Improve configuration of trusting file attributes in FileSnapshot

FileSnapshot relies on File attributes (which can be retrieved by the
stat() function on Unix) to quickly determine if a File was modified
without reading file content or listing content of a directory.

On NFS this doesn't work reliably due to NFS client caching behavior.

Hence we introduced the option core.trustFolderStat to control if
FileSnapshot can trust File attributes to ensure we don't miss
modifications on NFS. Later more specific options for handling packed
and loose refs were added which also support another config value
AFTER_OPEN, in addition to ALWAYS and NEVER, which refreshes File
attributes by opening a FileInputStream on the file instead of reading
its content and then trusts the File attributes of the refreshed File.

We discussed in jgit-127 how to extend these options for other scenarios
where file attributes are used to detect modifications and came to the
conclusion to improve the existing trustXXX config options in the
following way:

- replace the not well defined "trustFolderStat" option by a general
option "trustStat" which allows to configure all these scenarios with a
single option
- introduce a new enum TrustStat and use it for all scenarios. It has
the values
  - NEVER don't trust File attributes
  - ALWAYS always trust File attributes
  - AFTER_OPEN open a FileInputStream on the respective file or folder
    to ensure its File attributes are refreshed and then trust the
    refreshed File attributes
  - INHERIT only used for specific options to signal it should inherit
    its value from the "trustStat" option
- deprecate the old, now unused enums "TrustPackedRefsStat" and
  "TrustLooseRefStat"
- deprecate "trustFolderStat", if set, translate it to the corresponding
  value of the new option "trustStat"
- if both "trustFolderStat" and "trustStat" are configured the value
  configured for "trustStat" takes precedence and "trustFolderStat" is
  ignored
- add one specific option for each scenario which can override the
  global setting
- add new options "trustLooseObjectStat" and "trustPackStat" which allow
  to override the global setting for handling of loose objects and pack
  files
- implement option AFTER_OPEN for "trustLooseObjectStat" and
  "trustPackStat"

Bug: jgit-127
Change-Id: I662982258bc4494f146805875e52838394673c8f

9 files changed, 278 insertions, 72 deletions

diff --git a/Documentation/config-options.md b/Documentation/config-options.md
index eeb78ff550..807d4a8002 100644
--- a/Documentation/config-options.md
+++ b/Documentation/config-options.md
@@ -55,9 +55,12 @@ For details on native git options see also the official [git config documentatio
 | `core.streamFileThreshold` | `50 MiB` | ⃞ | The size threshold beyond which objects must be streamed. |
 | `core.supportsAtomicFileCreation` | `true` | ⃞ | Whether the filesystem supports atomic file creation. |
 | `core.symlinks` | Auto detect if filesystem supports symlinks| ✅ | If false, symbolic links are checked out as small plain files that contain the link text. |
-| `core.trustFolderStat` | `true` | ⃞ | Whether to trust the pack folder's, packed-refs file's and loose-objects folder's file attributes (Java equivalent of stat command on *nix). When looking for pack files, if `false` JGit will always scan the `.git/objects/pack` folder and if set to `true` it assumes that pack files are unchanged if the file attributes of the pack folder are unchanged. When getting the list of packed refs, if `false` JGit will always read the packed-refs file and if set to `true` it uses the file attributes of the packed-refs file and will only read it if a file attribute has changed. When looking for loose objects, if `false` and if a loose object is not found, JGit will open and close a stream to `.git/objects` folder (which can refresh its directory listing, at least on some NFS clients) and retry looking for that loose object. Setting this option to `false` can help to workaround caching issues on NFS, but reduces performance. |
-| `core.trustPackedRefsStat` | `unset` | ⃞ | Whether to trust the file attributes (Java equivalent of stat command on *nix) of the packed-refs file. If `never` JGit will ignore the file attributes of the packed-refs file and always read it. If `always` JGit will trust the file attributes of the packed-refs file and will only read it if a file attribute has changed. `after_open` behaves the same as `always`, except that the packed-refs file is opened and closed before its file attributes are considered. An open/close of the packed-refs file is known to refresh its file attributes, at least on some NFS clients. If `unset`, JGit will use the behavior described in `trustFolderStat`. |
-| `core.trustLooseRefStat` | `always` | ⃞ | Whether to trust the file attributes (Java equivalent of stat command on *nix) of the loose ref. If `always` JGit will trust the file attributes of the loose ref and its parent directories. `after_open` behaves similar to `always`, except that all parent directories of the loose ref up to the repository root are opened and closed before its file attributes are considered. An open/close of these parent directories is known to refresh the file attributes, at least on some NFS clients. |
+| ~~`core.trustFolderStat`~~ | `true` | ⃞ | __Deprecated__, use `core.trustStat` instead. If set to `true` translated to `core.trustStat=always`, if `false` translated to `core.trustStat=never`, see below. If both `core.trustFolderStat` and `core.trustStat` are configured then `trustStat` takes precedence and `trustFolderStat` is ignored. |
+| `core.trustLooseRefStat` | `inherit` | ⃞ | Whether to trust the file attributes of loose refs and its fan-out parent directory. See `core.trustStat` for possible values. If `inherit`, JGit will use the behavior configured in `trustStat`. |
+| `core.trustPackedRefsStat` | `inherit` | ⃞ | Whether to trust the file attributes of the packed-refs file. See `core.trustStat` for possible values. If `inherit`, JGit will use the behavior configured in `core.trustStat`. |
+| `core.trustLooseObjectStat` | `inherit` | ⃞ | Whether to trust the file attributes of the loose object file and its fan-out parent directory. See `core.trustStat` for possible values. If `inherit`, JGit will use the behavior configured in `core.trustStat`. |
+| `core.trustPackStat` | `inherit` | ⃞ | Whether to trust the file attributes of the `objects/pack` directory. See `core.trustStat` for possible values. If `inherit`, JGit will use the behavior configured in `core.trustStat`. |
+| `core.trustStat` | `always` | ⃞ | Global option to configure whether to trust file attributes (Java equivalent of stat command on Unix) of files storing git objects. Can be overridden for specific files by configuring `core.trustLooseRefStat, core.trustPackedRefsStat, core.trustLooseObjectStat, core.trustPackStat`. If `never` JGit will ignore the file attributes of the file and always read it. If `always` JGit will trust the file attributes and will only read it if a file attribute has changed. `after_open` behaves the same as `always`, but file attributes are only considered *after* the file itself and any transient parent directories have been opened and closed. An open/close of the file/directory is known to refresh its file attributes, at least on some NFS clients. |
 | `core.worktree` | Root directory of the working tree if it is not the parent directory of the `.git` directory | ✅ | The path to the root of the working tree. |
 
 ## __fetch__ options
diff --git a/org.eclipse.jgit.test/tst/org/eclipse/jgit/internal/storage/file/ObjectDirectoryTest.java b/org.eclipse.jgit.test/tst/org/eclipse/jgit/internal/storage/file/ObjectDirectoryTest.java
index 7d298ee6f1..33cbc868ca 100644
--- a/org.eclipse.jgit.test/tst/org/eclipse/jgit/internal/storage/file/ObjectDirectoryTest.java
+++ b/org.eclipse.jgit.test/tst/org/eclipse/jgit/internal/storage/file/ObjectDirectoryTest.java
@@ -50,6 +50,7 @@ import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.verify;
@@ -210,17 +211,17 @@ public class ObjectDirectoryTest extends RepositoryTestCase {
 				.fromString("873fb8d667d05436d728c52b1d7a09528e6eb59b");
 		WindowCursor curs = new WindowCursor(db.getObjectDatabase());
 
-		LooseObjects mock = mock(LooseObjects.class);
+		Config config = new Config();
+		config.setString("core", null, "trustLooseObjectStat", "ALWAYS");
+		LooseObjects spy = Mockito.spy(new LooseObjects(config, trash));
 		UnpackedObjectCache unpackedObjectCacheMock = mock(
 				UnpackedObjectCache.class);
 
-		Mockito.when(mock.getObjectLoader(any(), any(), any()))
-				.thenThrow(new IOException("Stale File Handle"));
-		Mockito.when(mock.open(curs, id)).thenCallRealMethod();
-		Mockito.when(mock.unpackedObjectCache())
-				.thenReturn(unpackedObjectCacheMock);
+		doThrow(new IOException("Stale File Handle")).when(spy)
+				.getObjectLoader(any(), any(), any());
+		doReturn(unpackedObjectCacheMock).when(spy).unpackedObjectCache();
 
-		assertNull(mock.open(curs, id));
+		assertNull(spy.open(curs, id));
 		verify(unpackedObjectCacheMock).remove(id);
 	}
 
@@ -231,7 +232,7 @@ public class ObjectDirectoryTest extends RepositoryTestCase {
 		WindowCursor curs = new WindowCursor(db.getObjectDatabase());
 
 		Config config = new Config();
-		config.setString("core", null, "trustFolderStat", "false");
+		config.setString("core", null, "trustLooseObjectStat", "NEVER");
 		LooseObjects spy = spy(new LooseObjects(config,
 				db.getObjectDatabase().getDirectory()));
 
diff --git a/org.eclipse.jgit/resources/org/eclipse/jgit/internal/JGitText.properties b/org.eclipse.jgit/resources/org/eclipse/jgit/internal/JGitText.properties
index acfe812a20..7c47d3a04f 100644
--- a/org.eclipse.jgit/resources/org/eclipse/jgit/internal/JGitText.properties
+++ b/org.eclipse.jgit/resources/org/eclipse/jgit/internal/JGitText.properties
@@ -267,6 +267,7 @@ deletingBranches=Deleting branches...
 deletingNotSupported=Deleting {0} not supported.
 depthMustBeAt1=Depth must be >= 1
 depthWithUnshallow=Depth and unshallow can\'t be used together
+deprecatedTrustFolderStat=Option core.trustFolderStat is deprecated, replace it by core.trustStat.
 destinationIsNotAWildcard=Destination is not a wildcard.
 detachedHeadDetected=HEAD is detached
 diffToolNotGivenError=No diff tool provided and no defaults configured.
@@ -464,6 +465,7 @@ invalidTimestamp=Invalid timestamp in {0}
 invalidTimeUnitValue2=Invalid time unit value: {0}.{1}={2}
 invalidTimeUnitValue3=Invalid time unit value: {0}.{1}.{2}={3}
 invalidTreeZeroLengthName=Cannot append a tree entry with zero-length name
+invalidTrustStat=core.trustStat must not be set to TrustStat.INHERIT, falling back to TrustStat.ALWAYS.
 invalidURL=Invalid URL {0}
 invalidWildcards=Invalid wildcards {0}
 invalidRefSpec=Invalid refspec {0}
@@ -615,6 +617,7 @@ peerDidNotSupplyACompleteObjectGraph=peer did not supply a complete object graph
 personIdentEmailNonNull=E-mail address of PersonIdent must not be null.
 personIdentNameNonNull=Name of PersonIdent must not be null.
 postCommitHookFailed=Execution of post-commit hook failed: {0}.
+precedenceTrustConfig=Both core.trustFolderStat and core.trustStat are set, ignoring trustFolderStat since trustStat takes precedence. Remove core.trustFolderStat from your configuration.
 prefixRemote=remote:
 problemWithResolvingPushRefSpecsLocally=Problem with resolving push ref specs locally: {0}
 progressMonUploading=Uploading {0}
diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/internal/JGitText.java b/org.eclipse.jgit/src/org/eclipse/jgit/internal/JGitText.java
index 2d9d2c527c..07e882498c 100644
--- a/org.eclipse.jgit/src/org/eclipse/jgit/internal/JGitText.java
+++ b/org.eclipse.jgit/src/org/eclipse/jgit/internal/JGitText.java
@@ -295,6 +295,7 @@ public class JGitText extends TranslationBundle {
 	/***/ public String deleteTagUnexpectedResult;
 	/***/ public String deletingBranches;
 	/***/ public String deletingNotSupported;
+	/***/ public String deprecatedTrustFolderStat;
 	/***/ public String depthMustBeAt1;
 	/***/ public String depthWithUnshallow;
 	/***/ public String destinationIsNotAWildcard;
@@ -493,6 +494,7 @@ public class JGitText extends TranslationBundle {
 	/***/ public String invalidTimeUnitValue2;
 	/***/ public String invalidTimeUnitValue3;
 	/***/ public String invalidTreeZeroLengthName;
+	/***/ public String invalidTrustStat;
 	/***/ public String invalidURL;
 	/***/ public String invalidWildcards;
 	/***/ public String invalidRefSpec;
@@ -645,6 +647,7 @@ public class JGitText extends TranslationBundle {
 	/***/ public String personIdentEmailNonNull;
 	/***/ public String personIdentNameNonNull;
 	/***/ public String postCommitHookFailed;
+	/***/ public String precedenceTrustConfig;
 	/***/ public String prefixRemote;
 	/***/ public String problemWithResolvingPushRefSpecsLocally;
 	/***/ public String progressMonUploading;
diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/LooseObjects.java b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/LooseObjects.java
index 74ef6e139c..909b3e3082 100644
--- a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/LooseObjects.java
+++ b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/LooseObjects.java
@@ -26,8 +26,9 @@ import org.eclipse.jgit.internal.storage.file.FileObjectDatabase.InsertLooseObje
 import org.eclipse.jgit.lib.AbbreviatedObjectId;
 import org.eclipse.jgit.lib.AnyObjectId;
 import org.eclipse.jgit.lib.Config;
-import org.eclipse.jgit.lib.ConfigConstants;
 import org.eclipse.jgit.lib.Constants;
+import org.eclipse.jgit.lib.CoreConfig;
+import org.eclipse.jgit.lib.CoreConfig.TrustStat;
 import org.eclipse.jgit.lib.ObjectId;
 import org.eclipse.jgit.lib.ObjectLoader;
 import org.eclipse.jgit.util.FileUtils;
@@ -55,7 +56,7 @@ class LooseObjects {
 
 	private final UnpackedObjectCache unpackedObjectCache;
 
-	private final boolean trustFolderStat;
+	private final TrustStat trustLooseObjectStat;
 
 	/**
 	 * Initialize a reference to an on-disk object directory.
@@ -68,9 +69,8 @@ class LooseObjects {
 	LooseObjects(Config config, File dir) {
 		directory = dir;
 		unpackedObjectCache = new UnpackedObjectCache();
-		trustFolderStat = config.getBoolean(
-				ConfigConstants.CONFIG_CORE_SECTION,
-				ConfigConstants.CONFIG_KEY_TRUSTFOLDERSTAT, true);
+		trustLooseObjectStat = config.get(CoreConfig.KEY)
+				.getTrustLooseObjectStat();
 	}
 
 	/**
@@ -108,7 +108,8 @@ class LooseObjects {
 	 */
 	boolean has(AnyObjectId objectId) {
 		boolean exists = hasWithoutRefresh(objectId);
-		if (trustFolderStat || exists) {
+		if (trustLooseObjectStat == TrustStat.ALWAYS
+				|| exists) {
 			return exists;
 		}
 		try (InputStream stream = Files.newInputStream(directory.toPath())) {
@@ -165,9 +166,29 @@ class LooseObjects {
 	ObjectLoader open(WindowCursor curs, AnyObjectId id) throws IOException {
 		File path = fileFor(id);
 		for (int retries = 0; retries < MAX_STALE_READ_RETRIES; retries++) {
-			if (trustFolderStat && !path.exists()) {
+			boolean reload = true;
+			switch (trustLooseObjectStat) {
+			case NEVER:
 				break;
+			case AFTER_OPEN:
+				try (InputStream stream = Files
+						.newInputStream(path.getParentFile().toPath())) {
+					// open the loose object's fanout directory to refresh
+					// attributes (on some NFS clients)
+				} catch (FileNotFoundException | NoSuchFileException e) {
+					// ignore
+				}
+				//$FALL-THROUGH$
+			case ALWAYS:
+				if (!path.exists()) {
+					reload = false;
+				}
+				break;
+			case INHERIT:
+				// only used in CoreConfig internally
+				throw new IllegalStateException();
 			}
+			if (reload) {
 			try {
 				return getObjectLoader(curs, path, id);
 			} catch (FileNotFoundException noFile) {
@@ -181,9 +202,10 @@ class LooseObjects {
 				}
 				if (LOG.isDebugEnabled()) {
 					LOG.debug(MessageFormat.format(
-							JGitText.get().looseObjectHandleIsStale, id.name(),
-							Integer.valueOf(retries), Integer.valueOf(
-									MAX_STALE_READ_RETRIES)));
+								JGitText.get().looseObjectHandleIsStale,
+								id.name(), Integer.valueOf(retries),
+								Integer.valueOf(MAX_STALE_READ_RETRIES)));
+					}
 				}
 			}
 		}
@@ -209,7 +231,7 @@ class LooseObjects {
 		try {
 			return getObjectLoaderWithoutRefresh(curs, path, id);
 		} catch (FileNotFoundException e) {
-			if (trustFolderStat) {
+			if (trustLooseObjectStat == TrustStat.ALWAYS) {
 				throw e;
 			}
 			try (InputStream stream = Files
@@ -246,7 +268,7 @@ class LooseObjects {
 			return getSizeWithoutRefresh(curs, id);
 		} catch (FileNotFoundException noFile) {
 			try {
-				if (trustFolderStat) {
+				if (trustLooseObjectStat == TrustStat.ALWAYS) {
 					throw noFile;
 				}
 				try (InputStream stream = Files
diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackDirectory.java b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackDirectory.java
index 1ce14b3a18..ef877d8a48 100644
--- a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackDirectory.java
+++ b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/PackDirectory.java
@@ -17,6 +17,8 @@ import static org.eclipse.jgit.internal.storage.pack.PackExt.PACK;
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
 import java.text.MessageFormat;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -42,7 +44,8 @@ import org.eclipse.jgit.internal.storage.pack.PackWriter;
 import org.eclipse.jgit.lib.AbbreviatedObjectId;
 import org.eclipse.jgit.lib.AnyObjectId;
 import org.eclipse.jgit.lib.Config;
-import org.eclipse.jgit.lib.ConfigConstants;
+import org.eclipse.jgit.lib.CoreConfig;
+import org.eclipse.jgit.lib.CoreConfig.TrustStat;
 import org.eclipse.jgit.lib.ObjectId;
 import org.eclipse.jgit.lib.ObjectLoader;
 import org.eclipse.jgit.util.FileUtils;
@@ -72,7 +75,7 @@ class PackDirectory {
 
 	private final AtomicReference<PackList> packList;
 
-	private final boolean trustFolderStat;
+	private final TrustStat trustPackStat;
 
 	/**
 	 * Initialize a reference to an on-disk 'pack' directory.
@@ -86,14 +89,7 @@ class PackDirectory {
 		this.config = config;
 		this.directory = directory;
 		packList = new AtomicReference<>(NO_PACKS);
-
-		// Whether to trust the pack folder's modification time. If set to false
-		// we will always scan the .git/objects/pack folder to check for new
-		// pack files. If set to true (default) we use the folder's size,
-		// modification time, and key (inode) and assume that no new pack files
-		// can be in this folder if these attributes have not changed.
-		trustFolderStat = config.getBoolean(ConfigConstants.CONFIG_CORE_SECTION,
-				ConfigConstants.CONFIG_KEY_TRUSTFOLDERSTAT, true);
+		trustPackStat = config.get(CoreConfig.KEY).getTrustPackStat();
 	}
 
 	/**
@@ -365,8 +361,26 @@ class PackDirectory {
 	}
 
 	boolean searchPacksAgain(PackList old) {
-		return (!trustFolderStat || old.snapshot.isModified(directory))
-				&& old != scanPacks(old);
+		switch (trustPackStat) {
+		case NEVER:
+			break;
+		case AFTER_OPEN:
+			try (InputStream stream = Files
+					.newInputStream(directory.toPath())) {
+				// open the pack directory to refresh attributes (on some NFS clients)
+			} catch (IOException e) {
+				// ignore
+			}
+			//$FALL-THROUGH$
+		case ALWAYS:
+			if (!old.snapshot.isModified(directory)) {
+				return false;
+			}
+			break;
+		case INHERIT:
+			// only used in CoreConfig internally
+		}
+		return old != scanPacks(old);
 	}
 
 	void insert(Pack pack) {
diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/RefDirectory.java b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/RefDirectory.java
index 33996519f7..05f1ef53a1 100644
--- a/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/RefDirectory.java
+++ b/org.eclipse.jgit/src/org/eclipse/jgit/internal/storage/file/RefDirectory.java
@@ -64,10 +64,9 @@ import org.eclipse.jgit.errors.MissingObjectException;
 import org.eclipse.jgit.errors.ObjectWritingException;
 import org.eclipse.jgit.events.RefsChangedEvent;
 import org.eclipse.jgit.internal.JGitText;
-import org.eclipse.jgit.lib.ConfigConstants;
 import org.eclipse.jgit.lib.Constants;
-import org.eclipse.jgit.lib.CoreConfig.TrustLooseRefStat;
-import org.eclipse.jgit.lib.CoreConfig.TrustPackedRefsStat;
+import org.eclipse.jgit.lib.CoreConfig;
+import org.eclipse.jgit.lib.CoreConfig.TrustStat;
 import org.eclipse.jgit.lib.ObjectId;
 import org.eclipse.jgit.lib.ObjectIdRef;
 import org.eclipse.jgit.lib.ProgressMonitor;
@@ -185,11 +184,7 @@ public class RefDirectory extends RefDatabase {
 
 	private List<Integer> retrySleepMs = RETRY_SLEEP_MS;
 
-	private final boolean trustFolderStat;
-
-	private final TrustPackedRefsStat trustPackedRefsStat;
-
-	private final TrustLooseRefStat trustLooseRefStat;
+	private final CoreConfig coreConfig;
 
 	RefDirectory(RefDirectory refDb) {
 		parent = refDb.parent;
@@ -201,9 +196,7 @@ public class RefDirectory extends RefDatabase {
 		packedRefsFile = refDb.packedRefsFile;
 		looseRefs.set(refDb.looseRefs.get());
 		packedRefs.set(refDb.packedRefs.get());
-		trustFolderStat = refDb.trustFolderStat;
-		trustPackedRefsStat = refDb.trustPackedRefsStat;
-		trustLooseRefStat = refDb.trustLooseRefStat;
+		coreConfig = refDb.coreConfig;
 		inProcessPackedRefsLock = refDb.inProcessPackedRefsLock;
 	}
 
@@ -219,17 +212,7 @@ public class RefDirectory extends RefDatabase {
 
 		looseRefs.set(RefList.<LooseRef> emptyList());
 		packedRefs.set(NO_PACKED_REFS);
-		trustFolderStat = db.getConfig()
-				.getBoolean(ConfigConstants.CONFIG_CORE_SECTION,
-						ConfigConstants.CONFIG_KEY_TRUSTFOLDERSTAT, true);
-		trustPackedRefsStat = db.getConfig()
-				.getEnum(ConfigConstants.CONFIG_CORE_SECTION, null,
-						ConfigConstants.CONFIG_KEY_TRUST_PACKED_REFS_STAT,
-						TrustPackedRefsStat.UNSET);
-		trustLooseRefStat = db.getConfig()
-				.getEnum(ConfigConstants.CONFIG_CORE_SECTION, null,
-						ConfigConstants.CONFIG_KEY_TRUST_LOOSE_REF_STAT,
-						TrustLooseRefStat.ALWAYS);
+		coreConfig = db.getConfig().get(CoreConfig.KEY);
 		inProcessPackedRefsLock = new ReentrantLock(true);
 	}
 
@@ -979,7 +962,7 @@ public class RefDirectory extends RefDatabase {
 	PackedRefList getPackedRefs() throws IOException {
 		final PackedRefList curList = packedRefs.get();
 
-		switch (trustPackedRefsStat) {
+		switch (coreConfig.getTrustPackedRefsStat()) {
 		case NEVER:
 			break;
 		case AFTER_OPEN:
@@ -995,12 +978,8 @@ public class RefDirectory extends RefDatabase {
 				return curList;
 			}
 			break;
-		case UNSET:
-			if (trustFolderStat
-					&& !curList.snapshot.isModified(packedRefsFile)) {
-				return curList;
-			}
-			break;
+		case INHERIT:
+			// only used in CoreConfig internally
 		}
 
 		return refreshPackedRefs(curList);
@@ -1186,7 +1165,7 @@ public class RefDirectory extends RefDatabase {
 	LooseRef scanRef(LooseRef ref, String name) throws IOException {
 		final File path = fileFor(name);
 
-		if (trustLooseRefStat.equals(TrustLooseRefStat.AFTER_OPEN)) {
+		if (coreConfig.getTrustLooseRefStat() == TrustStat.AFTER_OPEN) {
 			refreshPathToLooseRef(Paths.get(name));
 		}
 
diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/lib/ConfigConstants.java b/org.eclipse.jgit/src/org/eclipse/jgit/lib/ConfigConstants.java
index 5068a6cce0..30e7de47c3 100644
--- a/org.eclipse.jgit/src/org/eclipse/jgit/lib/ConfigConstants.java
+++ b/org.eclipse.jgit/src/org/eclipse/jgit/lib/ConfigConstants.java
@@ -600,11 +600,21 @@ public final class ConfigConstants {
 
 	/**
 	 * The "trustfolderstat" key in the "core" section
+	 *
 	 * @since 3.6
+	 * @deprecated use {CONFIG_KEY_TRUST_STAT} instead
 	 */
+	@Deprecated(since = "7.2", forRemoval = true)
 	public static final String CONFIG_KEY_TRUSTFOLDERSTAT = "trustfolderstat";
 
 	/**
+	 * The "trustfilestat" key in the "core"section
+	 *
+	 * @since 7.2
+	 */
+	public static final String CONFIG_KEY_TRUST_STAT = "truststat";
+
+	/**
 	 * The "supportsAtomicFileCreation" key in the "core" section
 	 *
 	 * @since 4.5
@@ -1023,6 +1033,19 @@ public final class ConfigConstants {
 	public static final String CONFIG_KEY_TRUST_LOOSE_REF_STAT = "trustLooseRefStat";
 
 	/**
+	 * The "trustLooseRefStat" key
+	 *
+	 * @since 7.2
+	 */
+	public static final String CONFIG_KEY_TRUST_PACK_STAT = "trustPackStat";
+
+	/**
+	 * The "trustLooseObjectFileStat" key
+	 *
+	 * @since 7.2
+	 */
+	public static final String CONFIG_KEY_TRUST_LOOSE_OBJECT_STAT = "trustLooseObjectStat";
+	/**
 	 * The "pack.preserveOldPacks" key
 	 *
 	 * @since 5.13.2
diff --git a/org.eclipse.jgit/src/org/eclipse/jgit/lib/CoreConfig.java b/org.eclipse.jgit/src/org/eclipse/jgit/lib/CoreConfig.java
index 49602a75eb..e43c9653dd 100644
--- a/org.eclipse.jgit/src/org/eclipse/jgit/lib/CoreConfig.java
+++ b/org.eclipse.jgit/src/org/eclipse/jgit/lib/CoreConfig.java
@@ -17,12 +17,16 @@ package org.eclipse.jgit.lib;
 
 import static java.util.zip.Deflater.DEFAULT_COMPRESSION;
 
+import org.eclipse.jgit.internal.JGitText;
 import org.eclipse.jgit.lib.Config.SectionParser;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * This class keeps git repository core parameters.
  */
 public class CoreConfig {
+	private static final Logger LOG = LoggerFactory.getLogger(CoreConfig.class);
 	/** Key for {@link Config#get(SectionParser)}. */
 	public static final Config.SectionParser<CoreConfig> KEY = CoreConfig::new;
 
@@ -127,7 +131,9 @@ public class CoreConfig {
 	 * Permissible values for {@code core.trustPackedRefsStat}.
 	 *
 	 * @since 6.1.1
+	 * @deprecated use {@link TrustStat} instead
 	 */
+	@Deprecated(since = "7.2", forRemoval = true)
 	public enum TrustPackedRefsStat {
 		/** Do not trust file attributes of the packed-refs file. */
 		NEVER,
@@ -135,12 +141,15 @@ public class CoreConfig {
 		/** Trust file attributes of the packed-refs file. */
 		ALWAYS,
 
-		/** Open and close the packed-refs file to refresh its file attributes
-		 * and then trust it. */
+		/**
+		 * Open and close the packed-refs file to refresh its file attributes
+		 * and then trust it.
+		 */
 		AFTER_OPEN,
 
-		/** {@code core.trustPackedRefsStat} defaults to this when it is
-		 * not set */
+		/**
+		 * {@code core.trustPackedRefsStat} defaults to this when it is not set
+		 */
 		UNSET
 	}
 
@@ -148,17 +157,44 @@ public class CoreConfig {
 	 * Permissible values for {@code core.trustLooseRefStat}.
 	 *
 	 * @since 6.9
+	 * @deprecated use {@link TrustStat} instead
 	 */
+	@Deprecated(since = "7.2", forRemoval = true)
 	public enum TrustLooseRefStat {
 
 		/** Trust file attributes of the loose ref. */
 		ALWAYS,
 
-		/** Open and close parent directories of the loose ref file until the
-		 * repository root to refresh its file attributes and then trust it. */
+		/**
+		 * Open and close parent directories of the loose ref file until the
+		 * repository root to refresh its file attributes and then trust it.
+		 */
 		AFTER_OPEN,
 	}
 
+	/**
+	 * Values for {@code core.trustXXX} options.
+	 *
+	 * @since 7.2
+	 */
+	public enum TrustStat {
+		/** Do not trust file attributes of a File. */
+		NEVER,
+
+		/** Always trust file attributes of a File. */
+		ALWAYS,
+
+		/** Open and close the File to refresh its file attributes
+		 * and then trust it. */
+		AFTER_OPEN,
+
+		/**
+		 * Used for specific options to inherit value from value set for
+		 * core.trustStat.
+		 */
+		INHERIT
+	}
+
 	private final int compression;
 
 	private final int packIndexVersion;
@@ -169,6 +205,16 @@ public class CoreConfig {
 
 	private final boolean commitGraph;
 
+	private final TrustStat trustStat;
+
+	private final TrustStat trustPackedRefsStat;
+
+	private final TrustStat trustLooseRefStat;
+
+	private final TrustStat trustPackStat;
+
+	private final TrustStat trustLooseObjectStat;
+
 	/**
 	 * Options for symlink handling
 	 *
@@ -198,7 +244,13 @@ public class CoreConfig {
 		DOTGITONLY
 	}
 
-	private CoreConfig(Config rc) {
+	/**
+	 * Create a new core configuration from the passed configuration.
+	 *
+	 * @param rc
+	 *            git configuration
+	 */
+	CoreConfig(Config rc) {
 		compression = rc.getInt(ConfigConstants.CONFIG_CORE_SECTION,
 				ConfigConstants.CONFIG_KEY_COMPRESSION, DEFAULT_COMPRESSION);
 		packIndexVersion = rc.getInt(ConfigConstants.CONFIG_PACK_SECTION,
@@ -210,6 +262,60 @@ public class CoreConfig {
 		commitGraph = rc.getBoolean(ConfigConstants.CONFIG_CORE_SECTION,
 				ConfigConstants.CONFIG_COMMIT_GRAPH,
 				DEFAULT_COMMIT_GRAPH_ENABLE);
+
+		trustStat = parseTrustStat(rc);
+		trustPackedRefsStat = parseTrustPackedRefsStat(rc);
+		trustLooseRefStat = parseTrustLooseRefStat(rc);
+		trustPackStat = parseTrustPackFileStat(rc);
+		trustLooseObjectStat = parseTrustLooseObjectFileStat(rc);
+	}
+
+	private static TrustStat parseTrustStat(Config rc) {
+		Boolean tfs = rc.getBoolean(ConfigConstants.CONFIG_CORE_SECTION,
+				ConfigConstants.CONFIG_KEY_TRUSTFOLDERSTAT);
+		TrustStat ts = rc.getEnum(TrustStat.values(),
+				ConfigConstants.CONFIG_CORE_SECTION, null,
+				ConfigConstants.CONFIG_KEY_TRUST_STAT);
+		if (tfs != null) {
+			if (ts == null) {
+				LOG.warn(JGitText.get().deprecatedTrustFolderStat);
+				return tfs.booleanValue() ? TrustStat.ALWAYS : TrustStat.NEVER;
+			}
+			LOG.warn(JGitText.get().precedenceTrustConfig);
+		}
+		if (ts == null) {
+			ts = TrustStat.ALWAYS;
+		} else if (ts == TrustStat.INHERIT) {
+			LOG.warn(JGitText.get().invalidTrustStat);
+			ts = TrustStat.ALWAYS;
+		}
+		return ts;
+	}
+
+	private TrustStat parseTrustPackedRefsStat(Config rc) {
+		return inheritParseTrustStat(rc,
+				ConfigConstants.CONFIG_KEY_TRUST_PACKED_REFS_STAT);
+	}
+
+	private TrustStat parseTrustLooseRefStat(Config rc) {
+		return inheritParseTrustStat(rc,
+				ConfigConstants.CONFIG_KEY_TRUST_LOOSE_REF_STAT);
+	}
+
+	private TrustStat parseTrustPackFileStat(Config rc) {
+		return inheritParseTrustStat(rc,
+				ConfigConstants.CONFIG_KEY_TRUST_PACK_STAT);
+	}
+
+	private TrustStat parseTrustLooseObjectFileStat(Config rc) {
+		return inheritParseTrustStat(rc,
+				ConfigConstants.CONFIG_KEY_TRUST_LOOSE_OBJECT_STAT);
+	}
+
+	private TrustStat inheritParseTrustStat(Config rc, String key) {
+		TrustStat t = rc.getEnum(ConfigConstants.CONFIG_CORE_SECTION, null, key,
+				TrustStat.INHERIT);
+		return t == TrustStat.INHERIT ? trustStat : t;
 	}
 
 	/**
@@ -260,4 +366,56 @@ public class CoreConfig {
 	public boolean enableCommitGraph() {
 		return commitGraph;
 	}
+
+	/**
+	 * Get how far we can trust file attributes of packed-refs file which is
+	 * used to store {@link org.eclipse.jgit.lib.Ref}s in
+	 * {@link org.eclipse.jgit.internal.storage.file.RefDirectory}.
+	 *
+	 * @return how far we can trust file attributes of packed-refs file.
+	 *
+	 * @since 7.2
+	 */
+	public TrustStat getTrustPackedRefsStat() {
+		return trustPackedRefsStat;
+	}
+
+	/**
+	 * Get how far we can trust file attributes of loose ref files which are
+	 * used to store {@link org.eclipse.jgit.lib.Ref}s in
+	 * {@link org.eclipse.jgit.internal.storage.file.RefDirectory}.
+	 *
+	 * @return how far we can trust file attributes of loose ref files.
+	 *
+	 * @since 7.2
+	 */
+	public TrustStat getTrustLooseRefStat() {
+		return trustLooseRefStat;
+	}
+
+	/**
+	 * Get how far we can trust file attributes of packed-refs file which is
+	 * used to store {@link org.eclipse.jgit.lib.Ref}s in
+	 * {@link org.eclipse.jgit.internal.storage.file.RefDirectory}.
+	 *
+	 * @return how far we can trust file attributes of packed-refs file.
+	 *
+	 * @since 7.2
+	 */
+	public TrustStat getTrustPackStat() {
+		return trustPackStat;
+	}
+
+	/**
+	 * Get how far we can trust file attributes of loose ref files which are
+	 * used to store {@link org.eclipse.jgit.lib.Ref}s in
+	 * {@link org.eclipse.jgit.internal.storage.file.RefDirectory}.
+	 *
+	 * @return how far we can trust file attributes of loose ref files.
+	 *
+	 * @since 7.2
+	 */
+	public TrustStat getTrustLooseObjectStat() {
+		return trustLooseObjectStat;
+	}
 }