Age	Commit message (Collapse)	Author	Lines
22 hours	Page a followed log by the name asked for	Bryce Kwon	-6/+15
	Each row of a followed log moves ctx.qry.vpath to the name its commit knew the file by, and the pager built its links from that, so past a rename both links named the old file and led to an empty page.
22 hours	Show the root commit in a followed log	Bryce Kwon	-13/+50
	A followed log diffs each commit against its parent to learn whether the file changed there, and a root commit was skipped rather than diffed against the empty tree, so a file created in the first commit never showed that commit.
22 hours	Peel an annotated tag before looking for a readme	Bryce Kwon	-0/+15
	Tag links carry the tag name as the head, so on any page reached from an annotated tag the about tab vanished and the about page redirected to the summary.
22 hours	Encode repository urls and the feed branch	Bryce Kwon	-27/+67
	Links built from the repository url, among them the description link on the index and the Atom and refs links, wrote it as configured, so a name holding a space, '#' or '?' broke them. The feed link in the page head did the same with the branch, which turned a '+' into a space.
22 hours	Hold object sizes in size_t as git 2.55 does	Bryce Kwon	-37/+37
	Git 2.55 moved object sizes from unsigned long to size_t. The two are the same type on 64-bit hosts, but not on a 32-bit one, where GCC 14 rejects the mismatched pointers, so cgit stopped compiling there.
36 hours	Say how to build cgit on musl	Bryce Kwon	-0/+6
	Git's code there needs the kernel headers and its bundled regex, and the build failed with nothing to say so.
36 hours	Build Git without translations or Tcl tools	Bryce Kwon	-10/+11
	cgit never shows Git's translations or runs its Tcl tools, yet building needed libintl and msgfmt for one and, under make test, tclsh for the other, which a musl system such as Alpine lacks.
36 hours	Name every Lua filter failure in the log	Bryce Kwon	-9/+30
	A script raising anything but a string handed die a null to print, and a Lua state that could not be created was used anyway once the filter closed.
36 hours	Let a Lua script write while it loads	Bryce Kwon	-2/+26
	A script's top level runs before cgit hooks stdout for it, and the unhook html() began with tripped an assert that aborted cgit.
36 hours	Claim and test Lua 5.5 for every extension	Bryce Kwon	-20/+20
	luaossl from release 20260910 and luaposix load under Lua 5.5, and cgit renders the same pages under it as under LuaJIT. Running the suites there already caught a write to a for loop's control variable, which 5.5 makes read-only.
36 hours	Detect Lua 5.5 when building	Bryce Kwon	-4/+4
	cgit builds against Lua 5.5 and serves the same pages with it, but a host whose only Lua was 5.5 got a binary without Lua from the search.
36 hours	Drop the highlighter's stale guard and dead branch	Bryce Kwon	-11/+2
	cgit runs as a CGI, so no interpreter outlives its request, and the lexers load once per process. The loop below already wrote nothing for an empty blob.
36 hours	Find a script's lexer from its shebang line	Bryce Kwon	-7/+16
	Scintillua's detect reads the first line as well as the name, and without it hooks, bin scripts and anything else lacking an extension stayed plain.
36 hours	Ship the example tracker links commented out	Bryce Kwon	-24/+43
	An unedited copy sent every #123, Closes: and Bug: mark to bugs.example.com, a link that is wrong for every site.
36 hours	Say that a protected repository stays on the index	Bryce Kwon	-0/+8
36 hours	Name the auth cookie __Host- where it can be	Bryce Kwon	-30/+71
	Without the prefix any host under the same domain could set a cgitauth cookie of its own, signing a visitor in as someone else or out.
36 hours	End a session when its account's hash changes	Bryce Kwon	-62/+108
	A session stayed good for its whole week after the password changed or the account went away, which is when ending it matters most.
36 hours	Load auth libraries only when a request needs one	Bryce Kwon	-18/+63
	Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
36 hours	Say which hash kinds each system's crypt checks	Bryce Kwon	-4/+27
	The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead.
37 hours	Spend a missing account's login on a real hash	Bryce Kwon	-57/+99
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
37 hours	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-2/+32
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
37 hours	Read the auth cookie in linear time	Bryce Kwon	-14/+52
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
37 hours	Offer avatars at twice the size to dense screens	Bryce Kwon	-14/+23
	The 13 pixel icon came out blurred on the high density screens most phones and laptops have.
37 hours	Hash avatar addresses with SHA-256	Bryce Kwon	-13/+16
	Gravatar's documentation now describes SHA-256 hashes on gravatar.com alone, and Libravatar has long accepted them beside MD5.
37 hours	Mark avatar icons as decorative	Bryce Kwon	-11/+7
	A screen reader announced the service's name before every author.
37 hours	Unwrap an avatar address in linear time	Bryce Kwon	-6/+19
	An author email of 16,000 "<" took three quarters of a second per log row, and one of 64,000 took twelve seconds.
37 hours	Draw no avatar when luaossl is missing	Bryce Kwon	-15/+41
	The require at the top raised as cgit loaded the filter, so every page that lists an author stopped at its first author cell with an error.
38 hours	Drop the table loop's dead blank-line test	Bryce Kwon	-1/+1
	A line holding a pipe is never blank.
38 hours	Compare the cached page with the uncached one whole	Bryce Kwon	-5/+1
	The footer lost the time it was generated at in 2018, and both runs come from the same binary, so the two pages have nothing to differ in.
38 hours	Give an empty repository's clone table its hooks	Bryce Kwon	-10/+21
	It was a bare table.list with no name, section or label, the one listing that broke what the README promises a theme.
38 hours	Check every markup hook the README names	Bryce Kwon	-8/+84
	The README promised that t0005 checked them all, while fourteen went unchecked, and three of its claims were too broad. A date shown in full carries no age hooks, line anchors follow enable-tree-linenumbers and cgit.css also styles html.cgit-standalone.
38 hours	Complete the README's pages and query parameters	Bryce Kwon	-3/+14
38 hours	List everything make install puts in place	Bryce Kwon	-3/+4
38 hours	Add blame to the source filter and line number docs	Bryce Kwon	-15/+23
38 hours	Name every trailer link-trailers.lua links	Bryce Kwon	-6/+6
38 hours	Say that js may be given more than once	Bryce Kwon	-3/+24
38 hours	Fix the sample cgitrc's defaults and value syntax	Bryce Kwon	-13/+16
38 hours	Add html serving to the scanned cgitrc trust list	Bryce Kwon	-3/+4
	1456483 gated the key and named it under trust-scan-config, but this section kept the list from before.
38 hours	Describe root-readme as the site's about page	Bryce Kwon	-18/+36
38 hours	Say which filters get the repository variables	Bryce Kwon	-1/+15
38 hours	Leave readme out of what scan-path fixes	Bryce Kwon	-3/+15
38 hours	Name the log link that enable-index-links adds	Bryce Kwon	-3/+12
	The manual has named the commit page since it was written in 2008, a year after the index started linking the log instead.
38 hours	Give readme headings anchors like GitHub's	Bryce Kwon	-10/+58
	A readme's links to its own sections, as in a table of contents, had nothing on the page to land on.
38 hours	Keep underscores inside words out of emphasis	Bryce Kwon	-4/+15
38 hours	Let character references through to the browser	Bryce Kwon	-2/+26
	Decoding them here instead would mean carrying every named reference HTML defines, while the browser already knows them all.
38 hours	Honour backslash escapes in readmes	Bryce Kwon	-1/+12
38 hours	Link the urls and addresses in angle brackets	Bryce Kwon	-1/+26
38 hours	Keep a wrapped list item in its list	Bryce Kwon	-8/+29
	The item's second line became a paragraph of its own and the items after it a new list, so an ordered list started counting again.
38 hours	Let a table cut a paragraph short	Bryce Kwon	-2/+18
	A table written right under a line of text came out as more of the paragraph, pipes and all.
38 hours	Run a paragraph's lines together like GitHub	Bryce Kwon	-13/+43
	GitHub shows a single newline in a markdown file as a space, and roff fills the lines of a man page the same way, so text wrapped in the source came out ragged on the about page.