Now that a compatibility wrapper for utimensat(2) has been introduced,
migrate all call sites across the codebase to use utimensat(2) instead of
the legacy utime(3p) interface:

- In `commit-graph.c`, use utimensat(2) with UTIME_OMIT and the computed
  timestamp `now` to bump the commit-graph modification time consistently
  across all files without needing an extra stat(2) call to preserve atime.
- In `copy.c`, use utimensat(2) to copy full sub-second access and
  modification timestamps from the source file.
- In `odb/source-packed.c`, `odb/source-loose.c`, and `object-file.c`,
  use utimensat(2) with `struct timespec` to freshen file timestamps.
- In `builtin/pack-objects.c`, update the pack timestamp with
  utimensat(2).
- In `rerere.c`, touch the postimage file with utimensat(2) passing NULL
  to set both atime and mtime to current time.
- In `t/helper/test-chmtime.c`, update file modification times using
  utimensat(2).

Signed-off-by: Alexey Samsonov <vonosmas@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

With all callers across the codebase now converted to utimensat(2), we no
longer need to include the legacy <utime.h> header in `compat/posix.h`.

Remove `#include <utime.h>` from `compat/posix.h` and test fixtures,
remove `mingw_utime()` from `compat/mingw.c`, and delete the legacy
header shims in `compat/vcbuild/include/`.

Signed-off-by: Alexey Samsonov <vonosmas@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

After the external merge runs, we read the file back into a heap buffer.
This ancient code does it by hand, but these days we can make the code
shorter and less error prone by using strbuf_read_file().

It's not quite a one-liner replacement, because we have to copy the
pointer and size into an mmbuffer_t. Two things to note there:

  1. We can't just pass result->size to strbuf_detach(), since the
     former uses long instead of size_t (something that we'd ideally fix
     in the long run, but is way out of scope here).

  2. We can leave result untouched on error; we zero it at the top of
     the function (confusingly we may still return LL_MERGE_OK and a
     NULL result if we hit an I/O error, but that is how the function
     has always behaved, and callers know to check for NULL).

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

When writing out tempfiles for an external merge driver, we catch the
case that write() fails, but not the follow-up close(). This close()
would usually succeed, but the system could report a delayed write error
(e.g., on a network file system).

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

When there's a long(er) running merge driver helper, the user may just
decide to terminate it with Ctrl+C. That sends a signal to the driver
prog and to the whole process group as well, including the git merge
command proper. Hence the cleanup code would not run and .merge_file_*
files are left behind.

We can fix this by using the tempfile API, which auto-cleans files on
signal or other error. That covers the Ctrl+C case above, as well as any
other incidental death (e.g., allocation error due to a gigantic
output).

Note that there is one gotcha here. The current code uses short,
relative filenames for the tempfiles (like ".merge_file_abc123"). But
the tempfile API stores and returns absolute paths. Because we run the
merge driver as a shell command, this can result in problems if the
leading directories contain shell metacharacters (like our tests, which
put a space in the trash directory name for exactly this purpose).

If we were starting from scratch, I'd say the correct solution here is
to shell-quote the filenames we put in the command. But doing so isn't
strictly backwards compatible, because users might have their own shell
characters. For example, if I configure a driver like this:

  [merge "foo"]
  driver = "my-driver '%O' '%A' '%B'"

then adding extra quoting will screw things up! Strictly speaking, this
kind of quoting is wrong (it would fail if %A expanded to something with
a single-quote in it), but it is entirely harmless with the current
vanilla relative paths. It doesn't seem worth breaking it.

So let's take the most conservative route, and just continue reporting
the relative paths.

Commit-message-stolen-from: Michal Koutný <mkoutny@suse.com>
Reported-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

The setup of alternates has been deferred to object database
creation time during clone, which drops the unused ad-hoc alternate
writing API, simplifying the object database backend interface.

* ps/odb-alternates-at-creation:
  odb/source: remove the ability to write alternates
  builtin/clone: write alternates via `odb_create_on_disk()`
  odb/source: support writing alternates when creating the database
  builtin/clone: move setup of alternates for non-shared local clones
  builtin/clone: move setup of alternates for shared local clones
  builtin/clone: refactor handling of "--reference{,-if-able}"
  builtin/clone: move around `setup_reference()`
  builtin/clone: defer setup of the object database
  setup: split up concerns of `init_db()`

The experimental 'git history' command has been taught a new 'squash'
subcommand to fold a range of commits into a single commit, with any
descendants replayed on top.

* hn/history-squash:
  history: support editing squashed commit messages
  history: create squashed commits without editing
  history: protect branches when squashing a range
  history: validate squash revision ranges
  history: add skeleton for squash subcommand
  sequencer: share the squash message marker helpers and flags
  history: give commit_tree_ext a message template
  history: extract helper for a commit's parent tree

A new hook 'report' is added to 'git receive-pack', which runs after
reference updates and allows the server to filter or modify the
packet-line status report sent back to the client.

* kn/receive-report-hook:
  receive-pack: coccinelle fix
  hook: introduce the receive-report hook
  receive-pack: move message generation to separate function
  receive-pack: drop static variables to track report status version
  doc: add proc-receive hook info in 'git-receive-pack.adoc'

Updates to Coccinelle semantic patches to correctly handle the
'FREE_AND_NULL()' macro and avoid generating broken transformations
for negated pointer checks.

* jc/cocci-free-updates:
  cocci: FREE_AND_NULL(E) is safe to call on NULL
  cocci: remove risky "if (!E) free(E)" conversion

The files backend has been updated to avoid unconditionally locking
the 'packed-refs' file when deleting a root ref (which are never
packed).

* ak/refs-files-root-ref-lock:
  refs/files: avoid packed-refs lock for root ref deletion

The terminology regarding reference storage formats has been unified
across command-line options, environment variables, configuration
variables, and source code, standardizing on the phrase "ref storage
format" (e.g., `--ref-storage-format`, `'GIT_REF_STORAGE_FORMAT'`).
Additionally, the `--ref-storage-format` option has been updated to
accept payloads in the form `<format>://<payload>`.

* ps/ref-storage-format:
  setup: allow "--ref-storage-format=" to specify a payload
  setup: rename "init.defaultRefFormat" to "init.defaultRefStorageFormat"
  t: rename GIT_TEST_DEFAULT_REF_FORMAT
  setup: rename ref storage format environment variables
  setup: refactor how we configure the ref storage format
  refs: expose function to parse reference URIs
  help: rename "default-ref-format" to "default-ref-storage-format"
  builtin/rev-parse: rename "--show-ref-format" to "--show-ref-storage-format"
  builtin/submodule: rename "--ref-format=" to "--ref-storage-format="
  builtin/refs: rename "--ref-format=" to "--ref-storage-format="
  builtin/clone: rename "--ref-format=" to "--ref-storage-format="
  builtin/init: rename "--ref-format=" to "--ref-storage-format="
  parse-options: allow for hidden aliases

The build-time knob 'USE_NSEC' for nanosecond stat precision has been
converted to a runtime configuration 'core.useNanosec', allowing
distributions to bundle one binary that adapts to filesystem
capabilities dynamically.

* dk/use-nsec-runtime:
  core: convert build-time USE_NSEC into runtime core.useNanosec
  environment: align repo_config_values_init with struct declaration
  meson: expose knob for xmlto relative links in manuals

The shell script implementation of 'git subtree' has been updated to
check for the presence of the configuration file of the new Rust
implementation, preventing users from accidentally running the old
script on repositories already managed by the new tool.

* ij/subtree-reject-v2-config:
  git-subtree: Bail out if we find output from Rust rewrite (test)
  git-subtree: Bail out if we find output from Rust rewrite

When an HTTP request triggers a redirect and the target yields an
authentication challenge, the WWW-Authenticate headers received
during the redirect are now explicitly preserved across the
credential URL update, fixing an issue where they were incorrectly
cleared.

* ap/http-preserve-wwwauth-redirect:
  http: preserve wwwauth_headers across redirects

The codebase has been updated to use the newer utimensat() POSIX
function instead of the obsolescent utime(), allowing
high-precision timestamps while preserving fallback compatibility.

* as/utimensat-utimes:
  compat/posix: drop legacy <utime.h> header and shims
  treewide: use utimensat(2) instead of legacy utime(3p)
  compat/posix: introduce utimensat(2) wrapper

The --recurse-submodules option in 'git branch' has been fixed to
avoid a crash when the start point is not a reference (e.g., a raw
object ID).  The creation path now skips setting up tracking and
properly forwards the absent tracking name to the submodule helper.

* vv/branch-recurse-no-start-ref:
  branch: allow recursion with no tracking name
  branch: do not track a start point with no ref

The git config --global read operations have been updated to respect
both $HOME/.gitconfig and $XDG_CONFIG_HOME/git/config, fixing an
inconsistency where only the former was read when both configuration
files are present.

* dw/config-read-both-global:
  config: read global scope via config_sequence
  config: let sequence require a successful file
  path: use forward slashes in XDG config on Windows

A new linter test has been added to Documentation/lint-manpages.sh
to ensure that all non-command manual pages (guides and developer
interfaces) listed in Documentation/Makefile are present in
command-list.txt, replacing an older comment that reminded
developers to keep them in sync.

* ta/command-list-guides-sync-lint:
  lint-docs: check the guide list in command-list.txt
  command-list.txt: add gitformat-loose(5) and gitpacking(7)

The external merge driver in 'git merge' now uses the tempfile API
to create its temporary files.  This ensures that these temporaries
are reliably cleaned up even when the merge driver or its parent Git
process is terminated abruptly.

* jk/merge-ll-tempfile-cleanup:
  merge-ll: use tempfile API for external driver files
  merge-ll: catch close() errors when writing external tempfiles
  merge-ll: use strbuf to read back external merge result

The `git multi-pack-index write` command has been updated to
silently return success when there are no object entries to index.
This avoids writing empty `multi-pack-index` layers, which
previously caused subsequent incremental midx writes using the
`--bitmap` option to fail when attempting to load the missing
reverse index.

* pp/midx-write-skip-empty:
  midx-write: skip writes with no object entries

The 'git range-diff' command has been augmented with a
'--matched-only' option to skip commits that are only present on
one side, allowing users to easily focus on only the commits that
have been retained.

* hn/range-diff-matched-only:
  range-diff: add --matched-only to skip one-sided commits