The `AddRemote()` and `RemoveRemote()` RPCs are currently the only ones
which don't cast transactional votes in production. As a result, all
secondaries are always considered as outdated whenever we for example
update object pools or mirrors. Given that these RPCs are typically
executed before these long running actions, the net result is that
secondaries will be out of date most of the time.

Fix the issue by adding transactional voting for `AddRemote()` and
`RemoveRemote()`. In both cases, voting is done on the remote
configuration only, and not on the complete configuration. This may be
inaccurate as the remote may be influenced by other configuration like
for example the `http.<url>.` config entries. But given that we do not
synchronize configuration on replication, it may be risky to instead
vote on the complete configuration as it may have diverged across nodes
and would never recover even after a replication job got processed.

Given that these RPCs are about to be phased out soonish anyway, we just
ignore this issue for now. At least for a subset of fetches, this change
will likely not yet enable transactional behaviour. Instead, we may see
a shift to missing votes in `SetConfig()`, which is used to set up
credentials. We can fix this issue in a follow-up though, especially so
because at that time we'll also need to have replication of the config
to recover from failed votes.

Changelog: added

Neither the `AddRemote()` nor the `RemoveRemote()` RPCs currently handle
transactional voting. This is about to change in subsequent commits. But
given that it's got some risk involved we want to do it behind a feature
flag, which we introduce now.

The remote service setup functions do not accept testserver options,
which makes it impossible to override a subset of dependencies. Refactor
them to accept options.

We're about to start using the transaction manager in the remote
service. Inject it as a preparatory step.

Fix lint task on MacOS

See merge request gitlab-org/gitaly!3488

config: update a bin_dir of config.toml.example

See merge request gitlab-org/gitaly!3503

A default usage of `make` does compile binaries
in `_build/bin`. To make a `config.toml.example`
be easy to use in a default setting this aligns
`bin_dir` with this change.

If a `make install` is done, a default `DESTDIR=/usr/local/bin`
a `bin_dir` needs to be aligned as well.

TestUser moved into the gittest package

See merge request gitlab-org/gitaly!3498

Fix improperly designed test case for command

See merge request gitlab-org/gitaly!3422

Fix Gitaly seg fault when creating new projects

Closes #3621

See merge request gitlab-org/gitaly!3501

The refactoring in
https://gitlab.com/gitlab-org/gitaly/-/merge_requests/3477 omitted the
cache invalidator argument in one area, leading to a seg fault when a
project was created.

Closes https://gitlab.com/gitlab-org/gitaly/-/issues/3621

Remove GrpcErrorHasMessage test helper

See merge request gitlab-org/gitaly!3497

Set restrictive permissions on backup files

See merge request gitlab-org/gitaly!3481

Remove testhelper.CloneRepoWithWorktree

See merge request gitlab-org/gitaly!3468

CloneRepoWithWorktree function relies on the global config.Config
variable and as we are on the road to remove it from the code we
drop CloneRepoWithWorktree function and replaces its usages with
an alternative CloneRepoWithWorktreeAtStorage function call.

Part of: https://gitlab.com/gitlab-org/gitaly/-/issues/2699

Break dependency of the CloneRepoAtStorage on the global config.Config

See merge request gitlab-org/gitaly!3466

Mark Repository service's Fsck as an accssor

See merge request gitlab-org/gitaly!3499

In order to get rid of the global variable config.Config we change
CloneRepoAtStorage function to accept config.Cfg as an input parameter.
We use locally defined instance of the config.Cfg type to call modified
function, so the usage of it is no longer depend on the config.Config
variable.

Part of: https://gitlab.com/gitlab-org/gitaly/-/issues/2699

cache: Refactor package to get rid of global state

See merge request gitlab-org/gitaly!3477

Repository service's Fsck method performs a `git fsck` on a repository
to verify its integrity. This is a read-only operation but is incorrectly
marked as a mutator. This commit marks the RPC as an accessor.

Changelog: fixed

Factor out stats collector cleanup

See merge request gitlab-org/gitaly!3443

Replace MergeOutgoingMetadata with new GitalyServersMetadataFromCfg

See merge request gitlab-org/gitaly!3465

Now that the last user of the global configuration hooks is gone, let's
remove them.

The `Cache` structure is now the single gatekeeper to interact with disk
caches. As such, we can use it to host all counters and get rid of the
global metric variables.

Now that the `Cache` structure is the only interface external callers
interact with, let's make the `LeaseKeyer` structure internal to the
cache package.

With the preceding commit, the `Cache` has been converted to be the
primary gatekeeper of leases and is thus the central authority to all
things disk caches. The middleware is still using an ad-hoc created
LeaseKeyer instead of the global cache.

Inject the global cache into the server factory and use it as cache
invalidator.

It's currently the LeaseKeyer's responsibility to create leases. This is
an awkward interface to use because we cannot reuse information hosted
in the `Cache` structure itself, and arguably it should be the `Cache`'s
responsibility to be the gatekeeper of all leases. The result is that we
have implicitly shared state between leasers and disk caches where both
must be created with the same set of parameters, otherwise we'll run
into hard to debug issues. One location where this shows is the
middleware, which creates another ad-hoc leaser to invalidate caches --
which again, should really be handled by the cache structure itself.

As a preparatory step to disentangle this mess, implement the Leaser
interface for the `Cache` structure by forwarding calls to `StartLease`
to its keyer.

`TestNewCommandProxyEnv` is designed to prove that http proxy related
envs can be whitelisted from environments and export to git spawn
later. But the current test just passed proxy related envs directly
into `New`, making the test meaningless.

Furthermore, a new test `TestNewCommandExportedEnv` is added to merge
`TestNewCommandTZEnv` and `TestNewCommandProxyEnv` together, as they
are actually testing the same thing.

Another test `TestNewCommandUnexportedEnv` is added as a negative
case proving that envs will not be exported to git spawn if they are
not on the white list.

Signed-off-by: blanet <bupt_xingxin@163.com>

In order to remove ad-hoc creations of the disk cache, this commit
starts to inject it via service dependencies. By doing this, we can get
rid of state that is currently tracked via global variables eventually.

We'll be moving the walker implementation into the `Cache` structure and
will thus require information about configured storages. Prepare for
this by injecting the Gitaly config and locator now already.

The primary structure of the cache package is currently called
`StreamDB`, which is a bit confusing. Given that no new cache types have
been added to the package over the two years where the disk cache has
existed, let's rename it to `Cache` to make it the primary exported
structure of the package. This also prepares for a world where no other
types will be exported by it because everything else is an internal
implementation detail.

Metrics for the disk cache are currently implemented in a file called
"prometheus.go", while its test helpers are located in "export_test.go".
Rename both to "metrics{,_test}.go" to make their association clearer.

The tests for our disk cache are hosted in a separate package
"cache_test" ever since their inception in 87dec4f8 (Lease-based disk
cache strategy, 2019-07-12). An educated guess is that this has
originally been done to avoid cyclic imports, but in any case there is
none nowadays.

Remove the split and move tests into the normal code package again. This
will grant us the ability to make more implementation details private
without compromising on testability.

Remove unused test gRPC server setup code

See merge request gitlab-org/gitaly!3492

The call 'git config gittest.TestUser.name test@example.com'
creates a new configuration entry, but it has no any effect
for the test. Those calls removed as they are redundant.

TestUser is a hardcoded value that describes a git
user. As it is part of the git stuff it is moved
into the related package - gittest.

All usages of the MergeOutgoingMetadata function were replaced
with the new GitalyServersMetadataFromCfg function call.
As it is not used anymore we remove it from the source code.

The old MergeOutgoingMetadata function uses hardcoded values to
fill the headers for the gRPC request and propagates only a single
address. The new function uses all addresses defined on the context
and no hardcoded values.

There is no much sense in use of the GrpcErrorHasMessage
helper function. It is better to use equality check for
the received error and expected result as in that case
you check both - the error message and the status code,
so we are more confident about the implementation and
a contract.

Simplified check for file existence in the tests

See merge request gitlab-org/gitaly!3493