annex_test.go | 522 ++++++++++++++--------------
 1 file changed, 262 insertions(+), 260 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 49f26924e3..e364e68852 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -34,13 +34,13 @@ import (
 //   which is assumed to be owned by that username; if you want to target a different
 //   repo, you need to edit its .Reponame or just ignore it and write "username/reponame.git"
 
-func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext, private bool) (err error) {
+func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext, private bool, objectFormat git.ObjectFormat) (err error) {
 	// creating a repo counts as editing the user's profile (is done by POSTing
 	// to /api/v1/user/repos/) -- which means it needs a User-scoped token and
 	// both that and editing need a Repo-scoped token because they edit repositories.
 	rescopedCtx := ctx
 	rescopedCtx.Token = getTokenForLoggedInUser(t, ctx.Session, auth_model.AccessTokenScopeWriteUser, auth_model.AccessTokenScopeWriteRepository)
-	doAPICreateRepository(rescopedCtx, false)(t)
+	doAPICreateRepository(rescopedCtx, false, objectFormat)(t)
 	t.Cleanup(func() { util.MakeWritable(setting.RepoRootPath) })
 	doAPIEditRepository(rescopedCtx, &api.EditRepoOption{Private: &private})(t)
 
@@ -78,365 +78,367 @@ func TestGitAnnexPermissions(t *testing.T) {
 	// 'annex copy' -- potentially leaving a security gap.
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		t.Run("Public", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-
-			ownerCtx := NewAPITestContext(t, "user2", "annex-public", auth_model.AccessTokenScopeWriteRepository)
-
-			// create a public repo
-			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, false))
-
-			// double-check it's public
-			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
-			require.NoError(t, err)
-			require.False(t, repo.IsPrivate)
-
-			// Remote addresses of the repo
-			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
-			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
-
-			// Different sessions, so we can test different permissions.
-			// We leave Reponame blank because we don't actually then later add it according to each case if needed
-			//
-			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
-			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
-			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
-			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
-
-			// set up collaborators
-			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
-			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
-
-			// tests
-			t.Run("Owner", func(t *testing.T) {
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			t.Run("Public", func(t *testing.T) {
 				defer tests.PrintCurrentTest(t)()
 
-				t.Run("SSH", func(t *testing.T) {
+				ownerCtx := NewAPITestContext(t, "user2", "annex-public"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
+
+				// create a public repo
+				require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, false, objectFormat))
+
+				// double-check it's public
+				repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+				require.NoError(t, err)
+				require.False(t, repo.IsPrivate)
+
+				// Remote addresses of the repo
+				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+				// Different sessions, so we can test different permissions.
+				// We leave Reponame blank because we don't actually then later add it according to each case if needed
+				//
+				// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+				writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+				readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+				outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+
+				// set up collaborators
+				doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+				doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+				// tests
+				t.Run("Owner", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Writer", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Writer", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, writerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Reader", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Reader", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, readerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Outsider", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Outsider", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, outsiderCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Delete", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				// Delete the repo, make sure it's fully gone
-				doAPIDeleteRepository(ownerCtx)(t)
-				_, statErr := os.Stat(remoteRepoPath)
-				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
-			})
-		})
-
-		t.Run("Private", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-
-			ownerCtx := NewAPITestContext(t, "user2", "annex-private", auth_model.AccessTokenScopeWriteRepository)
-
-			// create a private repo
-			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, true))
-
-			// double-check it's private
-			repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
-			require.NoError(t, err)
-			require.True(t, repo.IsPrivate)
-
-			// Remote addresses of the repo
-			repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
-			remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
-
-			// Different sessions, so we can test different permissions.
-			// We leave Reponame blank because we don't actually then later add it according to each case if needed
-			//
-			// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
-			writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
-			readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
-			outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
-			// Note: there's also full anonymous access, which is only available for public HTTP repos;
-			// it should behave the same as 'outsider' but we (will) test it separately below anyway
-
-			// set up collaborators
-			doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
-			doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
-
-			// tests
-			t.Run("Owner", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Delete", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
-
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
-
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
-						})
-
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
-
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-						})
-					})
+					// Delete the repo, make sure it's fully gone
+					doAPIDeleteRepository(ownerCtx)(t)
+					_, statErr := os.Stat(remoteRepoPath)
+					require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
 				})
 			})
 
-			t.Run("Writer", func(t *testing.T) {
+			t.Run("Private", func(t *testing.T) {
 				defer tests.PrintCurrentTest(t)()
 
-				t.Run("SSH", func(t *testing.T) {
+				ownerCtx := NewAPITestContext(t, "user2", "annex-private"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
+
+				// create a private repo
+				require.NoError(t, doCreateRemoteAnnexRepository(t, u, ownerCtx, true, objectFormat))
+
+				// double-check it's private
+				repo, err := repo_model.GetRepositoryByOwnerAndName(db.DefaultContext, ownerCtx.Username, ownerCtx.Reponame)
+				require.NoError(t, err)
+				require.True(t, repo.IsPrivate)
+
+				// Remote addresses of the repo
+				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
+				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
+
+				// Different sessions, so we can test different permissions.
+				// We leave Reponame blank because we don't actually then later add it according to each case if needed
+				//
+				// NB: these usernames need to match appropriate entries in models/fixtures/user.yml
+				writerCtx := NewAPITestContext(t, "user5", "", auth_model.AccessTokenScopeWriteRepository)
+				readerCtx := NewAPITestContext(t, "user4", "", auth_model.AccessTokenScopeReadRepository)
+				outsiderCtx := NewAPITestContext(t, "user8", "", auth_model.AccessTokenScopeReadRepository) // a user with no specific access
+				// Note: there's also full anonymous access, which is only available for public HTTP repos;
+				// it should behave the same as 'outsider' but we (will) test it separately below anyway
+
+				// set up collaborators
+				doAPIAddCollaborator(ownerCtx, readerCtx.Username, perm.AccessModeRead)(t)
+				doAPIAddCollaborator(ownerCtx, writerCtx.Username, perm.AccessModeWrite)(t)
+
+				// tests
+				t.Run("Owner", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, writerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Reader", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Writer", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, readerCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Outsider", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
-
-				t.Run("SSH", func(t *testing.T) {
+				t.Run("Reader", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-					defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
 
-					withAnnexCtxKeyFile(t, ownerCtx, func() {
-						doGitClone(repoPath, repoURL)(t)
-					})
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
-					withAnnexCtxKeyFile(t, outsiderCtx, func() {
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-
-							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
 						})
 
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+						withAnnexCtxKeyFile(t, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
-						})
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
 
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
 
-							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
 						})
 					})
 				})
-			})
 
-			t.Run("Delete", func(t *testing.T) {
-				defer tests.PrintCurrentTest(t)()
+				t.Run("Outsider", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
 
-				// Delete the repo, make sure it's fully gone
-				doAPIDeleteRepository(ownerCtx)(t)
-				_, statErr := os.Stat(remoteRepoPath)
-				require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+					t.Run("SSH", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxKeyFile(t, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxKeyFile(t, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+							})
+						})
+					})
+				})
+
+				t.Run("Delete", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					// Delete the repo, make sure it's fully gone
+					doAPIDeleteRepository(ownerCtx)(t)
+					_, statErr := os.Stat(remoteRepoPath)
+					require.True(t, os.IsNotExist(statErr), "Remote annex repo should be removed from disk")
+				})
 			})
 		})
 	})

From d13faeccaa9314de48b5c33c58d17cbddf094c10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 30 Apr 2024 12:12:39 +0200
Subject: [PATCH 088/125] Adapt patch to upstream changes

A dead code check started to complain because FileCmp was only used in
tests. Moved the function to test_utils.
---
 modules/util/filecmp.go             | 87 -----------------------------
 tests/integration/git_annex_test.go |  4 +-
 tests/test_utils.go                 | 79 ++++++++++++++++++++++++++
 3 files changed, 81 insertions(+), 89 deletions(-)
 delete mode 100644 modules/util/filecmp.go

diff --git a/modules/util/filecmp.go b/modules/util/filecmp.go
deleted file mode 100644
index 76e7705cc1..0000000000
--- a/modules/util/filecmp.go
+++ /dev/null
@@ -1,87 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package util
-
-import (
-	"bytes"
-	"io"
-	"os"
-)
-
-// Decide if two files have the same contents or not.
-// chunkSize is the size of the blocks to scan by; pass 0 to get a sensible default.
-// *Follows* symlinks.
-//
-// May return an error if something else goes wrong; in this case, you should ignore the value of 'same'.
-//
-// derived from https://stackoverflow.com/a/30038571
-// under CC-BY-SA-4.0 by several contributors
-func FileCmp(file1, file2 string, chunkSize int) (same bool, err error) {
-	if chunkSize == 0 {
-		chunkSize = 4 * 1024
-	}
-
-	// shortcuts: check file metadata
-	stat1, err := os.Stat(file1)
-	if err != nil {
-		return false, err
-	}
-
-	stat2, err := os.Stat(file2)
-	if err != nil {
-		return false, err
-	}
-
-	// are inputs are literally the same file?
-	if os.SameFile(stat1, stat2) {
-		return true, nil
-	}
-
-	// do inputs at least have the same size?
-	if stat1.Size() != stat2.Size() {
-		return false, nil
-	}
-
-	// long way: compare contents
-	f1, err := os.Open(file1)
-	if err != nil {
-		return false, err
-	}
-	defer f1.Close()
-
-	f2, err := os.Open(file2)
-	if err != nil {
-		return false, err
-	}
-	defer f2.Close()
-
-	b1 := make([]byte, chunkSize)
-	b2 := make([]byte, chunkSize)
-	for {
-		n1, err1 := io.ReadFull(f1, b1)
-		n2, err2 := io.ReadFull(f2, b2)
-
-		// https://pkg.go.dev/io#Reader
-		// > Callers should always process the n > 0 bytes returned
-		// > before considering the error err. Doing so correctly
-		// > handles I/O errors that happen after reading some bytes
-		// > and also both of the allowed EOF behaviors.
-
-		if !bytes.Equal(b1[:n1], b2[:n2]) {
-			return false, nil
-		}
-
-		if (err1 == io.EOF && err2 == io.EOF) || (err1 == io.ErrUnexpectedEOF && err2 == io.ErrUnexpectedEOF) {
-			return true, nil
-		}
-
-		// some other error, like a dropped network connection or a bad transfer
-		if err1 != nil {
-			return false, err1
-		}
-		if err2 != nil {
-			return false, err2
-		}
-	}
-}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index e364e68852..667e57c499 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -522,7 +522,7 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
 	if err != nil {
 		return err
 	}
@@ -575,7 +575,7 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
 	if err != nil {
 		return err
 	}
diff --git a/tests/test_utils.go b/tests/test_utils.go
index b3c03a30a1..6e9374db25 100644
--- a/tests/test_utils.go
+++ b/tests/test_utils.go
@@ -5,9 +5,11 @@
 package tests
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"fmt"
+	"io"
 	"os"
 	"path"
 	"path/filepath"
@@ -488,3 +490,80 @@ func CreateDeclarativeRepo(t *testing.T, owner *user_model.User, name string, en
 
 	return CreateDeclarativeRepoWithOptions(t, owner, opts)
 }
+
+// Decide if two files have the same contents or not.
+// chunkSize is the size of the blocks to scan by; pass 0 to get a sensible default.
+// *Follows* symlinks.
+//
+// May return an error if something else goes wrong; in this case, you should ignore the value of 'same'.
+//
+// derived from https://stackoverflow.com/a/30038571
+// under CC-BY-SA-4.0 by several contributors
+func FileCmp(file1, file2 string, chunkSize int) (same bool, err error) {
+	if chunkSize == 0 {
+		chunkSize = 4 * 1024
+	}
+
+	// shortcuts: check file metadata
+	stat1, err := os.Stat(file1)
+	if err != nil {
+		return false, err
+	}
+
+	stat2, err := os.Stat(file2)
+	if err != nil {
+		return false, err
+	}
+
+	// are inputs are literally the same file?
+	if os.SameFile(stat1, stat2) {
+		return true, nil
+	}
+
+	// do inputs at least have the same size?
+	if stat1.Size() != stat2.Size() {
+		return false, nil
+	}
+
+	// long way: compare contents
+	f1, err := os.Open(file1)
+	if err != nil {
+		return false, err
+	}
+	defer f1.Close()
+
+	f2, err := os.Open(file2)
+	if err != nil {
+		return false, err
+	}
+	defer f2.Close()
+
+	b1 := make([]byte, chunkSize)
+	b2 := make([]byte, chunkSize)
+	for {
+		n1, err1 := io.ReadFull(f1, b1)
+		n2, err2 := io.ReadFull(f2, b2)
+
+		// https://pkg.go.dev/io#Reader
+		// > Callers should always process the n > 0 bytes returned
+		// > before considering the error err. Doing so correctly
+		// > handles I/O errors that happen after reading some bytes
+		// > and also both of the allowed EOF behaviors.
+
+		if !bytes.Equal(b1[:n1], b2[:n2]) {
+			return false, nil
+		}
+
+		if (err1 == io.EOF && err2 == io.EOF) || (err1 == io.ErrUnexpectedEOF && err2 == io.ErrUnexpectedEOF) {
+			return true, nil
+		}
+
+		// some other error, like a dropped network connection or a bad transfer
+		if err1 != nil {
+			return false, err1
+		}
+		if err2 != nil {
+			return false, err2
+		}
+	}
+}

From 37a8fa9b5c18020c84b9a0d1c019ec0af13bef21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 12 Aug 2024 11:34:45 +0200
Subject: [PATCH 089/125] Adapt patch to upstream changes

---
 tests/integration/git_annex_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 667e57c499..f52f8759b1 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -752,11 +752,11 @@ func withAnnexCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
 	defer func() {
 		// reset
 		if gitAnnexUseGitSSHExists {
-			os.Setenv("GIT_ANNEX_USE_GIT_SSH", _gitAnnexUseGitSSH)
+			t.Setenv("GIT_ANNEX_USE_GIT_SSH", _gitAnnexUseGitSSH)
 		}
 	}()
 
-	os.Setenv("GIT_ANNEX_USE_GIT_SSH", "1") // withKeyFile works by setting GIT_SSH_COMMAND, but git-annex only respects that if this is set
+	t.Setenv("GIT_ANNEX_USE_GIT_SSH", "1") // withKeyFile works by setting GIT_SSH_COMMAND, but git-annex only respects that if this is set
 
 	withCtxKeyFile(t, ctx, callback)
 }

From 3d7458b8ccc6db6b0b4895cff3a5b4f18e224cf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 18 Apr 2024 17:25:32 +0200
Subject: [PATCH 090/125] Install git-annex in the testing workflow

---
 .forgejo/workflows/testing.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index c2918c757e..53ab5c0790 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -196,7 +196,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-lfs
+          packages: git git-annex git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-mysql-migration test-mysql'
@@ -232,7 +232,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-lfs
+          packages: git git-annex git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-pgsql-migration test-pgsql'
@@ -253,7 +253,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-lfs
+          packages: git git-annex git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-sqlite-migration test-sqlite'

From cc193ec4efce61e06c986e0136bec9f86bdf65d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 25 Apr 2024 10:21:08 +0200
Subject: [PATCH 091/125] Fix failing tests

Multiple tests that worked fine on v1.20.4-1 started to fail after the
rebase onto v1.20.5-1. These tests are:
- TestGitAnnexPermissions/Private/Owner/HTTP/Init
- TestGitAnnexPermissions/Private/Owner/HTTP/Download
- TestGitAnnexPermissions/Private/Writer/HTTP/Init
- TestGitAnnexPermissions/Private/Writer/HTTP/Download
- TestGitAnnexPermissions/Private/Reader/HTTP/Init
- TestGitAnnexPermissions/Private/Reader/HTTP/Download

What these tests have in common is that they all operate on a private
repository via http with authentication.

They broke at some point between v1.20.4-1 and v1.20.5-1, so I did a
bisect between these two points running the offending tests. This
brought me to the conclusion that
ee48c0d5ea8f148c7f4a792b590d93eb51cbf67d introduced the issue.

The thing is, this commit does not change any code, it only changes the
test environment. Among other things that didn't look as suspicious, it
changes the container image from a bespoke test_env image based on
debian bullseye to a node image based on debian bookworm. Obviously,
this means that there are many version differences between the two.

The first one I looked at was git. The previous bullseye image used a
manually installed git version 2.40.0, while the bookworm image has
2.39.2 installed. Updating git in the new image did not fix the issue,
however.

The next thing I looked at was the git-annex version. Bullseye had
8.20210223 installed and worked, while bookworm used 10.20230126 when
the tests broke. So I tried my luck upgrading to a more recent version
via neurodebian (10.20240227-1~ndall+1). This still worked fine on
bullseye and now also works fine on bookworm.

I have no idea why this specific version of git-annex broke the tests,
but at least there was a commit to pinpoint this to, which isn't always
the case with docker images silently changing beneath you...

Below are the versions as they are reported by git and git-annex:

bullseye (works):

    git version 2.30.2
    git-annex version: 8.20210223
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22 bloomfilter-2.0.1.0 cryptonite-0.26 DAV-1.3.4 feed-1.3.0.1 ghc-8.8.4 http-client-0.6.4.1 persistent-sqlite-2.10.6.2 torrent-10000.1.1 uuid-1.3.13 yesod-1.6.1.0
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7

bullseye + git-annex from neurodebian (works):

    git version 2.30.2
    git-annex version: 10.20240227-1~ndall+1
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Benchmark Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22.1 bloomfilter-2.0.1.0 cryptonite-0.29 DAV-1.3.4 feed-1.3.2.1 ghc-9.0.2 http-client-0.7.13.1 persistent-sqlite-2.13.1.0 torrent-10000.1.1 uuid-1.3.15 yesod-1.6.2.1
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8 9 10
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7 8 9 10

bookworm (fails):

    git version 2.39.2
    git-annex version: 10.20230126
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Benchmark Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22.1 bloomfilter-2.0.1.0 cryptonite-0.29 DAV-1.3.4 feed-1.3.2.1 ghc-9.0.2 http-client-0.7.13.1 persistent-sqlite-2.13.1.0 torrent-10000.1.1 uuid-1.3.15 yesod-1.6.2.1
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8 9 10
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7 8 9 10

bookworm + git-annex from neurodebian (works):

    git version 2.39.2
    git-annex version: 10.20240227-1~ndall+1
    build flags: Assistant Webapp Pairing Inotify DBus DesktopNotify TorrentParser MagicMime Benchmark Feeds Testsuite S3 WebDAV
    dependency versions: aws-0.22.1 bloomfilter-2.0.1.0 cryptonite-0.29 DAV-1.3.4 feed-1.3.2.1 ghc-9.0.2 http-client-0.7.13.1 persistent-sqlite-2.13.1.0 torrent-10000.1.1 uuid-1.3.15 yesod-1.6.2.1
    key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 SHA1E SHA1 MD5E MD5 WORM URL X*
    remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg hook external
    operating system: linux x86_64
    supported repository versions: 8 9 10
    upgrade supported from repository versions: 0 1 2 3 4 5 6 7 8 9 10
---
 .forgejo/workflows-composite/apt-install-from/action.yaml | 3 +++
 .forgejo/workflows/testing.yml                            | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.forgejo/workflows-composite/apt-install-from/action.yaml b/.forgejo/workflows-composite/apt-install-from/action.yaml
index 615e7cb184..ab55883a11 100644
--- a/.forgejo/workflows-composite/apt-install-from/action.yaml
+++ b/.forgejo/workflows-composite/apt-install-from/action.yaml
@@ -13,6 +13,8 @@ runs:
       run: |
         export DEBIAN_FRONTEND=noninteractive
         echo "deb http://deb.debian.org/debian/ ${RELEASE} main" > "/etc/apt/sources.list.d/${RELEASE}.list"
+        wget -O- http://neuro.debian.net/lists/bookworm.de-fzj.libre | tee /etc/apt/sources.list.d/neurodebian.sources.list
+        apt-key adv --recv-keys --keyserver hkps://keyserver.ubuntu.com 0xA5D32F012649A5A9
       env:
         RELEASE: ${{inputs.release}}
     - name: install packages
@@ -24,6 +26,7 @@ runs:
     - name: remove temporary package list to prevent using it in other steps
       run: |
         rm "/etc/apt/sources.list.d/${RELEASE}.list"
+        rm "/etc/apt/sources.list.d/neurodebian.sources.list"
         apt-get update -qq
       env:
         RELEASE: ${{inputs.release}}
diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 53ab5c0790..e4e78d320e 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -196,7 +196,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-annex git-lfs
+          packages: git git-annex-standalone git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-mysql-migration test-mysql'
@@ -232,7 +232,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-annex git-lfs
+          packages: git git-annex-standalone git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-pgsql-migration test-pgsql'
@@ -253,7 +253,7 @@ jobs:
       - name: install dependencies & git >= 2.42
         uses: ./.forgejo/workflows-composite/apt-install-from
         with:
-          packages: git git-annex git-lfs
+          packages: git git-annex-standalone git-lfs
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-sqlite-migration test-sqlite'

From f42432a9e432b66af370ebd01ee9c67ae4f8dcdd Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Mon, 19 Sep 2022 17:22:42 -0400
Subject: [PATCH 092/125] git-annex: add configuration setting [annex].ENABLED

Fixes https://github.com/neuropoly/gitea/issues/8

Co-authored-by: Mathieu Guay-Paquet <mathieu.guaypaquet@gmail.com>
---
 cmd/serv.go                         |  3 +--
 cmd/web.go                          |  4 ++++
 custom/conf/app.example.ini         |  9 +++++++++
 modules/setting/annex.go            | 20 ++++++++++++++++++++
 modules/setting/setting.go          |  1 +
 routers/private/serv.go             |  2 +-
 tests/integration/git_annex_test.go |  9 +++------
 tests/mysql.ini.tmpl                |  3 +++
 tests/pgsql.ini.tmpl                |  3 +++
 tests/sqlite.ini.tmpl               |  3 +++
 10 files changed, 48 insertions(+), 9 deletions(-)
 create mode 100644 modules/setting/annex.go

diff --git a/cmd/serv.go b/cmd/serv.go
index 7d16547053..ac4aa36599 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -215,8 +215,7 @@ func runServ(c *cli.Context) error {
 	}
 
 	if verb == gitAnnexShellVerb {
-		// if !setting.Annex.Enabled { // TODO: https://github.com/neuropoly/gitea/issues/8
-		if false {
+		if !setting.Annex.Enabled {
 			return fail(ctx, "Unknown git command", "git-annex request over SSH denied, git-annex support is disabled")
 		}
 
diff --git a/cmd/web.go b/cmd/web.go
index 44babd51c5..a817204aa6 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -311,6 +311,10 @@ func listen(m http.Handler, handleRedirector bool) error {
 		log.Info("LFS server enabled")
 	}
 
+	if setting.Annex.Enabled {
+		log.Info("git-annex enabled")
+	}
+
 	var err error
 	switch setting.Protocol {
 	case setting.HTTP:
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index ee8ad66668..486adc60a0 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -2678,6 +2678,15 @@ LEVEL = Info
 ;; Limit the number of concurrent upload/download operations within a batch
 ;BATCH_OPERATION_CONCURRENCY = 8
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;[annex]
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Whether git-annex is enabled; defaults to false
+;ENABLED = false
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; settings for packages, will override storage setting
diff --git a/modules/setting/annex.go b/modules/setting/annex.go
new file mode 100644
index 0000000000..a0eeac9bb8
--- /dev/null
+++ b/modules/setting/annex.go
@@ -0,0 +1,20 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package setting
+
+import (
+	"code.gitea.io/gitea/modules/log"
+)
+
+// Annex represents the configuration for git-annex
+var Annex = struct {
+	Enabled bool `ini:"ENABLED"`
+}{}
+
+func loadAnnexFrom(rootCfg ConfigProvider) {
+	sec := rootCfg.Section("annex")
+	if err := sec.MapTo(&Annex); err != nil {
+		log.Fatal("Failed to map Annex settings: %v", err)
+	}
+}
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index c9d30836ac..9710fb23d8 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -153,6 +153,7 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 	loadCamoFrom(cfg)
 	loadI18nFrom(cfg)
 	loadGitFrom(cfg)
+	loadAnnexFrom(cfg)
 	loadMirrorFrom(cfg)
 	loadMarkupFrom(cfg)
 	loadQuotaFrom(cfg)
diff --git a/routers/private/serv.go b/routers/private/serv.go
index b42fbc04f4..a3a0c6961a 100644
--- a/routers/private/serv.go
+++ b/routers/private/serv.go
@@ -289,7 +289,7 @@ func ServCommand(ctx *context.PrivateContext) {
 			repo.IsPrivate ||
 			owner.Visibility.IsPrivate() ||
 			(user != nil && user.IsRestricted) || // user will be nil if the key is a deploykey
-			( /*setting.Annex.Enabled && */ len(verbs) > 0 && verbs[0] == "git-annex-shell") || // git-annex has its own permission enforcement, for which we expose results.UserMode
+			(setting.Annex.Enabled && len(verbs) > 0 && verbs[0] == "git-annex-shell") || // git-annex has its own permission enforcement, for which we expose results.UserMode
 			setting.Service.RequireSignInView) {
 		if key.Type == asymkey_model.KeyTypeDeploy {
 			results.UserMode = deployKey.Mode
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index f52f8759b1..9b8c53ff59 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -62,12 +62,9 @@ Test that permissions are enforced on git-annex-shell commands.
 	Along the way, test that uploading, downloading, and deleting all work.
 */
 func TestGitAnnexPermissions(t *testing.T) {
-	/*
-		// TODO: look into how LFS did this
-		if !setting.Annex.Enabled {
-			t.Skip()
-		}
-	*/
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
 
 	// Each case below is split so that 'clone' is done as
 	// the repo owner, but 'copy' as the user under test.
diff --git a/tests/mysql.ini.tmpl b/tests/mysql.ini.tmpl
index e15e79952b..b8320265ab 100644
--- a/tests/mysql.ini.tmpl
+++ b/tests/mysql.ini.tmpl
@@ -97,6 +97,9 @@ DISABLE_QUERY_AUTH_TOKEN = true
 [lfs]
 PATH = tests/{{TEST_TYPE}}/gitea-{{TEST_TYPE}}-mysql/data/lfs
 
+[annex]
+ENABLED = true
+
 [packages]
 ENABLED = true
 
diff --git a/tests/pgsql.ini.tmpl b/tests/pgsql.ini.tmpl
index 340531fb38..781508a648 100644
--- a/tests/pgsql.ini.tmpl
+++ b/tests/pgsql.ini.tmpl
@@ -122,6 +122,9 @@ MINIO_LOCATION = us-east-1
 MINIO_USE_SSL = false
 MINIO_CHECKSUM_ALGORITHM = md5
 
+[annex]
+ENABLED = true
+
 [packages]
 ENABLED = true
 
diff --git a/tests/sqlite.ini.tmpl b/tests/sqlite.ini.tmpl
index 277916a539..231c0d19c2 100644
--- a/tests/sqlite.ini.tmpl
+++ b/tests/sqlite.ini.tmpl
@@ -102,6 +102,9 @@ JWT_SECRET = KZb_QLUd4fYVyxetjxC4eZkrBgWM2SndOOWDNtgUUko
 [lfs]
 PATH = tests/{{TEST_TYPE}}/gitea-{{TEST_TYPE}}-sqlite/data/lfs
 
+[annex]
+ENABLED = true
+
 [packages]
 ENABLED = true
 

From d8bf745749d40c1147e5f7853ccadb14d6c70571 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Tue, 20 Sep 2022 16:17:56 -0400
Subject: [PATCH 093/125] git-annex: support downloading over HTTP

This makes HTTP symmetric with SSH clone URLs.

This gives us the fancy feature of _anonymous_ downloads,
so people can access datasets without having to set up an
account or manage ssh keys.

Previously, to access "open access" data shared this way,
users would need to:

  1. Create an account on gitea.example.com
  2. Create ssh keys
  3. Upload ssh keys (and make sure to find and upload the correct file)
  4. `git clone git@gitea.example.com:user/dataset.git`
  5. `cd dataset`
  6. `git annex get`

This cuts that down to just the last three steps:

  1. `git clone https://gitea.example.com/user/dataset.git`
  2. `cd dataset`
  3. `git annex get`

This is significantly simpler for downstream users, especially for those
unfamiliar with the command line.

Unfortunately there's no uploading. While git-annex supports uploading
over HTTP to S3 and some other special remotes, it seems to fail on a
_plain_ HTTP remote. See https://github.com/neuropoly/gitea/issues/7
and https://git-annex.branchable.com/forum/HTTP_uploads/#comment-ce28adc128fdefe4c4c49628174d9b92.

This is not a major loss since no one wants uploading to be anonymous anyway.

To support private repos, I had to hunt down and patch a secret extra security
corner that Gitea only applies to HTTP for some reason (services/auth/basic.go).

This was guided by https://git-annex.branchable.com/tips/setup_a_public_repository_on_a_web_site/

Fixes https://github.com/neuropoly/gitea/issues/3

Co-authored-by: Mathieu Guay-Paquet <mathieu.guaypaquet@polymtl.ca>
---
 modules/git/command.go                        |   3 +-
 routers/web/repo/githttp.go                   |  31 ++
 routers/web/web.go                            |  13 +
 services/auth/auth.go                         |  11 +
 services/auth/basic.go                        |   4 +-
 tests/integration/git_annex_test.go           | 360 +++++++++++++++++-
 .../git_helper_for_declarative_test.go        |   7 +
 7 files changed, 412 insertions(+), 17 deletions(-)

diff --git a/modules/git/command.go b/modules/git/command.go
index a3d43aaec6..d3e6b7b8bc 100644
--- a/modules/git/command.go
+++ b/modules/git/command.go
@@ -457,12 +457,13 @@ func (c *Command) RunStdBytes(opts *RunOpts) (stdout, stderr []byte, runErr RunS
 }
 
 // AllowLFSFiltersArgs return globalCommandArgs with lfs filter, it should only be used for tests
+// It also re-enables git-credential(1), which is used to test git-annex's HTTP support
 func AllowLFSFiltersArgs() TrustedCmdArgs {
 	// Now here we should explicitly allow lfs filters to run
 	filteredLFSGlobalArgs := make(TrustedCmdArgs, len(globalCommandArgs))
 	j := 0
 	for _, arg := range globalCommandArgs {
-		if strings.Contains(string(arg), "lfs") {
+		if strings.Contains(string(arg), "lfs") || strings.Contains(string(arg), "credential") {
 			j--
 		} else {
 			filteredLFSGlobalArgs[j] = arg
diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index c1adca174f..fc6864ed40 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -597,3 +597,34 @@ func GetIdxFile(ctx *context.Context) {
 		h.sendFile(ctx, "application/x-git-packed-objects-toc", "objects/pack/pack-"+ctx.Params("file")+".idx")
 	}
 }
+
+// GetAnnexObject implements git-annex dumb HTTP
+func GetAnnexObject(ctx *context.Context) {
+	h := httpBase(ctx)
+	if h != nil {
+		// git-annex objects are stored in .git/annex/objects/{hash1}/{hash2}/{key}/{key}
+		// where key is a string containing the size and (usually SHA256) checksum of the file,
+		// and hash1+hash2 are the first few bits of the md5sum of key itself.
+		// ({hash1}/{hash2}/ is just there to avoid putting too many files in one directory)
+		// ref: https://git-annex.branchable.com/internals/hashing/
+
+		// keyDir should = key, but we don't enforce that
+		object := path.Join(ctx.Params("hash1"), ctx.Params("hash2"), ctx.Params("keyDir"), ctx.Params("key"))
+
+		// Sanitize the input against directory traversals.
+		//
+		// This works because at the filesystem root, "/.." = "/";
+		// So if a path starts rooted ("/"), path.Clean(), which
+		// path.Join() calls internally, removes all '..' prefixes.
+		// After, this unroots the path unconditionally ([1:]), which
+		// works because we know the input is never supposed to be rooted.
+		//
+		// The router code probably also disallows "..", so this
+		// should be redundant, but it's defensive to keep it
+		// whenever touching filesystem paths with user input.
+		object = path.Join("/", object)[1:]
+
+		h.setHeaderCacheForever()
+		h.sendFile("application/octet-stream", "annex/objects/"+object)
+	}
+}
diff --git a/routers/web/web.go b/routers/web/web.go
index 4d8d280c89..bee637e76b 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -356,6 +356,13 @@ func registerRoutes(m *web.Route) {
 		}
 	}
 
+	annexEnabled := func(ctx *context.Context) {
+		if !setting.Annex.Enabled {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+	}
+
 	federationEnabled := func(ctx *context.Context) {
 		if !setting.Federation.Enabled {
 			ctx.Error(http.StatusNotFound)
@@ -1635,6 +1642,12 @@ func registerRoutes(m *web.Route) {
 				})
 			}, ignSignInAndCsrf, lfsServerEnabled)
 
+			m.Group("", func() {
+				// for git-annex
+				m.GetOptions("/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
+				m.GetOptions("/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
+			}, ignSignInAndCsrf, annexEnabled, context_service.UserAssignmentWeb())
+
 			gitHTTPRouters(m)
 		})
 	})
diff --git a/services/auth/auth.go b/services/auth/auth.go
index c10872313f..100e5b25a2 100644
--- a/services/auth/auth.go
+++ b/services/auth/auth.go
@@ -61,6 +61,17 @@ func isArchivePath(req *http.Request) bool {
 	return archivePathRe.MatchString(req.URL.Path)
 }
 
+var annexPathRe = regexp.MustCompile(`^/[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+/annex/`)
+
+func isAnnexPath(req *http.Request) bool {
+	if setting.Annex.Enabled {
+		// "/config" is git's config, not specifically git-annex's; but the only current
+		// user of it is when git-annex downloads the annex.uuid during 'git annex init'.
+		return strings.HasSuffix(req.URL.Path, "/config") || annexPathRe.MatchString(req.URL.Path)
+	}
+	return false
+}
+
 // handleSignIn clears existing session variables and stores new ones for the specified user object
 func handleSignIn(resp http.ResponseWriter, req *http.Request, sess SessionStore, user *user_model.User) {
 	// We need to regenerate the session...
diff --git a/services/auth/basic.go b/services/auth/basic.go
index d489164954..8e8fbfc9c7 100644
--- a/services/auth/basic.go
+++ b/services/auth/basic.go
@@ -43,8 +43,8 @@ func (b *Basic) Name() string {
 // name/token on successful validation.
 // Returns nil if header is empty or validation fails.
 func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
-	// Basic authentication should only fire on API, Download or on Git or LFSPaths
-	if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) {
+	// Basic authentication should only fire on API, Download or on Git, LFSPaths or Git-Annex paths
+	if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) && !isAnnexPath(req) {
 		return nil, nil
 	}
 
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 9b8c53ff59..89a5cb2389 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -59,7 +59,8 @@ func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext,
 /*
 Test that permissions are enforced on git-annex-shell commands.
 
-	Along the way, test that uploading, downloading, and deleting all work.
+	Along the way, this also tests that uploading, downloading, and deleting all work,
+	so we haven't written separate tests for those.
 */
 func TestGitAnnexPermissions(t *testing.T) {
 	if !setting.Annex.Enabled {
@@ -75,6 +76,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 	// 'annex copy' -- potentially leaving a security gap.
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		// Tell git-annex to allow http://127.0.0.1, http://localhost and http://::1. Without
+		// this, all `git annex` commands will silently fail when run against http:// remotes
+		// without explaining what's wrong.
+		//
+		// Note: onGiteaRun() sets up an alternate HOME so this actually edits
+		//       tests/integration/gitea-integration-*/data/home/.gitconfig and
+		//       if you're debugging you need to remember to match that.
+		_, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global").AddArguments("annex.security.allowed-ip-addresses", "all").RunStdString(&git.RunOpts{})
+		require.NoError(t, err)
+
 		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
 			t.Run("Public", func(t *testing.T) {
 				defer tests.PrintCurrentTest(t)()
@@ -89,8 +100,6 @@ func TestGitAnnexPermissions(t *testing.T) {
 				require.NoError(t, err)
 				require.False(t, repo.IsPrivate)
 
-				// Remote addresses of the repo
-				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
 				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
 
 				// Different sessions, so we can test different permissions.
@@ -112,6 +121,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -139,6 +150,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -147,6 +183,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -174,6 +212,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -182,6 +245,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -209,6 +274,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Outsider", func(t *testing.T) {
@@ -217,6 +307,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -244,6 +336,61 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
+				})
+
+				t.Run("Anonymous", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					// Only HTTP has an anonymous mode
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+					})
 				})
 
 				t.Run("Delete", func(t *testing.T) {
@@ -269,8 +416,6 @@ func TestGitAnnexPermissions(t *testing.T) {
 				require.NoError(t, err)
 				require.True(t, repo.IsPrivate)
 
-				// Remote addresses of the repo
-				repoURL := createSSHUrl(ownerCtx.GitPath(), u)                        // remote git URL
 				remoteRepoPath := path.Join(setting.RepoRootPath, ownerCtx.GitPath()) // path on disk -- which can be examined directly because we're testing from localhost
 
 				// Different sessions, so we can test different permissions.
@@ -294,6 +439,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -321,6 +468,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -329,6 +501,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -356,6 +530,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -364,6 +563,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -391,6 +592,31 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Outsider", func(t *testing.T) {
@@ -399,6 +625,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 					t.Run("SSH", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
+						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
 						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
 						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
 
@@ -426,6 +654,61 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+					})
+				})
+
+				t.Run("Anonymous", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					// Only HTTP has an anonymous mode
+					t.Run("HTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+					})
 				})
 
 				t.Run("Delete", func(t *testing.T) {
@@ -447,7 +730,7 @@ Test that 'git annex init' works.
 	precondition: repoPath contains a pre-cloned repo set up by doInitAnnexRepository().
 */
 func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "init", "cloned-repo").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "init", "cloned-repo").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't `git annex init`: %w", err)
 	}
@@ -455,7 +738,7 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 	// - method 0: 'git config remote.origin.annex-uuid'.
 	//   Demonstrates that 'git annex init' successfully contacted
 	//   the remote git-annex and was able to learn its ID number.
-	readAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "remote.origin.annex-uuid").RunStdString(&git.RunOpts{Dir: repoPath})
+	readAnnexUUID, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config", "remote.origin.annex-uuid").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't read remote `git config remote.origin.annex-uuid`: %w", err)
 	}
@@ -466,7 +749,7 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 		return fmt.Errorf("'git config remote.origin.annex-uuid' should have been able to download the remote's uuid; but instead read '%s'", readAnnexUUID)
 	}
 
-	remoteAnnexUUID, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: remoteRepoPath})
+	remoteAnnexUUID, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: remoteRepoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't read local `git config annex.uuid`: %w", err)
 	}
@@ -483,7 +766,7 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 
 	// - method 1: 'git annex whereis'.
 	//   Demonstrates that git-annex understands the annexed file can be found in the remote annex.
-	annexWhereis, _, err := git.NewCommand(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
+	annexWhereis, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return fmt.Errorf("Couldn't `git annex whereis large.bin`: %w", err)
 	}
@@ -502,7 +785,7 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	//     "git annex copy" will notice and run "git annex init", silently.
 	//     This shouldn't change any results, but be aware in case it does.
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "copy", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -550,12 +833,12 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "copy", "--to", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "copy", "--to", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -667,7 +950,7 @@ func doInitAnnexRepository(repoPath string) error {
 	}
 
 	// 'git annex init'
-	err = git.NewCommand(git.DefaultContext, "annex", "init", "test-repo").Run(&git.RunOpts{Dir: repoPath})
+	err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "init", "test-repo").Run(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -705,7 +988,7 @@ func doInitRemoteAnnexRepository(t *testing.T, repoURL *url.URL) error {
 		return err
 	}
 
-	_, _, err = git.NewCommand(git.DefaultContext, "annex", "sync", "--content").RunStdString(&git.RunOpts{Dir: repoPath})
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "sync", "--content").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
 	}
@@ -757,3 +1040,52 @@ func withAnnexCtxKeyFile(t *testing.T, ctx APITestContext, callback func()) {
 
 	withCtxKeyFile(t, ctx, callback)
 }
+
+/*
+Like withKeyFile(), but sets HTTP credentials instead of SSH credentials.
+
+	It does this by temporarily arranging through `git config --global`
+	to use git-credential-store(1) with the password written to a tempfile.
+
+	This is the only reliable way to pass HTTP credentials non-interactively
+	to git-annex.  See https://git-annex.branchable.com/bugs/http_remotes_ignore_annex.web-options_--netrc/#comment-b5a299e9826b322f2d85c96d4929a430
+	for joeyh's proclamation on the subject.
+
+	This **is only effective** when used around git.NewCommandContextNoGlobals() calls.
+	git.NewCommand() disables credential.helper as a precaution (see modules/git/git.go).
+
+	In contrast, the tests in git_test.go put the password in the remote's URL like
+	`git config remote.origin.url http://user2:password@localhost:3003/user2/repo-name.git`,
+	writing the password in repoPath+"/.git/config". That would be equally good, except
+	that git-annex ignores it!
+*/
+func withAnnexCtxHTTPPassword(t *testing.T, u *url.URL, ctx APITestContext, callback func()) {
+	credentialedURL := *u
+	credentialedURL.User = url.UserPassword(ctx.Username, userPassword) // NB: all test users use the same password
+
+	creds := path.Join(t.TempDir(), "creds")
+	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()), 0o600))
+
+	originalCredentialHelper, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper").RunStdString(&git.RunOpts{})
+	if err != nil && !err.IsExitCode(1) {
+		// ignore the 'error' thrown when credential.helper is unset (when git config returns 1)
+		// but catch all others
+		require.NoError(t, err)
+	}
+	hasOriginalCredentialHelper := (err == nil)
+
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper", fmt.Sprintf("store --file=%s", creds)).RunStdString(&git.RunOpts{})
+	require.NoError(t, err)
+
+	defer (func() {
+		// reset
+		if hasOriginalCredentialHelper {
+			_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global").AddArguments("credential.helper").AddDynamicArguments(originalCredentialHelper).RunStdString(&git.RunOpts{})
+		} else {
+			_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global").AddOptionValues("--unset").AddArguments("credential.helper").RunStdString(&git.RunOpts{})
+		}
+		require.NoError(t, err)
+	})()
+
+	callback()
+}
diff --git a/tests/integration/git_helper_for_declarative_test.go b/tests/integration/git_helper_for_declarative_test.go
index 1e39b988fd..575f01dcdb 100644
--- a/tests/integration/git_helper_for_declarative_test.go
+++ b/tests/integration/git_helper_for_declarative_test.go
@@ -73,6 +73,13 @@ func withKeyFile(t *testing.T, keyname string, callback func(string)) {
 	callback(keyFile)
 }
 
+func createHTTPUrl(gitPath string, u *url.URL) *url.URL {
+	// this assumes u contains the HTTP base URL that Gitea is running on
+	u2 := *u
+	u2.Path = gitPath
+	return &u2
+}
+
 func createSSHUrl(gitPath string, u *url.URL) *url.URL {
 	u2 := *u
 	u2.Scheme = "ssh"

From f0da2f268ac36d6af3a8400474ef8f58e6368867 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 1 Mar 2024 14:23:33 +0100
Subject: [PATCH 094/125] Replace m.GetOptions with m.Methods

This applies the same changes that were done in
265cd70bdb152291a13e520cff1da70b8c029432 to the git-annex specific
routes as well.
---
 routers/web/web.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/routers/web/web.go b/routers/web/web.go
index bee637e76b..4480be4498 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -1644,8 +1644,8 @@ func registerRoutes(m *web.Route) {
 
 			m.Group("", func() {
 				// for git-annex
-				m.GetOptions("/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
-				m.GetOptions("/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
+				m.Methods("GET,OPTIONS", "/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
+				m.Methods("GET,OPTIONS", "/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
 			}, ignSignInAndCsrf, annexEnabled, context_service.UserAssignmentWeb())
 
 			gitHTTPRouters(m)

From 24264cb45f6a222cb0aa56f71904f3541ed9aef6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 29 Apr 2024 15:52:47 +0200
Subject: [PATCH 095/125] Fix exit code check for git command

The err.IsExitCode method was changed to a function IsErrorExitCode
taking err as its first argument in
1e7a6483b8322ad5e1183545a6283f137a0546ac.
---
 tests/integration/git_annex_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 89a5cb2389..5423d86d34 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -1067,7 +1067,7 @@ func withAnnexCtxHTTPPassword(t *testing.T, u *url.URL, ctx APITestContext, call
 	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()), 0o600))
 
 	originalCredentialHelper, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper").RunStdString(&git.RunOpts{})
-	if err != nil && !err.IsExitCode(1) {
+	if err != nil && !git.IsErrorExitCode(err, 1) {
 		// ignore the 'error' thrown when credential.helper is unset (when git config returns 1)
 		// but catch all others
 		require.NoError(t, err)

From 3c11eb1e26397d475554249e70712d25be074535 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 29 Apr 2024 17:44:58 +0200
Subject: [PATCH 096/125] Adapt patch to upstream changes

Usage of `path` was replaced by `path/filepath` in upstream forgejo, and
it made sense to use that as well where `path` was previously used. The
`setHeaderCacheForever` function and the `sendFile` method had their
signature changed.
---
 routers/web/repo/githttp.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index fc6864ed40..d715b6bdf0 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -609,7 +609,7 @@ func GetAnnexObject(ctx *context.Context) {
 		// ref: https://git-annex.branchable.com/internals/hashing/
 
 		// keyDir should = key, but we don't enforce that
-		object := path.Join(ctx.Params("hash1"), ctx.Params("hash2"), ctx.Params("keyDir"), ctx.Params("key"))
+		object := filepath.Join(ctx.Params("hash1"), ctx.Params("hash2"), ctx.Params("keyDir"), ctx.Params("key"))
 
 		// Sanitize the input against directory traversals.
 		//
@@ -622,9 +622,9 @@ func GetAnnexObject(ctx *context.Context) {
 		// The router code probably also disallows "..", so this
 		// should be redundant, but it's defensive to keep it
 		// whenever touching filesystem paths with user input.
-		object = path.Join("/", object)[1:]
+		object = filepath.Join(string(filepath.Separator), object)[1:]
 
-		h.setHeaderCacheForever()
-		h.sendFile("application/octet-stream", "annex/objects/"+object)
+		setHeaderCacheForever(ctx)
+		h.sendFile(ctx, "application/octet-stream", "annex/objects/"+object)
 	}
 }

From 0c81519d4ef3d8c288aaf401913f1acfc97707e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 30 Apr 2024 11:25:16 +0200
Subject: [PATCH 097/125] Adapt patch to upstream changes

The "context_service" import was changed to use the default name of just
"context". The patch set had to be adapted for that.
---
 routers/web/web.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routers/web/web.go b/routers/web/web.go
index 4480be4498..4cf4086aba 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -1646,7 +1646,7 @@ func registerRoutes(m *web.Route) {
 				// for git-annex
 				m.Methods("GET,OPTIONS", "/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
 				m.Methods("GET,OPTIONS", "/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
-			}, ignSignInAndCsrf, annexEnabled, context_service.UserAssignmentWeb())
+			}, ignSignInAndCsrf, annexEnabled, context.UserAssignmentWeb())
 
 			gitHTTPRouters(m)
 		})

From 0831aeccd1fe0ed1f7cfc863d497fec2990957dc Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Sun, 27 Nov 2022 00:28:55 -0500
Subject: [PATCH 098/125] git-annex: create modules/annex

This moves the `annexObjectPath()` helper out of the tests and into a
dedicated sub-package as `annex.ContentLocation()`, and expands it with
`.Pointer()` (which validates using `git annex examinekey`),
`.IsAnnexed()` and `.Content()` to make it a more useful module.

The tests retain their own wrapper version of `ContentLocation()`
because I tried to follow close to the API modules/lfs uses, which in
terms of abstract `git.Blob` and `git.TreeEntry` objects, not in terms
of `repoPath string`s which are more convenient for the tests.
---
 modules/annex/annex.go              | 154 ++++++++++++++++++++++++++++
 modules/git/blob.go                 |   4 +
 tests/integration/git_annex_test.go |  41 ++++----
 3 files changed, 181 insertions(+), 18 deletions(-)
 create mode 100644 modules/annex/annex.go

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
new file mode 100644
index 0000000000..bb049d77ed
--- /dev/null
+++ b/modules/annex/annex.go
@@ -0,0 +1,154 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Unlike modules/lfs, which operates mainly on git.Blobs, this operates on git.TreeEntrys.
+// The motivation for this is that TreeEntrys have an easy pointer to the on-disk repo path,
+// while blobs do not (in fact, if building with TAGS=gogit, blobs might exist only in a mock
+// filesystem, living only in process RAM). We must have the on-disk path to do anything
+// useful with git-annex because all of its interesting data is on-disk under .git/annex/.
+
+package annex
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"strings"
+
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+)
+
+const (
+	// > The maximum size of a pointer file is 32 kb.
+	// - https://git-annex.branchable.com/internals/pointer_file/
+	// It's unclear if that's kilobytes or kibibytes; assuming kibibytes:
+	blobSizeCutoff = 32 * 1024
+)
+
+// ErrInvalidPointer occurs if the pointer's value doesn't parse
+var ErrInvalidPointer = errors.New("Not a git-annex pointer")
+
+// Gets the content of the blob as raw text, up to n bytes.
+// (the pre-existing blob.GetBlobContent() has a hardcoded 1024-byte limit)
+func getBlobContent(b *git.Blob, n int) (string, error) {
+	dataRc, err := b.DataAsync()
+	if err != nil {
+		return "", err
+	}
+	defer dataRc.Close()
+	buf := make([]byte, n)
+	n, _ = util.ReadAtMost(dataRc, buf)
+	buf = buf[:n]
+	return string(buf), nil
+}
+
+func Pointer(blob *git.Blob) (string, error) {
+	// git-annex doesn't seem fully spec what its pointer are, but
+	// the fullest description is here:
+	// https://git-annex.branchable.com/internals/pointer_file/
+
+	// a pointer can be:
+	// the original format, generated by `git annex add`: a symlink to '.git/annex/objects/$HASHDIR/$HASHDIR2/$KEY/$KEY'
+	// the newer, git-lfs influenced, format, generated by `git annex smudge`: a text file containing '/annex/objects/$KEY'
+	//
+	// in either case we can extract the $KEY the same way, and we need not actually know if it's a symlink or not because
+	// git.Blob.DataAsync() works like open() + readlink(), handling both cases in one.
+
+	if blob.Size() > blobSizeCutoff {
+		// > The maximum size of a pointer file is 32 kb. If it is any longer, it is not considered to be a valid pointer file.
+		// https://git-annex.branchable.com/internals/pointer_file/
+
+		// It's unclear to me whether the same size limit applies to symlink-pointers, but it seems sensible to limit them too.
+		return "", ErrInvalidPointer
+	}
+
+	pointer, err := getBlobContent(blob, blobSizeCutoff)
+	if err != nil {
+		return "", fmt.Errorf("error reading %s: %w", blob.Name(), err)
+	}
+
+	// the spec says a pointer file can contain multiple lines each with a pointer in them
+	// but that makes no sense to me, so I'm just ignoring all but the first
+	lines := strings.Split(pointer, "\n")
+	if len(lines) < 1 {
+		return "", ErrInvalidPointer
+	}
+	pointer = lines[0]
+
+	// in both the symlink and pointer-file formats, the pointer must have "/annex/" somewhere in it
+	if !strings.Contains(pointer, "/annex/") {
+		return "", ErrInvalidPointer
+	}
+
+	// extract $KEY
+	pointer = path.Base(strings.TrimSpace(pointer))
+
+	// ask git-annex's opinion on $KEY
+	// XXX: this is probably a bit slow, especially if this operation gets run often
+	//      and examinekey is not that strict:
+	//      - it doesn't enforce that the "BACKEND" tag is one it knows,
+	//      - it doesn't enforce that the fields and their format fit the "BACKEND" tag
+	//      so maybe this is a wasteful step
+	_, examineStderr, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "examinekey").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
+	if err != nil {
+		// TODO: make ErrInvalidPointer into a type capable of wrapping err
+		if strings.TrimSpace(examineStderr) == "git-annex: bad key" {
+			return "", ErrInvalidPointer
+		}
+		return "", err
+	}
+
+	return pointer, nil
+}
+
+// return the absolute path of the content pointed to by the annex pointer stored in the git object
+// errors if the content is not found in this repo
+func ContentLocation(blob *git.Blob) (string, error) {
+	pointer, err := Pointer(blob)
+	if err != nil {
+		return "", err
+	}
+
+	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", blob.Repo().Path, pointer, err)
+	}
+	contentLocation = strings.TrimSpace(contentLocation)
+	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
+	contentLocation = path.Join(blob.Repo().Path, contentLocation)
+
+	return contentLocation, nil
+}
+
+// returns a stream open to the annex content
+func Content(blob *git.Blob) (*os.File, error) {
+	contentLocation, err := ContentLocation(blob)
+	if err != nil {
+		return nil, err
+	}
+
+	return os.Open(contentLocation)
+}
+
+// whether the object appears to be a valid annex pointer
+// does *not* verify if the content is actually in this repo;
+// for that, use ContentLocation()
+func IsAnnexed(blob *git.Blob) (bool, error) {
+	if !setting.Annex.Enabled {
+		return false, nil
+	}
+
+	// Pointer() is written to only return well-formed pointers
+	// so the test is just to see if it errors
+	_, err := Pointer(blob)
+	if err != nil {
+		if errors.Is(err, ErrInvalidPointer) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
diff --git a/modules/git/blob.go b/modules/git/blob.go
index 2f02693428..bbfab7d005 100644
--- a/modules/git/blob.go
+++ b/modules/git/blob.go
@@ -126,6 +126,10 @@ func (b *blobReader) Close() error {
 	return nil
 }
 
+func (b *Blob) Repo() *Repository {
+	return b.repo
+}
+
 // Name returns name of the tree entry this blob object was created from (or empty string)
 func (b *Blob) Name() string {
 	return b.name
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 5423d86d34..95693219f6 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -19,6 +19,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/perm"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
@@ -791,13 +792,13 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	}
 
 	// verify the file was downloaded
-	localObjectPath, err := annexObjectPath(repoPath, "large.bin")
+	localObjectPath, err := contentLocation(repoPath, "large.bin")
 	if err != nil {
 		return err
 	}
 	// localObjectPath := path.Join(repoPath, "large.bin") // or, just compare against the checked-out file
 
-	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "large.bin")
+	remoteObjectPath, err := contentLocation(remoteRepoPath, "large.bin")
 	if err != nil {
 		return err
 	}
@@ -844,13 +845,13 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	}
 
 	// verify the file was uploaded
-	localObjectPath, err := annexObjectPath(repoPath, "contribution.bin")
+	localObjectPath, err := contentLocation(repoPath, "contribution.bin")
 	if err != nil {
 		return err
 	}
 	// localObjectPath := path.Join(repoPath, "contribution.bin") // or, just compare against the checked-out file
 
-	remoteObjectPath, err := annexObjectPath(remoteRepoPath, "contribution.bin")
+	remoteObjectPath, err := contentLocation(remoteRepoPath, "contribution.bin")
 	if err != nil {
 		return err
 	}
@@ -1004,26 +1005,30 @@ Find the path in .git/annex/objects/ of the contents for a given annexed file.
 
 	TODO: pass a parameter to allow examining non-HEAD branches
 */
-func annexObjectPath(repoPath, file string) (string, error) {
-	// NB: `git annex lookupkey` is more reliable, but doesn't work in bare repos.
-	annexKey, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "show").AddDynamicArguments("HEAD:" + file).RunStdString(&git.RunOpts{Dir: repoPath})
+func contentLocation(repoPath, file string) (path string, err error) {
+	path = ""
+
+	repo, err := git.OpenRepository(git.DefaultContext, repoPath)
 	if err != nil {
-		return "", fmt.Errorf("in %s: %w", repoPath, err) // the error from git prints the filename but not repo
+		return path, nil
 	}
 
-	// There are two formats an annexed file pointer might be:
-	// * a symlink to .git/annex/objects/$HASHDIR/$ANNEX_KEY/$ANNEX_KEY - used by files created with 'git annex add'
-	// * a text file containing /annex/objects/$ANNEX_KEY - used by files for which 'git add' was configured to run git-annex-smudge
-	// This recovers $ANNEX_KEY from either case:
-	annexKey = path.Base(strings.TrimSpace(annexKey))
-
-	contentPath, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(annexKey).RunStdString(&git.RunOpts{Dir: repoPath})
+	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
 	if err != nil {
-		return "", fmt.Errorf("in %s: %s does not seem to be annexed: %w", repoPath, file, err)
+		return path, nil
 	}
-	contentPath = strings.TrimSpace(contentPath)
 
-	return path.Join(repoPath, contentPath), nil
+	commit, err := repo.GetCommit(commitID)
+	if err != nil {
+		return path, nil
+	}
+
+	treeEntry, err := commit.GetTreeEntryByPath(file)
+	if err != nil {
+		return path, nil
+	}
+
+	return annex.ContentLocation(treeEntry.Blob())
 }
 
 /* like withKeyFile(), but automatically sets it the account given in ctx for use by git-annex */

From 635770f8a4e869b444ec9dcbcb49a42495630748 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 14 May 2024 11:48:43 +0200
Subject: [PATCH 099/125] Adapt patch to upstream changes

The git repository must be closed after using it. Without this change
some tests started to fail due to the lingering repository running into
a timeout.
---
 tests/integration/git_annex_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 95693219f6..d8e1d49904 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -1012,6 +1012,7 @@ func contentLocation(repoPath, file string) (path string, err error) {
 	if err != nil {
 		return path, nil
 	}
+	defer repo.Close()
 
 	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
 	if err != nil {

From 2c0cb04776ca2fe0ad55d55c594ad71d1e39df97 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Sun, 27 Nov 2022 00:40:06 -0500
Subject: [PATCH 100/125] git-annex: make /media/ download annexed content

Previously, Gitea's LFS support allowed direct-downloads of LFS content,
via http://$HOSTNAME:$PORT/$USER/$REPO/media/branch/$BRANCH/$FILE
Expand that grace to git-annex too. Now /media should provide the
relevant *content* from the .git/annex/objects/ folder.

This adds tests too. And expands the tests to try symlink-based annexing,
since /media implicitly supports both that and pointer-file-based annexing.
---
 routers/web/repo/download.go        |  21 ++++
 tests/integration/git_annex_test.go | 146 ++++++++++++++++++++++++----
 2 files changed, 148 insertions(+), 19 deletions(-)

diff --git a/routers/web/repo/download.go b/routers/web/repo/download.go
index 1e87bbf015..aefaa79521 100644
--- a/routers/web/repo/download.go
+++ b/routers/web/repo/download.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	git_model "code.gitea.io/gitea/models/git"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/httpcache"
 	"code.gitea.io/gitea/modules/lfs"
@@ -79,6 +80,26 @@ func ServeBlobOrLFS(ctx *context.Context, blob *git.Blob, lastModified *time.Tim
 	}
 	closed = true
 
+	// check for git-annex files
+	// (this code is weirdly redundant because I'm trying not to delete any lines in order to make merges easier)
+	isAnnexed, err := annex.IsAnnexed(blob)
+	if err != nil {
+		ctx.ServerError("annex.IsAnnexed", err)
+		return err
+	}
+	if isAnnexed {
+		content, err := annex.Content(blob)
+		if err != nil {
+			// XXX are there any other possible failure cases here?
+			// there are, there could be unrelated io errors; those should be ctx.ServerError()s
+			ctx.NotFound("annex.Content", err)
+			return err
+		}
+		defer content.Close()
+		common.ServeContentByReadSeeker(ctx.Base, ctx.Repo.TreePath, lastModified, content)
+		return nil
+	}
+
 	return common.ServeBlob(ctx.Base, ctx.Repo.TreePath, blob, lastModified)
 }
 
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index d8e1d49904..efdd65d617 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -7,7 +7,9 @@ package integration
 import (
 	"errors"
 	"fmt"
+	"io"
 	"math/rand"
+	"net/http"
 	"net/url"
 	"os"
 	"path"
@@ -57,6 +59,63 @@ func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext,
 	return nil
 }
 
+func TestGitAnnexMedia(t *testing.T) {
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		ctx := NewAPITestContext(t, "user2", "annex-media-test", auth_model.AccessTokenScopeWriteRepository)
+
+		// create a public repo
+		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+
+		// the filenames here correspond to specific cases defined in doInitAnnexRepository()
+		t.Run("AnnexSymlink", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			doAnnexMediaTest(t, ctx, "annexed.tiff")
+		})
+		t.Run("AnnexPointer", func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+			doAnnexMediaTest(t, ctx, "annexed.bin")
+		})
+	})
+}
+
+func doAnnexMediaTest(t *testing.T, ctx APITestContext, file string) {
+	// Make sure that downloading via /media on the website recognizes it should give the annexed content
+
+	// TODO:
+	// - [ ] roll this into TestGitAnnexPermissions to ensure that permission enforcement works correctly even on /media?
+
+	session := loginUser(t, ctx.Username) // logs in to the http:// site/API, storing a cookie;
+	// this is a different auth method than the git+ssh:// or git+http:// protocols TestGitAnnexPermissions uses!
+
+	// compute server-side path of the annexed file
+	remoteRepoPath := path.Join(setting.RepoRootPath, ctx.GitPath())
+	remoteObjectPath, err := contentLocation(remoteRepoPath, file)
+	require.NoError(t, err)
+
+	// download annexed file
+	localObjectPath := path.Join(t.TempDir(), file)
+	fd, err := os.OpenFile(localObjectPath, os.O_CREATE|os.O_WRONLY, 0o777)
+	defer fd.Close()
+	require.NoError(t, err)
+
+	mediaLink := path.Join("/", ctx.Username, ctx.Reponame, "/media/branch/master", file)
+	req := NewRequest(t, "GET", mediaLink)
+	resp := session.MakeRequest(t, req, http.StatusOK)
+
+	_, err = io.Copy(fd, resp.Body)
+	require.NoError(t, err)
+	fd.Close()
+
+	// verify the download
+	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	require.NoError(t, err)
+	require.True(t, match, "Annexed files should be the same")
+}
+
 /*
 Test that permissions are enforced on git-annex-shell commands.
 
@@ -766,16 +825,16 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 	}
 
 	// - method 1: 'git annex whereis'.
-	//   Demonstrates that git-annex understands the annexed file can be found in the remote annex.
-	annexWhereis, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "whereis", "large.bin").RunStdString(&git.RunOpts{Dir: repoPath})
+	//   Demonstrates that git-annex understands annexed files can be found in the remote annex.
+	annexWhereis, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "whereis", "annexed.bin").RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
-		return fmt.Errorf("Couldn't `git annex whereis large.bin`: %w", err)
+		return fmt.Errorf("Couldn't `git annex whereis`: %w", err)
 	}
 	// Note: this regex is unanchored because 'whereis' outputs multiple lines containing
 	//       headers and 1+ remotes and we just want to find one of them.
 	match = regexp.MustCompile(regexp.QuoteMeta(remoteAnnexUUID) + " -- .* \\[origin\\]\n").MatchString(annexWhereis)
 	if !match {
-		return errors.New("'git annex whereis' should report large.bin is known to be in [origin]")
+		return errors.New("'git annex whereis' should report files are known to be in [origin]")
 	}
 
 	return nil
@@ -791,27 +850,56 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	// verify the file was downloaded
-	localObjectPath, err := contentLocation(repoPath, "large.bin")
-	if err != nil {
-		return err
-	}
-	// localObjectPath := path.Join(repoPath, "large.bin") // or, just compare against the checked-out file
+	// verify the files downloaded
 
-	remoteObjectPath, err := contentLocation(remoteRepoPath, "large.bin")
+	cmp := func(filename string) error {
+		localObjectPath, err := contentLocation(repoPath, filename)
+		if err != nil {
+			return err
+		}
+		// localObjectPath := path.Join(repoPath, filename) // or, just compare against the checked-out file
+
+		remoteObjectPath, err := contentLocation(remoteRepoPath, filename)
+		if err != nil {
+			return err
+		}
+
+		match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
+		if err != nil {
+			return err
+		}
+		if !match {
+			return errors.New("Annexed files should be the same")
+		}
+
+		return nil
+	}
+
+	// this is the annex-symlink file
+	stat, err := os.Lstat(path.Join(repoPath, "annexed.tiff"))
 	if err != nil {
+		return fmt.Errorf("Lstat: %w", err)
+	}
+	if !((stat.Mode() & os.ModeSymlink) != 0) {
+		// this line is really just double-checking that the text fixture is set up correctly
+		return errors.New("*.tiff should be a symlink")
+	}
+	if err = cmp("annexed.tiff"); err != nil {
 		return err
 	}
 
-	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
+	// this is the annex-pointer file
+	stat, err = os.Lstat(path.Join(repoPath, "annexed.bin"))
 	if err != nil {
-		return err
+		return fmt.Errorf("Lstat: %w", err)
 	}
-	if !match {
-		return errors.New("Annexed files should be the same")
+	if !((stat.Mode() & os.ModeSymlink) == 0) {
+		// this line is really just double-checking that the text fixture is set up correctly
+		return errors.New("*.bin should not be a symlink")
 	}
+	err = cmp("annexed.bin")
 
-	return nil
+	return err
 }
 
 func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
@@ -956,16 +1044,36 @@ func doInitAnnexRepository(repoPath string) error {
 		return err
 	}
 
-	// add a file to the annex
-	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "large.bin"))
+	// add files to the annex, stored via annex symlinks
+	// // a binary file
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "annexed.tiff"))
 	if err != nil {
 		return err
 	}
+
+	err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "add", ".").Run(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+
+	// add files to the annex, stored via git-annex-smudge
+	// // a binary file
+	err = generateRandomFile(1024*1024/4, path.Join(repoPath, "annexed.bin"))
+	if err != nil {
+		return err
+	}
+
+	if err != nil {
+		return err
+	}
+
 	err = git.AddChanges(repoPath, false, ".")
 	if err != nil {
 		return err
 	}
-	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex a file"})
+
+	// save everything
+	err = git.CommitChanges(repoPath, git.CommitChangesOptions{Message: "Annex files"})
 	if err != nil {
 		return err
 	}

From 2845a75cbe24f9a7914af6f0af603002c2bf39a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 24 May 2024 13:21:20 +0200
Subject: [PATCH 101/125] Adapt patch to upstream changes

Test with different objectFormats.
---
 tests/integration/git_annex_test.go | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index efdd65d617..34dceefb9b 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -65,19 +65,21 @@ func TestGitAnnexMedia(t *testing.T) {
 	}
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		ctx := NewAPITestContext(t, "user2", "annex-media-test", auth_model.AccessTokenScopeWriteRepository)
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			ctx := NewAPITestContext(t, "user2", "annex-media-test"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
 
-		// create a public repo
-		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+			// create a public repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false, objectFormat))
 
-		// the filenames here correspond to specific cases defined in doInitAnnexRepository()
-		t.Run("AnnexSymlink", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-			doAnnexMediaTest(t, ctx, "annexed.tiff")
-		})
-		t.Run("AnnexPointer", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
-			doAnnexMediaTest(t, ctx, "annexed.bin")
+			// the filenames here correspond to specific cases defined in doInitAnnexRepository()
+			t.Run("AnnexSymlink", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+				doAnnexMediaTest(t, ctx, "annexed.tiff")
+			})
+			t.Run("AnnexPointer", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+				doAnnexMediaTest(t, ctx, "annexed.bin")
+			})
 		})
 	})
 }

From 82c9a86e831235eea3b4299569d72f94051869d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 14 May 2024 14:34:44 +0200
Subject: [PATCH 102/125] Adapt patch to upstream changes

Use tests.FileCmp instead of util.FileCmp.
---
 tests/integration/git_annex_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 34dceefb9b..b3dc2b974d 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -113,7 +113,7 @@ func doAnnexMediaTest(t *testing.T, ctx APITestContext, file string) {
 	fd.Close()
 
 	// verify the download
-	match, err := util.FileCmp(localObjectPath, remoteObjectPath, 0)
+	match, err := tests.FileCmp(localObjectPath, remoteObjectPath, 0)
 	require.NoError(t, err)
 	require.True(t, match, "Annexed files should be the same")
 }

From 56a9ea1fc35b12d4990652f32d2995bd4b1b0484 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Sun, 27 Nov 2022 02:13:46 -0500
Subject: [PATCH 103/125] git-annex: views for annex files

This updates the repo index/file view endpoints so annex files match the way
LFS files are rendered, making annexed files accessible via the web instead of
being black boxes only accessible by git clone.

This mostly just duplicates the existing LFS logic. It doesn't try to combine itself
with the existing logic, to make merging with upstream easier. If upstream ever
decides to accept, I would like to try to merge the redundant logic.

The one bit that doesn't directly copy LFS is my choice to hide annex-symlinks.
LFS files are always _pointer files_ and therefore always render with the "file"
icon and no special label, but annex files come in two flavours: symlinks or
pointer files. I've conflated both kinds to try to give a consistent experience.

The tests in here ensure the correct download link (/media, from the last PR)
renders in both the toolbar and, if a binary file (like most annexed files will be),
in the main pane, but it also adds quite a bit of code to make sure text files
that happen to be annexed are dug out and rendered inline like LFS files are.
---
 modules/base/tool.go                |   7 ++
 options/locale/locale_cs-CZ.ini     |   2 +
 options/locale/locale_de-DE.ini     |   2 +
 options/locale/locale_el-GR.ini     |   2 +
 options/locale/locale_en-US.ini     |   2 +
 options/locale/locale_es-ES.ini     |   2 +
 options/locale/locale_fa-IR.ini     |   2 +
 options/locale/locale_fr-FR.ini     |   2 +
 options/locale/locale_hu-HU.ini     |   2 +
 options/locale/locale_id-ID.ini     |   2 +
 options/locale/locale_is-IS.ini     |   1 +
 options/locale/locale_it-IT.ini     |   2 +
 options/locale/locale_ja-JP.ini     |   2 +
 options/locale/locale_ko-KR.ini     |   1 +
 options/locale/locale_lv-LV.ini     |   4 +-
 options/locale/locale_nl-NL.ini     |   2 +
 options/locale/locale_pl-PL.ini     |   2 +
 options/locale/locale_pt-BR.ini     |   2 +
 options/locale/locale_pt-PT.ini     |   2 +
 options/locale/locale_ru-RU.ini     |   2 +
 options/locale/locale_si-LK.ini     |   2 +
 options/locale/locale_sk-SK.ini     |   1 +
 options/locale/locale_sv-SE.ini     |   2 +
 options/locale/locale_tr-TR.ini     |   2 +
 options/locale/locale_uk-UA.ini     |   2 +
 options/locale/locale_zh-CN.ini     |   2 +
 options/locale/locale_zh-HK.ini     |   3 +-
 options/locale/locale_zh-TW.ini     |   2 +
 routers/web/repo/view.go            |  66 +++++++++++---
 templates/repo/file_info.tmpl       |   1 +
 tests/integration/git_annex_test.go | 133 ++++++++++++++++++++++++++++
 31 files changed, 248 insertions(+), 13 deletions(-)

diff --git a/modules/base/tool.go b/modules/base/tool.go
index 02f1db59d3..3d0fe73823 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -16,6 +16,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 
@@ -103,6 +104,12 @@ func Int64sToStrings(ints []int64) []string {
 func EntryIcon(entry *git.TreeEntry) string {
 	switch {
 	case entry.IsLink():
+		isAnnexed, _ := annex.IsAnnexed(entry.Blob())
+		if isAnnexed {
+			// git-annex files are sometimes stored as symlinks;
+			// short-circuit that so like LFS they are displayed as regular files
+			return "file"
+		}
 		te, _, err := entry.FollowLink()
 		if err != nil {
 			log.Debug(err.Error())
diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 0143a9aed2..1894aeb81c 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -1317,6 +1317,7 @@ view_git_blame=Zobrazit git blame
 video_not_supported_in_browser=Váš prohlížeč nepodporuje značku HTML5 „video“.
 audio_not_supported_in_browser=Váš prohlížeč nepodporuje značku HTML5 „audio“.
 stored_lfs=Uloženo pomocí Git LFS
+stored_annex=Uloženo pomocí Git Annex
 symbolic_link=Symbolický odkaz
 executable_file=Spustitelný soubor
 vendored = Vendorováno
@@ -1342,6 +1343,7 @@ editor.upload_file=Nahrát soubor
 editor.edit_file=Upravit soubor
 editor.preview_changes=Náhled změn
 editor.cannot_edit_lfs_files=LFS soubory nemohou být upravovány přes webové rozhraní.
+editor.cannot_edit_annex_files=Annex soubory nemohou být upravovány přes webové rozhraní.
 editor.cannot_edit_non_text_files=Binární soubory nemohou být upravovány přes webové rozhraní.
 editor.edit_this_file=Upravit soubor
 editor.this_file_locked=Soubor je uzamčen
diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 3064552aac..9bc1bf5932 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -1317,6 +1317,7 @@ view_git_blame=„git blame“ ansehen
 video_not_supported_in_browser=Dein Browser unterstützt das HTML5-„video“-Tag nicht.
 audio_not_supported_in_browser=Dein Browser unterstützt das HTML5-„audio“-Tag nicht.
 stored_lfs=Gespeichert mit Git LFS
+stored_annex=Gespeichert mit Git Annex
 symbolic_link=Softlink
 executable_file=Ausführbare Datei
 commit_graph=Commit-Graph
@@ -1340,6 +1341,7 @@ editor.upload_file=Datei hochladen
 editor.edit_file=Datei bearbeiten
 editor.preview_changes=Vorschau der Änderungen
 editor.cannot_edit_lfs_files=LFS-Dateien können im Webinterface nicht bearbeitet werden.
+editor.cannot_edit_annex_files=Annex-Dateien können im Webinterface nicht bearbeitet werden.
 editor.cannot_edit_non_text_files=Binärdateien können nicht im Webinterface bearbeitet werden.
 editor.edit_this_file=Datei bearbeiten
 editor.this_file_locked=Datei ist gesperrt
diff --git a/options/locale/locale_el-GR.ini b/options/locale/locale_el-GR.ini
index e80b815843..2f6d82b8f0 100644
--- a/options/locale/locale_el-GR.ini
+++ b/options/locale/locale_el-GR.ini
@@ -1314,6 +1314,7 @@ view_git_blame=Προβολή git blame
 video_not_supported_in_browser=Το πρόγραμμα περιήγησής σας δεν υποστηρίζει την ετικέτα HTML5 «video».
 audio_not_supported_in_browser=Το πρόγραμμα περιήγησής σας δεν υποστηρίζει την ετικέτα HTML5 «audio».
 stored_lfs=Αποθηκεύτηκε με το Git LFS
+stored_annex=Αποθηκεύτηκε με το Git Annex
 symbolic_link=Symbolic link
 executable_file=Εκτελέσιμο αρχείο
 commit_graph=Γράφημα υποβολών
@@ -1337,6 +1338,7 @@ editor.upload_file=Ανέβασμα αρχείου
 editor.edit_file=Επεξεργασία αρχείου
 editor.preview_changes=Προεπισκόπηση αλλαγών
 editor.cannot_edit_lfs_files=Τα αρχεία LFS δεν μπορούν να επεξεργαστούν στη διεπαφή web.
+editor.cannot_edit_annex_files=Τα αρχεία Annex δεν μπορούν να επεξεργαστούν στη διεπαφή web.
 editor.cannot_edit_non_text_files=Τα δυαδικά αρχεία δεν μπορούν να επεξεργαστούν στη διεπαφή web.
 editor.edit_this_file=Επεξεργασία αρχείου
 editor.this_file_locked=Το αρχείο είναι κλειδωμένο
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 53a47f0c17..73909e772a 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -1337,6 +1337,7 @@ view_git_blame = View git blame
 video_not_supported_in_browser = Your browser does not support the HTML5 "video" tag.
 audio_not_supported_in_browser = Your browser does not support the HTML5 "audio" tag.
 stored_lfs = Stored with Git LFS
+stored_annex = Stored with Git Annex
 symbolic_link = Symbolic link
 executable_file = Executable file
 vendored = Vendored
@@ -1364,6 +1365,7 @@ editor.upload_file = Upload file
 editor.edit_file = Edit file
 editor.preview_changes = Preview changes
 editor.cannot_edit_lfs_files = LFS files cannot be edited in the web interface.
+editor.cannot_edit_annex_files = Annex files cannot be edited in the web interface.
 editor.cannot_edit_non_text_files = Binary files cannot be edited in the web interface.
 editor.edit_this_file = Edit file
 editor.this_file_locked = File is locked
diff --git a/options/locale/locale_es-ES.ini b/options/locale/locale_es-ES.ini
index cc24e95703..839d2d0676 100644
--- a/options/locale/locale_es-ES.ini
+++ b/options/locale/locale_es-ES.ini
@@ -1312,6 +1312,7 @@ view_git_blame=Ver Git blame
 video_not_supported_in_browser=Su navegador no soporta el tag "video" de HTML5.
 audio_not_supported_in_browser=Su navegador no soporta el tag "audio" de HTML5.
 stored_lfs=Almacenados con Git LFS
+stored_annex=Almacenados con Git Annex
 symbolic_link=Enlace simbólico
 executable_file=Archivo ejecutable
 commit_graph=Gráfico de commits
@@ -1335,6 +1336,7 @@ editor.upload_file=Subir archivo
 editor.edit_file=Editar archivo
 editor.preview_changes=Vista previa de los cambios
 editor.cannot_edit_lfs_files=Los archivos LFS no se pueden editar en la interfaz web.
+editor.cannot_edit_annex_files=Los archivos Annex no se pueden editar en la interfaz web.
 editor.cannot_edit_non_text_files=Los archivos binarios no se pueden editar en la interfaz web.
 editor.edit_this_file=Editar archivo
 editor.this_file_locked=El archivo está bloqueado
diff --git a/options/locale/locale_fa-IR.ini b/options/locale/locale_fa-IR.ini
index e2c9dc4bdd..01d931b1ac 100644
--- a/options/locale/locale_fa-IR.ini
+++ b/options/locale/locale_fa-IR.ini
@@ -951,6 +951,7 @@ file_copy_permalink=پرمالینک را کپی کنید
 video_not_supported_in_browser=مرورگر شما از تگ video که در HTML5 تعریف شده است، پشتیبانی نمی کند.
 audio_not_supported_in_browser=مرورگر شما از تگ audio که در HTML5 تعریف شده است، پشتیبانی نمی کند.
 stored_lfs=ذخیره شده با GIT LFS
+stored_annex=ذخیره شده با GIT Annex
 symbolic_link=پیوند نمادین
 commit_graph=نمودار کامیت
 commit_graph.select=انتخاب برنچها
@@ -968,6 +969,7 @@ editor.upload_file=بارگذاری پرونده
 editor.edit_file=ویرایش پرونده
 editor.preview_changes=پیش نمایش تغییرات
 editor.cannot_edit_lfs_files=پرونده های LFS در صحفه وب قابل تغییر نیست.
+editor.cannot_edit_annex_files=پرونده های Annex در صحفه وب قابل تغییر نیست.
 editor.cannot_edit_non_text_files=پرونده‎های دودویی در صفحه وب قابل تغییر نیست.
 editor.edit_this_file=ویرایش پرونده
 editor.this_file_locked=پرونده قفل شده است
diff --git a/options/locale/locale_fr-FR.ini b/options/locale/locale_fr-FR.ini
index 92da5ee8a2..aaaa2e7a9a 100644
--- a/options/locale/locale_fr-FR.ini
+++ b/options/locale/locale_fr-FR.ini
@@ -1318,6 +1318,7 @@ view_git_blame=Voir Git blame
 video_not_supported_in_browser=Votre navigateur ne supporte pas la balise « vidéo » HTML5.
 audio_not_supported_in_browser=Votre navigateur ne supporte pas la balise « audio » HTML5.
 stored_lfs=Stocké avec Git LFS
+stored_annex=Stocké avec Git Annex
 symbolic_link=Lien symbolique
 executable_file=Fichier exécutable
 vendored = Vendored
@@ -1343,6 +1344,7 @@ editor.upload_file=Téléverser un fichier
 editor.edit_file=Modifier le fichier
 editor.preview_changes=Aperçu des modifications
 editor.cannot_edit_lfs_files=Les fichiers LFS ne peuvent pas être modifiés dans l'interface web.
+editor.cannot_edit_annex_files=Les fichiers Annex ne peuvent pas être modifiés dans l'interface web.
 editor.cannot_edit_non_text_files=Les fichiers binaires ne peuvent pas être édités dans l'interface web.
 editor.edit_this_file=Modifier le fichier
 editor.this_file_locked=Le fichier est verrouillé
diff --git a/options/locale/locale_hu-HU.ini b/options/locale/locale_hu-HU.ini
index 57555b90a2..ef94d2de0c 100644
--- a/options/locale/locale_hu-HU.ini
+++ b/options/locale/locale_hu-HU.ini
@@ -787,6 +787,7 @@ file_too_large=Ez a fájl túl nagy ahhoz, hogy megjelenítsük.
 video_not_supported_in_browser=A böngésző nem támogatja a HTML5 video tag-et.
 audio_not_supported_in_browser=A böngésző nem támogatja a HTML5 audio tag-et.
 stored_lfs=Git LFS-el eltárolva
+stored_annex=Git Annex-el eltárolva
 symbolic_link=Szimbolikus hivatkozás
 commit_graph=Commit gráf
 commit_graph.hide_pr_refs=Pull request-ek elrejtése
@@ -799,6 +800,7 @@ editor.upload_file=Fájl feltöltése
 editor.edit_file=Fájl szerkesztése
 editor.preview_changes=Változások előnézete
 editor.cannot_edit_lfs_files=LFS fájlok nem szerkeszthetőek a webes felületen.
+editor.cannot_edit_annex_files=Annex fájlok nem szerkeszthetőek a webes felületen.
 editor.cannot_edit_non_text_files=Bináris fájlok nem szerkeszthetőek a webes felületen.
 editor.edit_this_file=Fájl szerkesztése
 editor.this_file_locked=Zárolt állomány
diff --git a/options/locale/locale_id-ID.ini b/options/locale/locale_id-ID.ini
index 1e0044e4ce..8cf3457aae 100644
--- a/options/locale/locale_id-ID.ini
+++ b/options/locale/locale_id-ID.ini
@@ -596,6 +596,7 @@ file_permalink=Permalink
 file_too_large=Berkas terlalu besar untuk ditampilkan.
 
 stored_lfs=Tersimpan dengan GIT LFS
+stored_annex=Tersimpan dengan GIT Annex
 commit_graph=Grafik Komit
 blame=Salahkan
 normal_view=Pandangan Normal
@@ -607,6 +608,7 @@ editor.upload_file=Unggah Berkas
 editor.edit_file=Sunting Berkas
 editor.preview_changes=Tinjau Perubahan
 editor.cannot_edit_lfs_files=Berkas LFS tidak dapat disunting dalam antarmuka web.
+editor.cannot_edit_annex_files=Berkas Annex tidak dapat disunting dalam antarmuka web.
 editor.cannot_edit_non_text_files=Berkas biner tidak dapat disunting dalam antarmuka web.
 editor.edit_this_file=Sunting Berkas
 editor.this_file_locked=Berkas terkunci
diff --git a/options/locale/locale_is-IS.ini b/options/locale/locale_is-IS.ini
index 3a6e844de2..b3cf17fccc 100644
--- a/options/locale/locale_is-IS.ini
+++ b/options/locale/locale_is-IS.ini
@@ -680,6 +680,7 @@ file_view_rendered=Skoða Unnið
 
 file_copy_permalink=Afrita Varanlega Slóð
 stored_lfs=Geymt með Git LFS
+stored_annex=Geymt með Git Annex
 commit_graph.hide_pr_refs=Fela Sameiningarbeiðnir
 commit_graph.monochrome=Einlitað
 commit_graph.color=Litað
diff --git a/options/locale/locale_it-IT.ini b/options/locale/locale_it-IT.ini
index 61753a718f..4bfc6762b8 100644
--- a/options/locale/locale_it-IT.ini
+++ b/options/locale/locale_it-IT.ini
@@ -1267,6 +1267,7 @@ view_git_blame=Visualizza git incolpa
 video_not_supported_in_browser=Il tuo browser non supporta le etichette "video" di HTML5.
 audio_not_supported_in_browser=Il tuo browser non supporta le etichette "audio" di HTML5.
 stored_lfs=Memorizzati con Git LFS
+stored_annex=Memorizzati con Git Annex
 symbolic_link=Link Simbolico
 commit_graph=Grafico dei commit
 commit_graph.select=Seleziona rami
@@ -1285,6 +1286,7 @@ editor.upload_file=Carica file
 editor.edit_file=Modifica file
 editor.preview_changes=Anteprima modifiche
 editor.cannot_edit_lfs_files=I file LFS non possono essere modificati nell'interfaccia web.
+editor.cannot_edit_annex_files=I file Annex non possono essere modificati nell'interfaccia web.
 editor.cannot_edit_non_text_files=I file binari non possono essere modificati tramite interfaccia web.
 editor.edit_this_file=Modifica file
 editor.this_file_locked=Il file è bloccato
diff --git a/options/locale/locale_ja-JP.ini b/options/locale/locale_ja-JP.ini
index 890c2e857c..2a4f075994 100644
--- a/options/locale/locale_ja-JP.ini
+++ b/options/locale/locale_ja-JP.ini
@@ -1305,6 +1305,7 @@ view_git_blame=Git Blameを表示
 video_not_supported_in_browser=このブラウザはHTML5のvideoタグをサポートしていません。
 audio_not_supported_in_browser=このブラウザーはHTML5のaudioタグをサポートしていません。
 stored_lfs=Git LFSで保管されています
+stored_annex=Git Annexで保管されています
 symbolic_link=シンボリック リンク
 executable_file=実行ファイル
 commit_graph=コミットグラフ
@@ -1328,6 +1329,7 @@ editor.upload_file=ファイルをアップロード
 editor.edit_file=ファイルを編集
 editor.preview_changes=変更をプレビュー
 editor.cannot_edit_lfs_files=LFSのファイルはWebインターフェースで編集できません。
+editor.cannot_edit_annex_files=AnnexのファイルはWebインターフェースで編集できません。
 editor.cannot_edit_non_text_files=バイナリファイルはWebインターフェースで編集できません。
 editor.edit_this_file=ファイルを編集
 editor.this_file_locked=ファイルはロックされています
diff --git a/options/locale/locale_ko-KR.ini b/options/locale/locale_ko-KR.ini
index 58e723db7a..0573982812 100644
--- a/options/locale/locale_ko-KR.ini
+++ b/options/locale/locale_ko-KR.ini
@@ -821,6 +821,7 @@ file_too_large=보여주기에는 파일이 너무 큽니다.
 video_not_supported_in_browser=당신의 브라우저가 HTML5의 "video" 태그를 지원하지 않습니다.
 audio_not_supported_in_browser=당신의 브라우저가 HTML5의 "audio" 태그를 지원하지 않습니다.
 stored_lfs=Git LFS에 저장되어 있습니다
+stored_annex=Git Annex에 저장되어 있습니다
 commit_graph=커밋 그래프
 
 editor.new_file=새 파일
diff --git a/options/locale/locale_lv-LV.ini b/options/locale/locale_lv-LV.ini
index bd77588b5b..30b53cb7e5 100644
--- a/options/locale/locale_lv-LV.ini
+++ b/options/locale/locale_lv-LV.ini
@@ -1316,6 +1316,7 @@ view_git_blame=Apskatīt Git izmaiņu veicējus
 video_not_supported_in_browser=Pārlūks neatbalsta HTML5 tagu "video".
 audio_not_supported_in_browser=Pārlūks neatbalsta HTML5 tagu "audio".
 stored_lfs=Saglabāts Git LFS
+stored_annex=Saglabāts Git Annex
 symbolic_link=Simboliska saite
 executable_file=Izpildāma datne
 commit_graph=Iesūtījumu karte
@@ -1339,6 +1340,7 @@ editor.upload_file=Augšupielādēt datni
 editor.edit_file=Labot datni
 editor.preview_changes=Priekšskatīt izmaiņas
 editor.cannot_edit_lfs_files=LFS datnes tīmekļa saskarnē nevar labot.
+editor.cannot_edit_annex_files=Annex datnes tīmekļa saskarnē nevar labot.
 editor.cannot_edit_non_text_files=Binārās datnes tīmekļa saskarnē nevar labot.
 editor.edit_this_file=Labot datni
 editor.this_file_locked=Datne ir slēgta
@@ -4027,4 +4029,4 @@ filepreview.lines = %[1]d. līdz %[2]d. rinda %[3]s
 filepreview.truncated = Priekšskatījums tika saīsināts
 
 [translation_meta]
-test = Šī ir pārbaudes virkne. Tā netiek attēlota Forgejo saskarnē, bet tiek izmantota pārbaudes nolūkiem. Droši var ievadīt "ok", lai ietaupītu laiku (vai kādu jautru faktu pēc izvēles), lai sasniegtu to saldo 100% pabeigšanas atzīmi.
\ No newline at end of file
+test = Šī ir pārbaudes virkne. Tā netiek attēlota Forgejo saskarnē, bet tiek izmantota pārbaudes nolūkiem. Droši var ievadīt "ok", lai ietaupītu laiku (vai kādu jautru faktu pēc izvēles), lai sasniegtu to saldo 100% pabeigšanas atzīmi.
diff --git a/options/locale/locale_nl-NL.ini b/options/locale/locale_nl-NL.ini
index 83acf180d6..de2c1bde3f 100644
--- a/options/locale/locale_nl-NL.ini
+++ b/options/locale/locale_nl-NL.ini
@@ -1285,6 +1285,7 @@ view_git_blame=Bekijk git blame
 video_not_supported_in_browser=Uw browser ondersteunt de HTML5 "video" element niet.
 audio_not_supported_in_browser=Uw browser ondersteunt de HTML5 "audio" element niet.
 stored_lfs=Opgeslagen met Git LFS
+stored_annex=Opgeslagen met Git Annex
 symbolic_link=Symbolische link
 commit_graph=Commit grafiek
 commit_graph.select=Selecteer branches
@@ -1303,6 +1304,7 @@ editor.upload_file=Upload bestand
 editor.edit_file=Bewerk bestand
 editor.preview_changes=Voorbeeld tonen
 editor.cannot_edit_lfs_files=LFS-bestanden kunnen niet worden bewerkt in de webinterface.
+editor.cannot_edit_annex_files=Annex-bestanden kunnen niet worden bewerkt in de webinterface.
 editor.cannot_edit_non_text_files=Binaire bestanden kunnen niet worden bewerkt in de webinterface.
 editor.edit_this_file=Bewerk bestand
 editor.this_file_locked=Bestand is vergrendeld
diff --git a/options/locale/locale_pl-PL.ini b/options/locale/locale_pl-PL.ini
index 11ea38ee2b..97678ea43a 100644
--- a/options/locale/locale_pl-PL.ini
+++ b/options/locale/locale_pl-PL.ini
@@ -1249,6 +1249,7 @@ file_copy_permalink=Kopiuj bezpośredni odnośnik
 video_not_supported_in_browser=Twoja przeglądarka nie obsługuje znacznika HTML5 "video".
 audio_not_supported_in_browser=Twoja przeglądarka nie obsługuje znacznika HTML5 "audio".
 stored_lfs=Przechowane za pomocą Git LFS
+stored_annex=Przechowane za pomocą Git Annex
 symbolic_link=Dowiązanie symboliczne
 commit_graph=Wykres commitów
 commit_graph.select=Wybierz gałęzie
@@ -1266,6 +1267,7 @@ editor.upload_file=Wyślij plik
 editor.edit_file=Edytuj plik
 editor.preview_changes=Podgląd zmian
 editor.cannot_edit_lfs_files=Pliki LFS nie mogą być edytowane poprzez interfejs przeglądarkowy.
+editor.cannot_edit_annex_files=Pliki Annex nie mogą być edytowane poprzez interfejs przeglądarkowy.
 editor.cannot_edit_non_text_files=Pliki binarne nie mogą być edytowane poprzez interfejs przeglądarkowy.
 editor.edit_this_file=Edytuj plik
 editor.this_file_locked=Plik jest zablokowany
diff --git a/options/locale/locale_pt-BR.ini b/options/locale/locale_pt-BR.ini
index 22802418d9..78a871f0d0 100644
--- a/options/locale/locale_pt-BR.ini
+++ b/options/locale/locale_pt-BR.ini
@@ -1310,6 +1310,7 @@ view_git_blame=Ver git blame
 video_not_supported_in_browser=Seu navegador não tem suporte para a tag "video" do HTML5.
 audio_not_supported_in_browser=Seu navegador não tem suporte para a tag "audio" do HTML5.
 stored_lfs=Armazenado com Git LFS
+stored_annex=Armazenado com Git Annex
 symbolic_link=Link simbólico
 executable_file=Arquivo executável
 commit_graph=Gráfico de commits
@@ -1333,6 +1334,7 @@ editor.upload_file=Enviar arquivo
 editor.edit_file=Editar arquivo
 editor.preview_changes=Pré-visualizar alterações
 editor.cannot_edit_lfs_files=Arquivos LFS não podem ser editados na interface web.
+editor.cannot_edit_annex_files=Arquivos Annex não podem ser editados na interface web.
 editor.cannot_edit_non_text_files=Arquivos binários não podem ser editados na interface web.
 editor.edit_this_file=Editar arquivo
 editor.this_file_locked=Arquivo está bloqueado
diff --git a/options/locale/locale_pt-PT.ini b/options/locale/locale_pt-PT.ini
index 8e30b897b0..994f9677da 100644
--- a/options/locale/locale_pt-PT.ini
+++ b/options/locale/locale_pt-PT.ini
@@ -1321,6 +1321,7 @@ view_git_blame=Ver git blame
 video_not_supported_in_browser=O seu navegador não suporta a etiqueta "video" do HTML5.
 audio_not_supported_in_browser=O seu navegador não suporta a etiqueta "audio" do HTML5.
 stored_lfs=Armazenado com Git LFS
+stored_annex=Armazenado com Git Annex
 symbolic_link=Ligação simbólica
 executable_file=Ficheiro executável
 vendored=Externo
@@ -1346,6 +1347,7 @@ editor.upload_file=Carregar ficheiro
 editor.edit_file=Editar ficheiro
 editor.preview_changes=Pré-visualizar modificações
 editor.cannot_edit_lfs_files=Ficheiros LFS não podem ser editados na interface web.
+editor.cannot_edit_annex_files=Ficheiros Annex não podem ser editados na interface web.
 editor.cannot_edit_non_text_files=Ficheiros binários não podem ser editados na interface da web.
 editor.edit_this_file=Editar ficheiro
 editor.this_file_locked=Ficheiro bloqueado
diff --git a/options/locale/locale_ru-RU.ini b/options/locale/locale_ru-RU.ini
index 83093fa573..d45a251b21 100644
--- a/options/locale/locale_ru-RU.ini
+++ b/options/locale/locale_ru-RU.ini
@@ -1304,6 +1304,7 @@ view_git_blame=Показать git blame
 video_not_supported_in_browser=Ваш браузер не поддерживает тэг HTML5 «video».
 audio_not_supported_in_browser=Ваш браузер не поддерживает тэг HTML5 «audio».
 stored_lfs=Хранится Git LFS
+stored_annex=Хранится Git Annex
 symbolic_link=Символическая ссылка
 executable_file=Исполняемый файл
 commit_graph=Граф коммитов
@@ -1327,6 +1328,7 @@ editor.upload_file=Загрузить файл
 editor.edit_file=Редактировать файл
 editor.preview_changes=Просмотр изменений
 editor.cannot_edit_lfs_files=LFS файлы невозможно редактировать в веб-интерфейсе.
+editor.cannot_edit_annex_files=Annex файлы невозможно редактировать в веб-интерфейсе.
 editor.cannot_edit_non_text_files=Двоичные файлы нельзя редактировать в веб-интерфейсе.
 editor.edit_this_file=Редактировать файл
 editor.this_file_locked=Файл заблокирован
diff --git a/options/locale/locale_si-LK.ini b/options/locale/locale_si-LK.ini
index e52e5bcaf9..e26bf30ae1 100644
--- a/options/locale/locale_si-LK.ini
+++ b/options/locale/locale_si-LK.ini
@@ -889,6 +889,7 @@ file_copy_permalink=පිටපත් මාමලින්ක්
 video_not_supported_in_browser=ඔබගේ බ්රව්සරය HTML5 'වීඩියෝ' ටැගය සඳහා සහය නොදක්වයි.
 audio_not_supported_in_browser=ඔබගේ බ්රව්සරය HTML5 'ශ්රව්ය' ටැගය සඳහා සහය නොදක්වයි.
 stored_lfs=Git LFS සමඟ ගබඩා
+stored_annex=Git Annex සමඟ ගබඩා
 symbolic_link=සංකේතාත්මක සබැඳිය
 commit_graph=ප්රස්තාරය කැප
 commit_graph.select=ශාඛා තෝරන්න
@@ -906,6 +907,7 @@ editor.upload_file=ගොනුව උඩුගත කරන්න
 editor.edit_file=ගොනුව සංස්කරණය
 editor.preview_changes=වෙනස්කම් පෙරදසුන
 editor.cannot_edit_lfs_files=LFS ගොනු වෙබ් අතුරු මුහුණත තුළ සංස්කරණය කළ නොහැක.
+editor.cannot_edit_annex_files=Annex ගොනු වෙබ් අතුරු මුහුණත තුළ සංස්කරණය කළ නොහැක.
 editor.cannot_edit_non_text_files=ද්විමය ගොනු වෙබ් අතුරු මුහුණත තුළ සංස්කරණය කළ නොහැක.
 editor.edit_this_file=ගොනුව සංස්කරණය
 editor.this_file_locked=ගොනුවට අගුළු ලා ඇත
diff --git a/options/locale/locale_sk-SK.ini b/options/locale/locale_sk-SK.ini
index 3e5b4a63f6..f714bdf0dc 100644
--- a/options/locale/locale_sk-SK.ini
+++ b/options/locale/locale_sk-SK.ini
@@ -1010,6 +1010,7 @@ view_git_blame=Zobraziť Git Blame
 video_not_supported_in_browser=Váš prehliadač nepodporuje HTML5 tag 'video'.
 audio_not_supported_in_browser=Váš prehliadač nepodporuje HTML5 tag 'audio'.
 stored_lfs=Uložené pomocou Git LFS
+stored_annex=Uložené pomocou Git Annex
 symbolic_link=Symbolický odkaz
 commit_graph=Graf commitov
 line=riadok
diff --git a/options/locale/locale_sv-SE.ini b/options/locale/locale_sv-SE.ini
index 4d94211540..3e8924f48a 100644
--- a/options/locale/locale_sv-SE.ini
+++ b/options/locale/locale_sv-SE.ini
@@ -910,6 +910,7 @@ file_too_large=Filen är för stor för att visas.
 video_not_supported_in_browser=Din webbläsare stödjer ej HTML5-taggen "video".
 audio_not_supported_in_browser=Din webbläsare stödjer ej HTML5-taggen "audio".
 stored_lfs=Sparad med Git LFS
+stored_annex=Sparad med Git Annex
 symbolic_link=Symbolisk länk
 commit_graph=Commitgraf
 commit_graph.monochrome=Mono
@@ -923,6 +924,7 @@ editor.upload_file=Ladda upp fil
 editor.edit_file=Redigera fil
 editor.preview_changes=Förhandsgranska ändringar
 editor.cannot_edit_lfs_files=LFS-filer kan inte redigeras i webbgränssnittet.
+editor.cannot_edit_annex_files=Annex-filer kan inte redigeras i webbgränssnittet.
 editor.cannot_edit_non_text_files=Binära filer kan inte redigeras genom webbgränssnittet.
 editor.edit_this_file=Redigera fil
 editor.this_file_locked=Filen är låst
diff --git a/options/locale/locale_tr-TR.ini b/options/locale/locale_tr-TR.ini
index 49b52c3ea0..58384d93f4 100644
--- a/options/locale/locale_tr-TR.ini
+++ b/options/locale/locale_tr-TR.ini
@@ -1290,6 +1290,7 @@ view_git_blame=Git Suç Görüntüle
 video_not_supported_in_browser=Tarayıcınız HTML5 'video' etiketini desteklemiyor.
 audio_not_supported_in_browser=Tarayıcınız HTML5 'audio' etiketini desteklemiyor.
 stored_lfs=Git LFS ile depolandı
+stored_annex=Git Annex ile depolandı
 symbolic_link=Sembolik Bağlantı
 executable_file=Çalıştırılabilir Dosya
 commit_graph=İşleme Grafiği
@@ -1313,6 +1314,7 @@ editor.upload_file=Dosya Yükle
 editor.edit_file=Dosyayı Düzenle
 editor.preview_changes=Değişiklikleri Önizle
 editor.cannot_edit_lfs_files=LFS dosyaları web arayüzünde düzenlenemez.
+editor.cannot_edit_annex_files=Annex dosyaları web arayüzünde düzenlenemez.
 editor.cannot_edit_non_text_files=Bu tür dosyalar web arayüzünden düzenlenemez.
 editor.edit_this_file=Dosyayı Düzenle
 editor.this_file_locked=Dosya kilitlendi
diff --git a/options/locale/locale_uk-UA.ini b/options/locale/locale_uk-UA.ini
index 52303c2d6b..c306e7db98 100644
--- a/options/locale/locale_uk-UA.ini
+++ b/options/locale/locale_uk-UA.ini
@@ -1243,6 +1243,7 @@ file_copy_permalink=Копіювати постійне посилання
 video_not_supported_in_browser=Ваш браузер не підтримує тег HTML5 «video».
 audio_not_supported_in_browser=Ваш браузер не підтримує тег HTML5 «audio».
 stored_lfs=Збережено з Git LFS
+stored_annex=Збережено з Git Annex
 symbolic_link=Символічне посилання
 commit_graph=Графік комітів
 commit_graph.select=Виберіть гілки
@@ -1260,6 +1261,7 @@ editor.upload_file=Завантажити файл
 editor.edit_file=Редагувати файл
 editor.preview_changes=Попередній перегляд змін
 editor.cannot_edit_lfs_files=Файли LFS не можна редагувати в веб-інтерфейсі.
+editor.cannot_edit_annex_files=Файли Annex не можна редагувати в веб-інтерфейсі.
 editor.cannot_edit_non_text_files=Бінарні файли не можливо редагувати у веб-інтерфейсі.
 editor.edit_this_file=Редагувати файл
 editor.this_file_locked=Файл заблоковано
diff --git a/options/locale/locale_zh-CN.ini b/options/locale/locale_zh-CN.ini
index e809795fd9..1c152e72a6 100644
--- a/options/locale/locale_zh-CN.ini
+++ b/options/locale/locale_zh-CN.ini
@@ -1319,6 +1319,7 @@ view_git_blame=查看 Git Blame
 video_not_supported_in_browser=您的浏览器不支持 HTML5 “video” 标签。
 audio_not_supported_in_browser=您的浏览器不支持 HTML5 “audio” 标签。
 stored_lfs=存储到Git LFS
+stored_annex=存储到Git Annex
 symbolic_link=符号链接
 executable_file=可执行文件
 vendored = Vendored
@@ -1344,6 +1345,7 @@ editor.upload_file=上传文件
 editor.edit_file=编辑文件
 editor.preview_changes=预览变更
 editor.cannot_edit_lfs_files=无法在 web 界面中编辑 lfs 文件。
+editor.cannot_edit_annex_files=无法在 web 界面中编辑 lfs 文件。
 editor.cannot_edit_non_text_files=网页不能编辑二进制文件。
 editor.edit_this_file=编辑文件
 editor.this_file_locked=文件已锁定
diff --git a/options/locale/locale_zh-HK.ini b/options/locale/locale_zh-HK.ini
index e5080e65bb..25dfcdf913 100644
--- a/options/locale/locale_zh-HK.ini
+++ b/options/locale/locale_zh-HK.ini
@@ -472,6 +472,7 @@ file_view_raw=查看原始文件
 file_permalink=永久連結
 
 stored_lfs=儲存到到 Git LFS
+stored_annex=儲存到到 Git Annex
 
 editor.preview_changes=預覽更改
 editor.or=或
@@ -1132,4 +1133,4 @@ runners.labels = 標籤
 
 [projects]
 
-[git.filemode]
\ No newline at end of file
+[git.filemode]
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index 720267f7d2..6506b6726a 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -1293,6 +1293,7 @@ view_git_blame=檢視 Git Blame
 video_not_supported_in_browser=您的瀏覽器不支援 HTML5 的「video」標籤。
 audio_not_supported_in_browser=您的瀏覽器不支援 HTML5 的「audio」標籤。
 stored_lfs=已使用 Git LFS 儲存
+stored_annex=已使用 Git Annex 儲存
 symbolic_link=符號連結
 commit_graph=提交線圖
 commit_graph.select=選擇分支
@@ -1312,6 +1313,7 @@ editor.upload_file=上傳檔案
 editor.edit_file=編輯檔案
 editor.preview_changes=預覽變更
 editor.cannot_edit_lfs_files=無法在 web 介面中編輯 LFS 檔。
+editor.cannot_edit_annex_files=無法在 web 介面中編輯 Annex 檔。
 editor.cannot_edit_non_text_files=網站介面不能編輯二進位檔案。
 editor.edit_this_file=編輯檔案
 editor.this_file_locked=檔案已被鎖定
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index fd8c1da058..59efa4334f 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -34,6 +34,7 @@ import (
 	unit_model "code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/actions"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/charset"
 	"code.gitea.io/gitea/modules/git"
@@ -209,14 +210,47 @@ func localizedExtensions(ext, languageCode string) (localizedExts []string) {
 }
 
 type fileInfo struct {
-	isTextFile bool
-	isLFSFile  bool
-	fileSize   int64
-	lfsMeta    *lfs.Pointer
-	st         typesniffer.SniffedType
+	isTextFile  bool
+	isLFSFile   bool
+	isAnnexFile bool
+	fileSize    int64
+	lfsMeta     *lfs.Pointer
+	st          typesniffer.SniffedType
 }
 
 func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte, io.ReadCloser, *fileInfo, error) {
+	isAnnexed, err := annex.IsAnnexed(blob)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	if isAnnexed {
+		// TODO: this code could be merged with the LFS case, especially the redundant type sniffer,
+		//       but it is *currently* written this way to make merging with the non-annex upstream easier:
+		//       this way, the git-annex patch is (mostly) pure additions.
+
+		annexContent, err := annex.Content(blob)
+		if err != nil {
+			// in the case where annex content is missing, what should happen?
+			// do we render the page with an error message?
+			// actually that's not a bad idea, there's some sort of error message situation
+			// TODO: display an error to the user explaining that their data is missing
+			return nil, nil, nil, err
+		}
+
+		stat, err := annexContent.Stat()
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		buf := make([]byte, 1024)
+		n, _ := util.ReadAtMost(annexContent, buf)
+		buf = buf[:n]
+
+		st := typesniffer.DetectContentType(buf)
+
+		return buf, annexContent, &fileInfo{st.IsText(), false, true, stat.Size(), nil, st}, nil
+	}
+
 	dataRc, err := blob.DataAsync()
 	if err != nil {
 		return nil, nil, nil, err
@@ -231,18 +265,18 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	// FIXME: what happens when README file is an image?
 	if !isTextFile || !setting.LFS.StartServer {
-		return buf, dataRc, &fileInfo{isTextFile, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
 	}
 
 	pointer, _ := lfs.ReadPointerFromBuffer(buf)
 	if !pointer.IsValid() { // fallback to plain file
-		return buf, dataRc, &fileInfo{isTextFile, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
 	}
 
 	meta, err := git_model.GetLFSMetaObjectByOid(ctx, repoID, pointer.Oid)
 	if err != nil { // fallback to plain file
 		log.Warn("Unable to access LFS pointer %s in repo %d: %v", pointer.Oid, repoID, err)
-		return buf, dataRc, &fileInfo{isTextFile, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
 	}
 
 	dataRc.Close()
@@ -262,7 +296,7 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	st = typesniffer.DetectContentType(buf)
 
-	return buf, dataRc, &fileInfo{st.IsText(), true, meta.Size, &meta.Pointer, st}, nil
+	return buf, dataRc, &fileInfo{st.IsText(), true, false, meta.Size, &meta.Pointer, st}, nil
 }
 
 func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.TreeEntry) {
@@ -447,10 +481,17 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 	isDisplayingSource := ctx.FormString("display") == "source"
 	isDisplayingRendered := !isDisplayingSource
 
-	if fInfo.isLFSFile {
+	if fInfo.isLFSFile || fInfo.isAnnexFile {
 		ctx.Data["RawFileLink"] = ctx.Repo.RepoLink + "/media/" + ctx.Repo.BranchNameSubURL() + "/" + util.PathEscapeSegments(ctx.Repo.TreePath)
 	}
 
+	if fInfo.isAnnexFile {
+		// pre-git-annex v7, all annexed files were represented in-repo as symlinks;
+		// but we pretend they aren't, since that's a distracting quirk of git-annex
+		// and not a meaningful choice on the user's part
+		ctx.Data["FileIsSymlink"] = false
+	}
+
 	isRepresentableAsText := fInfo.st.IsRepresentableAsText()
 	if !isRepresentableAsText {
 		// If we can't show plain text, always try to render.
@@ -458,6 +499,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 		isDisplayingRendered = true
 	}
 	ctx.Data["IsLFSFile"] = fInfo.isLFSFile
+	ctx.Data["IsAnnexFile"] = fInfo.isAnnexFile
 	ctx.Data["FileSize"] = fInfo.fileSize
 	ctx.Data["IsTextFile"] = fInfo.isTextFile
 	ctx.Data["IsRepresentableAsText"] = isRepresentableAsText
@@ -492,6 +534,8 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 	// Assume file is not editable first.
 	if fInfo.isLFSFile {
 		ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.cannot_edit_lfs_files")
+	} else if fInfo.isAnnexFile {
+		ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.cannot_edit_annex_files")
 	} else if !isRepresentableAsText {
 		ctx.Data["EditFileTooltip"] = ctx.Tr("repo.editor.cannot_edit_non_text_files")
 	}
@@ -599,7 +643,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 			ctx.Data["FileContent"] = fileContent
 			ctx.Data["LineEscapeStatus"] = statuses
 		}
-		if !fInfo.isLFSFile {
+		if !fInfo.isLFSFile && !fInfo.isAnnexFile {
 			if ctx.Repo.CanEnableEditor(ctx, ctx.Doer) {
 				if lfsLock != nil && lfsLock.OwnerID != ctx.Doer.ID {
 					ctx.Data["CanEditFile"] = false
diff --git a/templates/repo/file_info.tmpl b/templates/repo/file_info.tmpl
index 6ae7c15a26..05d9825cfb 100644
--- a/templates/repo/file_info.tmpl
+++ b/templates/repo/file_info.tmpl
@@ -17,6 +17,7 @@
 	{{if .FileSize}}
 		<div class="file-info-entry">
 			{{ctx.Locale.TrSize .FileSize}}{{if .IsLFSFile}} ({{ctx.Locale.Tr "repo.stored_lfs"}}){{end}}
+			{{if .IsAnnexFile}} ({{ctx.Locale.Tr "repo.stored_annex"}}){{end}}
 		</div>
 	{{end}}
 	{{if .LFSLock}}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index b3dc2b974d..bc52d2ae1d 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -118,6 +118,111 @@ func doAnnexMediaTest(t *testing.T, ctx APITestContext, file string) {
 	require.True(t, match, "Annexed files should be the same")
 }
 
+func TestGitAnnexViews(t *testing.T) {
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		ctx := NewAPITestContext(t, "user2", "annex-template-render-test", auth_model.AccessTokenScopeWriteRepository)
+
+		// create a public repo
+		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+
+		session := loginUser(t, ctx.Username)
+
+		t.Run("Index", func(t *testing.T) {
+			// test that annex symlinks renders with the _file icon_ on the main list
+			defer tests.PrintCurrentTest(t)()
+
+			repoLink := path.Join("/", ctx.Username, ctx.Reponame)
+			req := NewRequest(t, "GET", repoLink)
+			resp := session.MakeRequest(t, req, http.StatusOK)
+
+			htmlDoc := NewHTMLParser(t, resp.Body)
+			isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
+			require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
+		})
+
+		t.Run("View", func(t *testing.T) {
+			// test how routers/web/repo/view.go + templates/repo/view_file.tmpl handle annexed files
+			defer tests.PrintCurrentTest(t)()
+
+			doViewTest := func(file string) (htmlDoc *HTMLDoc, viewLink, mediaLink string) {
+				viewLink = path.Join("/", ctx.Username, ctx.Reponame, "/src/branch/master", file)
+				// rawLink := strings.Replace(viewLink, "/src/", "/raw/", 1) // TODO: do something with this?
+				mediaLink = strings.Replace(viewLink, "/src/", "/media/", 1)
+
+				req := NewRequest(t, "GET", viewLink)
+				resp := session.MakeRequest(t, req, http.StatusOK)
+
+				htmlDoc = NewHTMLParser(t, resp.Body)
+				// the first button on the toolbar on the view template is the "Raw" button
+				// this CSS selector is the most precise I can think to use
+				buttonLink, exists := htmlDoc.Find(".file-header").Find("a[download]").Attr("href")
+				require.True(t, exists, "Download button should exist on the file header")
+				require.EqualValues(t, mediaLink, buttonLink, "Download link should use /media URL for annex files")
+
+				return htmlDoc, viewLink, mediaLink
+			}
+
+			t.Run("Binary", func(t *testing.T) {
+				// test that annexing a file renders the /media link in /src and NOT the /raw link
+				defer tests.PrintCurrentTest(t)()
+
+				doBinaryViewTest := func(file string) {
+					htmlDoc, _, mediaLink := doViewTest(file)
+
+					rawLink, exists := htmlDoc.Find("div.file-view > div.view-raw > a").Attr("href")
+					require.True(t, exists, "Download link should render instead of content because this is a binary file")
+					require.EqualValues(t, mediaLink, rawLink)
+				}
+
+				t.Run("AnnexSymlink", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doBinaryViewTest("annexed.tiff")
+				})
+				t.Run("AnnexPointer", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doBinaryViewTest("annexed.bin")
+				})
+			})
+
+			t.Run("Text", func(t *testing.T) {
+				defer tests.PrintCurrentTest(t)()
+
+				doTextViewTest := func(file string) {
+					htmlDoc, _, _ := doViewTest(file)
+					require.True(t, htmlDoc.Find("div.file-view").Is(".code-view"), "should render as code")
+				}
+
+				t.Run("AnnexSymlink", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doTextViewTest("annexed.txt")
+
+					t.Run("Markdown", func(t *testing.T) {
+						// special case: check that markdown can be pulled out of the annex and rendered, too
+						defer tests.PrintCurrentTest(t)()
+						htmlDoc, _, _ := doViewTest("annexed.md")
+						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+					})
+				})
+				t.Run("AnnexPointer", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+					doTextViewTest("annexed.rst")
+
+					t.Run("Markdown", func(t *testing.T) {
+						// special case: check that markdown can be pulled out of the annex and rendered, too
+						defer tests.PrintCurrentTest(t)()
+						htmlDoc, _, _ := doViewTest("annexed.markdown")
+						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+					})
+				})
+			})
+		})
+	})
+}
+
 /*
 Test that permissions are enforced on git-annex-shell commands.
 
@@ -1029,6 +1134,14 @@ func doInitAnnexRepository(repoPath string) error {
 	if err != nil {
 		return err
 	}
+	_, err = f.WriteString("*.rst  filter=annex\n")
+	if err != nil {
+		return err
+	}
+	_, err = f.WriteString("*.markdown  filter=annex\n")
+	if err != nil {
+		return err
+	}
 	f.Close()
 
 	err = git.AddChanges(repoPath, false, ".")
@@ -1053,6 +1166,18 @@ func doInitAnnexRepository(repoPath string) error {
 		return err
 	}
 
+	// // a text file
+	err = os.WriteFile(path.Join(repoPath, "annexed.md"), []byte("Overview\n=====\n\n1. Profit\n2. ???\n3. Review Life Activations\n"), 0o777)
+	if err != nil {
+		return err
+	}
+
+	// // a markdown file
+	err = os.WriteFile(path.Join(repoPath, "annexed.txt"), []byte("We're going to see the wizard\nThe wonderful\nMonkey of\nBoz\n"), 0o777)
+	if err != nil {
+		return err
+	}
+
 	err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "add", ".").Run(&git.RunOpts{Dir: repoPath})
 	if err != nil {
 		return err
@@ -1065,6 +1190,14 @@ func doInitAnnexRepository(repoPath string) error {
 		return err
 	}
 
+	// // a text file
+	err = os.WriteFile(path.Join(repoPath, "annexed.rst"), []byte("Title\n=====\n\n- this is to test annexing a text file\n- lists are fun\n"), 0o777)
+	if err != nil {
+		return err
+	}
+
+	// // a markdown file
+	err = os.WriteFile(path.Join(repoPath, "annexed.markdown"), []byte("Overview\n=====\n\n1. Profit\n2. ???\n3. Review Life Activations\n"), 0o777)
 	if err != nil {
 		return err
 	}

From 5ff795156035b82382df8987a5cd8b81e8c97173 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 24 May 2024 13:21:42 +0200
Subject: [PATCH 104/125] Adapt patch to upstream changes

Test with different objectFormats.
---
 tests/integration/git_annex_test.go | 148 ++++++++++++++--------------
 1 file changed, 75 insertions(+), 73 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index bc52d2ae1d..4d4a0da88e 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -124,98 +124,100 @@ func TestGitAnnexViews(t *testing.T) {
 	}
 
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		ctx := NewAPITestContext(t, "user2", "annex-template-render-test", auth_model.AccessTokenScopeWriteRepository)
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			ctx := NewAPITestContext(t, "user2", "annex-template-render-test"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
 
-		// create a public repo
-		require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false))
+			// create a public repo
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false, objectFormat))
 
-		session := loginUser(t, ctx.Username)
+			session := loginUser(t, ctx.Username)
 
-		t.Run("Index", func(t *testing.T) {
-			// test that annex symlinks renders with the _file icon_ on the main list
-			defer tests.PrintCurrentTest(t)()
+			t.Run("Index", func(t *testing.T) {
+				// test that annex symlinks renders with the _file icon_ on the main list
+				defer tests.PrintCurrentTest(t)()
 
-			repoLink := path.Join("/", ctx.Username, ctx.Reponame)
-			req := NewRequest(t, "GET", repoLink)
-			resp := session.MakeRequest(t, req, http.StatusOK)
-
-			htmlDoc := NewHTMLParser(t, resp.Body)
-			isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
-			require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
-		})
-
-		t.Run("View", func(t *testing.T) {
-			// test how routers/web/repo/view.go + templates/repo/view_file.tmpl handle annexed files
-			defer tests.PrintCurrentTest(t)()
-
-			doViewTest := func(file string) (htmlDoc *HTMLDoc, viewLink, mediaLink string) {
-				viewLink = path.Join("/", ctx.Username, ctx.Reponame, "/src/branch/master", file)
-				// rawLink := strings.Replace(viewLink, "/src/", "/raw/", 1) // TODO: do something with this?
-				mediaLink = strings.Replace(viewLink, "/src/", "/media/", 1)
-
-				req := NewRequest(t, "GET", viewLink)
+				repoLink := path.Join("/", ctx.Username, ctx.Reponame)
+				req := NewRequest(t, "GET", repoLink)
 				resp := session.MakeRequest(t, req, http.StatusOK)
 
-				htmlDoc = NewHTMLParser(t, resp.Body)
-				// the first button on the toolbar on the view template is the "Raw" button
-				// this CSS selector is the most precise I can think to use
-				buttonLink, exists := htmlDoc.Find(".file-header").Find("a[download]").Attr("href")
-				require.True(t, exists, "Download button should exist on the file header")
-				require.EqualValues(t, mediaLink, buttonLink, "Download link should use /media URL for annex files")
-
-				return htmlDoc, viewLink, mediaLink
-			}
-
-			t.Run("Binary", func(t *testing.T) {
-				// test that annexing a file renders the /media link in /src and NOT the /raw link
-				defer tests.PrintCurrentTest(t)()
-
-				doBinaryViewTest := func(file string) {
-					htmlDoc, _, mediaLink := doViewTest(file)
-
-					rawLink, exists := htmlDoc.Find("div.file-view > div.view-raw > a").Attr("href")
-					require.True(t, exists, "Download link should render instead of content because this is a binary file")
-					require.EqualValues(t, mediaLink, rawLink)
-				}
-
-				t.Run("AnnexSymlink", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-					doBinaryViewTest("annexed.tiff")
-				})
-				t.Run("AnnexPointer", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-					doBinaryViewTest("annexed.bin")
-				})
+				htmlDoc := NewHTMLParser(t, resp.Body)
+				isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
+				require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
 			})
 
-			t.Run("Text", func(t *testing.T) {
+			t.Run("View", func(t *testing.T) {
+				// test how routers/web/repo/view.go + templates/repo/view_file.tmpl handle annexed files
 				defer tests.PrintCurrentTest(t)()
 
-				doTextViewTest := func(file string) {
-					htmlDoc, _, _ := doViewTest(file)
-					require.True(t, htmlDoc.Find("div.file-view").Is(".code-view"), "should render as code")
+				doViewTest := func(file string) (htmlDoc *HTMLDoc, viewLink, mediaLink string) {
+					viewLink = path.Join("/", ctx.Username, ctx.Reponame, "/src/branch/master", file)
+					// rawLink := strings.Replace(viewLink, "/src/", "/raw/", 1) // TODO: do something with this?
+					mediaLink = strings.Replace(viewLink, "/src/", "/media/", 1)
+
+					req := NewRequest(t, "GET", viewLink)
+					resp := session.MakeRequest(t, req, http.StatusOK)
+
+					htmlDoc = NewHTMLParser(t, resp.Body)
+					// the first button on the toolbar on the view template is the "Raw" button
+					// this CSS selector is the most precise I can think to use
+					buttonLink, exists := htmlDoc.Find(".file-header").Find("a[download]").Attr("href")
+					require.True(t, exists, "Download button should exist on the file header")
+					require.EqualValues(t, mediaLink, buttonLink, "Download link should use /media URL for annex files")
+
+					return htmlDoc, viewLink, mediaLink
 				}
 
-				t.Run("AnnexSymlink", func(t *testing.T) {
+				t.Run("Binary", func(t *testing.T) {
+					// test that annexing a file renders the /media link in /src and NOT the /raw link
 					defer tests.PrintCurrentTest(t)()
-					doTextViewTest("annexed.txt")
 
-					t.Run("Markdown", func(t *testing.T) {
-						// special case: check that markdown can be pulled out of the annex and rendered, too
+					doBinaryViewTest := func(file string) {
+						htmlDoc, _, mediaLink := doViewTest(file)
+
+						rawLink, exists := htmlDoc.Find("div.file-view > div.view-raw > a").Attr("href")
+						require.True(t, exists, "Download link should render instead of content because this is a binary file")
+						require.EqualValues(t, mediaLink, rawLink)
+					}
+
+					t.Run("AnnexSymlink", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
-						htmlDoc, _, _ := doViewTest("annexed.md")
-						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						doBinaryViewTest("annexed.tiff")
+					})
+					t.Run("AnnexPointer", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+						doBinaryViewTest("annexed.bin")
 					})
 				})
-				t.Run("AnnexPointer", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-					doTextViewTest("annexed.rst")
 
-					t.Run("Markdown", func(t *testing.T) {
-						// special case: check that markdown can be pulled out of the annex and rendered, too
+				t.Run("Text", func(t *testing.T) {
+					defer tests.PrintCurrentTest(t)()
+
+					doTextViewTest := func(file string) {
+						htmlDoc, _, _ := doViewTest(file)
+						require.True(t, htmlDoc.Find("div.file-view").Is(".code-view"), "should render as code")
+					}
+
+					t.Run("AnnexSymlink", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
-						htmlDoc, _, _ := doViewTest("annexed.markdown")
-						require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						doTextViewTest("annexed.txt")
+
+						t.Run("Markdown", func(t *testing.T) {
+							// special case: check that markdown can be pulled out of the annex and rendered, too
+							defer tests.PrintCurrentTest(t)()
+							htmlDoc, _, _ := doViewTest("annexed.md")
+							require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						})
+					})
+					t.Run("AnnexPointer", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+						doTextViewTest("annexed.rst")
+
+						t.Run("Markdown", func(t *testing.T) {
+							// special case: check that markdown can be pulled out of the annex and rendered, too
+							defer tests.PrintCurrentTest(t)()
+							htmlDoc, _, _ := doViewTest("annexed.markdown")
+							require.True(t, htmlDoc.Find("div.file-view").Is(".markdown"), "should render as markdown")
+						})
 					})
 				})
 			})

From e97e20427d635e89228b662eb54e9aa89f9a13c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 15 May 2024 10:55:12 +0200
Subject: [PATCH 105/125] Add git-annex to docker image

---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index af9269a6ce..1f33f5d57f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -78,6 +78,7 @@ RUN apk --no-cache add \
     sqlite \
     su-exec \
     gnupg \
+    git-annex \
     && rm -rf /var/cache/apk/*
 
 RUN addgroup \

From 246131cc6922a64d8b536c1900603b38ea60d0d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 18 Jul 2024 16:43:42 +0000
Subject: [PATCH 106/125] Error if git-annex is enabled but missing (#16)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Copied from https://github.com/neuropoly/gitea/pull/47

This adds a check so that if `setting.Annex.Enabled` is true and git-annex is not in the PATH Forgejo will abort on startup with a reasonable error message.

Fixes #15.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/16
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 cmd/web.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/cmd/web.go b/cmd/web.go
index a817204aa6..661e6d158e 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -9,6 +9,7 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -247,6 +248,12 @@ func runWeb(ctx *cli.Context) error {
 		createPIDFile(ctx.String("pid"))
 	}
 
+	if setting.Annex.Enabled {
+		if _, err := exec.LookPath("git-annex"); err != nil {
+			log.Fatal("You have enabled git-annex support but git-annex is not installed. Please make sure that Forgejo's PATH contains the git-annex executable.")
+		}
+	}
+
 	if !setting.InstallLock {
 		if err := serveInstall(ctx); err != nil {
 			return err

From e83f575da5cb9fbf98309cea6cdc809e1cc261bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 18 Jul 2024 18:18:06 +0000
Subject: [PATCH 107/125] Git-annex web uploads (#21)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements support for uploading files into the annex using the web
interface.

If a repository is a git-annex-enabled repository all files will be
added to it using git annex add. This means that the repository's
configuration for what to put into the annex (annex.largefiles in
gitattributes) will be respected.

Plain git repositories without git-annex will work as before, directly
uploading to git.

Fixes #5.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/21
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go                 |  6 ++
 modules/util/remove.go                 | 11 ++--
 services/repository/files/temp_repo.go | 20 +++++++
 services/repository/files/upload.go    | 83 +++++++++++++++++++++++++-
 tests/integration/git_annex_test.go    | 81 +++++++++++++++++++++++++
 5 files changed, 194 insertions(+), 7 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index bb049d77ed..bab5a7e0b2 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -152,3 +152,9 @@ func IsAnnexed(blob *git.Blob) (bool, error) {
 	}
 	return true, nil
 }
+
+// IsAnnexRepo determines if repo is a git-annex enabled repository
+func IsAnnexRepo(repo *git.Repository) bool {
+	_, _, err := git.NewCommand(repo.Ctx, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: repo.Path})
+	return err == nil
+}
diff --git a/modules/util/remove.go b/modules/util/remove.go
index f2a61ae467..39556e5e0b 100644
--- a/modules/util/remove.go
+++ b/modules/util/remove.go
@@ -53,10 +53,13 @@ func MakeWritable(name string) error {
 				return err
 			}
 
-			// 0200 == u+w, in octal unix permission notation
-			err = os.Chmod(path, info.Mode()|0o200)
-			if err != nil {
-				return err
+			// Don't try chmod'ing symlinks (will fail with broken symlinks)
+			if info.Mode()&os.ModeSymlink != os.ModeSymlink {
+				// 0200 == u+w, in octal unix permission notation
+				err = os.Chmod(path, info.Mode()|0o200)
+				if err != nil {
+					return err
+				}
 			}
 		}
 		return nil
diff --git a/services/repository/files/temp_repo.go b/services/repository/files/temp_repo.go
index 6e7570b82c..566ae5ff8f 100644
--- a/services/repository/files/temp_repo.go
+++ b/services/repository/files/temp_repo.go
@@ -202,6 +202,26 @@ func (t *TemporaryUploadRepository) AddObjectToIndex(mode, objectHash, objectPat
 	return nil
 }
 
+// InitPrivateAnnex initializes a private annex in the repository
+func (t *TemporaryUploadRepository) InitPrivateAnnex() error {
+	if _, _, err := git.NewCommand(t.ctx, "config", "annex.private", "true").RunStdString(&git.RunOpts{Dir: t.basePath}); err != nil {
+		return err
+	}
+	if _, _, err := git.NewCommand(t.ctx, "annex", "init").RunStdString(&git.RunOpts{Dir: t.basePath}); err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddAnnex adds the file at path to the repository using git annex add
+// This requires a non-bare repository
+func (t *TemporaryUploadRepository) AddAnnex(path string) error {
+	if _, _, err := git.NewCommand(t.ctx, "annex", "add").AddDynamicArguments(path).RunStdString(&git.RunOpts{Dir: t.basePath}); err != nil {
+		return err
+	}
+	return nil
+}
+
 // WriteTree writes the current index as a tree to the object db and returns its hash
 func (t *TemporaryUploadRepository) WriteTree() (string, error) {
 	stdout, _, err := git.NewCommand(t.ctx, "write-tree").RunStdString(&git.RunOpts{Dir: t.basePath})
diff --git a/services/repository/files/upload.go b/services/repository/files/upload.go
index 1330116889..21cd5a8344 100644
--- a/services/repository/files/upload.go
+++ b/services/repository/files/upload.go
@@ -6,13 +6,16 @@ package files
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"path"
+	"path/filepath"
 	"strings"
 
 	git_model "code.gitea.io/gitea/models/git"
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/setting"
@@ -89,7 +92,7 @@ func UploadRepoFiles(ctx context.Context, repo *repo_model.Repository, doer *use
 	defer t.Close()
 
 	hasOldBranch := true
-	if err = t.Clone(opts.OldBranch, true); err != nil {
+	if err = t.Clone(opts.OldBranch, false); err != nil {
 		if !git.IsErrBranchNotExist(err) || !repo.IsEmpty {
 			return err
 		}
@@ -105,10 +108,30 @@ func UploadRepoFiles(ctx context.Context, repo *repo_model.Repository, doer *use
 		}
 	}
 
-	// Copy uploaded files into repository.
-	if err := copyUploadedLFSFilesIntoRepository(infos, t, opts.TreePath); err != nil {
+	r, err := git.OpenRepository(ctx, repo.RepoPath())
+	if err != nil {
 		return err
 	}
+	if annex.IsAnnexRepo(r) {
+		// Initialize annex privately in temporary clone
+		if err := t.InitPrivateAnnex(); err != nil {
+			return err
+		}
+		// Copy uploaded files into git-annex repository
+		if err := copyUploadedFilesIntoAnnexRepository(infos, t, opts.TreePath); err != nil {
+			return err
+		}
+		// Move all annexed content in the temporary repository, i.e. everything we have just added, to the origin
+		author, committer := GetAuthorAndCommitterUsers(opts.Author, opts.Committer, doer)
+		if err := moveAnnexedFilesToOrigin(t, author, committer); err != nil {
+			return err
+		}
+	} else {
+		// Copy uploaded files into repository.
+		if err := copyUploadedLFSFilesIntoRepository(infos, t, opts.TreePath); err != nil {
+			return err
+		}
+	}
 
 	// Now write the tree
 	treeHash, err := t.WriteTree()
@@ -246,3 +269,57 @@ func uploadToLFSContentStore(info uploadInfo, contentStore *lfs.ContentStore) er
 	}
 	return nil
 }
+
+func copyUploadedFilesIntoAnnexRepository(infos []uploadInfo, t *TemporaryUploadRepository, treePath string) error {
+	for i := range len(infos) {
+		if err := copyUploadedFileIntoAnnexRepository(&infos[i], t, treePath); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func copyUploadedFileIntoAnnexRepository(info *uploadInfo, t *TemporaryUploadRepository, treePath string) error {
+	pathInRepo := path.Join(t.basePath, treePath, info.upload.Name)
+	if err := os.MkdirAll(filepath.Dir(pathInRepo), 0o700); err != nil {
+		return err
+	}
+	if err := os.Rename(info.upload.LocalPath(), pathInRepo); err != nil {
+		// Rename didn't work, try copy and remove
+		inputFile, err := os.Open(info.upload.LocalPath())
+		if err != nil {
+			return fmt.Errorf("could not open source file: %v", err)
+		}
+		defer inputFile.Close()
+		outputFile, err := os.Create(pathInRepo)
+		if err != nil {
+			return fmt.Errorf("could not open dest file: %v", err)
+		}
+		defer outputFile.Close()
+		_, err = io.Copy(outputFile, inputFile)
+		if err != nil {
+			return fmt.Errorf("could not copy to dest from source: %v", err)
+		}
+		inputFile.Close()
+		err = os.Remove(info.upload.LocalPath())
+		if err != nil {
+			return fmt.Errorf("could not remove source file: %v", err)
+		}
+	}
+	return t.AddAnnex(pathInRepo)
+}
+
+func moveAnnexedFilesToOrigin(t *TemporaryUploadRepository, author, committer *user_model.User) error {
+	authorSig := author.NewGitSig()
+	committerSig := committer.NewGitSig()
+	env := append(os.Environ(),
+		"GIT_AUTHOR_NAME="+authorSig.Name,
+		"GIT_AUTHOR_EMAIL="+authorSig.Email,
+		"GIT_COMMITTER_NAME="+committerSig.Name,
+		"GIT_COMMITTER_EMAIL="+committerSig.Email,
+	)
+	if _, _, err := git.NewCommand(t.ctx, "annex", "move", "--to", "origin").RunStdString(&git.RunOpts{Dir: t.basePath, Env: env}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 4d4a0da88e..ff840c8b68 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -5,14 +5,17 @@
 package integration
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"io"
 	"math/rand"
+	"mime/multipart"
 	"net/http"
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
@@ -59,6 +62,84 @@ func doCreateRemoteAnnexRepository(t *testing.T, u *url.URL, ctx APITestContext,
 	return nil
 }
 
+func TestGitAnnexWebUpload(t *testing.T) {
+	if !setting.Annex.Enabled {
+		t.Skip("Skipping since annex support is disabled.")
+	}
+
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		forEachObjectFormat(t, func(t *testing.T, objectFormat git.ObjectFormat) {
+			ctx := NewAPITestContext(t, "user2", "annex-web-upload-test"+objectFormat.Name(), auth_model.AccessTokenScopeWriteRepository)
+			require.NoError(t, doCreateRemoteAnnexRepository(t, u, ctx, false, objectFormat))
+
+			uploadFile := func(t *testing.T, path string) string {
+				t.Helper()
+
+				body := &bytes.Buffer{}
+				mpForm := multipart.NewWriter(body)
+				err := mpForm.WriteField("_csrf", GetCSRF(t, ctx.Session, ctx.Username+"/"+ctx.Reponame+"/_upload/"+setting.Repository.DefaultBranch))
+				require.NoError(t, err)
+
+				file, err := mpForm.CreateFormFile("file", filepath.Base(path))
+				require.NoError(t, err)
+
+				srcFile, err := os.Open(path)
+				require.NoError(t, err)
+
+				io.Copy(file, srcFile)
+				require.NoError(t, mpForm.Close())
+
+				req := NewRequestWithBody(t, "POST", "/"+ctx.Username+"/"+ctx.Reponame+"/upload-file", body)
+				req.Header.Add("Content-Type", mpForm.FormDataContentType())
+				resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+
+				respMap := map[string]string{}
+				DecodeJSON(t, resp, &respMap)
+				return respMap["uuid"]
+			}
+
+			// Generate random file
+			tmpFile := path.Join(t.TempDir(), "web-upload-test-file.bin")
+			require.NoError(t, generateRandomFile(1024*1024/4, tmpFile))
+			expectedContent, err := os.ReadFile(tmpFile)
+			require.NoError(t, err)
+
+			// Upload generated file
+			fileUUID := uploadFile(t, tmpFile)
+			req := NewRequestWithValues(t, "POST", ctx.Username+"/"+ctx.Reponame+"/_upload/"+setting.Repository.DefaultBranch, map[string]string{
+				"commit_choice":  "direct",
+				"files":          fileUUID,
+				"_csrf":          GetCSRF(t, ctx.Session, ctx.Username+"/"+ctx.Reponame+"/_upload/"+setting.Repository.DefaultBranch),
+				"commit_mail_id": "-1",
+			})
+			ctx.Session.MakeRequest(t, req, http.StatusSeeOther)
+
+			// Get some handles on the target repository and file
+			remoteRepoPath := path.Join(setting.RepoRootPath, ctx.GitPath())
+			repo, err := git.OpenRepository(git.DefaultContext, remoteRepoPath)
+			require.NoError(t, err)
+			defer repo.Close()
+			tree, err := repo.GetTree(setting.Repository.DefaultBranch)
+			require.NoError(t, err)
+			treeEntry, err := tree.GetTreeEntryByPath(filepath.Base(tmpFile))
+			require.NoError(t, err)
+			blob := treeEntry.Blob()
+
+			// Check that the uploaded file is annexed
+			isAnnexed, err := annex.IsAnnexed(blob)
+			require.NoError(t, err)
+			require.True(t, isAnnexed)
+
+			// Check that the uploaded file has the correct content
+			annexedFile, err := annex.Content(blob)
+			require.NoError(t, err)
+			actualContent, err := io.ReadAll(annexedFile)
+			require.NoError(t, err)
+			require.Equal(t, expectedContent, actualContent)
+		})
+	})
+}
+
 func TestGitAnnexMedia(t *testing.T) {
 	if !setting.Annex.Enabled {
 		t.Skip("Skipping since annex support is disabled.")

From 5b2ae61a1292af9f43d27e47b8980a31d2bbc72a Mon Sep 17 00:00:00 2001
From: Michael Hanke <michael.hanke@gmail.com>
Date: Tue, 30 Jul 2024 13:15:26 +0000
Subject: [PATCH 108/125] Add git-annex also to the rootless container (#24)

Same as https://codeberg.org/matrss/forgejo-aneksajo/commit/89f8aa0bf5134f7c986ea25856fa9ea32a0e0e8c, but for the rootless container.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/24
Reviewed-by: matrss <matrss@noreply.codeberg.org>
Co-authored-by: Michael Hanke <michael.hanke@gmail.com>
Co-committed-by: Michael Hanke <michael.hanke@gmail.com>
---
 Dockerfile.rootless | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile.rootless b/Dockerfile.rootless
index 82d15e8eac..63fb88a7a7 100644
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -71,6 +71,7 @@ RUN apk --no-cache add \
     git \
     curl \
     gnupg \
+    git-annex \
     && rm -rf /var/cache/apk/*
 
 RUN addgroup \

From 4c60dfb6f09a7a140e3f48c6d7d946f1c6f9b155 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 9 Aug 2024 11:51:11 +0000
Subject: [PATCH 109/125] Improve views for annexed but missing files (#28)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, trying to view files that were annexed, but missing, just
led to an uninformative error 500. This was rather confusing.

With these changes it now shows the pointer target instead of the
(missing) content of the file, and also indicates this situation in the
"stored with git-annex" message. For semantic correctness views for
missing files return a 404 instead of a 200, as they would with the
content present.

Fixes #7, fixes #13.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/28
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 options/locale/locale_de-DE.ini |  1 +
 options/locale/locale_en-US.ini |  1 +
 routers/web/repo/view.go        | 54 +++++++++++++++++++++++----------
 templates/repo/file_info.tmpl   |  2 +-
 4 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index 9bc1bf5932..a67390e75e 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -1318,6 +1318,7 @@ video_not_supported_in_browser=Dein Browser unterstützt das HTML5-„video“-T
 audio_not_supported_in_browser=Dein Browser unterstützt das HTML5-„audio“-Tag nicht.
 stored_lfs=Gespeichert mit Git LFS
 stored_annex=Gespeichert mit Git Annex
+stored_annex_not_present = hier nicht vorhanden, versuche git annex whereis
 symbolic_link=Softlink
 executable_file=Ausführbare Datei
 commit_graph=Commit-Graph
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 73909e772a..db58d50a22 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -1338,6 +1338,7 @@ video_not_supported_in_browser = Your browser does not support the HTML5 "video"
 audio_not_supported_in_browser = Your browser does not support the HTML5 "audio" tag.
 stored_lfs = Stored with Git LFS
 stored_annex = Stored with Git Annex
+stored_annex_not_present = not present here, try using git annex whereis
 symbolic_link = Symbolic link
 executable_file = Executable file
 vendored = Vendored
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 59efa4334f..23177a2a09 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -210,12 +210,13 @@ func localizedExtensions(ext, languageCode string) (localizedExts []string) {
 }
 
 type fileInfo struct {
-	isTextFile  bool
-	isLFSFile   bool
-	isAnnexFile bool
-	fileSize    int64
-	lfsMeta     *lfs.Pointer
-	st          typesniffer.SniffedType
+	isTextFile         bool
+	isLFSFile          bool
+	isAnnexFile        bool
+	isAnnexFilePresent bool
+	fileSize           int64
+	lfsMeta            *lfs.Pointer
+	st                 typesniffer.SniffedType
 }
 
 func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte, io.ReadCloser, *fileInfo, error) {
@@ -230,11 +231,22 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 		annexContent, err := annex.Content(blob)
 		if err != nil {
-			// in the case where annex content is missing, what should happen?
-			// do we render the page with an error message?
-			// actually that's not a bad idea, there's some sort of error message situation
-			// TODO: display an error to the user explaining that their data is missing
-			return nil, nil, nil, err
+			// If annex.Content returns an error it can mean that the blob does not
+			// refer to an annexed file or that it is not present here. Since we already
+			// checked that it is annexed the latter must be the case. So we return the
+			// content of the blob instead and indicate that the file is indeed annexed,
+			// but not present here. The template can then communicate the situation.
+			dataRc, err := blob.DataAsync()
+			if err != nil {
+				return nil, nil, nil, err
+			}
+
+			buf := make([]byte, 1024)
+			n, _ := util.ReadAtMost(dataRc, buf)
+			buf = buf[:n]
+
+			st := typesniffer.DetectContentType(buf)
+			return buf, dataRc, &fileInfo{st.IsText(), false, true, false, blob.Size(), nil, st}, nil
 		}
 
 		stat, err := annexContent.Stat()
@@ -248,7 +260,7 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 		st := typesniffer.DetectContentType(buf)
 
-		return buf, annexContent, &fileInfo{st.IsText(), false, true, stat.Size(), nil, st}, nil
+		return buf, annexContent, &fileInfo{st.IsText(), false, true, true, stat.Size(), nil, st}, nil
 	}
 
 	dataRc, err := blob.DataAsync()
@@ -265,18 +277,18 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	// FIXME: what happens when README file is an image?
 	if !isTextFile || !setting.LFS.StartServer {
-		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, false, blob.Size(), nil, st}, nil
 	}
 
 	pointer, _ := lfs.ReadPointerFromBuffer(buf)
 	if !pointer.IsValid() { // fallback to plain file
-		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, false, blob.Size(), nil, st}, nil
 	}
 
 	meta, err := git_model.GetLFSMetaObjectByOid(ctx, repoID, pointer.Oid)
 	if err != nil { // fallback to plain file
 		log.Warn("Unable to access LFS pointer %s in repo %d: %v", pointer.Oid, repoID, err)
-		return buf, dataRc, &fileInfo{isTextFile, false, false, blob.Size(), nil, st}, nil
+		return buf, dataRc, &fileInfo{isTextFile, false, false, false, blob.Size(), nil, st}, nil
 	}
 
 	dataRc.Close()
@@ -296,7 +308,7 @@ func getFileReader(ctx gocontext.Context, repoID int64, blob *git.Blob) ([]byte,
 
 	st = typesniffer.DetectContentType(buf)
 
-	return buf, dataRc, &fileInfo{st.IsText(), true, false, meta.Size, &meta.Pointer, st}, nil
+	return buf, dataRc, &fileInfo{st.IsText(), true, false, false, meta.Size, &meta.Pointer, st}, nil
 }
 
 func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.TreeEntry) {
@@ -500,6 +512,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 	}
 	ctx.Data["IsLFSFile"] = fInfo.isLFSFile
 	ctx.Data["IsAnnexFile"] = fInfo.isAnnexFile
+	ctx.Data["IsAnnexFilePresent"] = fInfo.isAnnexFilePresent
 	ctx.Data["FileSize"] = fInfo.fileSize
 	ctx.Data["IsTextFile"] = fInfo.isTextFile
 	ctx.Data["IsRepresentableAsText"] = isRepresentableAsText
@@ -1203,6 +1216,15 @@ PostRecentBranchCheck:
 	} else {
 		ctx.Data["CodeSearchOptions"] = git.GrepSearchOptions
 	}
+	isAnnexFile, okAnnexFile := ctx.Data["IsAnnexFile"]
+	isAnnexFilePresent, okAnnexFilePresent := ctx.Data["IsAnnexFilePresent"]
+	if okAnnexFile && okAnnexFilePresent && isAnnexFile.(bool) && !isAnnexFilePresent.(bool) {
+		// If the file to be viewed is annexed but not present then render it normally
+		// (which will show the plain git blob content, i.e. the symlink or pointer target)
+		// but make the status code a 404.
+		ctx.HTML(http.StatusNotFound, tplRepoHome)
+		return
+	}
 	ctx.HTML(http.StatusOK, tplRepoHome)
 }
 
diff --git a/templates/repo/file_info.tmpl b/templates/repo/file_info.tmpl
index 05d9825cfb..8655404394 100644
--- a/templates/repo/file_info.tmpl
+++ b/templates/repo/file_info.tmpl
@@ -17,7 +17,7 @@
 	{{if .FileSize}}
 		<div class="file-info-entry">
 			{{ctx.Locale.TrSize .FileSize}}{{if .IsLFSFile}} ({{ctx.Locale.Tr "repo.stored_lfs"}}){{end}}
-			{{if .IsAnnexFile}} ({{ctx.Locale.Tr "repo.stored_annex"}}){{end}}
+			{{if .IsAnnexFile}} ({{ctx.Locale.Tr "repo.stored_annex"}}{{if not .IsAnnexFilePresent}} - {{ctx.Locale.Tr "repo.stored_annex_not_present"}}{{end}}){{end}}
 		</div>
 	{{end}}
 	{{if .LFSLock}}

From 78ff09f63d953ee03c4caaabe1b63ef828e18da5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 9 Aug 2024 17:17:02 +0000
Subject: [PATCH 110/125] Change the icon for annexed files to file-binary
 (#29)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #26.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/29
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/base/tool.go                | 12 ++++++------
 tests/integration/git_annex_test.go |  8 +++++---
 web_src/css/repo.css                |  1 +
 3 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/modules/base/tool.go b/modules/base/tool.go
index 3d0fe73823..a885546fde 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -102,14 +102,14 @@ func Int64sToStrings(ints []int64) []string {
 
 // EntryIcon returns the octicon class for displaying files/directories
 func EntryIcon(entry *git.TreeEntry) string {
+	isAnnexed, _ := annex.IsAnnexed(entry.Blob())
+	if isAnnexed {
+		// Show git-annex files as binary files to differentiate them from non-annexed files
+		// TODO: find a more suitable icon, maybe something related to git-annex
+		return "file-binary"
+	}
 	switch {
 	case entry.IsLink():
-		isAnnexed, _ := annex.IsAnnexed(entry.Blob())
-		if isAnnexed {
-			// git-annex files are sometimes stored as symlinks;
-			// short-circuit that so like LFS they are displayed as regular files
-			return "file"
-		}
 		te, _, err := entry.FollowLink()
 		if err != nil {
 			log.Debug(err.Error())
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index ff840c8b68..11d709ca80 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -214,7 +214,7 @@ func TestGitAnnexViews(t *testing.T) {
 			session := loginUser(t, ctx.Username)
 
 			t.Run("Index", func(t *testing.T) {
-				// test that annex symlinks renders with the _file icon_ on the main list
+				// test that annexed files render with the binary file icon on the main list
 				defer tests.PrintCurrentTest(t)()
 
 				repoLink := path.Join("/", ctx.Username, ctx.Reponame)
@@ -222,8 +222,10 @@ func TestGitAnnexViews(t *testing.T) {
 				resp := session.MakeRequest(t, req, http.StatusOK)
 
 				htmlDoc := NewHTMLParser(t, resp.Body)
-				isFileIcon := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file")
-				require.True(t, isFileIcon, "annexed files should render a plain file icon, even when stored via annex symlink")
+				isFileBinaryIconLocked := htmlDoc.Find("tr[data-entryname='annexed.tiff'] > td.name svg").HasClass("octicon-file-binary")
+				require.True(t, isFileBinaryIconLocked, "locked annexed files should render a binary file icon")
+				isFileBinaryIconUnlocked := htmlDoc.Find("tr[data-entryname='annexed.bin'] > td.name svg").HasClass("octicon-file-binary")
+				require.True(t, isFileBinaryIconUnlocked, "unlocked annexed files should render a binary file icon")
 			})
 
 			t.Run("View", func(t *testing.T) {
diff --git a/web_src/css/repo.css b/web_src/css/repo.css
index d6faa4b2a7..c3f3292dd4 100644
--- a/web_src/css/repo.css
+++ b/web_src/css/repo.css
@@ -244,6 +244,7 @@ td .commit-summary {
 }
 
 .repository.file.list #repo-files-table tbody .svg.octicon-file,
+.repository.file.list #repo-files-table tbody .svg.octicon-file-binary,
 .repository.file.list #repo-files-table tbody .svg.octicon-file-symlink-file,
 .repository.file.list #repo-files-table tbody .svg.octicon-file-directory-symlink {
   color: var(--color-secondary-dark-7);

From 8065657151a1dc23df4b3c33b9597edcc4f1ed5f Mon Sep 17 00:00:00 2001
From: Michael Hanke <michael.hanke@gmail.com>
Date: Wed, 4 Sep 2024 09:32:40 +0000
Subject: [PATCH 111/125] Elevate external markup renderer interface for
 annexed file content (#36)

Previously, an external renderer that matched on an annexed file would
only see its content streamed via `STDIN`, or a temporary file with a copy
of its content would be generated and passed-by-filepath (with
`IS_INPUT_FILE=true`). Whether that happens, is also subject to
`MAX_DISPLAY_FILE_SIZE` (which defaults to 8MB).

This was problematic, because annexed files tend to be large. Moreover,
if present, they already exist as write-protected files on the
file-system. Creating a copy is both expensive and serves no particular
purpose.

This commit changes how external renderers are called.

1) With `IS_INPUT_FILE=true`, the renderer is passed the true location
   of an annex key, if present, and an empty path, if not.
2) The original, repository-relative path of the rendering target is
   made available to the renderer via the `GITEA_RELATIVE_PATH`
   environment variable.

To achieve a lean implementation, the `Blob` of the rendering target
is passed on to the `RenderContext` (because the implementation of
the annex-related functionality is centered on this dtype.

This change makes it less costly to increase `MAX_DISPLAY_FILE_SIZE`,
in order to make large, annexed files eligible for markup rendering,
because no content copies will be made any longer.

External renderers can now use the original file path, with the full
original filename, including extensions, for decision making. For
example, to detect particular compression formats based in a file name
extension, or to alter the rendering based on contextual information
encoded in the file path (e.g., a multi-file data structure with a
particular organization pattern).

Apart from the additional environment variable, there is no change to
the handling of renderers that take their input via `STDIN` (i.e.,
`IS_INPUT_FILE=false`).

Fixes #35.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/36
Reviewed-by: matrss <matrss@noreply.codeberg.org>
Co-authored-by: Michael Hanke <michael.hanke@gmail.com>
Co-committed-by: Michael Hanke <michael.hanke@gmail.com>
---
 modules/markup/external/external.go | 25 +++++++++++++++++++++++--
 modules/markup/renderer.go          | 20 ++++++++++++--------
 routers/web/repo/view.go            |  3 +++
 3 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/modules/markup/external/external.go b/modules/markup/external/external.go
index 122517ed11..b9760772a1 100644
--- a/modules/markup/external/external.go
+++ b/modules/markup/external/external.go
@@ -12,6 +12,7 @@ import (
 	"runtime"
 	"strings"
 
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/markup"
@@ -86,8 +87,22 @@ func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.
 		commands = strings.Fields(command)
 		args     = commands[1:]
 	)
-
-	if p.IsInputFile {
+	isAnnexed, _ := annex.IsAnnexed(ctx.Blob)
+	// if a renderer wants to read a file, and we have annexed content, we can
+	// provide the annex key file location directly to the renderer. git-annex
+	// takes care of having that location be read-only, so no critical
+	// protection layer is needed. Moreover, the file readily exists, and
+	// expensive temporary files can be avoided, also allowing an operator
+	// to raise MAX_DISPLAY_FILE_SIZE without much negative impact.
+	if p.IsInputFile && isAnnexed {
+		// look for annexed content, will be empty, if there is none
+		annexContentLocation, _ := annex.ContentLocation(ctx.Blob)
+		// we call the renderer, even if there is no annex content present.
+		// showing the pointer file content is not much use, and a topical
+		// renderer might be able to produce something useful from the
+		// filename alone (present in ENV)
+		args = append(args, annexContentLocation)
+	} else if p.IsInputFile {
 		// write to temp file
 		f, err := os.CreateTemp("", "gitea_input")
 		if err != nil {
@@ -130,6 +145,12 @@ func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.
 		os.Environ(),
 		"GITEA_PREFIX_SRC="+ctx.Links.SrcLink(),
 		"GITEA_PREFIX_RAW="+ctx.Links.RawLink(),
+		// also communicate the relative path of the to-be-rendered item.
+		// this enables the renderer to make use of the original file name
+		// and path, e.g., to make rendering or dtype-detection decisions
+		// that go beyond the originally matched extension. Even if the
+		// content is directly streamed to STDIN
+		"GITEA_RELATIVE_PATH="+ctx.RelativePath,
 	)
 	if !p.IsInputFile {
 		cmd.Stdin = input
diff --git a/modules/markup/renderer.go b/modules/markup/renderer.go
index 2137302f43..c00bd2b56e 100644
--- a/modules/markup/renderer.go
+++ b/modules/markup/renderer.go
@@ -67,14 +67,18 @@ type Header struct {
 
 // RenderContext represents a render context
 type RenderContext struct {
-	Ctx              context.Context
-	RelativePath     string // relative path from tree root of the branch
-	Type             string
-	IsWiki           bool
-	Links            Links
-	Metas            map[string]string
-	DefaultLink      string
-	GitRepo          *git.Repository
+	Ctx          context.Context
+	RelativePath string // relative path from tree root of the branch
+	Type         string
+	IsWiki       bool
+	Links        Links
+	Metas        map[string]string
+	DefaultLink  string
+	GitRepo      *git.Repository
+	// reporting the target blob that is to-be-rendered enables
+	// deeper inspection in the handler for external renderer
+	// (i.e., more targeted handling of annexed files)
+	Blob             *git.Blob
 	ShaExistCache    map[string]bool
 	cancelFn         func()
 	SidebarTocNode   ast.Node
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 23177a2a09..6329f5d714 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -371,6 +371,7 @@ func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.Tr
 			},
 			Metas:   ctx.Repo.Repository.ComposeDocumentMetas(ctx),
 			GitRepo: ctx.Repo.GitRepo,
+			Blob:    target.Blob(),
 		}, rd)
 		if err != nil {
 			log.Error("Render failed for %s in %-v: %v Falling back to rendering source", readmeFile.Name(), ctx.Repo.Repository, err)
@@ -603,6 +604,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 				},
 				Metas:   metas,
 				GitRepo: ctx.Repo.GitRepo,
+				Blob:    entry.Blob(),
 			}, rd)
 			if err != nil {
 				ctx.ServerError("Render", err)
@@ -701,6 +703,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 				},
 				Metas:   ctx.Repo.Repository.ComposeDocumentMetas(ctx),
 				GitRepo: ctx.Repo.GitRepo,
+				Blob:    entry.Blob(),
 			}, rd)
 			if err != nil {
 				ctx.ServerError("Render", err)

From cdc80b9fe699ab80128a3f824694787fa8ccc315 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 30 Sep 2024 14:56:03 +0000
Subject: [PATCH 112/125] Allow anonymous HEAD requests to annex/objects (#41)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Git-annex emits HEAD requests for keys while trying to drop them from a
repository that was cloned via http. Forgejo asked for authentication
for these HEAD requests. This meant that cloning and getting files was
possible without authentication, but dropping was not.

Since the response to a HEAD request is a subset of the response to a
GET request it is safe to make those unauthenticated as well. That is
what this change does, although limited to the
:username/:reponame/annex/objects endpoint.

Fixes #40.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/41
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 routers/web/repo/githttp.go | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index d715b6bdf0..dfdedb04f3 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -78,7 +78,24 @@ func httpBase(ctx *context.Context) *serviceHandler {
 		strings.HasSuffix(ctx.Req.URL.Path, "git-upload-archive") {
 		isPull = true
 	} else {
-		isPull = ctx.Req.Method == "GET"
+		// In addition to GET requests, HEAD requests are also "pull"
+		// operations (reads), so they should also not require
+		// authentication. This is necessary for git-annex to operate
+		// properly, as it emits HEAD requests to check for the
+		// existence of keys, e.g. before dropping locally, and asking
+		// for authentication would break unauthenticated http usage in
+		// this situation.
+		// It should be safe to make all HEAD requests require no
+		// authentication, but as it is only necessary for the
+		// annex/objects endpoints to fix git-annex' drop operations it
+		// is limited to those for now.
+		r, err := regexp.Compile("^/?" + username + "/" + reponame + "(.git)?/annex/objects")
+		if err != nil {
+			ctx.ServerError("failed to create URL path regex", err)
+			return nil
+		}
+		isPull = ctx.Req.Method == "GET" ||
+			r.MatchString(ctx.Req.URL.Path) && ctx.Req.Method == "HEAD"
 	}
 
 	var accessMode perm.AccessMode

From 3cf2111dbf1ba1f23947ddcdd8ba4b5507e33d4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 9 Oct 2024 14:44:18 +0000
Subject: [PATCH 113/125] Use PATH when looking for git commands (#44)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes some issues when using a git-annex that is installed in a
different location than where git is installed, e.g. when using the
git-annex-standalone release or one installed with nix.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/44
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 cmd/serv.go | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/cmd/serv.go b/cmd/serv.go
index ac4aa36599..57804034e2 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -339,9 +339,8 @@ func runServ(c *cli.Context) error {
 		return nil
 	}
 
-	gitBinPath := filepath.Dir(git.GitExecutable) // e.g. /usr/bin
-	gitBinVerb := filepath.Join(gitBinPath, verb) // e.g. /usr/bin/git-upload-pack
-	if _, err := os.Stat(gitBinVerb); err != nil {
+	gitBinVerb, err := exec.LookPath(verb)
+	if err != nil {
 		// if the command "git-upload-pack" doesn't exist, try to split "git-upload-pack" to use the sub-command with git
 		// ps: Windows only has "git.exe" in the bin path, so Windows always uses this way
 		// ps: git-annex-shell and other extensions may not necessarily be in gitBinPath,

From 4d65d593adb15d024b83816a27116c5ddaf18788 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 9 Oct 2024 19:33:05 +0000
Subject: [PATCH 114/125] Only upload to annex in doAnnexUploadTest (#46)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous implementation both uploaded to the annex and pushed to the
git repository. This meant that the tests checking that uploads without
permission fail actually could pass when the git push failed but the
git-annex upload didn't. The tests didn't catch the situation where
unauthorized users could modify the annex.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/46
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go              | 23 +++++-----
 tests/integration/git_annex_test.go | 68 ++++++++++++++++-------------
 2 files changed, 51 insertions(+), 40 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index bab5a7e0b2..ee0843926f 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -104,6 +104,18 @@ func Pointer(blob *git.Blob) (string, error) {
 	return pointer, nil
 }
 
+func ContentLocationFromPointer(repoPath, pointer string) (string, error) {
+	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", repoPath, pointer, err)
+	}
+	contentLocation = strings.TrimSpace(contentLocation)
+	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
+	contentLocation = path.Join(repoPath, contentLocation)
+
+	return contentLocation, nil
+}
+
 // return the absolute path of the content pointed to by the annex pointer stored in the git object
 // errors if the content is not found in this repo
 func ContentLocation(blob *git.Blob) (string, error) {
@@ -111,16 +123,7 @@ func ContentLocation(blob *git.Blob) (string, error) {
 	if err != nil {
 		return "", err
 	}
-
-	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
-	if err != nil {
-		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", blob.Repo().Path, pointer, err)
-	}
-	contentLocation = strings.TrimSpace(contentLocation)
-	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
-	contentLocation = path.Join(blob.Repo().Path, contentLocation)
-
-	return contentLocation, nil
+	return ContentLocationFromPointer(blob.Repo().Path, pointer)
 }
 
 // returns a stream open to the annex content
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 11d709ca80..44bc8376d7 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -1119,19 +1119,21 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 		return err
 	}
 
-	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "sync", "--no-content").RunStdString(&git.RunOpts{Dir: repoPath})
-	if err != nil {
-		return err
-	}
-
 	// verify the file was uploaded
-	localObjectPath, err := contentLocation(repoPath, "contribution.bin")
+	blob, err := blobForFile(repoPath, "contribution.bin")
+	if err != nil {
+		return err
+	}
+	key, err := annex.Pointer(blob)
+	if err != nil {
+		return err
+	}
+	localObjectPath, err := annex.ContentLocationFromPointer(repoPath, key)
 	if err != nil {
 		return err
 	}
-	// localObjectPath := path.Join(repoPath, "contribution.bin") // or, just compare against the checked-out file
 
-	remoteObjectPath, err := contentLocation(remoteRepoPath, "contribution.bin")
+	remoteObjectPath, err := annex.ContentLocationFromPointer(remoteRepoPath, key)
 	if err != nil {
 		return err
 	}
@@ -1325,6 +1327,31 @@ func doInitRemoteAnnexRepository(t *testing.T, repoURL *url.URL) error {
 	return nil
 }
 
+func blobForFile(repoPath, file string) (*git.Blob, error) {
+	repo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	if err != nil {
+		return nil, err
+	}
+	defer repo.Close()
+
+	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
+	if err != nil {
+		return nil, err
+	}
+
+	commit, err := repo.GetCommit(commitID)
+	if err != nil {
+		return nil, err
+	}
+
+	treeEntry, err := commit.GetTreeEntryByPath(file)
+	if err != nil {
+		return nil, err
+	}
+
+	return treeEntry.Blob(), nil
+}
+
 /*
 Find the path in .git/annex/objects/ of the contents for a given annexed file.
 
@@ -1334,30 +1361,11 @@ Find the path in .git/annex/objects/ of the contents for a given annexed file.
 	TODO: pass a parameter to allow examining non-HEAD branches
 */
 func contentLocation(repoPath, file string) (path string, err error) {
-	path = ""
-
-	repo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	blob, err := blobForFile(repoPath, file)
 	if err != nil {
-		return path, nil
+		return "", err
 	}
-	defer repo.Close()
-
-	commitID, err := repo.GetRefCommitID("HEAD") // NB: to examine a *branch*, prefix with "refs/branch/", or call repo.GetBranchCommitID(); ditto for tags
-	if err != nil {
-		return path, nil
-	}
-
-	commit, err := repo.GetCommit(commitID)
-	if err != nil {
-		return path, nil
-	}
-
-	treeEntry, err := commit.GetTreeEntryByPath(file)
-	if err != nil {
-		return path, nil
-	}
-
-	return annex.ContentLocation(treeEntry.Blob())
+	return annex.ContentLocation(blob)
 }
 
 /* like withKeyFile(), but automatically sets it the account given in ctx for use by git-annex */

From 592b23f5cd0ea74978b42938006ca7c3020b4f9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Mon, 14 Oct 2024 15:59:21 +0000
Subject: [PATCH 115/125] Add git-annex' testremote to the test suite (#48)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `git annex testremote` command runs a built-in set of tests against
a remote. It cannot hurt to check our implementation of a git-annex
remote against it too.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/48
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 tests/integration/git_annex_test.go | 196 ++++++++++++++++++++++++++++
 1 file changed, 196 insertions(+)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 44bc8376d7..03c8802918 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -395,6 +395,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -425,6 +435,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -457,6 +477,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -487,6 +517,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -519,6 +559,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -549,6 +599,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -581,6 +641,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -611,6 +681,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -642,6 +722,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
 					})
 				})
 
@@ -713,6 +803,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -743,6 +843,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -775,6 +885,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -805,6 +925,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -837,6 +967,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -867,6 +1007,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -899,6 +1049,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
 							})
 
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+
 							t.Run("Upload", func(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 
@@ -929,6 +1089,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 								defer tests.PrintCurrentTest(t)()
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
 						})
 					})
 				})
@@ -960,6 +1130,16 @@ func TestGitAnnexPermissions(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
 					})
 				})
 
@@ -1032,6 +1212,22 @@ func doAnnexInitTest(remoteRepoPath, repoPath string) (err error) {
 	return nil
 }
 
+func doAnnexTestremoteReadWriteTest(repoPath string) (err error) {
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "testremote", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func doAnnexTestremoteReadOnlyTest(repoPath string) (err error) {
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "testremote", "origin", "--test-readonly", "annexed.tiff").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	// NB: this test does something slightly different if run separately from "doAnnexInitTest()":
 	//     "git annex copy" will notice and run "git annex init", silently.

From 1dd3a341a702645285400d954581dabec05f1992 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 22 Oct 2024 18:33:26 +0000
Subject: [PATCH 116/125] Add tests for git annex drop (#47)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds some rudimentary tests that drop files in a repository's clone
as well as from a repository on Forgejo.

Fixes #4.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/47
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 tests/integration/git_annex_test.go | 1004 +++++++++++++++++++++------
 1 file changed, 796 insertions(+), 208 deletions(-)

diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 03c8802918..68e521397e 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -382,34 +382,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -425,24 +451,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -464,34 +524,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -507,24 +593,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -546,34 +666,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
-							})
 						})
 					})
 
@@ -589,24 +735,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -628,34 +808,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
-							})
 						})
 					})
 
@@ -671,24 +877,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -723,6 +963,26 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
 
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("TestremoteReadOnly", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
@@ -790,34 +1050,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -833,24 +1119,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -872,34 +1192,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
-							})
 						})
 					})
 
@@ -915,24 +1261,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -954,34 +1334,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "Uploading should fail due to permissions")
-							})
 						})
 					})
 
@@ -997,24 +1403,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -1036,34 +1476,60 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxKeyFile(t, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxKeyFile(t, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
-
-							t.Run("Upload", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
-
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
-							})
 						})
 					})
 
@@ -1079,24 +1545,58 @@ func TestGitAnnexPermissions(t *testing.T) {
 							doGitClone(repoPath, repoURL)(t)
 						})
 
-						withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-							t.Run("Init", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("Download", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadOnly", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
+						})
 
-							t.Run("TestremoteReadWrite", func(t *testing.T) {
-								defer tests.PrintCurrentTest(t)()
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
@@ -1131,6 +1631,26 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 						})
 
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("TestremoteReadOnly", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
@@ -1290,6 +1810,40 @@ func doAnnexDownloadTest(remoteRepoPath, repoPath string) (err error) {
 	return err
 }
 
+func doAnnexLocalDropTest(repoPath string) (err error) {
+	// This test assumes that files are present in repoPath, i.e. it is run after doAnnexDownloadTest.
+	// This test drops all files from the repository clone.
+	binPath, err := contentLocation(repoPath, "annexed.bin")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if err != nil {
+		return err
+	}
+	tiffPath, err := contentLocation(repoPath, "annexed.tiff")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(tiffPath)
+	if err != nil {
+		return err
+	}
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "drop").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.bin wasn't dropped properly: %w", err)
+	}
+	_, err = os.Stat(tiffPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.tiff wasn't dropped properly: %w", err)
+	}
+	return nil
+}
+
 func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	// NB: this test does something slightly different if run separately from "Init":
 	//     it first runs "git annex init" silently in the background.
@@ -1345,6 +1899,40 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	return nil
 }
 
+func doAnnexRemoteDropTest(remoteRepoPath, repoPath string) (err error) {
+	// This test assumes that files are present in repoPath, i.e. it is run after doAnnexDownloadTest.
+	// This test drops all files from the remote repository.
+	binPath, err := contentLocation(remoteRepoPath, "annexed.bin")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if err != nil {
+		return err
+	}
+	tiffPath, err := contentLocation(remoteRepoPath, "annexed.tiff")
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(tiffPath)
+	if err != nil {
+		return err
+	}
+	_, _, err = git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "drop", "--from", "origin").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return err
+	}
+	_, err = os.Stat(binPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.bin wasn't dropped properly: %w", err)
+	}
+	_, err = os.Stat(tiffPath)
+	if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("annexed.tiff wasn't dropped properly: %w", err)
+	}
+	return nil
+}
+
 // ---- Helpers ----
 
 func generateRandomFile(size int, path string) (err error) {

From 971f6f7bab8a49dd2166f2c11d61342a7f929a41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 25 Oct 2024 09:55:56 +0000
Subject: [PATCH 117/125] Add git-annex p2phttp support (#42)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds a new endpoint under `/git-annex-p2phttp` which acts as an
authenticating proxy to git-annex' p2phttp server. This makes it
possible to set `annex+<server-url>/git-annex-p2phttp` as
`remote.<name>.annexurl` and use git-annex fully over http(s) with the
normal credentials and access tokens provided by Forgejo.

Fixes #25.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/42
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 .forgejo/workflows/testing.yml      |   3 -
 custom/conf/app.example.ini         |   2 +
 modules/annex/annex.go              |  28 +
 modules/setting/annex.go            |   7 +-
 routers/web/repo/annex.go           | 146 +++++
 routers/web/repo/githttp.go         |  20 +
 routers/web/web.go                  |  12 +-
 services/auth/auth.go               |   2 +-
 tests/integration/git_annex_test.go | 888 +++++++++++++++++++++++++---
 9 files changed, 1012 insertions(+), 96 deletions(-)
 create mode 100644 routers/web/repo/annex.go

diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index e4e78d320e..a93ca7879c 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -200,7 +200,6 @@ jobs:
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-mysql-migration test-mysql'
-        timeout-minutes: 120
         env:
           USE_REPO_TEST_DIR: 1
   test-pgsql:
@@ -236,7 +235,6 @@ jobs:
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-pgsql-migration test-pgsql'
-        timeout-minutes: 120
         env:
           RACE_ENABLED: true
           USE_REPO_TEST_DIR: 1
@@ -257,7 +255,6 @@ jobs:
       - uses: ./.forgejo/workflows-composite/build-backend
       - run: |
           su forgejo -c 'make test-sqlite-migration test-sqlite'
-        timeout-minutes: 120
         env:
           TAGS: sqlite sqlite_unlock_notify
           RACE_ENABLED: true
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index 486adc60a0..3c723fa4c7 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -2686,6 +2686,8 @@ LEVEL = Info
 ;;
 ;; Whether git-annex is enabled; defaults to false
 ;ENABLED = false
+;; Whether to disable p2phttp support; default is the same as repository.DISABLE_HTTP_GIT
+;DISABLE_P2PHTTP = false
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index ee0843926f..7deb8ec2fa 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -12,8 +12,11 @@ package annex
 import (
 	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path"
+	"path/filepath"
+	"regexp"
 	"strings"
 
 	"code.gitea.io/gitea/modules/git"
@@ -161,3 +164,28 @@ func IsAnnexRepo(repo *git.Repository) bool {
 	_, _, err := git.NewCommand(repo.Ctx, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: repo.Path})
 	return err == nil
 }
+
+var repoConfigFileRe = regexp.MustCompile("[^/]+/[^/]+.git/config$")
+
+func UUID2RepoPath(uuid string) (string, error) {
+	var repoPath string
+	err := filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
+		if err == nil && repoConfigFileRe.MatchString(path) {
+			thisRepoPath := strings.TrimSuffix(path, "/config")
+			stdout, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: thisRepoPath})
+			if err != nil {
+				return nil
+			}
+			repoUUID := strings.TrimSpace(stdout)
+			if repoUUID == uuid {
+				repoPath = thisRepoPath
+				return fs.SkipAll
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return "", err
+	}
+	return repoPath, nil
+}
diff --git a/modules/setting/annex.go b/modules/setting/annex.go
index a0eeac9bb8..35e9e55c0e 100644
--- a/modules/setting/annex.go
+++ b/modules/setting/annex.go
@@ -9,7 +9,8 @@ import (
 
 // Annex represents the configuration for git-annex
 var Annex = struct {
-	Enabled bool `ini:"ENABLED"`
+	Enabled        bool `ini:"ENABLED"`
+	DisableP2PHTTP bool `ini:"DISABLE_P2PHTTP"`
 }{}
 
 func loadAnnexFrom(rootCfg ConfigProvider) {
@@ -17,4 +18,8 @@ func loadAnnexFrom(rootCfg ConfigProvider) {
 	if err := sec.MapTo(&Annex); err != nil {
 		log.Fatal("Failed to map Annex settings: %v", err)
 	}
+	if !sec.HasKey("DISABLE_P2PHTTP") {
+		// If DisableP2PHTTP is not explicitly set then use DisableHTTPGit as its default
+		Annex.DisableP2PHTTP = Repository.DisableHTTPGit
+	}
 }
diff --git a/routers/web/repo/annex.go b/routers/web/repo/annex.go
new file mode 100644
index 0000000000..852b5a11cc
--- /dev/null
+++ b/routers/web/repo/annex.go
@@ -0,0 +1,146 @@
+package repo
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"time"
+
+	"code.gitea.io/gitea/models/perm"
+	access_model "code.gitea.io/gitea/models/perm/access"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
+	"code.gitea.io/gitea/modules/annex"
+	"code.gitea.io/gitea/modules/graceful"
+	"code.gitea.io/gitea/modules/log"
+	services_context "code.gitea.io/gitea/services/context"
+)
+
+type p2phttpRecordType struct {
+	CancelFunc func()
+	LastUsed   time.Time
+	Port       string
+}
+
+var p2phttpRecords = make(map[string]*p2phttpRecordType)
+
+// AnnexP2PHTTP implements git-annex smart HTTP support by delegating to git annex p2phttp
+func AnnexP2PHTTP(ctx *services_context.Context) {
+	uuid := ctx.Params(":uuid")
+	repoPath, err := annex.UUID2RepoPath(uuid)
+	if err != nil {
+		ctx.PlainText(http.StatusNotFound, "Repository not found")
+		return
+	}
+
+	parts := strings.Split(repoPath, "/")
+	repoName := strings.TrimSuffix(parts[len(parts)-1], ".git")
+	owner := parts[len(parts)-2]
+	repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, owner, repoName)
+	if err != nil {
+		ctx.PlainText(http.StatusNotFound, "Repository not found")
+		return
+	}
+
+	p, err := access_model.GetUserRepoPermission(ctx, repo, ctx.Doer)
+	if err != nil {
+		ctx.ServerError("GetUserRepoPermission", err)
+		return
+	}
+
+	if !(ctx.Req.Method == "GET" && p.CanAccess(perm.AccessModeRead, unit.TypeCode) ||
+		ctx.Req.Method == "POST" && p.CanAccess(perm.AccessModeWrite, unit.TypeCode) ||
+		ctx.Req.Method == "POST" && strings.HasSuffix(ctx.Req.URL.Path, "/checkpresent") && p.CanAccess(perm.AccessModeRead, unit.TypeCode) ||
+		ctx.Req.Method == "POST" && strings.HasSuffix(ctx.Req.URL.Path, "/keeplocked") ||
+		ctx.Req.Method == "POST" && strings.HasSuffix(ctx.Req.URL.Path, "/lockcontent")) {
+		// GET requests require at least read access; POST requests for
+		// anything but checkpresent, lockcontent, and keeplocked
+		// require write permissions; POST requests for checkpresent
+		// only require read permissions, as it really is just a read.
+		// POST requests for lockcontent and keeplocked require no
+		// authentication at all, as is also the case for the
+		// authentication in the git-annex-p2phttp server. See
+		// https://git-annex.branchable.com/bugs/p2phttp__58___drop_difference_wideopen_unauth-readonly/
+		// for reasoning.
+		ctx.Resp.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
+	p2phttpRecord, p2phttpProcessExists := p2phttpRecords[uuid]
+	if p2phttpProcessExists {
+		p2phttpRecord.LastUsed = time.Now()
+	} else {
+		// Start a new p2phttp process for the requested repository
+		// There is a race condition here with the port selection, ideally git annex p2phttp could just listen on a unix socket...
+		lis, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			log.Error("Failed to listen on a free port: %v", err)
+			ctx.Resp.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		hopefullyFreePort := strings.SplitN(lis.Addr().String(), ":", 2)[1]
+		lis.Close()
+		p2phttpCtx, p2phttpCtxCancel := context.WithCancel(context.Background())
+		go func(ctx context.Context) {
+			cmd := exec.CommandContext(ctx, "git", "-C", repoPath, "annex", "p2phttp", "-J2", "--bind", "127.0.0.1", "--wideopen", "--port", hopefullyFreePort)
+			cmd.SysProcAttr = &syscall.SysProcAttr{
+				Pdeathsig: syscall.SIGINT,
+			}
+			cmd.Cancel = func() error { return cmd.Process.Signal(os.Interrupt) }
+			_ = cmd.Run()
+		}(p2phttpCtx)
+		graceful.GetManager().RunAtTerminate(p2phttpCtxCancel)
+
+		// Wait for the p2phttp server to get ready
+		start := time.Now()
+		sleepDuration := 1 * time.Millisecond
+		for {
+			if time.Since(start) > 5*time.Second {
+				p2phttpCtxCancel()
+				log.Error("Failed to start the p2phttp server in a reasonable amount of time")
+				ctx.Resp.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+			conn, err := net.Dial("tcp", "127.0.0.1:"+hopefullyFreePort)
+			if err == nil {
+				conn.Close()
+				break
+			}
+			time.Sleep(sleepDuration)
+			sleepDuration *= 2
+			if sleepDuration > 1*time.Second {
+				sleepDuration = 1 * time.Second
+			}
+		}
+
+		p2phttpRecord = &p2phttpRecordType{CancelFunc: p2phttpCtxCancel, LastUsed: time.Now(), Port: hopefullyFreePort}
+		p2phttpRecords[uuid] = p2phttpRecord
+	}
+
+	// Cleanup p2phttp processes that haven't been used for a while
+	for uuid, record := range p2phttpRecords {
+		if time.Since(record.LastUsed) > 5*time.Minute {
+			record.CancelFunc()
+			delete(p2phttpRecords, uuid)
+		}
+	}
+
+	url, err := url.Parse("http://127.0.0.1:" + p2phttpRecord.Port + strings.TrimPrefix(ctx.Req.RequestURI, "/git-annex-p2phttp"))
+	if err != nil {
+		log.Error("Failed to parse URL: %v", err)
+		ctx.Resp.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	proxy := httputil.ReverseProxy{
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.Out.URL = url
+		},
+	}
+	proxy.ServeHTTP(ctx.Resp, ctx.Req)
+}
diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index dfdedb04f3..b9354dd45a 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -562,6 +562,26 @@ func GetInfoRefs(ctx *context.Context) {
 	}
 }
 
+// GetConfig implements fetching the git config of a repository
+func GetConfig(ctx *context.Context) {
+	h := httpBase(ctx)
+	if h != nil {
+		setHeaderNoCache(ctx)
+		config, err := os.ReadFile(filepath.Join(h.getRepoDir(), "config"))
+		if err != nil {
+			log.Error("Failed to read git config file: %v", err)
+			ctx.Resp.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		if !setting.Annex.DisableP2PHTTP {
+			config = append(config, []byte("[annex]\n\turl = annex+"+setting.AppURL+"git-annex-p2phttp\n")...)
+		}
+		ctx.Resp.Header().Set("Content-Type", "text/plain")
+		ctx.Resp.Header().Set("Content-Length", fmt.Sprintf("%d", len(config)))
+		http.ServeContent(ctx.Resp, ctx.Req, "config", time.Now(), bytes.NewReader(config))
+	}
+}
+
 // GetTextFile implements Git dumb HTTP
 func GetTextFile(p string) func(*context.Context) {
 	return func(ctx *context.Context) {
diff --git a/routers/web/web.go b/routers/web/web.go
index 4cf4086aba..db0015fb6a 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -363,6 +363,13 @@ func registerRoutes(m *web.Route) {
 		}
 	}
 
+	annexP2PHTTPEnabled := func(ctx *context.Context) {
+		if setting.Annex.DisableP2PHTTP {
+			ctx.Error(http.StatusNotFound)
+			return
+		}
+	}
+
 	federationEnabled := func(ctx *context.Context) {
 		if !setting.Federation.Enabled {
 			ctx.Error(http.StatusNotFound)
@@ -962,6 +969,9 @@ func registerRoutes(m *web.Route) {
 	// ***** END: Organization *****
 
 	// ***** START: Repository *****
+	m.Group("", func() {
+		m.Methods("GET,POST", "/git-annex-p2phttp/git-annex/{uuid}/*", repo.AnnexP2PHTTP)
+	}, ignSignInAndCsrf, annexEnabled, annexP2PHTTPEnabled)
 	m.Group("/repo", func() {
 		m.Get("/create", repo.Create)
 		m.Post("/create", web.Bind(forms.CreateRepoForm{}), repo.CreatePost)
@@ -1644,7 +1654,7 @@ func registerRoutes(m *web.Route) {
 
 			m.Group("", func() {
 				// for git-annex
-				m.Methods("GET,OPTIONS", "/config", repo.GetTextFile("config")) // needed by clients reading annex.uuid during `git annex initremote`
+				m.Methods("GET,OPTIONS", "/config", repo.GetConfig) // needed by clients reading annex.uuid during `git annex initremote`
 				m.Methods("GET,OPTIONS", "/annex/objects/{hash1}/{hash2}/{keyDir}/{key}", repo.GetAnnexObject)
 			}, ignSignInAndCsrf, annexEnabled, context.UserAssignmentWeb())
 
diff --git a/services/auth/auth.go b/services/auth/auth.go
index 100e5b25a2..ddd31917e2 100644
--- a/services/auth/auth.go
+++ b/services/auth/auth.go
@@ -61,7 +61,7 @@ func isArchivePath(req *http.Request) bool {
 	return archivePathRe.MatchString(req.URL.Path)
 }
 
-var annexPathRe = regexp.MustCompile(`^/[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+/annex/`)
+var annexPathRe = regexp.MustCompile(`^(/git-annex-p2phttp/|/[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+/annex/)`)
 
 func isAnnexPath(req *http.Request) bool {
 	if setting.Annex.Enabled {
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 68e521397e..89e86cf932 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -458,6 +458,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
@@ -507,6 +511,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -600,6 +673,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
@@ -649,6 +726,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -742,6 +888,79 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
@@ -884,6 +1103,79 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err = git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
@@ -938,7 +1230,7 @@ func TestGitAnnexPermissions(t *testing.T) {
 				t.Run("Anonymous", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					// Only HTTP has an anonymous mode
+					// Only HTTP and P2PHTTP have an anonymous mode
 					t.Run("HTTP", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
@@ -958,6 +1250,65 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
@@ -1126,6 +1477,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
@@ -1175,6 +1530,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Writer", func(t *testing.T) {
@@ -1268,6 +1692,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
@@ -1317,6 +1745,75 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
+							})
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							})
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							withAnnexCtxHTTPPassword(t, u, writerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadWriteTest(repoPath))
+							})
+						})
+					})
 				})
 
 				t.Run("Reader", func(t *testing.T) {
@@ -1410,6 +1907,10 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 
+						// Unset annexurl so that git-annex uses the dumb http support
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.NoError(t, err)
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
@@ -1459,81 +1960,8 @@ func TestGitAnnexPermissions(t *testing.T) {
 							})
 						})
 					})
-				})
 
-				t.Run("Outsider", func(t *testing.T) {
-					defer tests.PrintCurrentTest(t)()
-
-					t.Run("SSH", func(t *testing.T) {
-						defer tests.PrintCurrentTest(t)()
-
-						repoURL := createSSHUrl(ownerCtx.GitPath(), u)
-
-						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
-						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
-
-						withAnnexCtxKeyFile(t, ownerCtx, func() {
-							doGitClone(repoPath, repoURL)(t)
-						})
-
-						t.Run("Init", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
-							})
-						})
-
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
-							})
-						})
-
-						t.Run("LocalDrop", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexLocalDropTest(repoPath))
-							})
-						})
-
-						t.Run("Download", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
-							})
-						})
-
-						t.Run("RemoteDrop", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
-							})
-						})
-
-						t.Run("Upload", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
-							})
-						})
-
-						t.Run("TestremoteReadOnly", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
-							})
-						})
-
-						t.Run("TestremoteReadWrite", func(t *testing.T) {
-							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxKeyFile(t, outsiderCtx, func() {
-								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
-							})
-						})
-					})
-
-					t.Run("HTTP", func(t *testing.T) {
+					t.Run("P2PHTTP", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
 						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
@@ -1547,66 +1975,281 @@ func TestGitAnnexPermissions(t *testing.T) {
 
 						t.Run("Init", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexInitTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("LocalDrop", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexLocalDropTest(repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexLocalDropTest(repoPath))
 							})
 						})
 
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("RemoteDrop", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("Upload", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
 							})
 						})
 
 						t.Run("TestremoteReadOnly", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
-								require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
+								require.NoError(t, doAnnexTestremoteReadOnlyTest(repoPath))
 							})
 						})
 
 						t.Run("TestremoteReadWrite", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
-							withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+							withAnnexCtxHTTPPassword(t, u, readerCtx, func() {
 								require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
 							})
 						})
 					})
+
+					t.Run("Outsider", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						t.Run("SSH", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							repoURL := createSSHUrl(ownerCtx.GitPath(), u)
+
+							repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+							defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+							withAnnexCtxKeyFile(t, ownerCtx, func() {
+								doGitClone(repoPath, repoURL)(t)
+							})
+
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath), "annex init should fail due to permissions")
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath), "annex copy --from should fail due to permissions")
+								})
+							})
+
+							t.Run("LocalDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexLocalDropTest(repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("RemoteDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath), "annex copy --to should fail due to permissions")
+								})
+							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxKeyFile(t, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+								})
+							})
+						})
+
+						t.Run("HTTP", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+							repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+							defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								doGitClone(repoPath, repoURL)(t)
+							})
+
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							// Try unsetting annexurl
+							_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+							require.Error(t, err)
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("LocalDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexLocalDropTest(repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("RemoteDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+								})
+							})
+						})
+
+						t.Run("P2PHTTP", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+
+							repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+							repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+							defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+							withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+								doGitClone(repoPath, repoURL)(t)
+							})
+
+							t.Run("Init", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("LocalDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexLocalDropTest(repoPath))
+								})
+							})
+
+							t.Run("Download", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("RemoteDrop", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("Upload", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadOnly", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+								})
+							})
+
+							t.Run("TestremoteReadWrite", func(t *testing.T) {
+								defer tests.PrintCurrentTest(t)()
+								withAnnexCtxHTTPPassword(t, u, outsiderCtx, func() {
+									require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+								})
+							})
+						})
+					})
 				})
 
 				t.Run("Anonymous", func(t *testing.T) {
 					defer tests.PrintCurrentTest(t)()
 
-					// Only HTTP has an anonymous mode
+					// Only HTTP and P2PHTTP have an anonymous mode
 					t.Run("HTTP", func(t *testing.T) {
 						defer tests.PrintCurrentTest(t)()
 
@@ -1626,6 +2269,65 @@ func TestGitAnnexPermissions(t *testing.T) {
 							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
 						})
 
+						// Try unsetting annexurl
+						_, _, err := git.NewCommand(git.DefaultContext, "config", "--unset", "remote.origin.annexurl").RunStdString(&git.RunOpts{Dir: repoPath})
+						require.Error(t, err)
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("LocalDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexLocalDropTest(repoPath))
+						})
+
+						t.Run("Download", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("RemoteDrop", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexRemoteDropTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("Upload", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexUploadTest(remoteRepoPath, repoPath))
+						})
+
+						t.Run("TestremoteReadOnly", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadOnlyTest(repoPath))
+						})
+
+						t.Run("TestremoteReadWrite", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexTestremoteReadWriteTest(repoPath))
+						})
+					})
+
+					t.Run("P2PHTTP", func(t *testing.T) {
+						defer tests.PrintCurrentTest(t)()
+
+						repoURL := createHTTPUrl(ownerCtx.GitPath(), u)
+
+						repoPath := path.Join(t.TempDir(), ownerCtx.Reponame)
+						defer util.RemoveAll(repoPath) // cleans out git-annex lockdown permissions
+
+						withAnnexCtxHTTPPassword(t, u, ownerCtx, func() {
+							doGitClone(repoPath, repoURL)(t)
+						})
+
+						// unlike the other tests, at this step we *do not* define credentials:
+
+						t.Run("Init", func(t *testing.T) {
+							defer tests.PrintCurrentTest(t)()
+							require.Error(t, doAnnexInitTest(remoteRepoPath, repoPath))
+						})
+
 						t.Run("Download", func(t *testing.T) {
 							defer tests.PrintCurrentTest(t)()
 							require.Error(t, doAnnexDownloadTest(remoteRepoPath, repoPath))
@@ -2189,8 +2891,14 @@ func withAnnexCtxHTTPPassword(t *testing.T, u *url.URL, ctx APITestContext, call
 	credentialedURL := *u
 	credentialedURL.User = url.UserPassword(ctx.Username, userPassword) // NB: all test users use the same password
 
+	credentialedAnnexURL := *u
+	credentialedAnnexURL.Host = strings.ReplaceAll(credentialedAnnexURL.Host, "127.0.0.1", "localhost")
+	credentialedAnnexURL.Scheme = "annex+" + credentialedAnnexURL.Scheme
+	credentialedAnnexURL.Path += "git-annex-p2phttp"
+	credentialedAnnexURL.User = url.UserPassword(ctx.Username, userPassword) // NB: all test users use the same password
+
 	creds := path.Join(t.TempDir(), "creds")
-	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()), 0o600))
+	require.NoError(t, os.WriteFile(creds, []byte(credentialedURL.String()+"\n"+credentialedAnnexURL.String()+"\n"), 0o600))
 
 	originalCredentialHelper, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "config").AddOptionValues("--global", "credential.helper").RunStdString(&git.RunOpts{})
 	if err != nil && !git.IsErrorExitCode(err, 1) {

From aa6674de6e600fe3a0590b961d4a3baffcf4cf33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 25 Oct 2024 09:56:36 +0000
Subject: [PATCH 118/125] Simplify git blob to annex key lookup (#43)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #27.

Reviewed-on: https://codeberg.org/matrss/forgejo-aneksajo/pulls/43
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go              | 102 ++++------------------------
 tests/integration/git_annex_test.go |   6 +-
 2 files changed, 18 insertions(+), 90 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 7deb8ec2fa..3f998f06cc 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -21,96 +21,24 @@ import (
 
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
 )
 
-const (
-	// > The maximum size of a pointer file is 32 kb.
-	// - https://git-annex.branchable.com/internals/pointer_file/
-	// It's unclear if that's kilobytes or kibibytes; assuming kibibytes:
-	blobSizeCutoff = 32 * 1024
-)
+// ErrBlobIsNotAnnexed occurs if a blob does not contain a valid annex key
+var ErrBlobIsNotAnnexed = errors.New("not a git-annex pointer")
 
-// ErrInvalidPointer occurs if the pointer's value doesn't parse
-var ErrInvalidPointer = errors.New("Not a git-annex pointer")
-
-// Gets the content of the blob as raw text, up to n bytes.
-// (the pre-existing blob.GetBlobContent() has a hardcoded 1024-byte limit)
-func getBlobContent(b *git.Blob, n int) (string, error) {
-	dataRc, err := b.DataAsync()
+func LookupKey(blob *git.Blob) (string, error) {
+	stdout, _, err := git.NewCommand(git.DefaultContext, "annex", "lookupkey", "--ref").AddDynamicArguments(blob.ID.String()).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
 	if err != nil {
-		return "", err
+		return "", ErrBlobIsNotAnnexed
 	}
-	defer dataRc.Close()
-	buf := make([]byte, n)
-	n, _ = util.ReadAtMost(dataRc, buf)
-	buf = buf[:n]
-	return string(buf), nil
+	key := strings.TrimSpace(stdout)
+	return key, nil
 }
 
-func Pointer(blob *git.Blob) (string, error) {
-	// git-annex doesn't seem fully spec what its pointer are, but
-	// the fullest description is here:
-	// https://git-annex.branchable.com/internals/pointer_file/
-
-	// a pointer can be:
-	// the original format, generated by `git annex add`: a symlink to '.git/annex/objects/$HASHDIR/$HASHDIR2/$KEY/$KEY'
-	// the newer, git-lfs influenced, format, generated by `git annex smudge`: a text file containing '/annex/objects/$KEY'
-	//
-	// in either case we can extract the $KEY the same way, and we need not actually know if it's a symlink or not because
-	// git.Blob.DataAsync() works like open() + readlink(), handling both cases in one.
-
-	if blob.Size() > blobSizeCutoff {
-		// > The maximum size of a pointer file is 32 kb. If it is any longer, it is not considered to be a valid pointer file.
-		// https://git-annex.branchable.com/internals/pointer_file/
-
-		// It's unclear to me whether the same size limit applies to symlink-pointers, but it seems sensible to limit them too.
-		return "", ErrInvalidPointer
-	}
-
-	pointer, err := getBlobContent(blob, blobSizeCutoff)
+func ContentLocationFromKey(repoPath, key string) (string, error) {
+	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(key).RunStdString(&git.RunOpts{Dir: repoPath})
 	if err != nil {
-		return "", fmt.Errorf("error reading %s: %w", blob.Name(), err)
-	}
-
-	// the spec says a pointer file can contain multiple lines each with a pointer in them
-	// but that makes no sense to me, so I'm just ignoring all but the first
-	lines := strings.Split(pointer, "\n")
-	if len(lines) < 1 {
-		return "", ErrInvalidPointer
-	}
-	pointer = lines[0]
-
-	// in both the symlink and pointer-file formats, the pointer must have "/annex/" somewhere in it
-	if !strings.Contains(pointer, "/annex/") {
-		return "", ErrInvalidPointer
-	}
-
-	// extract $KEY
-	pointer = path.Base(strings.TrimSpace(pointer))
-
-	// ask git-annex's opinion on $KEY
-	// XXX: this is probably a bit slow, especially if this operation gets run often
-	//      and examinekey is not that strict:
-	//      - it doesn't enforce that the "BACKEND" tag is one it knows,
-	//      - it doesn't enforce that the fields and their format fit the "BACKEND" tag
-	//      so maybe this is a wasteful step
-	_, examineStderr, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "examinekey").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: blob.Repo().Path})
-	if err != nil {
-		// TODO: make ErrInvalidPointer into a type capable of wrapping err
-		if strings.TrimSpace(examineStderr) == "git-annex: bad key" {
-			return "", ErrInvalidPointer
-		}
-		return "", err
-	}
-
-	return pointer, nil
-}
-
-func ContentLocationFromPointer(repoPath, pointer string) (string, error) {
-	contentLocation, _, err := git.NewCommandContextNoGlobals(git.DefaultContext, "annex", "contentlocation").AddDynamicArguments(pointer).RunStdString(&git.RunOpts{Dir: repoPath})
-	if err != nil {
-		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", repoPath, pointer, err)
+		return "", fmt.Errorf("in %s: %s does not seem to be a valid annexed file: %w", repoPath, key, err)
 	}
 	contentLocation = strings.TrimSpace(contentLocation)
 	contentLocation = path.Clean("/" + contentLocation)[1:] // prevent directory traversals
@@ -122,11 +50,11 @@ func ContentLocationFromPointer(repoPath, pointer string) (string, error) {
 // return the absolute path of the content pointed to by the annex pointer stored in the git object
 // errors if the content is not found in this repo
 func ContentLocation(blob *git.Blob) (string, error) {
-	pointer, err := Pointer(blob)
+	key, err := LookupKey(blob)
 	if err != nil {
 		return "", err
 	}
-	return ContentLocationFromPointer(blob.Repo().Path, pointer)
+	return ContentLocationFromKey(blob.Repo().Path, key)
 }
 
 // returns a stream open to the annex content
@@ -147,11 +75,11 @@ func IsAnnexed(blob *git.Blob) (bool, error) {
 		return false, nil
 	}
 
-	// Pointer() is written to only return well-formed pointers
+	// LookupKey is written to only return well-formed keys
 	// so the test is just to see if it errors
-	_, err := Pointer(blob)
+	_, err := LookupKey(blob)
 	if err != nil {
-		if errors.Is(err, ErrInvalidPointer) {
+		if errors.Is(err, ErrBlobIsNotAnnexed) {
 			return false, nil
 		}
 		return false, err
diff --git a/tests/integration/git_annex_test.go b/tests/integration/git_annex_test.go
index 89e86cf932..efcb571aa2 100644
--- a/tests/integration/git_annex_test.go
+++ b/tests/integration/git_annex_test.go
@@ -2576,16 +2576,16 @@ func doAnnexUploadTest(remoteRepoPath, repoPath string) (err error) {
 	if err != nil {
 		return err
 	}
-	key, err := annex.Pointer(blob)
+	key, err := annex.LookupKey(blob)
 	if err != nil {
 		return err
 	}
-	localObjectPath, err := annex.ContentLocationFromPointer(repoPath, key)
+	localObjectPath, err := annex.ContentLocationFromKey(repoPath, key)
 	if err != nil {
 		return err
 	}
 
-	remoteObjectPath, err := annex.ContentLocationFromPointer(remoteRepoPath, key)
+	remoteObjectPath, err := annex.ContentLocationFromKey(remoteRepoPath, key)
 	if err != nil {
 		return err
 	}

From 4b75d408538f1e14c519a216790c9e00a8422170 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Tue, 29 Oct 2024 11:45:40 +0000
Subject: [PATCH 119/125] Add an OCI image build and publish workflow (#50)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #49.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/50
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 .forgejo/workflows/build-oci-image.yml | 37 ++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .forgejo/workflows/build-oci-image.yml

diff --git a/.forgejo/workflows/build-oci-image.yml b/.forgejo/workflows/build-oci-image.yml
new file mode 100644
index 0000000000..9eabdf3eab
--- /dev/null
+++ b/.forgejo/workflows/build-oci-image.yml
@@ -0,0 +1,37 @@
+on:
+  push:
+    branches:
+      - 'forgejo'
+    tags:
+      - '*-git-annex*'
+
+jobs:
+  build-oci-image:
+    runs-on: docker
+    strategy:
+      matrix:
+        type: ["rootful", "rootless"]
+    steps:
+      - name: Determine registry and username
+        id: determine-registry-and-username
+        run: |
+          echo "registry=${GITHUB_SERVER_URL#https://}" >> "$GITHUB_OUTPUT"
+          echo "username=${GITHUB_REPOSITORY%/*}" >> "$GITHUB_OUTPUT"
+      - name: Install Docker
+        run: curl -fsSL https://get.docker.com | sh
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ steps.determine-registry-and-username.outputs.registry }}
+          username: ${{ steps.determine-registry-and-username.outputs.username }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          file: ${{ (matrix.type == 'rootful' && 'Dockerfile') || (matrix.type == 'rootless' && 'Dockerfile.rootless') }}
+          push: true
+          tags: ${{ steps.determine-registry-and-username.outputs.registry }}/${{ github.repository }}:${{ github.ref_name }}${{ (matrix.type == 'rootful' && ' ') || (matrix.type == 'rootless' && '-rootless') }}

From 99d2de89566c178cd96f18ad47e90cd80dae04e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Sat, 2 Nov 2024 15:00:59 +0000
Subject: [PATCH 120/125] Fix Forgejo version in published OCI images (#51)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Forgejo version is derived from the git history, so the image build
needs to happen in the context of a full repository clone.

Also, the post-processing of the version string needs to remove the
second occurrence of "-g", as the first one is now part of the added
"-git-annex" part.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/51
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 .forgejo/workflows/build-oci-image.yml | 4 ++++
 Makefile                               | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/build-oci-image.yml b/.forgejo/workflows/build-oci-image.yml
index 9eabdf3eab..8e843b41ee 100644
--- a/.forgejo/workflows/build-oci-image.yml
+++ b/.forgejo/workflows/build-oci-image.yml
@@ -12,6 +12,9 @@ jobs:
       matrix:
         type: ["rootful", "rootless"]
     steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # fetch the full history so that the Forgejo version is determined properly
       - name: Determine registry and username
         id: determine-registry-and-username
         run: |
@@ -32,6 +35,7 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
+          context: .
           file: ${{ (matrix.type == 'rootful' && 'Dockerfile') || (matrix.type == 'rootless' && 'Dockerfile.rootless') }}
           push: true
           tags: ${{ steps.determine-registry-and-username.outputs.registry }}/${{ github.repository }}:${{ github.ref_name }}${{ (matrix.type == 'rootful' && ' ') || (matrix.type == 'rootless' && '-rootless') }}
diff --git a/Makefile b/Makefile
index 95658a7842..561d674198 100644
--- a/Makefile
+++ b/Makefile
@@ -104,7 +104,7 @@ else
     FORGEJO_VERSION_API ?= $(GITEA_VERSION)+${GITEA_COMPATIBILITY}
   else
     # drop the "g" prefix prepended by git describe to the commit hash
-    FORGEJO_VERSION ?= $(shell git describe --exclude '*-test' --tags --always | sed 's/^v//' | sed 's/\-g/-/')+${GITEA_COMPATIBILITY}
+    FORGEJO_VERSION ?= $(shell git describe --exclude '*-test' --tags --always | sed 's/^v//' | sed 's/\-g/-/2')+${GITEA_COMPATIBILITY}
   endif
 endif
 FORGEJO_VERSION_MAJOR=$(shell echo $(FORGEJO_VERSION) | sed -e 's/\..*//')

From aa683cb1e2024c7ad4b97814a8a37e6b112680e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 6 Nov 2024 14:29:39 +0000
Subject: [PATCH 121/125] Explicitly set http(s) default ports in annex.url
 (#55)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise, git-annex tries to use its own default port (9417) and fails.

Fixes #52.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/55
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 routers/web/repo/githttp.go | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index b9354dd45a..53f18f9617 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -10,6 +10,7 @@ import (
 	gocontext "context"
 	"fmt"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -574,7 +575,23 @@ func GetConfig(ctx *context.Context) {
 			return
 		}
 		if !setting.Annex.DisableP2PHTTP {
-			config = append(config, []byte("[annex]\n\turl = annex+"+setting.AppURL+"git-annex-p2phttp\n")...)
+			appURL, err := url.Parse(setting.AppURL)
+			if err != nil {
+				log.Error("Could not parse 'setting.AppURL': %v", err)
+				ctx.Resp.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+			if appURL.Port() == "" {
+				// If there is no port set then set the http(s) default ports.
+				// Without this, git-annex would try its own default port (9417) and fail.
+				if appURL.Scheme == "http" {
+					appURL.Host += ":80"
+				}
+				if appURL.Scheme == "https" {
+					appURL.Host += ":443"
+				}
+			}
+			config = append(config, []byte("[annex]\n\turl = annex+"+appURL.String()+"git-annex-p2phttp\n")...)
 		}
 		ctx.Resp.Header().Set("Content-Type", "text/plain")
 		ctx.Resp.Header().Set("Content-Length", fmt.Sprintf("%d", len(config)))

From 22855c62385ca00522a6502ef392e1ac3ec19221 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Wed, 6 Nov 2024 16:22:29 +0000
Subject: [PATCH 122/125] Cache git-annex UUID to repository path mappings
 (#54)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Always walking the filesystem and searching for UUIDs slowed p2phttp
operations down significantly on a production server with more than a
handful of repositories. This caching strategy ensures that only the
first call is rather slow, and subsequent ones should be much faster.

This should better be implemented as a background job, but for now this
is a simple solution to the problem.

Fixes #53.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/54
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 3f998f06cc..7b499fe3f1 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -95,25 +95,43 @@ func IsAnnexRepo(repo *git.Repository) bool {
 
 var repoConfigFileRe = regexp.MustCompile("[^/]+/[^/]+.git/config$")
 
-func UUID2RepoPath(uuid string) (string, error) {
-	var repoPath string
-	err := filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
+var (
+	uuid2repoPathCache = make(map[string]string)
+	repoPath2uuidCache = make(map[string]string)
+)
+
+func updateUUID2RepoPathCache() error {
+	return filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
 		if err == nil && repoConfigFileRe.MatchString(path) {
 			thisRepoPath := strings.TrimSuffix(path, "/config")
+			_, ok := repoPath2uuidCache[thisRepoPath]
+			if ok {
+				return nil
+			}
 			stdout, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: thisRepoPath})
 			if err != nil {
 				return nil
 			}
 			repoUUID := strings.TrimSpace(stdout)
-			if repoUUID == uuid {
-				repoPath = thisRepoPath
-				return fs.SkipAll
+			if repoUUID != "" {
+				uuid2repoPathCache[repoUUID] = thisRepoPath
+				repoPath2uuidCache[thisRepoPath] = repoUUID
 			}
 		}
 		return nil
 	})
-	if err != nil {
+}
+
+func UUID2RepoPath(uuid string) (string, error) {
+	if repoPath, ok := uuid2repoPathCache[uuid]; ok {
+		return repoPath, nil
+	}
+	// If the cache didn't contain an entry for the UUID then update the cache and try again
+	if err := updateUUID2RepoPathCache(); err != nil {
 		return "", err
 	}
-	return repoPath, nil
+	if repoPath, ok := uuid2repoPathCache[uuid]; ok {
+		return repoPath, nil
+	}
+	return "", fmt.Errorf("no repository known for UUID '%s'", uuid)
 }

From efe77599e684cba86b5ead7938ebd8255859d388 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 30 Jan 2025 10:50:48 +0000
Subject: [PATCH 123/125] Pre-populate the git-annex UUID cache at startup
 (#59)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This eliminates the wait time for the first p2phttp connection since
server startup at the cost of adding that time to the startup itself.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/59
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go | 9 +++++++++
 routers/init.go        | 3 +++
 2 files changed, 12 insertions(+)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 7b499fe3f1..a94321f359 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -20,6 +20,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 )
 
@@ -100,6 +101,14 @@ var (
 	repoPath2uuidCache = make(map[string]string)
 )
 
+func Init() error {
+	if !setting.Annex.Enabled {
+		return nil
+	}
+	log.Info("Populating the git-annex UUID cache with existing repositories")
+	return updateUUID2RepoPathCache()
+}
+
 func updateUUID2RepoPathCache() error {
 	return filepath.WalkDir(setting.RepoRootPath, func(path string, d fs.DirEntry, err error) error {
 		if err == nil && repoConfigFileRe.MatchString(path) {
diff --git a/routers/init.go b/routers/init.go
index 821a0ef38c..d881edd030 100644
--- a/routers/init.go
+++ b/routers/init.go
@@ -11,6 +11,7 @@ import (
 	"code.gitea.io/gitea/models"
 	asymkey_model "code.gitea.io/gitea/models/asymkey"
 	authmodel "code.gitea.io/gitea/models/auth"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/eventsource"
 	"code.gitea.io/gitea/modules/git"
@@ -167,6 +168,8 @@ func InitWebInstalled(ctx context.Context) {
 
 	actions_service.Init()
 
+	mustInit(annex.Init)
+
 	// Finally start up the cron
 	cron.NewContext(ctx)
 }

From 0ee62840ff1ad29ade632a1e98e63f37ca5f50ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Thu, 30 Jan 2025 16:44:59 +0000
Subject: [PATCH 124/125] Invalidate outdated annex UUID cache entries (#60)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous implementation could lead to errors e.g. when a repository
was removed and a new one with a new UUID was created under the same
name. This now checks the validity of the retrieved cache entry every
time and invalidates the cache if necessary.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/60
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go | 36 +++++++++++++++++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index a94321f359..9a70612a1e 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -131,7 +131,7 @@ func updateUUID2RepoPathCache() error {
 	})
 }
 
-func UUID2RepoPath(uuid string) (string, error) {
+func repoPathFromUUIDCache(uuid string) (string, error) {
 	if repoPath, ok := uuid2repoPathCache[uuid]; ok {
 		return repoPath, nil
 	}
@@ -144,3 +144,37 @@ func UUID2RepoPath(uuid string) (string, error) {
 	}
 	return "", fmt.Errorf("no repository known for UUID '%s'", uuid)
 }
+
+func checkValidity(uuid, repoPath string) (bool, error) {
+	stdout, _, err := git.NewCommand(git.DefaultContext, "config", "annex.uuid").RunStdString(&git.RunOpts{Dir: repoPath})
+	if err != nil {
+		return false, err
+	}
+	repoUUID := strings.TrimSpace(stdout)
+	return uuid == repoUUID, nil
+}
+
+func removeCachedEntries(uuid, repoPath string) {
+	delete(uuid2repoPathCache, uuid)
+	delete(repoPath2uuidCache, repoPath)
+}
+
+func UUID2RepoPath(uuid string) (string, error) {
+	// Get the current cache entry for the UUID
+	repoPath, err := repoPathFromUUIDCache(uuid)
+	if err != nil {
+		return "", err
+	}
+	// Check if it is still up-to-date
+	valid, err := checkValidity(uuid, repoPath)
+	if err != nil {
+		return "", err
+	}
+	if !valid {
+		// If it isn't, remove the cache entry and try again
+		removeCachedEntries(uuid, repoPath)
+		return UUID2RepoPath(uuid)
+	}
+	// Otherwise just return the cached entry
+	return repoPath, nil
+}

From c5b3812553e8159f7df14b55863aa22d542e09a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matthias=20Ri=C3=9Fe?= <m.risse@fz-juelich.de>
Date: Fri, 31 Jan 2025 00:43:20 +0000
Subject: [PATCH 125/125] Use annexed content for comparison in diffs (#57)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This makes it such that annexed files are treated like plain git files
in comparisons (e.g. the diff of a commit).

It also changes the image diff viewer to show a more reasonable error
message when one of the annexed files under comparison is missing.

Fixes #56.

Reviewed-on: https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo/pulls/57
Co-authored-by: Matthias Riße <m.risse@fz-juelich.de>
Co-committed-by: Matthias Riße <m.risse@fz-juelich.de>
---
 modules/annex/annex.go           | 12 ++++++++++++
 routers/web/repo/compare.go      | 27 +++++++++++++++++++++------
 web_src/js/features/imagediff.js | 12 +++++++++++-
 3 files changed, 44 insertions(+), 7 deletions(-)

diff --git a/modules/annex/annex.go b/modules/annex/annex.go
index 9a70612a1e..dee24d21bc 100644
--- a/modules/annex/annex.go
+++ b/modules/annex/annex.go
@@ -22,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/typesniffer"
 )
 
 // ErrBlobIsNotAnnexed occurs if a blob does not contain a valid annex key
@@ -178,3 +179,14 @@ func UUID2RepoPath(uuid string) (string, error) {
 	// Otherwise just return the cached entry
 	return repoPath, nil
 }
+
+// GuessContentType guesses the content type of the annexed blob.
+func GuessContentType(blob *git.Blob) (typesniffer.SniffedType, error) {
+	r, err := Content(blob)
+	if err != nil {
+		return typesniffer.SniffedType{}, err
+	}
+	defer r.Close()
+
+	return typesniffer.DetectContentTypeFromReader(r)
+}
diff --git a/routers/web/repo/compare.go b/routers/web/repo/compare.go
index 03d49fa692..104655e134 100644
--- a/routers/web/repo/compare.go
+++ b/routers/web/repo/compare.go
@@ -23,6 +23,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/annex"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/charset"
 	csv_module "code.gitea.io/gitea/modules/csv"
@@ -72,7 +73,21 @@ func setCompareContext(ctx *context.Context, before, head *git.Commit, headOwner
 			return st
 		}
 
-		st, err := blob.GuessContentType()
+		isAnnexed, err := annex.IsAnnexed(blob)
+		if err != nil {
+			log.Error("IsAnnexed failed: %v", err)
+			return st
+		}
+		if isAnnexed {
+			st, err = annex.GuessContentType(blob)
+			if err != nil {
+				log.Error("GuessContentType failed: %v", err)
+				return st
+			}
+			return st
+		}
+
+		st, err = blob.GuessContentType()
 		if err != nil {
 			log.Error("GuessContentType failed: %v", err)
 			return st
@@ -90,18 +105,18 @@ func SourceCommitURL(owner, name string, commit *git.Commit) string {
 	return setting.AppSubURL + "/" + url.PathEscape(owner) + "/" + url.PathEscape(name) + "/src/commit/" + url.PathEscape(commit.ID.String())
 }
 
-// RawCommitURL creates a relative URL for the raw commit in the given repository
-func RawCommitURL(owner, name string, commit *git.Commit) string {
-	return setting.AppSubURL + "/" + url.PathEscape(owner) + "/" + url.PathEscape(name) + "/raw/commit/" + url.PathEscape(commit.ID.String())
+// MediaCommitURL creates a relative URL for the commit media (plain git, LFS, or annex content) in the given repository
+func MediaCommitURL(owner, name string, commit *git.Commit) string {
+	return setting.AppSubURL + "/" + url.PathEscape(owner) + "/" + url.PathEscape(name) + "/media/commit/" + url.PathEscape(commit.ID.String())
 }
 
 // setPathsCompareContext sets context data for source and raw paths
 func setPathsCompareContext(ctx *context.Context, base, head *git.Commit, headOwner, headName string) {
 	ctx.Data["SourcePath"] = SourceCommitURL(headOwner, headName, head)
-	ctx.Data["RawPath"] = RawCommitURL(headOwner, headName, head)
+	ctx.Data["RawPath"] = MediaCommitURL(headOwner, headName, head)
 	if base != nil {
 		ctx.Data["BeforeSourcePath"] = SourceCommitURL(headOwner, headName, base)
-		ctx.Data["BeforeRawPath"] = RawCommitURL(headOwner, headName, base)
+		ctx.Data["BeforeRawPath"] = MediaCommitURL(headOwner, headName, base)
 	}
 }
 
diff --git a/web_src/js/features/imagediff.js b/web_src/js/features/imagediff.js
index d1b139ffde..52c9017b07 100644
--- a/web_src/js/features/imagediff.js
+++ b/web_src/js/features/imagediff.js
@@ -92,7 +92,17 @@ export function initImageDiff() {
         return loadElem(img, info.path);
       }));
       // only the first images is associated with $boundsInfo
-      if (!success) info.$boundsInfo.text('(image error)');
+      if (!success) {
+        const blobContent = await GET(info.path.replace('/media/', '/raw/')).then((response) => response.text());
+        if (blobContent.startsWith('.git/annex/objects')) {
+          for (const item of document.querySelectorAll('.image-diff .overflow-menu-items .item')) {
+            item.style.display = 'none';
+          }
+          info.$boundsInfo[0].parentElement.textContent = 'annexed file is not present on the server';
+        } else {
+          info.$boundsInfo.text('(image error)');
+        }
+      }
       if (info.mime === 'image/svg+xml') {
         const resp = await GET(info.path);
         const text = await resp.text();