always check numcopies when moving from cluster

When the destination does not start with a copy, the cluster has one or
more copies. If more, dropping would reduce the number of copies, so
numcopies must be checked.

Considered checking how many nodes of the cluster contain a copy. If
only 1 node does, it could allow a move without checking numcopies.
The problem with that, though, is that other nodes of the cluster could
have copies that we don't know about. And dropping from a cluster tries
to drop from all nodes, so will drop even from those. So any drop from a
cluster can remove more than 1 copy.

diff --git a/Command/Move.hs b/Command/Move.hs
index 0d988955625420100c442bd366a3a0ad44debd0a..7dd638953f0fd5d5f304cde28be22186876ebb60 100644 (file)
--- a/Command/Move.hs
+++ b/Command/Move.hs
@@ -1,6 +1,6 @@
 {- git-annex command
  -
- - Copyright 2010-2023 Joey Hess <id@joeyh.name>
+ - Copyright 2010-2024 Joey Hess <id@joeyh.name>
  -
  - Licensed under the GNU AGPL version 3 or higher.
  -}
@@ -20,6 +20,7 @@ import Logs.Trust
 import Logs.File
 import Logs.Location
 import Annex.NumCopies
+import Types.Cluster
 
 import qualified Data.ByteString.Char8 as B8
 import qualified Data.ByteString.Lazy as L
@@ -502,7 +503,8 @@ fromToPerform src dest removewhen key afile = do
  - On the other hand, when the destination repository did not start
  - with a copy of a file, it can be dropped from the source without
  - making numcopies worse, so the move is allowed even if numcopies
- - is not met.
+ - is not met. (However, when the source is a cluster, dropping from it 
+ - drops from all nodes, and so numcopies must be checked.)
  -
  - Similarly, a file can move from an untrusted repository to another
  - untrusted repository, even if that is the only copy of the file.
@@ -519,7 +521,7 @@ fromToPerform src dest removewhen key afile = do
 willDropMakeItWorse :: UUID -> UUID -> DestStartedWithCopy -> Key -> AssociatedFile -> Annex DropCheck
 willDropMakeItWorse srcuuid destuuid (DestStartedWithCopy deststartedwithcopy _) key afile =
        ifM (Command.Drop.checkRequiredContent (Command.Drop.PreferredContentChecked False) srcuuid key afile)
-               ( if deststartedwithcopy
+               ( if deststartedwithcopy || isClusterUUID srcuuid
                        then unlessforced DropCheckNumCopies
                        else ifM checktrustlevel
                                ( return DropAllowed

diff --git a/doc/todo/git-annex_proxies.mdwn b/doc/todo/git-annex_proxies.mdwn
index 5e3c7f5bb1e90413fddae038df301d283e29e3df..6458415e720264381fc73f25388ddf2d8b0f6d40 100644 (file)
--- a/doc/todo/git-annex_proxies.mdwn
+++ b/doc/todo/git-annex_proxies.mdwn
@@ -67,10 +67,6 @@ For June's work on [[design/passthrough_proxy]], implementation plan:
   protocol. (done, but need to check for fencepost errors on resume of
   incomplete upload with remotes at different points)
 
-* Problem: `move --from cluster` in "does this make it worse"
-  check may fail to realize that dropping from multiple nodes does in fact
-  make it worse.
-
 * `git-annex sync --content` does not send content to clusters, or to
   proxied remotes. And when operating on clusters, it should operate on the
   cluster as a whole, not on cluster nodes.