bug#71074: 29.3; When doing a backup, the file is missing during interactive questions

[Vincent Lefevre]

On 2024-05-21 15:12:05 +0300, Eli Zaretskii wrote:
> > Date: Tue, 21 May 2024 10:44:16 +0200
> > From: Vincent Lefevre <vincent@vinc17.net>
> > Cc: 71074@debbugs.gnu.org
> > 
> > On 2024-05-20 14:30:56 +0300, Eli Zaretskii wrote:
> > > Does it help to customize the variable backup-by-copying to a non-nil
> > > value?
> > 
> > Yes, but note that a useless backup is done because the file will
> > not necessarily be saved (if the save operation is canceled via
> > an interactive question or due to Debian bug 1071372).
> 
> Sure, but if the danger is to lose the file due to some calamity, a
> useless backup is a very minor disadvantage, don't you agree?

Yes, but this could be a future improvement.

> > Whether renaming or copying, the backup should be done just before
> > actually saving.
> 
> We already do that.

By "just before", I mean that there should not be any system call
between a backup and the write of the file.

BTW, there is actually an issue with the backup system: the backup
is done only before the *first* save-buffer, while an issue might
appear only for a subsequent save-buffer.

> However, backup+save is not an atomic operation, and as long as it
> is not atomic, there's always a window of opportunity for some
> catastrophe, like a system crash or Emacs being killed, to happen
> in-between.

Yes, but if the window is restricted to the minimum, the probability
of a system crash / killed Emacs is significantly reduced. I suppose
that file-precious-flag as you suggested later may be the ultimate
solution.

> Moreover, Emacs being Emacs, with its high degree of customization,
> some feature can customize either backup or save (or both) in a way
> that makes the above-mentioned window very wide.  That's what happened
> in the case you reported: epa-file overrides write-contents, the Emacs
> primitive that actually writes the buffer to a file, with its own
> version, and that's why you get that prompt about untrusted key.

So, does this mean that file-precious-flag doesn't work here?

But perhaps that's a bug in epa-file, which should ensure that by
default, the pathname isn't removed (due to the backup by rename)
until the new file can be written. This means that it currently
does the backup too early.

> We cannot avoid such situations, because if we disallow customizations
> like that, Emacs will no longer be Emacs.  In fact, you yourself use a
> similar feature, when you define find-backup-file-name to force all
> the backup files to go to a specific directory.  Such a function could
> in theory do anything it wants, including prompting you and whatnot,
> thus prolonging the window between the backup and the save.

But customizations should be implemented properly to avoid issues.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)