add upgrade.log

The upgrade from V9 uses this to avoid an automatic upgrade until 1 year
after the V9 update. It can also be used in future such situations.

Sponsored-by: Dartmouth College's Datalad project

Upgrade/V8.hs

@@ -13,20 +13,7 @@ import Utility.Daemon
 
 upgrade :: Bool -> Annex UpgradeResult
 upgrade automatic = do
-	-- Skip running when git-annex assistant (or watch) is running,
-	-- because these are long-running daemons that could conceivably
-	-- run for an entire year, and so still be running when the v10
-	-- upgrade happens. If the assistant then tried to drop a file
-	-- after the v10 upgrade, it would use the wrong content file
-	-- locking, which could lead to data loss. The remotedaemon does
-	-- not drop content, so will not block the upgrade.
-	pidfile <- fromRepo gitAnnexPidFile
-	liftIO (checkDaemon (fromRawFilePath pidfile)) >>= \case
-		Just _pid
-			| automatic -> return UpgradeDeferred
-			| otherwise -> giveup "Cannot upgrade to v9 when git-annex assistant or watch daemon is running."
-		Nothing -> do
-			unless automatic $
-				showAction "v8 to v9"
+	unless automatic $
+		showAction "v8 to v9"
 
-			return UpgradeSuccess
+	return UpgradeSuccess

Upgrade/V9.hs

@@ -13,9 +13,41 @@ import Annex.Content
 import Annex.Perms
 import Git.ConfigTypes
 import Types.RepoVersion
+import Logs.Upgrade
+import Utility.Daemon
+
+import Data.Time.Clock.POSIX
 
 upgrade :: Bool -> Annex UpgradeResult
-upgrade automatic = do
+upgrade automatic
+	| automatic = do
+		-- For automatic upgrade, wait until a year after the v9
+		-- upgrade. This is to give time for any old processes
+		-- that were running before the v9 upgrade to finish.
+		-- Such old processes lock content using the old method,
+		-- and it is not safe for such to still be running after
+		-- this upgrade.
+		timeOfUpgrade (RepoVersion 9) >>= \case
+			Nothing -> performUpgrade automatic
+			Just t -> do
+				now <- liftIO getPOSIXTime
+				if now - 365*24*60*60 > t
+					then return UpgradeDeferred
+					else checkassistantrunning $
+						performUpgrade automatic
+	| otherwise = performUpgrade automatic
+  where
+	-- Skip upgrade when git-annex assistant (or watch) is running,
+	-- because these are long-running daemons that could conceivably
+	-- run for an entire year.
+	checkassistantrunning a = do
+		pidfile <- fromRepo gitAnnexPidFile
+		liftIO (checkDaemon (fromRawFilePath pidfile)) >>= \case
+			Just _pid -> return UpgradeDeferred
+			Nothing -> a
+
+performUpgrade :: Bool -> Annex UpgradeResult
+performUpgrade automatic = do
 	unless automatic $
 		showAction "v9 to v10"