Apache Subversion 1.14 LTS Release Notes

Path-based authorization compatibility ¶

A fix for Issue #4762 may change the way path-based authorization rules are applied in some circumstances. See r1882326.

Background: Subversion 1.10 introduced a new implementation of path-based authorization (authz) to deliver wildcard support and improved performance over that of Subversion 1.9 and earlier. From Subversion 1.10 through 1.14.0, the new implementation did not correctly combine global rules with repository rules: if a global rule and a per-repository rule were both present for a path, the global rule would be ignored and the per-repository rule would apply by itself. As a result, from Subversion 1.10 through 1.14.0, it was not possible to override per-path access rules for specific users (or groups) at the global level. Administrators whose authz rules rely on this incorrect behavior may need to adjust their rules accordingly.

This issue is fixed in 1.14.1, making it possible once again to override per-path access rules for specific users (and groups) at the global level. Such global rules are overridden by repository-specific rules only if both the user and the path match the repository-specific rule.

As an example, consider the following rule set:

[groups]
company = developer1, developer2, developer3
customer = customer1, customer2

# company can read-write on everything
[/]
@company = rw

[project1:/]
@customer = r

Does developer1 have rw access to "/trunk" in project1?

Subversion servers running 1.10.0 up to 1.10.6 or 1.14.0, without the fix for issue #4762, will only apply the repository-specific part of the rule set:

[project1:/]
@customer = r

The answer in this case is that developer1 has no access at all because the global rule which grants rw access to the @company group is ignored.

Subversion servers running 1.14.1 or later match the behaviour of Subversion 1.9, meaning they will apply both the global and the repository-specific part of the rule set:

# company can read-write on everything
[/]
@company = rw

[project1:/]
@customer = r

The answer in this case is that developer1 has rw access to any path in project1. Global rules are overridden by repository-specific rules only if both the user (developer1) and the path ("/", including child paths for which no specific rules exist) match the repository-specific rule. While the repository-specific rule matches "/trunk" it does not match developer1, and hence the global rule will be used.

svn log improvements ¶

svn log --quiet and --diff options are no longer mutually exclusive. This makes it easier to display only the differences in a range of revisions. (See r1871916.)

svn info improvements ¶

New changelist argument to svn info --show-item (r1869481).

Escaping/quoting of pathname arguments to the user-defined editor ¶

When invoking the user-defined editor, such as during interactive conflict resolution, Subversion now performs escaping of any special characters in the pathname of the file to be edited. This corrects a problem that would occur previously when the file to be edited (and/or the path leading to it) contained spaces or other special characters. (See r1874057, r1874093, and r1875230.)

Note that escaping is performed only on the pathname argument. As before, the editor itself is invoked through the shell and the user must properly quote/escape the command line used to launch it. This is intentional, as it allows the user to construct a shell command which itself contains command line arguments. See the related FAQ entry for more on spaces and/or command line options in the editor path.

The user-defined editor can be specified in the following ways, in this order of precedence:

• The --editor-cmd command-line option
• The $SVN_EDITOR environment variable
• The editor-cmd runtime configuration option
• The $VISUAL environment variable
• The $EDITOR environment variable

The escaped pathname of the file to be edited is passed to the editor as its last command line argument.

For example, suppose that $SVN_EDITOR is set as follows:

SVN_EDITOR='vim -N --'
export SVN_EDITOR

Furthermore, suppose 'svn up' finds a text conflict in a file called foo bar.txt:

$ svn up
Updating '.':
C    foo bar.txt
Updated to revision 2.
Summary of conflicts:
  Text conflicts: 1
Merge conflict discovered in file 'foo bar.txt'.
Select: (p) Postpone, (df) Show diff, (e) Edit file, (m) Merge,
        (s) Show all options: e

When Subversion launches the editor, the spaces in vim -N -- will not be escaped, allowing vim to be invoked with -N and -- as its first two arguments, but the space in foo bar.txt will be escaped.

Improvements to the interactive conflict resolver ¶

Since its introduction in 1.10, the new interactive conflict resolver has received various improvements.

Starting in 1.11, the interactive conflict resolver supports more conflict situations which involve moved files and directories. Specifically, many tree conflicts which report a "locally missing" item, as a result of an item having moved on the merge source branch, can now be resolved automatically.

For example, when a file edit is cherry-picked from a branch on which the edited file has been renamed, the edit will now be applied to the file's location in the merge target branch, provided it has not been renamed on that branch as well. For details, see issue #4694, "Unresolvable tree conflict when cherrypicking a file-edit after file was moved on source branch".

Furthermore, since 1.12, the interactive conflict resolver supports some cases where items were moved to disparate locations. Support for unversioned items in the working copy has been improved as well. The table below lists these cases and available resolution options for each.

During svn update, the deletion of a directory which contains unversioned items but is otherwise unmodified no longer causes a tree conflict. This avoids tree conflicts caused by software build artifacts in the working copy, for example.

Several bugs have been fixed in the conflict resolver, including:

• Issue #4744 "assertion failed (start_rev > end_rev)"
• Issue #4766 "resolver adds unrelated moves to move target list"
• A problem where the resolver mistakenly searched back through the entire history of the repository
• A case where text conflicts were created with the incoming changes theirs) and local changes (mine) swapped within text conflict markers. This caused unexpected results when the svn resolve command was used with the --accept theirs or --accept mine options. This is fixed as of 1.12.

Fixes for conflict resolver bugs found during the development of Subversion 1.11 and 1.12 have been backported to the Subversion 1.10 release series as well.

Additions to svn info --show-item ¶

This change was first introduced in 1.11.

Add 'schedule' and 'depth' items to 'svn info --show-item' (r1827032).

Allow the client cert password to be saved ¶

This change was first introduced in 1.11.

Allow the client cert password to be saved (r1836762).

svn help hides experimental commands by default ¶

This change was first introduced in 1.13.

By default, svn help no longer lists experimental commands. To show experimental commands, use svn help -v or svn help --verbose. (See issue #4828.)

Improved performance for working copy commands like svn status ¶

This change was first introduced in 1.13.

Some local operations, such as svn status on a large working copy, now perform more quickly as a result of reduced I/O. This is achieved by disabling SQLite's WAL (write-ahead logging) feature, which Subversion does not use, but which introduces more I/O when left enabled. (See r1865523.)

svnadmin dump shouldn't canonicalize svn:date (issue #4767) ¶

This change was first introduced in 1.11.

svnadmin dump no longer attempts to canonicalize the svn:date revision property value in its output. The dump output will now contain the value exactly as it exists in the repository.

Empty group definitions in authz rules ¶

This change was first introduced in 1.12.

Subversion servers will now ignore empty group definitions in their path-based authorization rules. The svnauthz command will print a warning if it detects empty group definitions.

Provide a hint about a possible mod_dav_svn misconfiguration ¶

This change was first introduced in 1.13.

Add a hint about a possible mod_dav_svn misconfiguration: When warning about an overlapping configuration, if two configuration blocks are for the same URL, then hint that the problem may be including the same configuration twice. (See r1866738.)

Plaintext passwords on disk disabled by default ¶

This change was first introduced in 1.12.

On Unix-like systems, client-side storage of passwords in plaintext on disk is now disabled by default at compile-time. Password caching mechanisms based on Gnome Keyring, Kwallet, or GPG-Agent, are recommended instead.

This change does not affect Windows or Mac OS platforms, where passwords have always been stored in an encrypted representation.

Improved copying from repository source to working copy target ¶

This change was first introduced in 1.12.

Behaviour of copy operations with a repository source and a working copy target has been improved:

• Existing parent directories are now handled correctly.
• Peg and operative revisions are now handled correctly (see issue #4785 for details).

svn list improvements ¶

This change was first introduced in 1.12.

The svn list command now avoids truncation of long author names by dynamically adjusting the width of columns displayed.

The svn list command now supports a --human-readable (-H) option which will display sizes in human-readable units (Bytes, Kilobytes, Megabytes, Gigabytes, Terabytes and Petabytes).

svn info improvements ¶

This change was first introduced in 1.12.

The svn info command can now display the size of files in the repository. The file size is only displayed if the target of svn info is a file URL.

svn cleanup improvements ¶

This change was first introduced in 1.12.

The svn cleanup command, when asked to remove unversioned or ignored items, will now remove directories even if they are write-protected.

Support for Python 3.x ¶

Some optional features of Subversion utilize the Python scripting language.

Subversion's SWIG Python bindings and Subversion's test suite now support Python 3.x (and newer).

Of course, we welcome contributions that extend Subversion's Python support to include other versions, subject to the project's other needs. See the section Enthusiastic Contributors Welcome below.

Support for Python 2.7 is being phased out ¶

As of 1 January 2020, Python 2.7 has reached end of life. All users are strongly encouraged to move to Python 3.

As Subversion 1.14 is a Long Term Support (LTS) release with planned support into 2024, well beyond end-of-life for Python 2.7, the core Subversion developers cannot commit to supporting and testing with Python 2.7, or to fixing bugs that affect Python 2.7 only, for the duration of this support period.

This means that although Subversion 1.14.0 still technically works with Python 2.7, any later 1.14.x point release may drop this support if it becomes too difficult to maintain.

If you must continue using Python 2.7, our previous Long Term Support release, Subversion 1.10, is supported until 2022. Python 2.7 support will not be removed from Subversion 1.10.

Of course, we welcome contributions that extend Subversion's Python 2.7 support, subject to the project's other needs. See the section Enthusiastic Contributors Welcome below.

Python is Optional ¶

Subversion does not require Python for its basic operation. Python is only required for building Subversion and for using Subversion's SWIG Python bindings. If you do not do either of these things, then this change does not affect you.

The Python bindings are used by:

• Third-party programs (e.g., ViewVC)
• Scripts distributed with Subversion itself in the tools/ subdirectory.
• Any in-house scripts you may have.

In more detail, Python is required for doing any of the following:

• Use the SWIG Python bindings
• Use the ctypes Python bindings
• Build Subversion on Windows
• Build Subversion from a tarball on Unix-like systems and run Subversion's test suite
• Build Subversion from a working copy checked out from Subversion's own repository
• Build the SWIG Python bindings
• Build the ctypes Python bindings

Python is not required for doing any of the following:

• Use the core command-line binaries (svn, svnadmin, svnsync, …)
• Use Subversion's C libraries
• Use any of Subversion's other language bindings
• Build Subversion from a tarball on Unix-like systems without running Subversion's test suite

New Build-Time Dependency: py3c ¶

Subversion's support for Python 3.x SWIG bindings introduces a new optional dependency on the Python 3 Compatibility layer for C extensions (py3c).

You need py3c to build the SWIG Python bindings, regardless of the version of Python. As py3c is a header-only library, it is needed only to build the bindings, not to use them.

The convenience script that downloads Subversion's minimal build-time dependencies, get-deps.sh, has been updated to download py3c. This script is found in the source distribution's root directory. For the full list of Subversion's dependencies, see the INSTALL file in the same directory.

Support for building with SWIG 4 on Python 3.x ¶

This section only affects those who build Subversion from a working copy. If you build Subversion from a tarball or zip file, you may skip this section.

Subversion's SWIG Python bindings can be built with SWIG 4 on Python 3. The bindings can be built with SWIG 3.x on Python 3 as well (the -modern argument to SWIG is automatically used). (See r1869853.)

JavaHL Updates ¶

This change was first introduced in 1.11.

The JavaHL bindings have been updated to be compatible with Java 10. Due to required build changes, JavaHL now requires at least Java 8 to compile.

The build system prefers Python 2 to Python 3 ¶

Although Python is not required for building Subversion, it is required for running the test suite, and therefore, on Unix-like systems, Subversion's build system looks for a Python executable.

The build system checks the environment variables $PYTHON, $PYTHON2, and $PYTHON3 in this order, followed by the command names python, python2, and python3 (in $PATH) in this order. The first of these that is an executable implementing Python version 2.7 or greater is used.

Since support for Python 2.7 is being phased out, we expect to change this to prefer Python 3 to Python 2.7 in a 1.14.x patch release. When we do, we will mention the change in the CHANGES file and update this section of the release notes.

This affects both tarball builds (using configure) and working copy builds (using autogen.sh). The release rolling scripts are also affected.

As a workaround, the environment variable PYTHON may be set to the full path of a Python 3 executable prior to running configure (or autogen.sh, if you build from a working copy).

Test suite broken when run with Python 3 on Windows ¶

As of 1.14.0, Subversion's test suite does not run correctly with Python 3 on Windows due to differences in the way that Python 2.7 and Python 3 handle End-Of-Line (EOL) conversions, special characters in pathnames, escaping of backslashes used in Windows pathnames, and handling of UTF-8 character sequences.

Most of these issues are corrected in 1.14.1. See r1876707, r1876734, r1877318, r1877712, r1878141, r1878142, r1878143, and r1878144.

Cannot redirect test suite output to a log file with Python 3.6 or later on Windows ¶

This issue affects Subversion 1.14.0 on Windows when using Python 3.6 or later due to changes in Python's handling of os.dup2().

When using win-tests.py to run Subversion's unit tests on Windows and redirecting the output to a log file, the following errors may occur:

Testing Release configuration on local repository.
[1/1] authz_tests.pyTraceback (most recent call last):
  File "win-tests.py", line 1126, in 
    failed = th.run(tests_to_run)
  File "build\run_tests.py",
line 590, in run
    failed = self._run_local_schedulers(testlist)
  File "build\run_tests.py",
line 536, in _run_local_schedulers
    failed = self._run_test(testcase, count, testcount) or failed
  File "build\run_tests.py",
line 947, in _run_test
    failed = testcase(progabs, progdir, progbase, test_nums, dots_needed)
  File "build\run_tests.py",
line 853, in _run_py_test
    print("PING")
OSError: [WinError 6] The handle is invalid
Exception ignored in: <_io.TextIOWrapper name='' mode='w'
encoding='utf-8'>
OSError: [WinError 6] The handle is invalid

Two workarounds are available:

• Define the PYTHONLEGACYWINDOWSSTDIO environment variable as described in this Stack Overflow question, or:
• Pass the --log-to-stdout switch to win-tests.py.

This issue is fixed as of Subversion 1.14.1. See r1883337.

C90 compatibility fixes ¶

In 1.14.0, several variable declarations in mid-block were reported to prevent building Subversion with VC9 (Visual Studio 2008). This issue is fixed as of 1.14.1. See r1877259.

Restored support for building with APR 1.4 ¶

Subversion 1.14.0 increased the minimum required version of APR to 1.5. By request to support building Subversion on older operating system distributions such as CentOS 7, Subversion 1.14.1 restores support for building with APR 1.4 or newer. See r1881958 and r1882128.

Error building with SQLite 3.36 ¶

Building Subversion with SQLite 3.36 on Unix-like systems may fail with an undefined reference to unixFcntlExternalReader:

/usr/bin/ld: .libs/sqlite3wrapper.o: in function `unixFileControl':
subversion-1.14.1/sqlite-amalgamation/sqlite3.c:38131: undefined reference to `unixFcntlExternalReader'
collect2: error: ld returned 1 exit status
make: *** [build-outputs.mk:530: subversion/libsvn_subr/libsvn_subr-1.la] Error 1

This appears to be caused by a bug in SQLite 3.36 only. Subversion builds successfully with other versions of SQLite, such as SQLite 3.35 and 3.37.