From c46316f7aec1a00b3db74a3565008c44c0b0807f Mon Sep 17 00:00:00 2001
From: KN4CK3R <admin@oldschoolhack.me>
Date: Thu, 25 Jan 2024 09:54:44 +0100
Subject: [PATCH 01/17] Respect branch info for relative links (#28909)

Fix #28904

Co-authored-by: Giteabot <teabot@gitea.io>
---
 modules/markup/markdown/goldmark.go      | 2 ++
 modules/markup/markdown/markdown_test.go | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/modules/markup/markdown/goldmark.go b/modules/markup/markdown/goldmark.go
index b92b90561b990..1db3cbad7e1b0 100644
--- a/modules/markup/markdown/goldmark.go
+++ b/modules/markup/markdown/goldmark.go
@@ -137,6 +137,8 @@ func (g *ASTTransformer) Transform(node *ast.Document, reader text.Reader, pc pa
 				var base string
 				if ctx.IsWiki {
 					base = ctx.Links.WikiLink()
+				} else if ctx.Links.HasBranchInfo() {
+					base = ctx.Links.SrcLink()
 				} else {
 					base = ctx.Links.Base
 				}
diff --git a/modules/markup/markdown/markdown_test.go b/modules/markup/markdown/markdown_test.go
index 957d773acde18..1edfb3e664463 100644
--- a/modules/markup/markdown/markdown_test.go
+++ b/modules/markup/markdown/markdown_test.go
@@ -765,7 +765,7 @@ space</p>
 			Expected: `<p>space @mention-user<br/>
 /just/a/path.bin<br/>
 <a href="https://example.com/file.bin" rel="nofollow">https://example.com/file.bin</a><br/>
-<a href="/user/repo/file.bin" rel="nofollow">local link</a><br/>
+<a href="/user/repo/src/branch/main/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/user/repo/src/branch/main/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
@@ -878,7 +878,7 @@ space</p>
 			Expected: `<p>space @mention-user<br/>
 /just/a/path.bin<br/>
 <a href="https://example.com/file.bin" rel="nofollow">https://example.com/file.bin</a><br/>
-<a href="/user/repo/file.bin" rel="nofollow">local link</a><br/>
+<a href="/user/repo/src/branch/main/sub/folder/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/user/repo/src/branch/main/sub/folder/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>

From 071b7b2a0308d3b65f2deafc0a004a340e6ead86 Mon Sep 17 00:00:00 2001
From: Zettat123 <zettat123@gmail.com>
Date: Thu, 25 Jan 2024 20:06:29 +0800
Subject: [PATCH 02/17] Implement `MigrateRepository` for the actions notifier
 (#28920)

Fixes #28699

This PR implements the `MigrateRepository` method for `actionsNotifier`
to detect the schedules from the workflow files in the migrated
repository.
---
 services/actions/notifier.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/services/actions/notifier.go b/services/actions/notifier.go
index 5a71d1cd791f7..0b4fed5db1282 100644
--- a/services/actions/notifier.go
+++ b/services/actions/notifier.go
@@ -565,3 +565,15 @@ func (n *actionsNotifier) DeleteWikiPage(ctx context.Context, doer *user_model.U
 		Page:       page,
 	}).Notify(ctx)
 }
+
+// MigrateRepository is used to detect workflows after a repository has been migrated
+func (n *actionsNotifier) MigrateRepository(ctx context.Context, doer, u *user_model.User, repo *repo_model.Repository) {
+	ctx = withMethod(ctx, "MigrateRepository")
+
+	newNotifyInput(repo, doer, webhook_module.HookEventRepository).WithPayload(&api.RepositoryPayload{
+		Action:       api.HookRepoCreated,
+		Repository:   convert.ToRepo(ctx, repo, access_model.Permission{AccessMode: perm_model.AccessModeOwner}),
+		Organization: convert.ToUser(ctx, u, nil),
+		Sender:       convert.ToUser(ctx, doer, nil),
+	}).Notify(ctx)
+}

From 3084c990b04aea16278f012da38152ada1290a0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anthony=20Qu=C3=A9r=C3=A9?=
 <47711333+Anthony-Jhoiro@users.noreply.github.com>
Date: Thu, 25 Jan 2024 13:51:32 +0100
Subject: [PATCH 03/17] fix: update enable_prune even if mirror_interval is not
 provided (#28905)

Currently, the `updateMirror` function which update the mirror interval
and enable prune properties is only executed by the `Edit` function. But
it is only triggered if `opts.MirrorInterval` is not null, even if
`opts.EnablePrune` is not null.

With this patch, it is now possible to update the enable_prune property
with a patch request without modifying the mirror_interval.

## Example request with httpie

### Currently:
**Does nothing**
```bash
http PATCH https://gitea.your-server/api/v1/repos/myOrg/myRepo "enable_prune:=false" -A bearer -a $gitea_token
```

**Updates both properties**
```bash
http PATCH https://gitea.your-server/api/v1/repos/myOrg/myRepo "enable_prune:=false" "mirror_interval=10m" -A bearer -a $gitea_token
```

### With the patch
**Updates enable_prune only**
```bash
http PATCH https://gitea.your-server/api/v1/repos/myOrg/myRepo "enable_prune:=false" -A bearer -a $gitea_token
```
---
 routers/api/v1/repo/repo.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go
index 9810e461de3cb..436b83adf2b35 100644
--- a/routers/api/v1/repo/repo.go
+++ b/routers/api/v1/repo/repo.go
@@ -637,7 +637,7 @@ func Edit(ctx *context.APIContext) {
 		}
 	}
 
-	if opts.MirrorInterval != nil {
+	if opts.MirrorInterval != nil || opts.EnablePrune != nil {
 		if err := updateMirror(ctx, opts); err != nil {
 			return
 		}

From 76bbad4e746af977fea66c719d38048869de36c4 Mon Sep 17 00:00:00 2001
From: John Olheiser <john.olheiser@gmail.com>
Date: Thu, 25 Jan 2024 12:04:50 -0600
Subject: [PATCH 04/17] Check for sha256 support to use --object-format flag
 (#28928)

This should fix https://github.com/go-gitea/gitea/issues/28927

Technically older versions of Git would support this flag as well, but
per https://github.com/go-gitea/gitea/pull/28466 that's the version
where using it (object-format=sha256) left "experimental" state.

`sha1` is (currently) the default, so older clients should be unaffected
in either case.

Signed-off-by: jolheiser <john.olheiser@gmail.com>
---
 modules/git/repo.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/git/repo.go b/modules/git/repo.go
index c3de2eb0adc32..db99d285a86a6 100644
--- a/modules/git/repo.go
+++ b/modules/git/repo.go
@@ -101,7 +101,9 @@ func InitRepository(ctx context.Context, repoPath string, bare bool, objectForma
 	if !IsValidObjectFormat(objectFormatName) {
 		return fmt.Errorf("invalid object format: %s", objectFormatName)
 	}
-	cmd.AddOptionValues("--object-format", objectFormatName)
+	if SupportHashSha256 {
+		cmd.AddOptionValues("--object-format", objectFormatName)
+	}
 
 	if bare {
 		cmd.AddArguments("--bare")

From ba24e0ba61b1b66f58c8448f27272d1d6d14f60c Mon Sep 17 00:00:00 2001
From: KN4CK3R <admin@oldschoolhack.me>
Date: Thu, 25 Jan 2024 22:40:24 +0100
Subject: [PATCH 05/17] Use new RPM constants (#28931)

https://github.com/sassoftware/go-rpmutils/pull/24 got merged.
---
 go.mod                           | 2 +-
 go.sum                           | 4 ++--
 modules/packages/rpm/metadata.go | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/go.mod b/go.mod
index 3268b81e66ead..7a752ec874cfc 100644
--- a/go.mod
+++ b/go.mod
@@ -92,7 +92,7 @@ require (
 	github.com/redis/go-redis/v9 v9.4.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
-	github.com/sassoftware/go-rpmutils v0.2.0
+	github.com/sassoftware/go-rpmutils v0.2.1-0.20240124161140-277b154961dd
 	github.com/sergi/go-diff v1.3.1
 	github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92
 	github.com/stretchr/testify v1.8.4
diff --git a/go.sum b/go.sum
index f13026c6bb841..b3b8ad8ce48f9 100644
--- a/go.sum
+++ b/go.sum
@@ -781,8 +781,8 @@ github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6g
 github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
-github.com/sassoftware/go-rpmutils v0.2.0 h1:pKW0HDYMFWQ5b4JQPiI3WI12hGsVoW0V8+GMoZiI/JE=
-github.com/sassoftware/go-rpmutils v0.2.0/go.mod h1:TJJQYtLe/BeEmEjelI3b7xNZjzAukEkeWKmoakvaOoI=
+github.com/sassoftware/go-rpmutils v0.2.1-0.20240124161140-277b154961dd h1:KpbqRPDwcAQTyaP+L+YudTRb3CnJlQ64Hfn1SF/zHBA=
+github.com/sassoftware/go-rpmutils v0.2.1-0.20240124161140-277b154961dd/go.mod h1:TJJQYtLe/BeEmEjelI3b7xNZjzAukEkeWKmoakvaOoI=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
diff --git a/modules/packages/rpm/metadata.go b/modules/packages/rpm/metadata.go
index 7fc47a53e69a2..f4f78c2cab57c 100644
--- a/modules/packages/rpm/metadata.go
+++ b/modules/packages/rpm/metadata.go
@@ -140,7 +140,7 @@ func ParsePackage(r io.Reader) (*Package, error) {
 
 			Provides:   getEntries(rpm.Header, rpmutils.PROVIDENAME, rpmutils.PROVIDEVERSION, rpmutils.PROVIDEFLAGS),
 			Requires:   getEntries(rpm.Header, rpmutils.REQUIRENAME, rpmutils.REQUIREVERSION, rpmutils.REQUIREFLAGS),
-			Conflicts:  getEntries(rpm.Header, 1054 /*rpmutils.CONFLICTNAME*/, 1055 /*rpmutils.CONFLICTVERSION*/, 1053 /*rpmutils.CONFLICTFLAGS*/), // https://github.com/sassoftware/go-rpmutils/pull/24
+			Conflicts:  getEntries(rpm.Header, rpmutils.CONFLICTNAME, rpmutils.CONFLICTVERSION, rpmutils.CONFLICTFLAGS),
 			Obsoletes:  getEntries(rpm.Header, rpmutils.OBSOLETENAME, rpmutils.OBSOLETEVERSION, rpmutils.OBSOLETEFLAGS),
 			Files:      getFiles(rpm.Header),
 			Changelogs: getChangelogs(rpm.Header),

From 534917d57670d82703567131e2b33fd945e6f8cb Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Fri, 26 Jan 2024 14:18:19 +0800
Subject: [PATCH 06/17] Don't remove all mirror repository's releases when
 mirroring (#28817)

Fix #22066

# Purpose

This PR fix the releases will be deleted when mirror repository sync the
tags.

# The problem

In the previous implementation of #19125. All releases record in
databases of one mirror repository will be deleted before sync.
Ref:
https://github.com/go-gitea/gitea/pull/19125/files#diff-2aa04998a791c30e5a02b49a97c07fcd93d50e8b31640ce2ddb1afeebf605d02R481

# The Pros

This PR introduced a new method which will load all releases from
databases and all tags on git data into memory. And detect which tags
needs to be inserted, which tags need to be updated or deleted. Only
tags releases(IsTag=true) which are not included in git data will be
deleted, only tags which sha1 changed will be updated. So it will not
delete any real releases include drafts.

# The Cons

The drawback is the memory usage will be higher than before if there are
many tags on this repository. This PR defined a special release struct
to reduce columns loaded from database to memory.
---
 modules/repository/repo.go      | 76 ++++++++++++++++++++++++++++++---
 modules/repository/repo_test.go | 76 +++++++++++++++++++++++++++++++++
 2 files changed, 146 insertions(+), 6 deletions(-)
 create mode 100644 modules/repository/repo_test.go

diff --git a/modules/repository/repo.go b/modules/repository/repo.go
index 5af69763d152e..5352da0378d9a 100644
--- a/modules/repository/repo.go
+++ b/modules/repository/repo.go
@@ -508,6 +508,18 @@ func StoreMissingLfsObjectsInRepository(ctx context.Context, repo *repo_model.Re
 	return nil
 }
 
+// shortRelease to reduce load memory, this struct can replace repo_model.Release
+type shortRelease struct {
+	ID      int64
+	TagName string
+	Sha1    string
+	IsTag   bool
+}
+
+func (shortRelease) TableName() string {
+	return "release"
+}
+
 // pullMirrorReleaseSync is a pull-mirror specific tag<->release table
 // synchronization which overwrites all Releases from the repository tags. This
 // can be relied on since a pull-mirror is always identical to its
@@ -521,16 +533,20 @@ func pullMirrorReleaseSync(ctx context.Context, repo *repo_model.Repository, git
 		return fmt.Errorf("unable to GetTagInfos in pull-mirror Repo[%d:%s/%s]: %w", repo.ID, repo.OwnerName, repo.Name, err)
 	}
 	err = db.WithTx(ctx, func(ctx context.Context) error {
-		//
-		// clear out existing releases
-		//
-		if _, err := db.DeleteByBean(ctx, &repo_model.Release{RepoID: repo.ID}); err != nil {
-			return fmt.Errorf("unable to clear releases for pull-mirror Repo[%d:%s/%s]: %w", repo.ID, repo.OwnerName, repo.Name, err)
+		dbReleases, err := db.Find[shortRelease](ctx, repo_model.FindReleasesOptions{
+			RepoID:        repo.ID,
+			IncludeDrafts: true,
+			IncludeTags:   true,
+		})
+		if err != nil {
+			return fmt.Errorf("unable to FindReleases in pull-mirror Repo[%d:%s/%s]: %w", repo.ID, repo.OwnerName, repo.Name, err)
 		}
+
+		inserts, deletes, updates := calcSync(tags, dbReleases)
 		//
 		// make release set identical to upstream tags
 		//
-		for _, tag := range tags {
+		for _, tag := range inserts {
 			release := repo_model.Release{
 				RepoID:       repo.ID,
 				TagName:      tag.Name,
@@ -547,6 +563,25 @@ func pullMirrorReleaseSync(ctx context.Context, repo *repo_model.Repository, git
 				return fmt.Errorf("unable insert tag %s for pull-mirror Repo[%d:%s/%s]: %w", tag.Name, repo.ID, repo.OwnerName, repo.Name, err)
 			}
 		}
+
+		// only delete tags releases
+		if len(deletes) > 0 {
+			if _, err := db.GetEngine(ctx).Where("repo_id=?", repo.ID).
+				In("id", deletes).
+				Delete(&repo_model.Release{}); err != nil {
+				return fmt.Errorf("unable to delete tags for pull-mirror Repo[%d:%s/%s]: %w", repo.ID, repo.OwnerName, repo.Name, err)
+			}
+		}
+
+		for _, tag := range updates {
+			if _, err := db.GetEngine(ctx).Where("repo_id = ? AND lower_tag_name = ?", repo.ID, strings.ToLower(tag.Name)).
+				Cols("sha1").
+				Update(&repo_model.Release{
+					Sha1: tag.Object.String(),
+				}); err != nil {
+				return fmt.Errorf("unable to update tag %s for pull-mirror Repo[%d:%s/%s]: %w", tag.Name, repo.ID, repo.OwnerName, repo.Name, err)
+			}
+		}
 		return nil
 	})
 	if err != nil {
@@ -556,3 +591,32 @@ func pullMirrorReleaseSync(ctx context.Context, repo *repo_model.Repository, git
 	log.Trace("pullMirrorReleaseSync: done rebuilding %d releases", numTags)
 	return nil
 }
+
+func calcSync(destTags []*git.Tag, dbTags []*shortRelease) ([]*git.Tag, []int64, []*git.Tag) {
+	destTagMap := make(map[string]*git.Tag)
+	for _, tag := range destTags {
+		destTagMap[tag.Name] = tag
+	}
+	dbTagMap := make(map[string]*shortRelease)
+	for _, rel := range dbTags {
+		dbTagMap[rel.TagName] = rel
+	}
+
+	inserted := make([]*git.Tag, 0, 10)
+	updated := make([]*git.Tag, 0, 10)
+	for _, tag := range destTags {
+		rel := dbTagMap[tag.Name]
+		if rel == nil {
+			inserted = append(inserted, tag)
+		} else if rel.Sha1 != tag.Object.String() {
+			updated = append(updated, tag)
+		}
+	}
+	deleted := make([]int64, 0, 10)
+	for _, tag := range dbTags {
+		if destTagMap[tag.TagName] == nil && tag.IsTag {
+			deleted = append(deleted, tag.ID)
+		}
+	}
+	return inserted, deleted, updated
+}
diff --git a/modules/repository/repo_test.go b/modules/repository/repo_test.go
new file mode 100644
index 0000000000000..68980f92f9450
--- /dev/null
+++ b/modules/repository/repo_test.go
@@ -0,0 +1,76 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package repository
+
+import (
+	"testing"
+
+	"code.gitea.io/gitea/modules/git"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_calcSync(t *testing.T) {
+	gitTags := []*git.Tag{
+		/*{
+			Name: "v0.1.0-beta", //deleted tag
+			Object: git.MustIDFromString(""),
+		},
+		{
+			Name: "v0.1.1-beta", //deleted tag but release should not be deleted because it's a release
+			Object: git.MustIDFromString(""),
+		},
+		*/
+		{
+			Name:   "v1.0.0", // keep as before
+			Object: git.MustIDFromString("1006e6e13c73ad3d9e2d5682ad266b5016523485"),
+		},
+		{
+			Name:   "v1.1.0", // retagged with new commit id
+			Object: git.MustIDFromString("bbdb7df30248e7d4a26a909c8d2598a152e13868"),
+		},
+		{
+			Name:   "v1.2.0", // new tag
+			Object: git.MustIDFromString("a5147145e2f24d89fd6d2a87826384cc1d253267"),
+		},
+	}
+
+	dbReleases := []*shortRelease{
+		{
+			ID:      1,
+			TagName: "v0.1.0-beta",
+			Sha1:    "244758d7da8dd1d9e0727e8cb7704ed4ba9a17c3",
+			IsTag:   true,
+		},
+		{
+			ID:      2,
+			TagName: "v0.1.1-beta",
+			Sha1:    "244758d7da8dd1d9e0727e8cb7704ed4ba9a17c3",
+			IsTag:   false,
+		},
+		{
+			ID:      3,
+			TagName: "v1.0.0",
+			Sha1:    "1006e6e13c73ad3d9e2d5682ad266b5016523485",
+		},
+		{
+			ID:      4,
+			TagName: "v1.1.0",
+			Sha1:    "53ab18dcecf4152b58328d1f47429510eb414d50",
+		},
+	}
+
+	inserts, deletes, updates := calcSync(gitTags, dbReleases)
+	if assert.EqualValues(t, 1, len(inserts), "inserts") {
+		assert.EqualValues(t, *gitTags[2], *inserts[0], "inserts equal")
+	}
+
+	if assert.EqualValues(t, 1, len(deletes), "deletes") {
+		assert.EqualValues(t, 1, deletes[0], "deletes equal")
+	}
+
+	if assert.EqualValues(t, 1, len(updates), "updates") {
+		assert.EqualValues(t, *gitTags[1], *updates[0], "updates equal")
+	}
+}

From a240d5dfa7e261f2fb703cf24b1ba4dc6aa47bfd Mon Sep 17 00:00:00 2001
From: wackbyte <wackbyte@pm.me>
Date: Fri, 26 Jan 2024 09:15:57 -0500
Subject: [PATCH 07/17] Fix non-alphabetic sorting of repo topics (#28938)

---
 models/repo/topic.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/models/repo/topic.go b/models/repo/topic.go
index b71f43bc88046..79b13e320da1d 100644
--- a/models/repo/topic.go
+++ b/models/repo/topic.go
@@ -366,7 +366,7 @@ func syncTopicsInRepository(sess db.Engine, repoID int64) error {
 	topicNames := make([]string, 0, 25)
 	if err := sess.Table("topic").Cols("name").
 		Join("INNER", "repo_topic", "repo_topic.topic_id = topic.id").
-		Where("repo_topic.repo_id = ?", repoID).Desc("topic.repo_count").Find(&topicNames); err != nil {
+		Where("repo_topic.repo_id = ?", repoID).Asc("topic.name").Find(&topicNames); err != nil {
 		return err
 	}
 

From 01acd1eea38f25d2b21f56ec15dd162ca6005fbf Mon Sep 17 00:00:00 2001
From: KN4CK3R <admin@oldschoolhack.me>
Date: Sat, 27 Jan 2024 04:36:01 +0100
Subject: [PATCH 08/17] Strip `/` from relative links (#28932)

Fixes #28915

Restores the old behaviour:

https://github.com/go-gitea/gitea/pull/26745/files#diff-d78a9d361b1fddc12218e4dd42f42d39d6be1fda184041e06bb6fb30f0d94c59L96
---
 modules/markup/markdown/goldmark.go      | 10 +++++----
 modules/markup/markdown/markdown_test.go | 26 ++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/modules/markup/markdown/goldmark.go b/modules/markup/markdown/goldmark.go
index 1db3cbad7e1b0..3dc5530e008c8 100644
--- a/modules/markup/markdown/goldmark.go
+++ b/modules/markup/markdown/goldmark.go
@@ -85,9 +85,11 @@ func (g *ASTTransformer) Transform(node *ast.Document, reader text.Reader, pc pa
 			// 2. If they're not wrapped with a link they need a link wrapper
 
 			// Check if the destination is a real link
-			link := v.Destination
-			if len(link) > 0 && !markup.IsLink(link) {
-				v.Destination = []byte(giteautil.URLJoin(ctx.Links.ResolveMediaLink(ctx.IsWiki), string(link)))
+			if len(v.Destination) > 0 && !markup.IsLink(v.Destination) {
+				v.Destination = []byte(giteautil.URLJoin(
+					ctx.Links.ResolveMediaLink(ctx.IsWiki),
+					strings.TrimLeft(string(v.Destination), "/"),
+				))
 			}
 
 			parent := n.Parent()
@@ -103,7 +105,7 @@ func (g *ASTTransformer) Transform(node *ast.Document, reader text.Reader, pc pa
 
 				// Duplicate the current image node
 				image := ast.NewImage(ast.NewLink())
-				image.Destination = link
+				image.Destination = v.Destination
 				image.Title = v.Title
 				for _, attr := range v.Attributes() {
 					image.SetAttribute(attr.Name, attr.Value)
diff --git a/modules/markup/markdown/markdown_test.go b/modules/markup/markdown/markdown_test.go
index 1edfb3e664463..bdf4011fa2486 100644
--- a/modules/markup/markdown/markdown_test.go
+++ b/modules/markup/markdown/markdown_test.go
@@ -580,6 +580,8 @@ https://example.com/file.bin
 [[local link|file.bin]]
 [[remote link|https://example.com]]
 ![local image](image.jpg)
+![local image](path/file)
+![local image](/path/file)
 ![remote image](https://example.com/image.jpg)
 [[local image|image.jpg]]
 [[remote link|https://example.com/image.jpg]]
@@ -609,6 +611,8 @@ mail@domain.com
 <a href="/src/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/image.jpg" target="_blank" rel="nofollow noopener"><img src="/image.jpg" alt="local image"/></a><br/>
+<a href="/path/file" target="_blank" rel="nofollow noopener"><img src="/path/file" alt="local image"/></a><br/>
+<a href="/path/file" target="_blank" rel="nofollow noopener"><img src="/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/image.jpg" rel="nofollow"><img src="/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -634,6 +638,8 @@ space</p>
 <a href="/wiki/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/wiki/raw/image.jpg" target="_blank" rel="nofollow noopener"><img src="/wiki/raw/image.jpg" alt="local image"/></a><br/>
+<a href="/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/wiki/raw/path/file" alt="local image"/></a><br/>
+<a href="/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/wiki/raw/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/wiki/raw/image.jpg" rel="nofollow"><img src="/wiki/raw/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -661,6 +667,8 @@ space</p>
 <a href="https://gitea.io/src/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="https://gitea.io/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://gitea.io/image.jpg" alt="local image"/></a><br/>
+<a href="https://gitea.io/path/file" target="_blank" rel="nofollow noopener"><img src="https://gitea.io/path/file" alt="local image"/></a><br/>
+<a href="https://gitea.io/path/file" target="_blank" rel="nofollow noopener"><img src="https://gitea.io/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="https://gitea.io/image.jpg" rel="nofollow"><img src="https://gitea.io/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -688,6 +696,8 @@ space</p>
 <a href="https://gitea.io/wiki/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="https://gitea.io/wiki/raw/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://gitea.io/wiki/raw/image.jpg" alt="local image"/></a><br/>
+<a href="https://gitea.io/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="https://gitea.io/wiki/raw/path/file" alt="local image"/></a><br/>
+<a href="https://gitea.io/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="https://gitea.io/wiki/raw/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="https://gitea.io/wiki/raw/image.jpg" rel="nofollow"><img src="https://gitea.io/wiki/raw/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -715,6 +725,8 @@ space</p>
 <a href="/relative/path/src/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/relative/path/image.jpg" target="_blank" rel="nofollow noopener"><img src="/relative/path/image.jpg" alt="local image"/></a><br/>
+<a href="/relative/path/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/path/file" alt="local image"/></a><br/>
+<a href="/relative/path/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/relative/path/image.jpg" rel="nofollow"><img src="/relative/path/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -742,6 +754,8 @@ space</p>
 <a href="/relative/path/wiki/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/image.jpg" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" rel="nofollow"><img src="/relative/path/wiki/raw/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -770,6 +784,8 @@ space</p>
 <a href="/user/repo/src/branch/main/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/user/repo/media/branch/main/image.jpg" target="_blank" rel="nofollow noopener"><img src="/user/repo/media/branch/main/image.jpg" alt="local image"/></a><br/>
+<a href="/user/repo/media/branch/main/path/file" target="_blank" rel="nofollow noopener"><img src="/user/repo/media/branch/main/path/file" alt="local image"/></a><br/>
+<a href="/user/repo/media/branch/main/path/file" target="_blank" rel="nofollow noopener"><img src="/user/repo/media/branch/main/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/user/repo/media/branch/main/image.jpg" rel="nofollow"><img src="/user/repo/media/branch/main/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -798,6 +814,8 @@ space</p>
 <a href="/relative/path/wiki/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/image.jpg" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" rel="nofollow"><img src="/relative/path/wiki/raw/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -826,6 +844,8 @@ space</p>
 <a href="/user/repo/src/sub/folder/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/user/repo/image.jpg" target="_blank" rel="nofollow noopener"><img src="/user/repo/image.jpg" alt="local image"/></a><br/>
+<a href="/user/repo/path/file" target="_blank" rel="nofollow noopener"><img src="/user/repo/path/file" alt="local image"/></a><br/>
+<a href="/user/repo/path/file" target="_blank" rel="nofollow noopener"><img src="/user/repo/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/user/repo/image.jpg" rel="nofollow"><img src="/user/repo/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -854,6 +874,8 @@ space</p>
 <a href="/relative/path/wiki/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/image.jpg" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" rel="nofollow"><img src="/relative/path/wiki/raw/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -883,6 +905,8 @@ space</p>
 <a href="/user/repo/src/branch/main/sub/folder/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/user/repo/media/branch/main/sub/folder/image.jpg" target="_blank" rel="nofollow noopener"><img src="/user/repo/media/branch/main/sub/folder/image.jpg" alt="local image"/></a><br/>
+<a href="/user/repo/media/branch/main/sub/folder/path/file" target="_blank" rel="nofollow noopener"><img src="/user/repo/media/branch/main/sub/folder/path/file" alt="local image"/></a><br/>
+<a href="/user/repo/media/branch/main/sub/folder/path/file" target="_blank" rel="nofollow noopener"><img src="/user/repo/media/branch/main/sub/folder/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/user/repo/media/branch/main/sub/folder/image.jpg" rel="nofollow"><img src="/user/repo/media/branch/main/sub/folder/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>
@@ -912,6 +936,8 @@ space</p>
 <a href="/relative/path/wiki/file.bin" rel="nofollow">local link</a><br/>
 <a href="https://example.com" rel="nofollow">remote link</a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/image.jpg" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
+<a href="/relative/path/wiki/raw/path/file" target="_blank" rel="nofollow noopener"><img src="/relative/path/wiki/raw/path/file" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a><br/>
 <a href="/relative/path/wiki/raw/image.jpg" rel="nofollow"><img src="/relative/path/wiki/raw/image.jpg" title="local image" alt="local image"/></a><br/>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a><br/>

From fc1bae00a4cc07d832eb9405ec8fd8f4e52c0197 Mon Sep 17 00:00:00 2001
From: KN4CK3R <admin@oldschoolhack.me>
Date: Sat, 27 Jan 2024 10:27:34 +0100
Subject: [PATCH 09/17] Fix SSPI user creation (#28948)

Fixes #28945

Setting the avatar is wrong and creating a random password is equal to
leave it empty.
---
 services/auth/sspi.go | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/services/auth/sspi.go b/services/auth/sspi.go
index 57ba0462c573b..0e974fde8f358 100644
--- a/services/auth/sspi.go
+++ b/services/auth/sspi.go
@@ -11,7 +11,6 @@ import (
 	"sync"
 
 	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/avatars"
 	"code.gitea.io/gitea/models/db"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/base"
@@ -167,12 +166,9 @@ func (s *SSPI) shouldAuthenticate(req *http.Request) (shouldAuth bool) {
 func (s *SSPI) newUser(ctx context.Context, username string, cfg *sspi.Source) (*user_model.User, error) {
 	email := gouuid.New().String() + "@localhost.localdomain"
 	user := &user_model.User{
-		Name:            username,
-		Email:           email,
-		Passwd:          gouuid.New().String(),
-		Language:        cfg.DefaultLanguage,
-		UseCustomAvatar: true,
-		Avatar:          avatars.DefaultAvatarLink(),
+		Name:     username,
+		Email:    email,
+		Language: cfg.DefaultLanguage,
 	}
 	emailNotificationPreference := user_model.EmailNotificationsDisabled
 	overwriteDefault := &user_model.CreateUserOverwriteOptions{

From 0e650dca3076bbf8e1a4d1a80cef3275a51af658 Mon Sep 17 00:00:00 2001
From: Yarden Shoham <git@yardenshoham.com>
Date: Sat, 27 Jan 2024 14:27:37 +0200
Subject: [PATCH 10/17] Make loading animation less aggressive (#28955)

The current animation loops in a very fast manner, causing a slight
feeling of uncomfortableness. This change slows it a bit for a smoother
experience.

# Before


![before](https://github.com/go-gitea/gitea/assets/20454870/215a722d-feb4-4643-819d-c37a620c5e48)

# After


![after](https://github.com/go-gitea/gitea/assets/20454870/7acb1fab-9157-4f4d-8cc7-45fea0234b47)

Signed-off-by: Yarden Shoham <git@yardenshoham.com>
---
 web_src/css/modules/animations.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web_src/css/modules/animations.css b/web_src/css/modules/animations.css
index cac824d87d66d..87eb6a75cf071 100644
--- a/web_src/css/modules/animations.css
+++ b/web_src/css/modules/animations.css
@@ -22,7 +22,7 @@
   height: min(4em, 66.6%);
   aspect-ratio: 1;
   transform: translate(-50%, -50%);
-  animation: isloadingspin 500ms infinite linear;
+  animation: isloadingspin 1000ms infinite linear;
   border-width: 4px;
   border-style: solid;
   border-color: var(--color-secondary) var(--color-secondary) var(--color-secondary-dark-8) var(--color-secondary-dark-8);

From 60e4a98ab07dcf3bd86cf630c79e6433c3ef3e84 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Sat, 27 Jan 2024 19:02:51 +0100
Subject: [PATCH 11/17] Preserve BOM in web editor (#28935)

The `ToUTF8*` functions were stripping BOM, while BOM is actually valid
in UTF8, so the stripping must be optional depending on use case. This
does:

- Add a options struct to all `ToUTF8*` functions, that by default will
strip BOM to preserve existing behaviour
- Remove `ToUTF8` function, it was dead code
- Rename `ToUTF8WithErr` to `ToUTF8`
- Preserve BOM in Monaco Editor
- Remove a unnecessary newline in the textarea value. Browsers did
ignore it, it seems but it's better not to rely on this behaviour.

Fixes: https://github.com/go-gitea/gitea/issues/28743
Related: https://github.com/go-gitea/gitea/issues/6716 which seems to
have once introduced a mechanism that strips and re-adds the BOM, but
from what I can tell, this mechanism was removed at some point after
that PR.
---
 modules/charset/charset.go                    |  43 +++---
 modules/charset/charset_test.go               | 133 +++++-------------
 modules/indexer/code/bleve/bleve.go           |   2 +-
 .../code/elasticsearch/elasticsearch.go       |   2 +-
 routers/web/repo/commit.go                    |   2 +-
 routers/web/repo/compare.go                   |   2 +-
 routers/web/repo/editor.go                    |   4 +-
 routers/web/repo/render.go                    |   2 +-
 routers/web/repo/setting/lfs.go               |   2 +-
 routers/web/repo/view.go                      |   4 +-
 templates/repo/editor/edit.tmpl               |   3 +-
 .../migration-test/migration_test.go          |   2 +-
 web_src/js/features/codeeditor.js             |   2 +-
 13 files changed, 69 insertions(+), 134 deletions(-)

diff --git a/modules/charset/charset.go b/modules/charset/charset.go
index 51152142a581f..1855446a98480 100644
--- a/modules/charset/charset.go
+++ b/modules/charset/charset.go
@@ -22,17 +22,21 @@ import (
 // UTF8BOM is the utf-8 byte-order marker
 var UTF8BOM = []byte{'\xef', '\xbb', '\xbf'}
 
+type ConvertOpts struct {
+	KeepBOM bool
+}
+
 // ToUTF8WithFallbackReader detects the encoding of content and converts to UTF-8 reader if possible
-func ToUTF8WithFallbackReader(rd io.Reader) io.Reader {
+func ToUTF8WithFallbackReader(rd io.Reader, opts ConvertOpts) io.Reader {
 	buf := make([]byte, 2048)
 	n, err := util.ReadAtMost(rd, buf)
 	if err != nil {
-		return io.MultiReader(bytes.NewReader(RemoveBOMIfPresent(buf[:n])), rd)
+		return io.MultiReader(bytes.NewReader(MaybeRemoveBOM(buf[:n], opts)), rd)
 	}
 
 	charsetLabel, err := DetectEncoding(buf[:n])
 	if err != nil || charsetLabel == "UTF-8" {
-		return io.MultiReader(bytes.NewReader(RemoveBOMIfPresent(buf[:n])), rd)
+		return io.MultiReader(bytes.NewReader(MaybeRemoveBOM(buf[:n], opts)), rd)
 	}
 
 	encoding, _ := charset.Lookup(charsetLabel)
@@ -42,20 +46,20 @@ func ToUTF8WithFallbackReader(rd io.Reader) io.Reader {
 
 	return transform.NewReader(
 		io.MultiReader(
-			bytes.NewReader(RemoveBOMIfPresent(buf[:n])),
+			bytes.NewReader(MaybeRemoveBOM(buf[:n], opts)),
 			rd,
 		),
 		encoding.NewDecoder(),
 	)
 }
 
-// ToUTF8WithErr converts content to UTF8 encoding
-func ToUTF8WithErr(content []byte) (string, error) {
+// ToUTF8 converts content to UTF8 encoding
+func ToUTF8(content []byte, opts ConvertOpts) (string, error) {
 	charsetLabel, err := DetectEncoding(content)
 	if err != nil {
 		return "", err
 	} else if charsetLabel == "UTF-8" {
-		return string(RemoveBOMIfPresent(content)), nil
+		return string(MaybeRemoveBOM(content, opts)), nil
 	}
 
 	encoding, _ := charset.Lookup(charsetLabel)
@@ -70,28 +74,22 @@ func ToUTF8WithErr(content []byte) (string, error) {
 		result = append(result, content[n:]...)
 	}
 
-	result = RemoveBOMIfPresent(result)
+	result = MaybeRemoveBOM(result, opts)
 
 	return string(result), err
 }
 
 // ToUTF8WithFallback detects the encoding of content and converts to UTF-8 if possible
-func ToUTF8WithFallback(content []byte) []byte {
-	bs, _ := io.ReadAll(ToUTF8WithFallbackReader(bytes.NewReader(content)))
+func ToUTF8WithFallback(content []byte, opts ConvertOpts) []byte {
+	bs, _ := io.ReadAll(ToUTF8WithFallbackReader(bytes.NewReader(content), opts))
 	return bs
 }
 
-// ToUTF8 converts content to UTF8 encoding and ignore error
-func ToUTF8(content string) string {
-	res, _ := ToUTF8WithErr([]byte(content))
-	return res
-}
-
 // ToUTF8DropErrors makes sure the return string is valid utf-8; attempts conversion if possible
-func ToUTF8DropErrors(content []byte) []byte {
+func ToUTF8DropErrors(content []byte, opts ConvertOpts) []byte {
 	charsetLabel, err := DetectEncoding(content)
 	if err != nil || charsetLabel == "UTF-8" {
-		return RemoveBOMIfPresent(content)
+		return MaybeRemoveBOM(content, opts)
 	}
 
 	encoding, _ := charset.Lookup(charsetLabel)
@@ -117,11 +115,14 @@ func ToUTF8DropErrors(content []byte) []byte {
 		}
 	}
 
-	return RemoveBOMIfPresent(decoded)
+	return MaybeRemoveBOM(decoded, opts)
 }
 
-// RemoveBOMIfPresent removes a UTF-8 BOM from a []byte
-func RemoveBOMIfPresent(content []byte) []byte {
+// MaybeRemoveBOM removes a UTF-8 BOM from a []byte when opts.KeepBOM is false
+func MaybeRemoveBOM(content []byte, opts ConvertOpts) []byte {
+	if opts.KeepBOM {
+		return content
+	}
 	if len(content) > 2 && bytes.Equal(content[0:3], UTF8BOM) {
 		return content[3:]
 	}
diff --git a/modules/charset/charset_test.go b/modules/charset/charset_test.go
index fc56799b47360..829844a9766cd 100644
--- a/modules/charset/charset_test.go
+++ b/modules/charset/charset_test.go
@@ -30,15 +30,15 @@ func resetDefaultCharsetsOrder() {
 	}
 }
 
-func TestRemoveBOMIfPresent(t *testing.T) {
-	res := RemoveBOMIfPresent([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
+func TestMaybeRemoveBOM(t *testing.T) {
+	res := MaybeRemoveBOM([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
-	res = RemoveBOMIfPresent([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
+	res = MaybeRemoveBOM([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 }
 
-func TestToUTF8WithErr(t *testing.T) {
+func TestToUTF8(t *testing.T) {
 	resetDefaultCharsetsOrder()
 	var res string
 	var err error
@@ -47,53 +47,53 @@ func TestToUTF8WithErr(t *testing.T) {
 	// locale, so some conversions might behave differently. For that reason, we don't
 	// depend on particular conversions but in expected behaviors.
 
-	res, err = ToUTF8WithErr([]byte{0x41, 0x42, 0x43})
+	res, err = ToUTF8([]byte{0x41, 0x42, 0x43}, ConvertOpts{})
 	assert.NoError(t, err)
 	assert.Equal(t, "ABC", res)
 
 	// "áéíóú"
-	res, err = ToUTF8WithErr([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
+	res, err = ToUTF8([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.NoError(t, err)
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, []byte(res))
 
 	// "áéíóú"
-	res, err = ToUTF8WithErr([]byte{
+	res, err = ToUTF8([]byte{
 		0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3,
 		0xc3, 0xba,
-	})
+	}, ConvertOpts{})
 	assert.NoError(t, err)
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, []byte(res))
 
-	res, err = ToUTF8WithErr([]byte{
+	res, err = ToUTF8([]byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
 		0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73, 0x41, 0x41, 0x41, 0x2e,
-	})
+	}, ConvertOpts{})
 	assert.NoError(t, err)
 	stringMustStartWith(t, "Hola,", res)
 	stringMustEndWith(t, "AAA.", res)
 
-	res, err = ToUTF8WithErr([]byte{
+	res, err = ToUTF8([]byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
 		0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73, 0x41, 0x41, 0x41, 0x2e,
-	})
+	}, ConvertOpts{})
 	assert.NoError(t, err)
 	stringMustStartWith(t, "Hola,", res)
 	stringMustEndWith(t, "AAA.", res)
 
-	res, err = ToUTF8WithErr([]byte{
+	res, err = ToUTF8([]byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
 		0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73, 0x41, 0x41, 0x41, 0x2e,
-	})
+	}, ConvertOpts{})
 	assert.NoError(t, err)
 	stringMustStartWith(t, "Hola,", res)
 	stringMustEndWith(t, "AAA.", res)
 
 	// Japanese (Shift-JIS)
 	// 日属秘ぞしちゅ。
-	res, err = ToUTF8WithErr([]byte{
+	res, err = ToUTF8([]byte{
 		0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82,
 		0xBF, 0x82, 0xE3, 0x81, 0x42,
-	})
+	}, ConvertOpts{})
 	assert.NoError(t, err)
 	assert.Equal(t, []byte{
 		0xE6, 0x97, 0xA5, 0xE5, 0xB1, 0x9E, 0xE7, 0xA7, 0x98, 0xE3,
@@ -101,7 +101,7 @@ func TestToUTF8WithErr(t *testing.T) {
 	},
 		[]byte(res))
 
-	res, err = ToUTF8WithErr([]byte{0x00, 0x00, 0x00, 0x00})
+	res, err = ToUTF8([]byte{0x00, 0x00, 0x00, 0x00}, ConvertOpts{})
 	assert.NoError(t, err)
 	assert.Equal(t, []byte{0x00, 0x00, 0x00, 0x00}, []byte(res))
 }
@@ -109,22 +109,22 @@ func TestToUTF8WithErr(t *testing.T) {
 func TestToUTF8WithFallback(t *testing.T) {
 	resetDefaultCharsetsOrder()
 	// "ABC"
-	res := ToUTF8WithFallback([]byte{0x41, 0x42, 0x43})
+	res := ToUTF8WithFallback([]byte{0x41, 0x42, 0x43}, ConvertOpts{})
 	assert.Equal(t, []byte{0x41, 0x42, 0x43}, res)
 
 	// "áéíóú"
-	res = ToUTF8WithFallback([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
+	res = ToUTF8WithFallback([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
 	// UTF8 BOM + "áéíóú"
-	res = ToUTF8WithFallback([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
+	res = ToUTF8WithFallback([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
 	// "Hola, así cómo ños"
 	res = ToUTF8WithFallback([]byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
 		0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73,
-	})
+	}, ConvertOpts{})
 	assert.Equal(t, []byte{
 		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xC3, 0xAD, 0x20, 0x63,
 		0xC3, 0xB3, 0x6D, 0x6F, 0x20, 0xC3, 0xB1, 0x6F, 0x73,
@@ -133,126 +133,65 @@ func TestToUTF8WithFallback(t *testing.T) {
 	// "Hola, así cómo "
 	minmatch := []byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xC3, 0xAD, 0x20, 0x63, 0xC3, 0xB3, 0x6D, 0x6F, 0x20}
 
-	res = ToUTF8WithFallback([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73})
+	res = ToUTF8WithFallback([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73}, ConvertOpts{})
 	// Do not fail for differences in invalid cases, as the library might change the conversion criteria for those
 	assert.Equal(t, minmatch, res[0:len(minmatch)])
 
-	res = ToUTF8WithFallback([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73})
+	res = ToUTF8WithFallback([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73}, ConvertOpts{})
 	// Do not fail for differences in invalid cases, as the library might change the conversion criteria for those
 	assert.Equal(t, minmatch, res[0:len(minmatch)])
 
 	// Japanese (Shift-JIS)
 	// "日属秘ぞしちゅ。"
-	res = ToUTF8WithFallback([]byte{0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82, 0xBF, 0x82, 0xE3, 0x81, 0x42})
+	res = ToUTF8WithFallback([]byte{0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82, 0xBF, 0x82, 0xE3, 0x81, 0x42}, ConvertOpts{})
 	assert.Equal(t, []byte{
 		0xE6, 0x97, 0xA5, 0xE5, 0xB1, 0x9E, 0xE7, 0xA7, 0x98, 0xE3,
 		0x81, 0x9E, 0xE3, 0x81, 0x97, 0xE3, 0x81, 0xA1, 0xE3, 0x82, 0x85, 0xE3, 0x80, 0x82,
 	}, res)
 
-	res = ToUTF8WithFallback([]byte{0x00, 0x00, 0x00, 0x00})
+	res = ToUTF8WithFallback([]byte{0x00, 0x00, 0x00, 0x00}, ConvertOpts{})
 	assert.Equal(t, []byte{0x00, 0x00, 0x00, 0x00}, res)
 }
 
-func TestToUTF8(t *testing.T) {
-	resetDefaultCharsetsOrder()
-	// Note: golang compiler seems so behave differently depending on the current
-	// locale, so some conversions might behave differently. For that reason, we don't
-	// depend on particular conversions but in expected behaviors.
-
-	res := ToUTF8(string([]byte{0x41, 0x42, 0x43}))
-	assert.Equal(t, "ABC", res)
-
-	// "áéíóú"
-	res = ToUTF8(string([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}))
-	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, []byte(res))
-
-	// BOM + "áéíóú"
-	res = ToUTF8(string([]byte{
-		0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3,
-		0xc3, 0xba,
-	}))
-	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, []byte(res))
-
-	// Latin1
-	// Hola, así cómo ños
-	res = ToUTF8(string([]byte{
-		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
-		0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73,
-	}))
-	assert.Equal(t, []byte{
-		0x48, 0x6f, 0x6c, 0x61, 0x2c, 0x20, 0x61, 0x73, 0xc3, 0xad, 0x20, 0x63,
-		0xc3, 0xb3, 0x6d, 0x6f, 0x20, 0xc3, 0xb1, 0x6f, 0x73,
-	}, []byte(res))
-
-	// Latin1
-	// Hola, así cómo \x07ños
-	res = ToUTF8(string([]byte{
-		0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63,
-		0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73,
-	}))
-	// Hola,
-	bytesMustStartWith(t, []byte{0x48, 0x6F, 0x6C, 0x61, 0x2C}, []byte(res))
-
-	// This test FAILS
-	// res = ToUTF8("Hola, así cómo \x81ños")
-	// Do not fail for differences in invalid cases, as the library might change the conversion criteria for those
-	// assert.Regexp(t, "^Hola, así cómo", res)
-
-	// Japanese (Shift-JIS)
-	// 日属秘ぞしちゅ。
-	res = ToUTF8(string([]byte{
-		0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82,
-		0xBF, 0x82, 0xE3, 0x81, 0x42,
-	}))
-	assert.Equal(t, []byte{
-		0xE6, 0x97, 0xA5, 0xE5, 0xB1, 0x9E, 0xE7, 0xA7, 0x98, 0xE3,
-		0x81, 0x9E, 0xE3, 0x81, 0x97, 0xE3, 0x81, 0xA1, 0xE3, 0x82, 0x85, 0xE3, 0x80, 0x82,
-	},
-		[]byte(res))
-
-	res = ToUTF8("\x00\x00\x00\x00")
-	assert.Equal(t, []byte{0x00, 0x00, 0x00, 0x00}, []byte(res))
-}
-
 func TestToUTF8DropErrors(t *testing.T) {
 	resetDefaultCharsetsOrder()
 	// "ABC"
-	res := ToUTF8DropErrors([]byte{0x41, 0x42, 0x43})
+	res := ToUTF8DropErrors([]byte{0x41, 0x42, 0x43}, ConvertOpts{})
 	assert.Equal(t, []byte{0x41, 0x42, 0x43}, res)
 
 	// "áéíóú"
-	res = ToUTF8DropErrors([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
+	res = ToUTF8DropErrors([]byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
 	// UTF8 BOM + "áéíóú"
-	res = ToUTF8DropErrors([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba})
+	res = ToUTF8DropErrors([]byte{0xef, 0xbb, 0xbf, 0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, ConvertOpts{})
 	assert.Equal(t, []byte{0xc3, 0xa1, 0xc3, 0xa9, 0xc3, 0xad, 0xc3, 0xb3, 0xc3, 0xba}, res)
 
 	// "Hola, así cómo ños"
-	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73})
+	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0xF1, 0x6F, 0x73}, ConvertOpts{})
 	assert.Equal(t, []byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73}, res[:8])
 	assert.Equal(t, []byte{0x73}, res[len(res)-1:])
 
 	// "Hola, así cómo "
 	minmatch := []byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xC3, 0xAD, 0x20, 0x63, 0xC3, 0xB3, 0x6D, 0x6F, 0x20}
 
-	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73})
+	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x07, 0xA4, 0x6F, 0x73}, ConvertOpts{})
 	// Do not fail for differences in invalid cases, as the library might change the conversion criteria for those
 	assert.Equal(t, minmatch, res[0:len(minmatch)])
 
-	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73})
+	res = ToUTF8DropErrors([]byte{0x48, 0x6F, 0x6C, 0x61, 0x2C, 0x20, 0x61, 0x73, 0xED, 0x20, 0x63, 0xF3, 0x6D, 0x6F, 0x20, 0x81, 0xA4, 0x6F, 0x73}, ConvertOpts{})
 	// Do not fail for differences in invalid cases, as the library might change the conversion criteria for those
 	assert.Equal(t, minmatch, res[0:len(minmatch)])
 
 	// Japanese (Shift-JIS)
 	// "日属秘ぞしちゅ。"
-	res = ToUTF8DropErrors([]byte{0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82, 0xBF, 0x82, 0xE3, 0x81, 0x42})
+	res = ToUTF8DropErrors([]byte{0x93, 0xFA, 0x91, 0xAE, 0x94, 0xE9, 0x82, 0xBC, 0x82, 0xB5, 0x82, 0xBF, 0x82, 0xE3, 0x81, 0x42}, ConvertOpts{})
 	assert.Equal(t, []byte{
 		0xE6, 0x97, 0xA5, 0xE5, 0xB1, 0x9E, 0xE7, 0xA7, 0x98, 0xE3,
 		0x81, 0x9E, 0xE3, 0x81, 0x97, 0xE3, 0x81, 0xA1, 0xE3, 0x82, 0x85, 0xE3, 0x80, 0x82,
 	}, res)
 
-	res = ToUTF8DropErrors([]byte{0x00, 0x00, 0x00, 0x00})
+	res = ToUTF8DropErrors([]byte{0x00, 0x00, 0x00, 0x00}, ConvertOpts{})
 	assert.Equal(t, []byte{0x00, 0x00, 0x00, 0x00}, res)
 }
 
@@ -302,10 +241,6 @@ func stringMustEndWith(t *testing.T, expected, value string) {
 	assert.Equal(t, expected, value[len(value)-len(expected):])
 }
 
-func bytesMustStartWith(t *testing.T, expected, value []byte) {
-	assert.Equal(t, expected, value[:len(expected)])
-}
-
 func TestToUTF8WithFallbackReader(t *testing.T) {
 	resetDefaultCharsetsOrder()
 
@@ -317,7 +252,7 @@ func TestToUTF8WithFallbackReader(t *testing.T) {
 		}
 		input = input[:testLen]
 		input += "// Выключаем"
-		rd := ToUTF8WithFallbackReader(bytes.NewReader([]byte(input)))
+		rd := ToUTF8WithFallbackReader(bytes.NewReader([]byte(input)), ConvertOpts{})
 		r, _ := io.ReadAll(rd)
 		assert.EqualValuesf(t, input, string(r), "testing string len=%d", testLen)
 	}
diff --git a/modules/indexer/code/bleve/bleve.go b/modules/indexer/code/bleve/bleve.go
index 0bfd85cb3f30d..8ba50ed77c938 100644
--- a/modules/indexer/code/bleve/bleve.go
+++ b/modules/indexer/code/bleve/bleve.go
@@ -174,7 +174,7 @@ func (b *Indexer) addUpdate(ctx context.Context, batchWriter git.WriteCloserErro
 	return batch.Index(id, &RepoIndexerData{
 		RepoID:    repo.ID,
 		CommitID:  commitSha,
-		Content:   string(charset.ToUTF8DropErrors(fileContents)),
+		Content:   string(charset.ToUTF8DropErrors(fileContents, charset.ConvertOpts{})),
 		Language:  analyze.GetCodeLanguage(update.Filename, fileContents),
 		UpdatedAt: time.Now().UTC(),
 	})
diff --git a/modules/indexer/code/elasticsearch/elasticsearch.go b/modules/indexer/code/elasticsearch/elasticsearch.go
index e7e3429a39af6..2fadbfeb064e1 100644
--- a/modules/indexer/code/elasticsearch/elasticsearch.go
+++ b/modules/indexer/code/elasticsearch/elasticsearch.go
@@ -135,7 +135,7 @@ func (b *Indexer) addUpdate(ctx context.Context, batchWriter git.WriteCloserErro
 			Id(id).
 			Doc(map[string]any{
 				"repo_id":    repo.ID,
-				"content":    string(charset.ToUTF8DropErrors(fileContents)),
+				"content":    string(charset.ToUTF8DropErrors(fileContents, charset.ConvertOpts{})),
 				"commit_id":  sha,
 				"language":   analyze.GetCodeLanguage(update.Filename, fileContents),
 				"updated_at": timeutil.TimeStampNow(),
diff --git a/routers/web/repo/commit.go b/routers/web/repo/commit.go
index abb39caa5753e..00157d44c99c4 100644
--- a/routers/web/repo/commit.go
+++ b/routers/web/repo/commit.go
@@ -384,7 +384,7 @@ func Diff(ctx *context.Context) {
 			Metas:   ctx.Repo.Repository.ComposeMetas(ctx),
 			GitRepo: ctx.Repo.GitRepo,
 			Ctx:     ctx,
-		}, template.HTMLEscapeString(string(charset.ToUTF8WithFallback(note.Message))))
+		}, template.HTMLEscapeString(string(charset.ToUTF8WithFallback(note.Message, charset.ConvertOpts{}))))
 		if err != nil {
 			ctx.ServerError("RenderCommitMessage", err)
 			return
diff --git a/routers/web/repo/compare.go b/routers/web/repo/compare.go
index 042b8ed692acf..5ae48e1ce8148 100644
--- a/routers/web/repo/compare.go
+++ b/routers/web/repo/compare.go
@@ -142,7 +142,7 @@ func setCsvCompareContext(ctx *context.Context) {
 				return nil, nil, err
 			}
 
-			csvReader, err := csv_module.CreateReaderAndDetermineDelimiter(ctx, charset.ToUTF8WithFallbackReader(reader))
+			csvReader, err := csv_module.CreateReaderAndDetermineDelimiter(ctx, charset.ToUTF8WithFallbackReader(reader, charset.ConvertOpts{}))
 			return csvReader, reader, err
 		}
 
diff --git a/routers/web/repo/editor.go b/routers/web/repo/editor.go
index 5e7cd1caa3995..85d40e7820b16 100644
--- a/routers/web/repo/editor.go
+++ b/routers/web/repo/editor.go
@@ -166,8 +166,8 @@ func editFile(ctx *context.Context, isNewFile bool) {
 		}
 
 		buf = append(buf, d...)
-		if content, err := charset.ToUTF8WithErr(buf); err != nil {
-			log.Error("ToUTF8WithErr: %v", err)
+		if content, err := charset.ToUTF8(buf, charset.ConvertOpts{KeepBOM: true}); err != nil {
+			log.Error("ToUTF8: %v", err)
 			ctx.Data["FileContent"] = string(buf)
 		} else {
 			ctx.Data["FileContent"] = content
diff --git a/routers/web/repo/render.go b/routers/web/repo/render.go
index f2c6ab3f8fff4..7eb5a42aa43c0 100644
--- a/routers/web/repo/render.go
+++ b/routers/web/repo/render.go
@@ -43,7 +43,7 @@ func RenderFile(ctx *context.Context) {
 	st := typesniffer.DetectContentType(buf)
 	isTextFile := st.IsText()
 
-	rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc))
+	rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc), charset.ConvertOpts{})
 
 	if markupType := markup.Type(blob.Name()); markupType == "" {
 		if isTextFile {
diff --git a/routers/web/repo/setting/lfs.go b/routers/web/repo/setting/lfs.go
index edf1298c2073e..cd0f11d548704 100644
--- a/routers/web/repo/setting/lfs.go
+++ b/routers/web/repo/setting/lfs.go
@@ -303,7 +303,7 @@ func LFSFileGet(ctx *context.Context) {
 			break
 		}
 
-		rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc))
+		rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc), charset.ConvertOpts{})
 
 		// Building code view blocks with line number on server side.
 		escapedContent := &bytes.Buffer{}
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 00fd47b6506d1..af3021da11287 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -303,7 +303,7 @@ func renderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.Tr
 		return
 	}
 
-	rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc))
+	rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc), charset.ConvertOpts{})
 
 	if markupType := markup.Type(readmeFile.Name()); markupType != "" {
 		ctx.Data["IsMarkup"] = true
@@ -492,7 +492,7 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry) {
 			break
 		}
 
-		rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc))
+		rd := charset.ToUTF8WithFallbackReader(io.MultiReader(bytes.NewReader(buf), dataRc), charset.ConvertOpts{})
 
 		shouldRenderSource := ctx.FormString("display") == "source"
 		readmeExist := util.IsReadmeFileName(blob.Name())
diff --git a/templates/repo/editor/edit.tmpl b/templates/repo/editor/edit.tmpl
index 58ed6f356e71a..cfc266731b144 100644
--- a/templates/repo/editor/edit.tmpl
+++ b/templates/repo/editor/edit.tmpl
@@ -38,8 +38,7 @@
 						data-url="{{.Repository.Link}}/markup"
 						data-context="{{.RepoLink}}"
 						data-previewable-extensions="{{.PreviewableExtensions}}"
-						data-line-wrap-extensions="{{.LineWrapExtensions}}">
-{{.FileContent}}</textarea>
+						data-line-wrap-extensions="{{.LineWrapExtensions}}">{{.FileContent}}</textarea>
 					<div class="editor-loading is-loading"></div>
 				</div>
 				<div class="ui bottom attached tab segment markup" data-tab="preview">
diff --git a/tests/integration/migration-test/migration_test.go b/tests/integration/migration-test/migration_test.go
index 556a54015b4f1..40fcf95705887 100644
--- a/tests/integration/migration-test/migration_test.go
+++ b/tests/integration/migration-test/migration_test.go
@@ -141,7 +141,7 @@ func readSQLFromFile(version string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return string(charset.RemoveBOMIfPresent(bytes)), nil
+	return string(charset.MaybeRemoveBOM(bytes, charset.ConvertOpts{})), nil
 }
 
 func restoreOldDB(t *testing.T, version string) bool {
diff --git a/web_src/js/features/codeeditor.js b/web_src/js/features/codeeditor.js
index ae54268d56d18..fceb2f7620e9e 100644
--- a/web_src/js/features/codeeditor.js
+++ b/web_src/js/features/codeeditor.js
@@ -114,7 +114,7 @@ export async function createMonaco(textarea, filename, editorOpts) {
 
   const model = editor.getModel();
   model.onDidChangeContent(() => {
-    textarea.value = editor.getValue();
+    textarea.value = editor.getValue({preserveBOM: true});
     textarea.dispatchEvent(new Event('change')); // seems to be needed for jquery-are-you-sure
   });
 

From 5f82ead13cb7706d3f660271d94de6101cef4119 Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Sun, 28 Jan 2024 04:09:51 +0800
Subject: [PATCH 12/17] Simplify how git repositories are opened (#28937)

## Purpose
This is a refactor toward building an abstraction over managing git
repositories.
Afterwards, it does not matter anymore if they are stored on the local
disk or somewhere remote.

## What this PR changes
We used `git.OpenRepository` everywhere previously.
Now, we should split them into two distinct functions:

Firstly, there are temporary repositories which do not change:

```go
git.OpenRepository(ctx, diskPath)
```

Gitea managed repositories having a record in the database in the
`repository` table are moved into the new package `gitrepo`:

```go
gitrepo.OpenRepository(ctx, repo_model.Repo)
```

Why is `repo_model.Repository` the second parameter instead of file
path?
Because then we can easily adapt our repository storage strategy.
The repositories can be stored locally, however, they could just as well
be stored on a remote server.

## Further changes in other PRs
- A Git Command wrapper on package `gitrepo` could be created. i.e.
`NewCommand(ctx, repo_model.Repository, commands...)`. `git.RunOpts{Dir:
repo.RepoPath()}`, the directory should be empty before invoking this
method and it can be filled in the function only. #28940
- Remove the `RepoPath()`/`WikiPath()` functions to reduce the
possibility of mistakes.

---------

Co-authored-by: delvh <dev.lh@web.de>
---
 cmd/admin.go                                  |   3 +-
 models/activities/repo_activity.go            |   5 +-
 models/issues/comment.go                      |   5 +-
 models/issues/pull.go                         |   3 +-
 models/repo/repo.go                           |   8 ++
 modules/context/api.go                        |   9 +-
 modules/context/context.go                    |   4 +-
 modules/context/repo.go                       |  10 +-
 modules/contexttest/context_tests.go          |   6 +-
 modules/git/repo_base.go                      |  44 --------
 modules/git/repo_branch.go                    |  23 ----
 modules/git/repo_branch_gogit.go              |  29 -----
 modules/git/repo_branch_nogogit.go            |  13 +--
 modules/gitrepo/branch.go                     |  32 ++++++
 modules/gitrepo/gitrepo.go                    | 103 ++++++++++++++++++
 modules/gitrepo/walk_gogit.go                 |  40 +++++++
 modules/gitrepo/walk_nogogit.go               |  17 +++
 modules/indexer/stats/db.go                   |   3 +-
 modules/repository/branch.go                  |   5 +-
 modules/repository/generate.go                |   3 +-
 modules/repository/repo.go                    |   3 +-
 routers/api/v1/repo/branch.go                 |   5 +-
 routers/api/v1/repo/file.go                   |   4 +-
 routers/api/v1/repo/pull.go                   |   9 +-
 routers/api/v1/repo/pull_review.go            |   5 +-
 routers/api/v1/repo/repo.go                   |   3 +-
 routers/api/v1/repo/wiki.go                   |   3 +-
 routers/api/v1/utils/git.go                   |   3 +-
 routers/private/internal_repo.go              |   4 +-
 routers/web/repo/commit.go                    |   5 +-
 routers/web/repo/compare.go                   |   7 +-
 routers/web/repo/editor_test.go               |   3 +-
 routers/web/repo/pull.go                      |  17 +--
 routers/web/repo/wiki.go                      |   3 +-
 routers/web/repo/wiki_test.go                 |   3 +-
 routers/web/shared/user/header.go             |   3 +-
 services/actions/notifier_helper.go           |   3 +-
 services/asymkey/sign.go                      |   7 +-
 services/automerge/automerge.go               |   7 +-
 services/convert/pull.go                      |   9 +-
 services/doctor/misc.go                       |   3 +-
 services/migrations/gitea_uploader.go         |   3 +-
 services/migrations/gitea_uploader_test.go    |   5 +-
 services/mirror/mirror_pull.go                |   7 +-
 services/mirror/mirror_push.go                |  21 +++-
 services/pull/check.go                        |   3 +-
 services/pull/comment.go                      |   5 +-
 services/pull/commit_status.go                |   3 +-
 services/pull/merge_rebase.go                 |   3 +-
 services/pull/merge_squash.go                 |   3 +-
 services/pull/patch.go                        |   3 +-
 services/pull/pull.go                         |  17 +--
 services/pull/pull_test.go                    |   5 +-
 services/pull/review.go                       |   3 +-
 services/release/release.go                   |   3 +-
 services/release/release_test.go              |  10 +-
 services/repository/adopt.go                  |   3 +-
 services/repository/archiver/archiver.go      |   3 +-
 services/repository/branch.go                 |   9 +-
 services/repository/create.go                 |   3 +-
 services/repository/files/commit.go           |   3 +-
 services/repository/files/content.go          |   5 +-
 services/repository/files/content_test.go     |   5 +-
 services/repository/files/file_test.go        |   4 +-
 services/repository/files/patch.go            |   3 +-
 services/repository/files/update.go           |   3 +-
 services/repository/fork.go                   |   5 +-
 services/repository/hooks.go                  |   6 +-
 services/repository/lfs.go                    |   3 +-
 services/repository/push.go                   |   9 +-
 services/wiki/wiki.go                         |   4 +-
 services/wiki/wiki_test.go                    |   9 +-
 tests/integration/api_packages_cargo_test.go  |   4 +-
 tests/integration/api_releases_test.go        |   5 +-
 .../integration/api_repo_file_create_test.go  |   6 +-
 .../integration/api_repo_file_update_test.go  |   4 +-
 .../integration/api_repo_files_change_test.go |   4 +-
 .../api_repo_get_contents_list_test.go        |   3 +-
 .../integration/api_repo_get_contents_test.go |   3 +-
 tests/integration/api_repo_git_tags_test.go   |   3 +-
 tests/integration/mirror_pull_test.go         |   3 +-
 tests/integration/mirror_push_test.go         |   5 +-
 tests/integration/pull_merge_test.go          |   5 +-
 tests/integration/repofiles_change_test.go    |   9 +-
 84 files changed, 426 insertions(+), 273 deletions(-)
 create mode 100644 modules/gitrepo/branch.go
 create mode 100644 modules/gitrepo/gitrepo.go
 create mode 100644 modules/gitrepo/walk_gogit.go
 create mode 100644 modules/gitrepo/walk_nogogit.go

diff --git a/cmd/admin.go b/cmd/admin.go
index 74bfa5a6c6703..6c9480e76eb7a 100644
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -11,6 +11,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
 
@@ -122,7 +123,7 @@ func runRepoSyncReleases(_ *cli.Context) error {
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
 			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RepoPath())
-			gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
 				continue
diff --git a/models/activities/repo_activity.go b/models/activities/repo_activity.go
index 91f5ac12bdc04..ba5e4959f0df8 100644
--- a/models/activities/repo_activity.go
+++ b/models/activities/repo_activity.go
@@ -14,6 +14,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 
 	"xorm.io/xorm"
 )
@@ -65,7 +66,7 @@ func GetActivityStats(ctx context.Context, repo *repo_model.Repository, timeFrom
 		return nil, fmt.Errorf("FillUnresolvedIssues: %w", err)
 	}
 	if code {
-		gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+		gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 		if err != nil {
 			return nil, fmt.Errorf("OpenRepository: %w", err)
 		}
@@ -82,7 +83,7 @@ func GetActivityStats(ctx context.Context, repo *repo_model.Repository, timeFrom
 
 // GetActivityStatsTopAuthors returns top author stats for git commits for all branches
 func GetActivityStatsTopAuthors(ctx context.Context, repo *repo_model.Repository, timeFrom time.Time, count int) ([]*ActivityAuthorData, error) {
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return nil, fmt.Errorf("OpenRepository: %w", err)
 	}
diff --git a/models/issues/comment.go b/models/issues/comment.go
index 8a3bae5b883d2..c63fcab8944f5 100644
--- a/models/issues/comment.go
+++ b/models/issues/comment.go
@@ -18,7 +18,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/references"
@@ -762,8 +762,7 @@ func (c *Comment) LoadPushCommits(ctx context.Context) (err error) {
 		c.OldCommit = data.CommitIDs[0]
 		c.NewCommit = data.CommitIDs[1]
 	} else {
-		repoPath := c.Issue.Repo.RepoPath()
-		gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repoPath)
+		gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, c.Issue.Repo)
 		if err != nil {
 			return err
 		}
diff --git a/models/issues/pull.go b/models/issues/pull.go
index 4ae6e38ae180e..2cb1e1b971e9c 100644
--- a/models/issues/pull.go
+++ b/models/issues/pull.go
@@ -19,6 +19,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
@@ -865,7 +866,7 @@ func PullRequestCodeOwnersReview(ctx context.Context, pull *Issue, pr *PullReque
 		return err
 	}
 
-	repo, err := git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+	repo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
 	if err != nil {
 		return err
 	}
diff --git a/models/repo/repo.go b/models/repo/repo.go
index 4401041cdd528..13493ba6e80e6 100644
--- a/models/repo/repo.go
+++ b/models/repo/repo.go
@@ -196,6 +196,14 @@ func init() {
 	db.RegisterModel(new(Repository))
 }
 
+func (repo *Repository) GetName() string {
+	return repo.Name
+}
+
+func (repo *Repository) GetOwnerName() string {
+	return repo.OwnerName
+}
+
 // SanitizedOriginalURL returns a sanitized OriginalURL
 func (repo *Repository) SanitizedOriginalURL() string {
 	if repo.OriginalURL == "" {
diff --git a/modules/context/api.go b/modules/context/api.go
index f41228ad7674e..e226264a87352 100644
--- a/modules/context/api.go
+++ b/modules/context/api.go
@@ -11,11 +11,11 @@ import (
 	"net/url"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	mc "code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/httpcache"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -224,7 +224,7 @@ func APIContexter() func(http.Handler) http.Handler {
 			defer baseCleanUp()
 
 			ctx.Base.AppendContextValue(apiContextKey, ctx)
-			ctx.Base.AppendContextValueFunc(git.RepositoryContextKey, func() any { return ctx.Repo.GitRepo })
+			ctx.Base.AppendContextValueFunc(gitrepo.RepositoryContextKey, func() any { return ctx.Repo.GitRepo })
 
 			// If request sends files, parse them here otherwise the Query() can't be parsed and the CsrfToken will be invalid.
 			if ctx.Req.Method == "POST" && strings.Contains(ctx.Req.Header.Get("Content-Type"), "multipart/form-data") {
@@ -278,10 +278,9 @@ func ReferencesGitRepo(allowEmpty ...bool) func(ctx *APIContext) (cancel context
 
 		// For API calls.
 		if ctx.Repo.GitRepo == nil {
-			repoPath := repo_model.RepoPath(ctx.Repo.Owner.Name, ctx.Repo.Repository.Name)
-			gitRepo, err := git.OpenRepository(ctx, repoPath)
+			gitRepo, err := gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 			if err != nil {
-				ctx.Error(http.StatusInternalServerError, "RepoRef Invalid repo "+repoPath, err)
+				ctx.Error(http.StatusInternalServerError, fmt.Sprintf("Open Repository %v failed", ctx.Repo.Repository.FullName()), err)
 				return cancel
 			}
 			ctx.Repo.GitRepo = gitRepo
diff --git a/modules/context/context.go b/modules/context/context.go
index 8a94e958b5169..d19c5d119830d 100644
--- a/modules/context/context.go
+++ b/modules/context/context.go
@@ -17,7 +17,7 @@ import (
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	mc "code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/httpcache"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/templates"
@@ -163,7 +163,7 @@ func Contexter() func(next http.Handler) http.Handler {
 			ctx.Data["PageData"] = ctx.PageData
 
 			ctx.Base.AppendContextValue(WebContextKey, ctx)
-			ctx.Base.AppendContextValueFunc(git.RepositoryContextKey, func() any { return ctx.Repo.GitRepo })
+			ctx.Base.AppendContextValueFunc(gitrepo.RepositoryContextKey, func() any { return ctx.Repo.GitRepo })
 
 			ctx.Csrf = PrepareCSRFProtector(csrfOpts, ctx)
 
diff --git a/modules/context/repo.go b/modules/context/repo.go
index 8d82be1990da1..75ebfec705447 100644
--- a/modules/context/repo.go
+++ b/modules/context/repo.go
@@ -23,6 +23,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	code_indexer "code.gitea.io/gitea/modules/indexer/code"
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
@@ -633,7 +634,7 @@ func RepoAssignment(ctx *Context) context.CancelFunc {
 		return nil
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo_model.RepoPath(userName, repoName))
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		if strings.Contains(err.Error(), "repository does not exist") || strings.Contains(err.Error(), "no such file or directory") {
 			log.Error("Repository %-v has a broken repository on the file system: %s Error: %v", ctx.Repo.Repository, ctx.Repo.Repository.RepoPath(), err)
@@ -645,7 +646,7 @@ func RepoAssignment(ctx *Context) context.CancelFunc {
 			}
 			return nil
 		}
-		ctx.ServerError("RepoAssignment Invalid repo "+repo_model.RepoPath(userName, repoName), err)
+		ctx.ServerError("RepoAssignment Invalid repo "+repo.FullName(), err)
 		return nil
 	}
 	if ctx.Repo.GitRepo != nil {
@@ -920,10 +921,9 @@ func RepoRefByType(refType RepoRefType, ignoreNotExistErr ...bool) func(*Context
 		)
 
 		if ctx.Repo.GitRepo == nil {
-			repoPath := repo_model.RepoPath(ctx.Repo.Owner.Name, ctx.Repo.Repository.Name)
-			ctx.Repo.GitRepo, err = git.OpenRepository(ctx, repoPath)
+			ctx.Repo.GitRepo, err = gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 			if err != nil {
-				ctx.ServerError("RepoRef Invalid repo "+repoPath, err)
+				ctx.ServerError(fmt.Sprintf("Open Repository %v failed", ctx.Repo.Repository.FullName()), err)
 				return nil
 			}
 			// We opened it, we should close it
diff --git a/modules/contexttest/context_tests.go b/modules/contexttest/context_tests.go
index 8994c1e451c41..9ca028bb6ec26 100644
--- a/modules/contexttest/context_tests.go
+++ b/modules/contexttest/context_tests.go
@@ -18,7 +18,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/templates"
 	"code.gitea.io/gitea/modules/translation"
 	"code.gitea.io/gitea/modules/web/middleware"
@@ -107,7 +107,7 @@ func LoadRepoCommit(t *testing.T, ctx gocontext.Context) {
 		assert.FailNow(t, "context is not *context.Context or *context.APIContext")
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo.Repository.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo.Repository)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 	branch, err := gitRepo.GetHEADBranch()
@@ -137,7 +137,7 @@ func LoadUser(t *testing.T, ctx gocontext.Context, userID int64) {
 func LoadGitRepo(t *testing.T, ctx *context.Context) {
 	assert.NoError(t, ctx.Repo.Repository.LoadOwner(ctx))
 	var err error
-	ctx.Repo.GitRepo, err = git.OpenRepository(ctx, ctx.Repo.Repository.RepoPath())
+	ctx.Repo.GitRepo, err = gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 	assert.NoError(t, err)
 }
 
diff --git a/modules/git/repo_base.go b/modules/git/repo_base.go
index a9d91d2deb2d2..6c148d9af516a 100644
--- a/modules/git/repo_base.go
+++ b/modules/git/repo_base.go
@@ -3,48 +3,4 @@
 
 package git
 
-import (
-	"context"
-	"io"
-)
-
 var isGogit bool
-
-// contextKey is a value for use with context.WithValue.
-type contextKey struct {
-	name string
-}
-
-// RepositoryContextKey is a context key. It is used with context.Value() to get the current Repository for the context
-var RepositoryContextKey = &contextKey{"repository"}
-
-// RepositoryFromContext attempts to get the repository from the context
-func RepositoryFromContext(ctx context.Context, path string) *Repository {
-	value := ctx.Value(RepositoryContextKey)
-	if value == nil {
-		return nil
-	}
-
-	if repo, ok := value.(*Repository); ok && repo != nil {
-		if repo.Path == path {
-			return repo
-		}
-	}
-
-	return nil
-}
-
-type nopCloser func()
-
-func (nopCloser) Close() error { return nil }
-
-// RepositoryFromContextOrOpen attempts to get the repository from the context or just opens it
-func RepositoryFromContextOrOpen(ctx context.Context, path string) (*Repository, io.Closer, error) {
-	gitRepo := RepositoryFromContext(ctx, path)
-	if gitRepo != nil {
-		return gitRepo, nopCloser(nil), nil
-	}
-
-	gitRepo, err := OpenRepository(ctx, path)
-	return gitRepo, gitRepo, err
-}
diff --git a/modules/git/repo_branch.go b/modules/git/repo_branch.go
index 59580939757c1..979c5dec9175a 100644
--- a/modules/git/repo_branch.go
+++ b/modules/git/repo_branch.go
@@ -86,29 +86,6 @@ func (repo *Repository) GetBranch(branch string) (*Branch, error) {
 	}, nil
 }
 
-// GetBranchesByPath returns a branch by it's path
-// if limit = 0 it will not limit
-func GetBranchesByPath(ctx context.Context, path string, skip, limit int) ([]*Branch, int, error) {
-	gitRepo, err := OpenRepository(ctx, path)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer gitRepo.Close()
-
-	return gitRepo.GetBranches(skip, limit)
-}
-
-// GetBranchCommitID returns a branch commit ID by its name
-func GetBranchCommitID(ctx context.Context, path, branch string) (string, error) {
-	gitRepo, err := OpenRepository(ctx, path)
-	if err != nil {
-		return "", err
-	}
-	defer gitRepo.Close()
-
-	return gitRepo.GetBranchCommitID(branch)
-}
-
 // GetBranches returns a slice of *git.Branch
 func (repo *Repository) GetBranches(skip, limit int) ([]*Branch, int, error) {
 	brs, countAll, err := repo.GetBranchNames(skip, limit)
diff --git a/modules/git/repo_branch_gogit.go b/modules/git/repo_branch_gogit.go
index 1c0d9a18aa9d9..d1ec14d81155f 100644
--- a/modules/git/repo_branch_gogit.go
+++ b/modules/git/repo_branch_gogit.go
@@ -7,7 +7,6 @@
 package git
 
 import (
-	"context"
 	"sort"
 	"strings"
 
@@ -95,34 +94,6 @@ func (repo *Repository) GetBranchNames(skip, limit int) ([]string, int, error) {
 	return branchNames, len(branchData), nil
 }
 
-// WalkReferences walks all the references from the repository
-// refType should be empty, ObjectTag or ObjectBranch. All other values are equivalent to empty.
-func WalkReferences(ctx context.Context, repoPath string, walkfn func(sha1, refname string) error) (int, error) {
-	repo := RepositoryFromContext(ctx, repoPath)
-	if repo == nil {
-		var err error
-		repo, err = OpenRepository(ctx, repoPath)
-		if err != nil {
-			return 0, err
-		}
-		defer repo.Close()
-	}
-
-	i := 0
-	iter, err := repo.gogitRepo.References()
-	if err != nil {
-		return i, err
-	}
-	defer iter.Close()
-
-	err = iter.ForEach(func(ref *plumbing.Reference) error {
-		err := walkfn(ref.Hash().String(), string(ref.Name()))
-		i++
-		return err
-	})
-	return i, err
-}
-
 // WalkReferences walks all the references from the repository
 func (repo *Repository) WalkReferences(arg ObjectType, skip, limit int, walkfn func(sha1, refname string) error) (int, error) {
 	i := 0
diff --git a/modules/git/repo_branch_nogogit.go b/modules/git/repo_branch_nogogit.go
index b1e7c8b73e640..470faebe25f79 100644
--- a/modules/git/repo_branch_nogogit.go
+++ b/modules/git/repo_branch_nogogit.go
@@ -65,11 +65,6 @@ func (repo *Repository) GetBranchNames(skip, limit int) ([]string, int, error) {
 	return callShowRef(repo.Ctx, repo.Path, BranchPrefix, TrustedCmdArgs{BranchPrefix, "--sort=-committerdate"}, skip, limit)
 }
 
-// WalkReferences walks all the references from the repository
-func WalkReferences(ctx context.Context, repoPath string, walkfn func(sha1, refname string) error) (int, error) {
-	return walkShowRef(ctx, repoPath, nil, 0, 0, walkfn)
-}
-
 // WalkReferences walks all the references from the repository
 // refType should be empty, ObjectTag or ObjectBranch. All other values are equivalent to empty.
 func (repo *Repository) WalkReferences(refType ObjectType, skip, limit int, walkfn func(sha1, refname string) error) (int, error) {
@@ -81,12 +76,12 @@ func (repo *Repository) WalkReferences(refType ObjectType, skip, limit int, walk
 		args = TrustedCmdArgs{BranchPrefix, "--sort=-committerdate"}
 	}
 
-	return walkShowRef(repo.Ctx, repo.Path, args, skip, limit, walkfn)
+	return WalkShowRef(repo.Ctx, repo.Path, args, skip, limit, walkfn)
 }
 
 // callShowRef return refs, if limit = 0 it will not limit
 func callShowRef(ctx context.Context, repoPath, trimPrefix string, extraArgs TrustedCmdArgs, skip, limit int) (branchNames []string, countAll int, err error) {
-	countAll, err = walkShowRef(ctx, repoPath, extraArgs, skip, limit, func(_, branchName string) error {
+	countAll, err = WalkShowRef(ctx, repoPath, extraArgs, skip, limit, func(_, branchName string) error {
 		branchName = strings.TrimPrefix(branchName, trimPrefix)
 		branchNames = append(branchNames, branchName)
 
@@ -95,7 +90,7 @@ func callShowRef(ctx context.Context, repoPath, trimPrefix string, extraArgs Tru
 	return branchNames, countAll, err
 }
 
-func walkShowRef(ctx context.Context, repoPath string, extraArgs TrustedCmdArgs, skip, limit int, walkfn func(sha1, refname string) error) (countAll int, err error) {
+func WalkShowRef(ctx context.Context, repoPath string, extraArgs TrustedCmdArgs, skip, limit int, walkfn func(sha1, refname string) error) (countAll int, err error) {
 	stdoutReader, stdoutWriter := io.Pipe()
 	defer func() {
 		_ = stdoutReader.Close()
@@ -189,7 +184,7 @@ func walkShowRef(ctx context.Context, repoPath string, extraArgs TrustedCmdArgs,
 // GetRefsBySha returns all references filtered with prefix that belong to a sha commit hash
 func (repo *Repository) GetRefsBySha(sha, prefix string) ([]string, error) {
 	var revList []string
-	_, err := walkShowRef(repo.Ctx, repo.Path, nil, 0, 0, func(walkSha, refname string) error {
+	_, err := WalkShowRef(repo.Ctx, repo.Path, nil, 0, 0, func(walkSha, refname string) error {
 		if walkSha == sha && strings.HasPrefix(refname, prefix) {
 			revList = append(revList, refname)
 		}
diff --git a/modules/gitrepo/branch.go b/modules/gitrepo/branch.go
new file mode 100644
index 0000000000000..dcaf92668d158
--- /dev/null
+++ b/modules/gitrepo/branch.go
@@ -0,0 +1,32 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package gitrepo
+
+import (
+	"context"
+
+	"code.gitea.io/gitea/modules/git"
+)
+
+// GetBranchesByPath returns a branch by its path
+// if limit = 0 it will not limit
+func GetBranchesByPath(ctx context.Context, repo Repository, skip, limit int) ([]*git.Branch, int, error) {
+	gitRepo, err := OpenRepository(ctx, repo)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer gitRepo.Close()
+
+	return gitRepo.GetBranches(skip, limit)
+}
+
+func GetBranchCommitID(ctx context.Context, repo Repository, branch string) (string, error) {
+	gitRepo, err := OpenRepository(ctx, repo)
+	if err != nil {
+		return "", err
+	}
+	defer gitRepo.Close()
+
+	return gitRepo.GetBranchCommitID(branch)
+}
diff --git a/modules/gitrepo/gitrepo.go b/modules/gitrepo/gitrepo.go
new file mode 100644
index 0000000000000..d89f8f9c0c88c
--- /dev/null
+++ b/modules/gitrepo/gitrepo.go
@@ -0,0 +1,103 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package gitrepo
+
+import (
+	"context"
+	"io"
+	"path/filepath"
+	"strings"
+
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/setting"
+)
+
+type Repository interface {
+	GetName() string
+	GetOwnerName() string
+}
+
+func repoPath(repo Repository) string {
+	return filepath.Join(setting.RepoRootPath, strings.ToLower(repo.GetOwnerName()), strings.ToLower(repo.GetName())+".git")
+}
+
+func wikiPath(repo Repository) string {
+	return filepath.Join(setting.RepoRootPath, strings.ToLower(repo.GetOwnerName()), strings.ToLower(repo.GetName())+".wiki.git")
+}
+
+// OpenRepository opens the repository at the given relative path with the provided context.
+func OpenRepository(ctx context.Context, repo Repository) (*git.Repository, error) {
+	return git.OpenRepository(ctx, repoPath(repo))
+}
+
+func OpenWikiRepository(ctx context.Context, repo Repository) (*git.Repository, error) {
+	return git.OpenRepository(ctx, wikiPath(repo))
+}
+
+// contextKey is a value for use with context.WithValue.
+type contextKey struct {
+	name string
+}
+
+// RepositoryContextKey is a context key. It is used with context.Value() to get the current Repository for the context
+var RepositoryContextKey = &contextKey{"repository"}
+
+// RepositoryFromContext attempts to get the repository from the context
+func repositoryFromContext(ctx context.Context, repo Repository) *git.Repository {
+	value := ctx.Value(RepositoryContextKey)
+	if value == nil {
+		return nil
+	}
+
+	if gitRepo, ok := value.(*git.Repository); ok && gitRepo != nil {
+		if gitRepo.Path == repoPath(repo) {
+			return gitRepo
+		}
+	}
+
+	return nil
+}
+
+type nopCloser func()
+
+func (nopCloser) Close() error { return nil }
+
+// RepositoryFromContextOrOpen attempts to get the repository from the context or just opens it
+func RepositoryFromContextOrOpen(ctx context.Context, repo Repository) (*git.Repository, io.Closer, error) {
+	gitRepo := repositoryFromContext(ctx, repo)
+	if gitRepo != nil {
+		return gitRepo, nopCloser(nil), nil
+	}
+
+	gitRepo, err := OpenRepository(ctx, repo)
+	return gitRepo, gitRepo, err
+}
+
+// repositoryFromContextPath attempts to get the repository from the context
+func repositoryFromContextPath(ctx context.Context, path string) *git.Repository {
+	value := ctx.Value(RepositoryContextKey)
+	if value == nil {
+		return nil
+	}
+
+	if repo, ok := value.(*git.Repository); ok && repo != nil {
+		if repo.Path == path {
+			return repo
+		}
+	}
+
+	return nil
+}
+
+// RepositoryFromContextOrOpenPath attempts to get the repository from the context or just opens it
+// Deprecated: Use RepositoryFromContextOrOpen instead
+func RepositoryFromContextOrOpenPath(ctx context.Context, path string) (*git.Repository, io.Closer, error) {
+	gitRepo := repositoryFromContextPath(ctx, path)
+	if gitRepo != nil {
+		return gitRepo, nopCloser(nil), nil
+	}
+
+	gitRepo, err := git.OpenRepository(ctx, path)
+	return gitRepo, gitRepo, err
+}
diff --git a/modules/gitrepo/walk_gogit.go b/modules/gitrepo/walk_gogit.go
new file mode 100644
index 0000000000000..6370faf08e7df
--- /dev/null
+++ b/modules/gitrepo/walk_gogit.go
@@ -0,0 +1,40 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build gogit
+
+package gitrepo
+
+import (
+	"context"
+
+	"github.com/go-git/go-git/v5/plumbing"
+)
+
+// WalkReferences walks all the references from the repository
+// refname is empty, ObjectTag or ObjectBranch. All other values should be treated as equivalent to empty.
+func WalkReferences(ctx context.Context, repo Repository, walkfn func(sha1, refname string) error) (int, error) {
+	gitRepo := repositoryFromContext(ctx, repo)
+	if gitRepo == nil {
+		var err error
+		gitRepo, err = OpenRepository(ctx, repo)
+		if err != nil {
+			return 0, err
+		}
+		defer gitRepo.Close()
+	}
+
+	i := 0
+	iter, err := gitRepo.GoGitRepo().References()
+	if err != nil {
+		return i, err
+	}
+	defer iter.Close()
+
+	err = iter.ForEach(func(ref *plumbing.Reference) error {
+		err := walkfn(ref.Hash().String(), string(ref.Name()))
+		i++
+		return err
+	})
+	return i, err
+}
diff --git a/modules/gitrepo/walk_nogogit.go b/modules/gitrepo/walk_nogogit.go
new file mode 100644
index 0000000000000..ff9555996dff5
--- /dev/null
+++ b/modules/gitrepo/walk_nogogit.go
@@ -0,0 +1,17 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build !gogit
+
+package gitrepo
+
+import (
+	"context"
+
+	"code.gitea.io/gitea/modules/git"
+)
+
+// WalkReferences walks all the references from the repository
+func WalkReferences(ctx context.Context, repo Repository, walkfn func(sha1, refname string) error) (int, error) {
+	return git.WalkShowRef(ctx, repoPath(repo), nil, 0, 0, walkfn)
+}
diff --git a/modules/indexer/stats/db.go b/modules/indexer/stats/db.go
index 163843b47fa5a..98a977c7008fe 100644
--- a/modules/indexer/stats/db.go
+++ b/modules/indexer/stats/db.go
@@ -8,6 +8,7 @@ import (
 
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -35,7 +36,7 @@ func (db *DBIndexer) Index(id int64) error {
 		return err
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		if err.Error() == "no such file or directory" {
 			return nil
diff --git a/modules/repository/branch.go b/modules/repository/branch.go
index cd45f162276f3..e448490f4ac18 100644
--- a/modules/repository/branch.go
+++ b/modules/repository/branch.go
@@ -11,6 +11,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/timeutil"
 )
@@ -24,9 +25,9 @@ func SyncRepoBranches(ctx context.Context, repoID, doerID int64) (int64, error)
 
 	log.Debug("SyncRepoBranches: in Repo[%d:%s]", repo.ID, repo.FullName())
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
-		log.Error("OpenRepository[%s]: %w", repo.RepoPath(), err)
+		log.Error("OpenRepository[%s]: %w", repo.FullName(), err)
 		return 0, err
 	}
 	defer gitRepo.Close()
diff --git a/modules/repository/generate.go b/modules/repository/generate.go
index f8478b8c1852a..b32c4e058e503 100644
--- a/modules/repository/generate.go
+++ b/modules/repository/generate.go
@@ -19,6 +19,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/util"
 
@@ -271,7 +272,7 @@ func generateGitContent(ctx context.Context, repo, templateRepo, generateRepo *r
 		repo.DefaultBranch = templateRepo.DefaultBranch
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		return fmt.Errorf("openRepository: %w", err)
 	}
diff --git a/modules/repository/repo.go b/modules/repository/repo.go
index 5352da0378d9a..fc3af040719ff 100644
--- a/modules/repository/repo.go
+++ b/modules/repository/repo.go
@@ -19,6 +19,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/migration"
@@ -291,7 +292,7 @@ func SyncRepoTags(ctx context.Context, repoID int64) error {
 		return err
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		return err
 	}
diff --git a/routers/api/v1/repo/branch.go b/routers/api/v1/repo/branch.go
index edbfbcc568bad..bd02a8afc4340 100644
--- a/routers/api/v1/repo/branch.go
+++ b/routers/api/v1/repo/branch.go
@@ -16,6 +16,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	repo_module "code.gitea.io/gitea/modules/repository"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
@@ -643,7 +644,7 @@ func CreateBranchProtection(ctx *context.APIContext) {
 	} else {
 		if !isPlainRule {
 			if ctx.Repo.GitRepo == nil {
-				ctx.Repo.GitRepo, err = git.OpenRepository(ctx, ctx.Repo.Repository.RepoPath())
+				ctx.Repo.GitRepo, err = gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 				if err != nil {
 					ctx.Error(http.StatusInternalServerError, "OpenRepository", err)
 					return
@@ -920,7 +921,7 @@ func EditBranchProtection(ctx *context.APIContext) {
 	} else {
 		if !isPlainRule {
 			if ctx.Repo.GitRepo == nil {
-				ctx.Repo.GitRepo, err = git.OpenRepository(ctx, ctx.Repo.Repository.RepoPath())
+				ctx.Repo.GitRepo, err = gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 				if err != nil {
 					ctx.Error(http.StatusInternalServerError, "OpenRepository", err)
 					return
diff --git a/routers/api/v1/repo/file.go b/routers/api/v1/repo/file.go
index 94e634461c278..065d6bf8b2c38 100644
--- a/routers/api/v1/repo/file.go
+++ b/routers/api/v1/repo/file.go
@@ -21,6 +21,7 @@ import (
 	"code.gitea.io/gitea/models/unit"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/httpcache"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/log"
@@ -279,9 +280,8 @@ func GetArchive(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"
 
-	repoPath := repo_model.RepoPath(ctx.Params(":username"), ctx.Params(":reponame"))
 	if ctx.Repo.GitRepo == nil {
-		gitRepo, err := git.OpenRepository(ctx, repoPath)
+		gitRepo, err := gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "OpenRepository", err)
 			return
diff --git a/routers/api/v1/repo/pull.go b/routers/api/v1/repo/pull.go
index b1cb7011f1d4b..eaf406e64d8a6 100644
--- a/routers/api/v1/repo/pull.go
+++ b/routers/api/v1/repo/pull.go
@@ -23,6 +23,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
@@ -906,9 +907,9 @@ func MergePullRequest(ctx *context.APIContext) {
 		if ctx.Repo != nil && ctx.Repo.Repository != nil && ctx.Repo.Repository.ID == pr.HeadRepoID && ctx.Repo.GitRepo != nil {
 			headRepo = ctx.Repo.GitRepo
 		} else {
-			headRepo, err = git.OpenRepository(ctx, pr.HeadRepo.RepoPath())
+			headRepo, err = gitrepo.OpenRepository(ctx, pr.HeadRepo)
 			if err != nil {
-				ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.HeadRepo.RepoPath()), err)
+				ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.HeadRepo.FullName()), err)
 				return
 			}
 			defer headRepo.Close()
@@ -1004,7 +1005,7 @@ func parseCompareInfo(ctx *context.APIContext, form api.CreatePullRequestOption)
 		headRepo = ctx.Repo.Repository
 		headGitRepo = ctx.Repo.GitRepo
 	} else {
-		headGitRepo, err = git.OpenRepository(ctx, repo_model.RepoPath(headUser.Name, headRepo.Name))
+		headGitRepo, err = gitrepo.OpenRepository(ctx, headRepo)
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "OpenRepository", err)
 			return nil, nil, nil, nil, "", ""
@@ -1308,7 +1309,7 @@ func GetPullRequestCommits(ctx *context.APIContext) {
 	}
 
 	var prInfo *git.CompareInfo
-	baseGitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, pr.BaseRepo.RepoPath())
+	baseGitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, pr.BaseRepo)
 	if err != nil {
 		ctx.ServerError("OpenRepository", err)
 		return
diff --git a/routers/api/v1/repo/pull_review.go b/routers/api/v1/repo/pull_review.go
index 7b9445be4c068..07d8f4877bb3d 100644
--- a/routers/api/v1/repo/pull_review.go
+++ b/routers/api/v1/repo/pull_review.go
@@ -13,7 +13,7 @@ import (
 	access_model "code.gitea.io/gitea/models/perm/access"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/web"
 	"code.gitea.io/gitea/routers/api/v1/utils"
@@ -329,8 +329,7 @@ func CreatePullReview(ctx *context.APIContext) {
 
 	// if CommitID is empty, set it as lastCommitID
 	if opts.CommitID == "" {
-
-		gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, pr.Issue.Repo.RepoPath())
+		gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, pr.Issue.Repo)
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "git.OpenRepository", err)
 			return
diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go
index 436b83adf2b35..2efdccb569901 100644
--- a/routers/api/v1/repo/repo.go
+++ b/routers/api/v1/repo/repo.go
@@ -21,6 +21,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/label"
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
@@ -718,7 +719,7 @@ func updateBasicProperties(ctx *context.APIContext, opts api.EditRepoOption) err
 
 	if ctx.Repo.GitRepo == nil && !repo.IsEmpty {
 		var err error
-		ctx.Repo.GitRepo, err = git.OpenRepository(ctx, ctx.Repo.Repository.RepoPath())
+		ctx.Repo.GitRepo, err = gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 		if err != nil {
 			ctx.Error(http.StatusInternalServerError, "Unable to OpenRepository", err)
 			return err
diff --git a/routers/api/v1/repo/wiki.go b/routers/api/v1/repo/wiki.go
index 8e5ecce310e3e..ba3e978a83531 100644
--- a/routers/api/v1/repo/wiki.go
+++ b/routers/api/v1/repo/wiki.go
@@ -12,6 +12,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
@@ -475,7 +476,7 @@ func findEntryForFile(commit *git.Commit, target string) (*git.TreeEntry, error)
 // findWikiRepoCommit opens the wiki repo and returns the latest commit, writing to context on error.
 // The caller is responsible for closing the returned repo again
 func findWikiRepoCommit(ctx *context.APIContext) (*git.Repository, *git.Commit) {
-	wikiRepo, err := git.OpenRepository(ctx, ctx.Repo.Repository.WikiPath())
+	wikiRepo, err := gitrepo.OpenWikiRepository(ctx, ctx.Repo.Repository)
 	if err != nil {
 
 		if git.IsErrNotExist(err) || err.Error() == "no such file or directory" {
diff --git a/routers/api/v1/utils/git.go b/routers/api/v1/utils/git.go
index 39714e343f013..2299cdc247548 100644
--- a/routers/api/v1/utils/git.go
+++ b/routers/api/v1/utils/git.go
@@ -10,6 +10,7 @@ import (
 
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 )
 
@@ -79,7 +80,7 @@ func ConvertToObjectID(ctx gocontext.Context, repo *context.Repository, commitID
 		}
 	}
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.Repository.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo.Repository)
 	if err != nil {
 		return objectFormat.EmptyObjectID(), fmt.Errorf("RepositoryFromContextOrOpen: %w", err)
 	}
diff --git a/routers/private/internal_repo.go b/routers/private/internal_repo.go
index 5e7e82b03c961..615239d479d96 100644
--- a/routers/private/internal_repo.go
+++ b/routers/private/internal_repo.go
@@ -10,7 +10,7 @@ import (
 
 	repo_model "code.gitea.io/gitea/models/repo"
 	gitea_context "code.gitea.io/gitea/modules/context"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/private"
 )
@@ -28,7 +28,7 @@ func RepoAssignment(ctx *gitea_context.PrivateContext) context.CancelFunc {
 		return nil
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		log.Error("Failed to open repository: %s/%s Error: %v", ownerName, repoName, err)
 		ctx.JSON(http.StatusInternalServerError, private.Response{
diff --git a/routers/web/repo/commit.go b/routers/web/repo/commit.go
index 00157d44c99c4..32fa973ef61e5 100644
--- a/routers/web/repo/commit.go
+++ b/routers/web/repo/commit.go
@@ -22,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/gitgraph"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/setting"
@@ -279,7 +280,7 @@ func Diff(ctx *context.Context) {
 	)
 
 	if ctx.Data["PageIsWiki"] != nil {
-		gitRepo, err = git.OpenRepository(ctx, ctx.Repo.Repository.WikiPath())
+		gitRepo, err = gitrepo.OpenWikiRepository(ctx, ctx.Repo.Repository)
 		if err != nil {
 			ctx.ServerError("Repo.GitRepo.GetCommit", err)
 			return
@@ -404,7 +405,7 @@ func Diff(ctx *context.Context) {
 func RawDiff(ctx *context.Context) {
 	var gitRepo *git.Repository
 	if ctx.Data["PageIsWiki"] != nil {
-		wikiRepo, err := git.OpenRepository(ctx, ctx.Repo.Repository.WikiPath())
+		wikiRepo, err := gitrepo.OpenWikiRepository(ctx, ctx.Repo.Repository)
 		if err != nil {
 			ctx.ServerError("OpenRepository", err)
 			return
diff --git a/routers/web/repo/compare.go b/routers/web/repo/compare.go
index 5ae48e1ce8148..a3593815b8b74 100644
--- a/routers/web/repo/compare.go
+++ b/routers/web/repo/compare.go
@@ -28,6 +28,7 @@ import (
 	"code.gitea.io/gitea/modules/context"
 	csv_module "code.gitea.io/gitea/modules/csv"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/setting"
@@ -408,7 +409,7 @@ func ParseCompareInfo(ctx *context.Context) *CompareInfo {
 		ci.HeadRepo = ctx.Repo.Repository
 		ci.HeadGitRepo = ctx.Repo.GitRepo
 	} else if has {
-		ci.HeadGitRepo, err = git.OpenRepository(ctx, ci.HeadRepo.RepoPath())
+		ci.HeadGitRepo, err = gitrepo.OpenRepository(ctx, ci.HeadRepo)
 		if err != nil {
 			ctx.ServerError("OpenRepository", err)
 			return nil
@@ -688,7 +689,7 @@ func PrepareCompareDiff(
 }
 
 func getBranchesAndTagsForRepo(ctx gocontext.Context, repo *repo_model.Repository) (branches, tags []string, err error) {
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -876,7 +877,7 @@ func ExcerptBlob(ctx *context.Context) {
 	gitRepo := ctx.Repo.GitRepo
 	if ctx.FormBool("wiki") {
 		var err error
-		gitRepo, err = git.OpenRepository(ctx, ctx.Repo.Repository.WikiPath())
+		gitRepo, err = gitrepo.OpenWikiRepository(ctx, ctx.Repo.Repository)
 		if err != nil {
 			ctx.ServerError("OpenRepository", err)
 			return
diff --git a/routers/web/repo/editor_test.go b/routers/web/repo/editor_test.go
index 67fb277d5c2b0..c28c3ef1d632d 100644
--- a/routers/web/repo/editor_test.go
+++ b/routers/web/repo/editor_test.go
@@ -9,6 +9,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/contexttest"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -66,7 +67,7 @@ func TestGetClosestParentWithFiles(t *testing.T) {
 
 	repo := ctx.Repo.Repository
 	branch := repo.DefaultBranch
-	gitRepo, _ := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+	gitRepo, _ := gitrepo.OpenRepository(git.DefaultContext, repo)
 	defer gitRepo.Close()
 	commit, _ := gitRepo.GetBranchCommit(branch)
 	var expectedTreePath string // Should return the root dir, empty string, since there are no subdirs in this repo
diff --git a/routers/web/repo/pull.go b/routers/web/repo/pull.go
index e36d7092af286..b265cf47548bc 100644
--- a/routers/web/repo/pull.go
+++ b/routers/web/repo/pull.go
@@ -29,6 +29,7 @@ import (
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	issue_template "code.gitea.io/gitea/modules/issue/template"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -530,7 +531,7 @@ func PrepareViewPullInfo(ctx *context.Context, issue *issues_model.Issue) *git.C
 	if pull.BaseRepoID == ctx.Repo.Repository.ID && ctx.Repo.GitRepo != nil {
 		baseGitRepo = ctx.Repo.GitRepo
 	} else {
-		baseGitRepo, err := git.OpenRepository(ctx, pull.BaseRepo.RepoPath())
+		baseGitRepo, err := gitrepo.OpenRepository(ctx, pull.BaseRepo)
 		if err != nil {
 			ctx.ServerError("OpenRepository", err)
 			return nil
@@ -582,7 +583,7 @@ func PrepareViewPullInfo(ctx *context.Context, issue *issues_model.Issue) *git.C
 	var headBranchSha string
 	// HeadRepo may be missing
 	if pull.HeadRepo != nil {
-		headGitRepo, err := git.OpenRepository(ctx, pull.HeadRepo.RepoPath())
+		headGitRepo, err := gitrepo.OpenRepository(ctx, pull.HeadRepo)
 		if err != nil {
 			ctx.ServerError("OpenRepository", err)
 			return nil
@@ -1314,9 +1315,9 @@ func MergePullRequest(ctx *context.Context) {
 		if ctx.Repo != nil && ctx.Repo.Repository != nil && pr.HeadRepoID == ctx.Repo.Repository.ID && ctx.Repo.GitRepo != nil {
 			headRepo = ctx.Repo.GitRepo
 		} else {
-			headRepo, err = git.OpenRepository(ctx, pr.HeadRepo.RepoPath())
+			headRepo, err = gitrepo.OpenRepository(ctx, pr.HeadRepo)
 			if err != nil {
-				ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.HeadRepo.RepoPath()), err)
+				ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.HeadRepo.FullName()), err)
 				return
 			}
 			defer headRepo.Close()
@@ -1537,9 +1538,9 @@ func CleanUpPullRequest(ctx *context.Context) {
 		gitBaseRepo = ctx.Repo.GitRepo
 	} else {
 		// If not just open it
-		gitBaseRepo, err = git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+		gitBaseRepo, err = gitrepo.OpenRepository(ctx, pr.BaseRepo)
 		if err != nil {
-			ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.BaseRepo.RepoPath()), err)
+			ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.BaseRepo.FullName()), err)
 			return
 		}
 		defer gitBaseRepo.Close()
@@ -1552,9 +1553,9 @@ func CleanUpPullRequest(ctx *context.Context) {
 		gitRepo = ctx.Repo.GitRepo
 	} else if pr.BaseRepoID != pr.HeadRepoID {
 		// Otherwise just load it up
-		gitRepo, err = git.OpenRepository(ctx, pr.HeadRepo.RepoPath())
+		gitRepo, err = gitrepo.OpenRepository(ctx, pr.HeadRepo)
 		if err != nil {
-			ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.HeadRepo.RepoPath()), err)
+			ctx.ServerError(fmt.Sprintf("OpenRepository[%s]", pr.HeadRepo.FullName()), err)
 			return
 		}
 		defer gitRepo.Close()
diff --git a/routers/web/repo/wiki.go b/routers/web/repo/wiki.go
index 4e09f046cf856..5e7b971e67b72 100644
--- a/routers/web/repo/wiki.go
+++ b/routers/web/repo/wiki.go
@@ -20,6 +20,7 @@ import (
 	"code.gitea.io/gitea/modules/charset"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/markup/markdown"
@@ -92,7 +93,7 @@ func findEntryForFile(commit *git.Commit, target string) (*git.TreeEntry, error)
 }
 
 func findWikiRepoCommit(ctx *context.Context) (*git.Repository, *git.Commit, error) {
-	wikiRepo, err := git.OpenRepository(ctx, ctx.Repo.Repository.WikiPath())
+	wikiRepo, err := gitrepo.OpenWikiRepository(ctx, ctx.Repo.Repository)
 	if err != nil {
 		ctx.ServerError("OpenRepository", err)
 		return nil, nil, err
diff --git a/routers/web/repo/wiki_test.go b/routers/web/repo/wiki_test.go
index ae050df967a52..d3decdae2deff 100644
--- a/routers/web/repo/wiki_test.go
+++ b/routers/web/repo/wiki_test.go
@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/contexttest"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/web"
 	"code.gitea.io/gitea/services/forms"
 	wiki_service "code.gitea.io/gitea/services/wiki"
@@ -26,7 +27,7 @@ const (
 )
 
 func wikiEntry(t *testing.T, repo *repo_model.Repository, wikiName wiki_service.WebPath) *git.TreeEntry {
-	wikiRepo, err := git.OpenRepository(git.DefaultContext, repo.WikiPath())
+	wikiRepo, err := gitrepo.OpenWikiRepository(git.DefaultContext, repo)
 	assert.NoError(t, err)
 	defer wikiRepo.Close()
 	commit, err := wikiRepo.GetBranchCommit("master")
diff --git a/routers/web/shared/user/header.go b/routers/web/shared/user/header.go
index 0f8d64e7b24d3..a2c0abb47e4a1 100644
--- a/routers/web/shared/user/header.go
+++ b/routers/web/shared/user/header.go
@@ -13,6 +13,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/markup/markdown"
@@ -90,7 +91,7 @@ func FindUserProfileReadme(ctx *context.Context, doer *user_model.User) (profile
 	if err == nil {
 		perm, err := access_model.GetUserRepoPermission(ctx, profileDbRepo, doer)
 		if err == nil && !profileDbRepo.IsEmpty && perm.CanRead(unit.TypeCode) {
-			if profileGitRepo, err = git.OpenRepository(ctx, profileDbRepo.RepoPath()); err != nil {
+			if profileGitRepo, err = gitrepo.OpenRepository(ctx, profileDbRepo); err != nil {
 				log.Error("FindUserProfileReadme failed to OpenRepository: %v", err)
 			} else {
 				if commit, err := profileGitRepo.GetBranchCommit(profileDbRepo.DefaultBranch); err != nil {
diff --git a/services/actions/notifier_helper.go b/services/actions/notifier_helper.go
index 2a3ffb76f30d2..9900de3d2ecdd 100644
--- a/services/actions/notifier_helper.go
+++ b/services/actions/notifier_helper.go
@@ -20,6 +20,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	actions_module "code.gitea.io/gitea/modules/actions"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -128,7 +129,7 @@ func notify(ctx context.Context, input *notifyInput) error {
 		return nil
 	}
 
-	gitRepo, err := git.OpenRepository(context.Background(), input.Repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(context.Background(), input.Repo)
 	if err != nil {
 		return fmt.Errorf("git.OpenRepository: %w", err)
 	}
diff --git a/services/asymkey/sign.go b/services/asymkey/sign.go
index 0c4aac8156934..2f5d76a29334b 100644
--- a/services/asymkey/sign.go
+++ b/services/asymkey/sign.go
@@ -13,8 +13,10 @@ import (
 	"code.gitea.io/gitea/models/db"
 	git_model "code.gitea.io/gitea/models/git"
 	issues_model "code.gitea.io/gitea/models/issues"
+	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
 	"code.gitea.io/gitea/modules/setting"
@@ -167,7 +169,8 @@ Loop:
 }
 
 // SignWikiCommit determines if we should sign the commits to this repository wiki
-func SignWikiCommit(ctx context.Context, repoWikiPath string, u *user_model.User) (bool, string, *git.Signature, error) {
+func SignWikiCommit(ctx context.Context, repo *repo_model.Repository, u *user_model.User) (bool, string, *git.Signature, error) {
+	repoWikiPath := repo.WikiPath()
 	rules := signingModeFromStrings(setting.Repository.Signing.Wiki)
 	signingKey, sig := SigningKey(ctx, repoWikiPath)
 	if signingKey == "" {
@@ -201,7 +204,7 @@ Loop:
 				return false, "", nil, &ErrWontSign{twofa}
 			}
 		case parentSigned:
-			gitRepo, err := git.OpenRepository(ctx, repoWikiPath)
+			gitRepo, err := gitrepo.OpenWikiRepository(ctx, repo)
 			if err != nil {
 				return false, "", nil, err
 			}
diff --git a/services/automerge/automerge.go b/services/automerge/automerge.go
index bf713c44314dd..bd427bef9f731 100644
--- a/services/automerge/automerge.go
+++ b/services/automerge/automerge.go
@@ -17,6 +17,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -111,7 +112,7 @@ func MergeScheduledPullRequest(ctx context.Context, sha string, repo *repo_model
 }
 
 func getPullRequestsByHeadSHA(ctx context.Context, sha string, repo *repo_model.Repository, filter func(*issues_model.PullRequest) bool) (map[int64]*issues_model.PullRequest, error) {
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		return nil, err
 	}
@@ -190,7 +191,7 @@ func handlePull(pullID int64, sha string) {
 		return
 	}
 
-	headGitRepo, err := git.OpenRepository(ctx, pr.HeadRepo.RepoPath())
+	headGitRepo, err := gitrepo.OpenRepository(ctx, pr.HeadRepo)
 	if err != nil {
 		log.Error("OpenRepository %-v: %v", pr.HeadRepo, err)
 		return
@@ -246,7 +247,7 @@ func handlePull(pullID int64, sha string) {
 			return
 		}
 
-		baseGitRepo, err = git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+		baseGitRepo, err = gitrepo.OpenRepository(ctx, pr.BaseRepo)
 		if err != nil {
 			log.Error("OpenRepository %-v: %v", pr.BaseRepo, err)
 			return
diff --git a/services/convert/pull.go b/services/convert/pull.go
index 7eebe20426c31..6d98121ed54c4 100644
--- a/services/convert/pull.go
+++ b/services/convert/pull.go
@@ -12,6 +12,7 @@ import (
 	access_model "code.gitea.io/gitea/models/perm/access"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	api "code.gitea.io/gitea/modules/structs"
 )
@@ -101,7 +102,7 @@ func ToAPIPullRequest(ctx context.Context, pr *issues_model.PullRequest, doer *u
 		apiPullRequest.Closed = pr.Issue.ClosedUnix.AsTimePtr()
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
 	if err != nil {
 		log.Error("OpenRepository[%s]: %v", pr.BaseRepo.RepoPath(), err)
 		return nil
@@ -127,7 +128,7 @@ func ToAPIPullRequest(ctx context.Context, pr *issues_model.PullRequest, doer *u
 	}
 
 	if pr.Flow == issues_model.PullRequestFlowAGit {
-		gitRepo, err := git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+		gitRepo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
 		if err != nil {
 			log.Error("OpenRepository[%s]: %v", pr.GetGitRefName(), err)
 			return nil
@@ -154,7 +155,7 @@ func ToAPIPullRequest(ctx context.Context, pr *issues_model.PullRequest, doer *u
 		apiPullRequest.Head.RepoID = pr.HeadRepo.ID
 		apiPullRequest.Head.Repository = ToRepo(ctx, pr.HeadRepo, p)
 
-		headGitRepo, err := git.OpenRepository(ctx, pr.HeadRepo.RepoPath())
+		headGitRepo, err := gitrepo.OpenRepository(ctx, pr.HeadRepo)
 		if err != nil {
 			log.Error("OpenRepository[%s]: %v", pr.HeadRepo.RepoPath(), err)
 			return nil
@@ -190,7 +191,7 @@ func ToAPIPullRequest(ctx context.Context, pr *issues_model.PullRequest, doer *u
 	}
 
 	if len(apiPullRequest.Head.Sha) == 0 && len(apiPullRequest.Head.Ref) != 0 {
-		baseGitRepo, err := git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+		baseGitRepo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
 		if err != nil {
 			log.Error("OpenRepository[%s]: %v", pr.BaseRepo.RepoPath(), err)
 			return nil
diff --git a/services/doctor/misc.go b/services/doctor/misc.go
index f0b5966b5440d..9300c3a25c9c6 100644
--- a/services/doctor/misc.go
+++ b/services/doctor/misc.go
@@ -16,6 +16,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
@@ -91,7 +92,7 @@ func checkEnablePushOptions(ctx context.Context, logger log.Logger, autofix bool
 
 	if err := iterateRepositories(ctx, func(repo *repo_model.Repository) error {
 		numRepos++
-		r, err := git.OpenRepository(ctx, repo.RepoPath())
+		r, err := gitrepo.OpenRepository(ctx, repo)
 		if err != nil {
 			return err
 		}
diff --git a/services/migrations/gitea_uploader.go b/services/migrations/gitea_uploader.go
index 5a4392c66775f..7b21d9f4d2438 100644
--- a/services/migrations/gitea_uploader.go
+++ b/services/migrations/gitea_uploader.go
@@ -21,6 +21,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	base_module "code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/label"
 	"code.gitea.io/gitea/modules/log"
 	base "code.gitea.io/gitea/modules/migration"
@@ -139,7 +140,7 @@ func (g *GiteaLocalUploader) CreateRepo(repo *base.Repository, opts base.Migrate
 	if err != nil {
 		return err
 	}
-	g.gitRepo, err = git.OpenRepository(g.ctx, r.RepoPath())
+	g.gitRepo, err = gitrepo.OpenRepository(g.ctx, r)
 	return err
 }
 
diff --git a/services/migrations/gitea_uploader_test.go b/services/migrations/gitea_uploader_test.go
index 4ec0361dfb467..c8102c6b8b71b 100644
--- a/services/migrations/gitea_uploader_test.go
+++ b/services/migrations/gitea_uploader_test.go
@@ -19,6 +19,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	base "code.gitea.io/gitea/modules/migration"
@@ -249,7 +250,7 @@ func TestGiteaUploadUpdateGitForPullRequest(t *testing.T) {
 		Author:    &signature,
 		Message:   "Initial Commit",
 	}))
-	fromGitRepo, err := git.OpenRepository(git.DefaultContext, fromRepo.RepoPath())
+	fromGitRepo, err := gitrepo.OpenRepository(git.DefaultContext, fromRepo)
 	assert.NoError(t, err)
 	defer fromGitRepo.Close()
 	baseSHA, err := fromGitRepo.GetBranchCommitID(baseRef)
@@ -292,7 +293,7 @@ func TestGiteaUploadUpdateGitForPullRequest(t *testing.T) {
 		Author:    &signature,
 		Message:   "branch2 commit",
 	}))
-	forkGitRepo, err := git.OpenRepository(git.DefaultContext, forkRepo.RepoPath())
+	forkGitRepo, err := gitrepo.OpenRepository(git.DefaultContext, forkRepo)
 	assert.NoError(t, err)
 	defer forkGitRepo.Close()
 	forkHeadSHA, err := forkGitRepo.GetBranchCommitID(forkHeadRef)
diff --git a/services/mirror/mirror_pull.go b/services/mirror/mirror_pull.go
index 6f03e14ab08bd..3418cf90dfe38 100644
--- a/services/mirror/mirror_pull.go
+++ b/services/mirror/mirror_pull.go
@@ -13,6 +13,7 @@ import (
 	system_model "code.gitea.io/gitea/models/system"
 	"code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -300,7 +301,7 @@ func runSync(ctx context.Context, m *repo_model.Mirror) ([]*mirrorSyncResult, bo
 		log.Error("SyncMirrors [repo: %-v]: %v", m.Repo, err)
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repoPath)
+	gitRepo, err := gitrepo.OpenRepository(ctx, m.Repo)
 	if err != nil {
 		log.Error("SyncMirrors [repo: %-v]: failed to OpenRepository: %v", m.Repo, err)
 		return nil, false
@@ -396,7 +397,7 @@ func runSync(ctx context.Context, m *repo_model.Mirror) ([]*mirrorSyncResult, bo
 	}
 
 	log.Trace("SyncMirrors [repo: %-v]: invalidating mirror branch caches...", m.Repo)
-	branches, _, err := git.GetBranchesByPath(ctx, m.Repo.RepoPath(), 0, 0)
+	branches, _, err := gitrepo.GetBranchesByPath(ctx, m.Repo, 0, 0)
 	if err != nil {
 		log.Error("SyncMirrors [repo: %-v]: failed to GetBranches: %v", m.Repo, err)
 		return nil, false
@@ -453,7 +454,7 @@ func SyncPullMirror(ctx context.Context, repoID int64) bool {
 		log.Trace("SyncMirrors [repo: %-v]: no branches updated", m.Repo)
 	} else {
 		log.Trace("SyncMirrors [repo: %-v]: %d branches updated", m.Repo, len(results))
-		gitRepo, err = git.OpenRepository(ctx, m.Repo.RepoPath())
+		gitRepo, err = gitrepo.OpenRepository(ctx, m.Repo)
 		if err != nil {
 			log.Error("SyncMirrors [repo: %-v]: unable to OpenRepository: %v", m.Repo, err)
 			return false
diff --git a/services/mirror/mirror_push.go b/services/mirror/mirror_push.go
index b117e79faca96..21ba0afeffd6e 100644
--- a/services/mirror/mirror_push.go
+++ b/services/mirror/mirror_push.go
@@ -15,6 +15,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -131,7 +132,11 @@ func SyncPushMirror(ctx context.Context, mirrorID int64) bool {
 func runPushSync(ctx context.Context, m *repo_model.PushMirror) error {
 	timeout := time.Duration(setting.Git.Timeout.Mirror) * time.Second
 
-	performPush := func(path string) error {
+	performPush := func(repo *repo_model.Repository, isWiki bool) error {
+		path := repo.RepoPath()
+		if isWiki {
+			path = repo.WikiPath()
+		}
 		remoteURL, err := git.GetRemoteURL(ctx, path, m.RemoteName)
 		if err != nil {
 			log.Error("GetRemoteAddress(%s) Error %v", path, err)
@@ -141,7 +146,12 @@ func runPushSync(ctx context.Context, m *repo_model.PushMirror) error {
 		if setting.LFS.StartServer {
 			log.Trace("SyncMirrors [repo: %-v]: syncing LFS objects...", m.Repo)
 
-			gitRepo, err := git.OpenRepository(ctx, path)
+			var gitRepo *git.Repository
+			if isWiki {
+				gitRepo, err = gitrepo.OpenWikiRepository(ctx, repo)
+			} else {
+				gitRepo, err = gitrepo.OpenRepository(ctx, repo)
+			}
 			if err != nil {
 				log.Error("OpenRepository: %v", err)
 				return errors.New("Unexpected error")
@@ -171,16 +181,15 @@ func runPushSync(ctx context.Context, m *repo_model.PushMirror) error {
 		return nil
 	}
 
-	err := performPush(m.Repo.RepoPath())
+	err := performPush(m.Repo, false)
 	if err != nil {
 		return err
 	}
 
 	if m.Repo.HasWiki() {
-		wikiPath := m.Repo.WikiPath()
-		_, err := git.GetRemoteAddress(ctx, wikiPath, m.RemoteName)
+		_, err := git.GetRemoteAddress(ctx, m.Repo.WikiPath(), m.RemoteName)
 		if err == nil {
-			err := performPush(wikiPath)
+			err := performPush(m.Repo, true)
 			if err != nil {
 				return err
 			}
diff --git a/services/pull/check.go b/services/pull/check.go
index ebe4c6d61b038..dd6c3ed230141 100644
--- a/services/pull/check.go
+++ b/services/pull/check.go
@@ -20,6 +20,7 @@ import (
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -215,7 +216,7 @@ func getMergeCommit(ctx context.Context, pr *issues_model.PullRequest) (*git.Com
 		return nil, fmt.Errorf("GetFullCommitID(%s) in %s: %w", prHeadRef, pr.BaseRepo.FullName(), err)
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
 	if err != nil {
 		return nil, fmt.Errorf("%-v OpenRepository: %w", pr.BaseRepo, err)
 	}
diff --git a/services/pull/comment.go b/services/pull/comment.go
index 14fba52f1e7e3..d538b118d5bf7 100644
--- a/services/pull/comment.go
+++ b/services/pull/comment.go
@@ -9,7 +9,7 @@ import (
 	issues_model "code.gitea.io/gitea/models/issues"
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -17,8 +17,7 @@ import (
 // isForcePush will be true if oldCommit isn't on the branch
 // Commit on baseBranch will skip
 func getCommitIDsFromRepo(ctx context.Context, repo *repo_model.Repository, oldCommitID, newCommitID, baseBranch string) (commitIDs []string, isForcePush bool, err error) {
-	repoPath := repo.RepoPath()
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repoPath)
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return nil, false, err
 	}
diff --git a/services/pull/commit_status.go b/services/pull/commit_status.go
index 39d60380ff202..b73816c7eb225 100644
--- a/services/pull/commit_status.go
+++ b/services/pull/commit_status.go
@@ -11,6 +11,7 @@ import (
 	git_model "code.gitea.io/gitea/models/git"
 	issues_model "code.gitea.io/gitea/models/issues"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/structs"
 
@@ -116,7 +117,7 @@ func GetPullRequestCommitStatusState(ctx context.Context, pr *issues_model.PullR
 	}
 
 	// check if all required status checks are successful
-	headGitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, pr.HeadRepo.RepoPath())
+	headGitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, pr.HeadRepo)
 	if err != nil {
 		return "", errors.Wrap(err, "OpenRepository")
 	}
diff --git a/services/pull/merge_rebase.go b/services/pull/merge_rebase.go
index a88f805ef0252..ecf376220e2af 100644
--- a/services/pull/merge_rebase.go
+++ b/services/pull/merge_rebase.go
@@ -9,6 +9,7 @@ import (
 
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 )
 
@@ -57,7 +58,7 @@ func doMergeRebaseFastForward(ctx *mergeContext) error {
 	}
 
 	// Original repo to read template from.
-	baseGitRepo, err := git.OpenRepository(ctx, ctx.pr.BaseRepo.RepoPath())
+	baseGitRepo, err := gitrepo.OpenRepository(ctx, ctx.pr.BaseRepo)
 	if err != nil {
 		log.Error("Unable to get Git repo for rebase: %v", err)
 		return err
diff --git a/services/pull/merge_squash.go b/services/pull/merge_squash.go
index f52a2301d906c..197d8102dd960 100644
--- a/services/pull/merge_squash.go
+++ b/services/pull/merge_squash.go
@@ -10,6 +10,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 )
@@ -24,7 +25,7 @@ func getAuthorSignatureSquash(ctx *mergeContext) (*git.Signature, error) {
 	// Try to get an signature from the same user in one of the commits, as the
 	// poster email might be private or commits might have a different signature
 	// than the primary email address of the poster.
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, ctx.tmpBasePath)
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpenPath(ctx, ctx.tmpBasePath)
 	if err != nil {
 		log.Error("%-v Unable to open base repository: %v", ctx.pr, err)
 		return nil, err
diff --git a/services/pull/patch.go b/services/pull/patch.go
index acaff04bda474..12b79a06253d1 100644
--- a/services/pull/patch.go
+++ b/services/pull/patch.go
@@ -19,6 +19,7 @@ import (
 	"code.gitea.io/gitea/models/unit"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -35,7 +36,7 @@ func DownloadDiffOrPatch(ctx context.Context, pr *issues_model.PullRequest, w io
 		return err
 	}
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, pr.BaseRepo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, pr.BaseRepo)
 	if err != nil {
 		return fmt.Errorf("OpenRepository: %w", err)
 	}
diff --git a/services/pull/pull.go b/services/pull/pull.go
index 930954bdfdfa1..e1ea4357fc5d2 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -23,6 +23,7 @@ import (
 	"code.gitea.io/gitea/modules/container"
 	gitea_context "code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/log"
@@ -62,7 +63,7 @@ func NewPullRequest(ctx context.Context, repo *repo_model.Repository, issue *iss
 	assigneeCommentMap := make(map[int64]*issues_model.Comment)
 
 	// add first push codes comment
-	baseGitRepo, err := git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+	baseGitRepo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
 	if err != nil {
 		return err
 	}
@@ -269,9 +270,9 @@ func checkForInvalidation(ctx context.Context, requests issues_model.PullRequest
 	if err != nil {
 		return fmt.Errorf("GetRepositoryByIDCtx: %w", err)
 	}
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
-		return fmt.Errorf("git.OpenRepository: %w", err)
+		return fmt.Errorf("gitrepo.OpenRepository: %w", err)
 	}
 	go func() {
 		// FIXME: graceful: We need to tell the manager we're doing something...
@@ -614,7 +615,7 @@ func CloseBranchPulls(ctx context.Context, doer *user_model.User, repoID int64,
 
 // CloseRepoBranchesPulls close all pull requests which head branches are in the given repository, but only whose base repo is not in the given repository
 func CloseRepoBranchesPulls(ctx context.Context, doer *user_model.User, repo *repo_model.Repository) error {
-	branches, _, err := git.GetBranchesByPath(ctx, repo.RepoPath(), 0, 0)
+	branches, _, err := gitrepo.GetBranchesByPath(ctx, repo, 0, 0)
 	if err != nil {
 		return err
 	}
@@ -671,7 +672,7 @@ func GetSquashMergeCommitMessages(ctx context.Context, pr *issues_model.PullRequ
 		}
 	}
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, pr.HeadRepo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, pr.HeadRepo)
 	if err != nil {
 		log.Error("Unable to open head repository: Error: %v", err)
 		return ""
@@ -845,7 +846,7 @@ func GetIssuesAllCommitStatus(ctx context.Context, issues issues_model.IssueList
 		}
 		gitRepo, ok := gitRepos[issue.RepoID]
 		if !ok {
-			gitRepo, err = git.OpenRepository(ctx, issue.Repo.RepoPath())
+			gitRepo, err = gitrepo.OpenRepository(ctx, issue.Repo)
 			if err != nil {
 				log.Error("Cannot open git repository %-v for issue #%d[%d]. Error: %v", issue.Repo, issue.Index, issue.ID, err)
 				continue
@@ -882,7 +883,7 @@ func IsHeadEqualWithBranch(ctx context.Context, pr *issues_model.PullRequest, br
 	if err = pr.LoadBaseRepo(ctx); err != nil {
 		return false, err
 	}
-	baseGitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, pr.BaseRepo.RepoPath())
+	baseGitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, pr.BaseRepo)
 	if err != nil {
 		return false, err
 	}
@@ -902,7 +903,7 @@ func IsHeadEqualWithBranch(ctx context.Context, pr *issues_model.PullRequest, br
 	} else {
 		var closer io.Closer
 
-		headGitRepo, closer, err = git.RepositoryFromContextOrOpen(ctx, pr.HeadRepo.RepoPath())
+		headGitRepo, closer, err = gitrepo.RepositoryFromContextOrOpen(ctx, pr.HeadRepo)
 		if err != nil {
 			return false, err
 		}
diff --git a/services/pull/pull_test.go b/services/pull/pull_test.go
index d63227a7d5e9c..787910bf760f3 100644
--- a/services/pull/pull_test.go
+++ b/services/pull/pull_test.go
@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/models/unit"
 	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -41,7 +42,7 @@ func TestPullRequest_GetDefaultMergeMessage_InternalTracker(t *testing.T) {
 	pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 2})
 
 	assert.NoError(t, pr.LoadBaseRepo(db.DefaultContext))
-	gitRepo, err := git.OpenRepository(git.DefaultContext, pr.BaseRepo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, pr.BaseRepo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
@@ -71,7 +72,7 @@ func TestPullRequest_GetDefaultMergeMessage_ExternalTracker(t *testing.T) {
 	pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 2, BaseRepo: baseRepo})
 
 	assert.NoError(t, pr.LoadBaseRepo(db.DefaultContext))
-	gitRepo, err := git.OpenRepository(git.DefaultContext, pr.BaseRepo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, pr.BaseRepo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
diff --git a/services/pull/review.go b/services/pull/review.go
index e48f3801547dd..d4ea97561253e 100644
--- a/services/pull/review.go
+++ b/services/pull/review.go
@@ -16,6 +16,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
@@ -170,7 +171,7 @@ func createCodeComment(ctx context.Context, doer *user_model.User, repo *repo_mo
 	if err := pr.LoadBaseRepo(ctx); err != nil {
 		return nil, fmt.Errorf("LoadBaseRepo: %w", err)
 	}
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, pr.BaseRepo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, pr.BaseRepo)
 	if err != nil {
 		return nil, fmt.Errorf("RepositoryFromContextOrOpen: %w", err)
 	}
diff --git a/services/release/release.go b/services/release/release.go
index f17682ae0f8f6..c1d13126f0b3b 100644
--- a/services/release/release.go
+++ b/services/release/release.go
@@ -16,6 +16,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/repository"
@@ -168,7 +169,7 @@ func CreateNewTag(ctx context.Context, doer *user_model.User, repo *repo_model.R
 		}
 	}
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return err
 	}
diff --git a/services/release/release_test.go b/services/release/release_test.go
index 4b57262981b55..3d0681f1e1710 100644
--- a/services/release/release_test.go
+++ b/services/release/release_test.go
@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/services/attachment"
 
 	_ "code.gitea.io/gitea/models/actions"
@@ -29,9 +30,8 @@ func TestRelease_Create(t *testing.T) {
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-	repoPath := repo_model.RepoPath(user.Name, repo.Name)
 
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
@@ -135,9 +135,8 @@ func TestRelease_Update(t *testing.T) {
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-	repoPath := repo_model.RepoPath(user.Name, repo.Name)
 
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
@@ -278,9 +277,8 @@ func TestRelease_createTag(t *testing.T) {
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-	repoPath := repo_model.RepoPath(user.Name, repo.Name)
 
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
diff --git a/services/repository/adopt.go b/services/repository/adopt.go
index 2e9b0c822f957..bfb965063f33e 100644
--- a/services/repository/adopt.go
+++ b/services/repository/adopt.go
@@ -17,6 +17,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
@@ -126,7 +127,7 @@ func adoptRepository(ctx context.Context, repoPath string, u *user_model.User, r
 	repo.IsEmpty = false
 
 	// Don't bother looking this repo in the context it won't be there
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		return fmt.Errorf("openRepository: %w", err)
 	}
diff --git a/services/repository/archiver/archiver.go b/services/repository/archiver/archiver.go
index c2ad4d484a69e..01c58f0ce402a 100644
--- a/services/repository/archiver/archiver.go
+++ b/services/repository/archiver/archiver.go
@@ -15,6 +15,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -209,7 +210,7 @@ func doArchive(ctx context.Context, r *ArchiveRequest) (*repo_model.RepoArchiver
 		return nil, fmt.Errorf("archiver.LoadRepo failed: %w", err)
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/repository/branch.go b/services/repository/branch.go
index c1e6625ed4761..e2e50297afacd 100644
--- a/services/repository/branch.go
+++ b/services/repository/branch.go
@@ -17,6 +17,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/queue"
@@ -160,7 +161,7 @@ func loadOneBranch(ctx context.Context, repo *repo_model.Repository, dbBranch *g
 		if pr.HasMerged {
 			baseGitRepo, ok := repoIDToGitRepo[pr.BaseRepoID]
 			if !ok {
-				baseGitRepo, err = git.OpenRepository(ctx, pr.BaseRepo.RepoPath())
+				baseGitRepo, err = gitrepo.OpenRepository(ctx, pr.BaseRepo)
 				if err != nil {
 					return nil, fmt.Errorf("OpenRepository: %v", err)
 				}
@@ -190,13 +191,9 @@ func loadOneBranch(ctx context.Context, repo *repo_model.Repository, dbBranch *g
 	}, nil
 }
 
-func GetBranchCommitID(ctx context.Context, repo *repo_model.Repository, branch string) (string, error) {
-	return git.GetBranchCommitID(ctx, repo.RepoPath(), branch)
-}
-
 // checkBranchName validates branch name with existing repository branches
 func checkBranchName(ctx context.Context, repo *repo_model.Repository, name string) error {
-	_, err := git.WalkReferences(ctx, repo.RepoPath(), func(_, refName string) error {
+	_, err := gitrepo.WalkReferences(ctx, repo, func(_, refName string) error {
 		branchRefName := strings.TrimPrefix(refName, git.BranchPrefix)
 		switch {
 		case branchRefName == name:
diff --git a/services/repository/create.go b/services/repository/create.go
index 0e89573343e66..a648c0d816787 100644
--- a/services/repository/create.go
+++ b/services/repository/create.go
@@ -16,6 +16,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/options"
 	repo_module "code.gitea.io/gitea/modules/repository"
@@ -175,7 +176,7 @@ func initRepository(ctx context.Context, repoPath string, u *user_model.User, re
 
 	if len(opts.DefaultBranch) > 0 {
 		repo.DefaultBranch = opts.DefaultBranch
-		gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+		gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 		if err != nil {
 			return fmt.Errorf("openRepository: %w", err)
 		}
diff --git a/services/repository/files/commit.go b/services/repository/files/commit.go
index 048e41e6fdd38..16a15e06a7ccc 100644
--- a/services/repository/files/commit.go
+++ b/services/repository/files/commit.go
@@ -12,6 +12,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/services/automerge"
 )
@@ -23,7 +24,7 @@ func CreateCommitStatus(ctx context.Context, repo *repo_model.Repository, creato
 	repoPath := repo.RepoPath()
 
 	// confirm that commit is exist
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return fmt.Errorf("OpenRepository[%s]: %w", repoPath, err)
 	}
diff --git a/services/repository/files/content.go b/services/repository/files/content.go
index 30d62fbcdf7c0..c278d7f8355cc 100644
--- a/services/repository/files/content.go
+++ b/services/repository/files/content.go
@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/models"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
@@ -58,7 +59,7 @@ func GetContentsOrList(ctx context.Context, repo *repo_model.Repository, treePat
 	}
 	treePath = cleanTreePath
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return nil, err
 	}
@@ -133,7 +134,7 @@ func GetContents(ctx context.Context, repo *repo_model.Repository, treePath, ref
 	}
 	treePath = cleanTreePath
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/repository/files/content_test.go b/services/repository/files/content_test.go
index 3ad3e3ab98b2a..d50847789ace1 100644
--- a/services/repository/files/content_test.go
+++ b/services/repository/files/content_test.go
@@ -6,10 +6,9 @@ package files
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/contexttest"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	api "code.gitea.io/gitea/modules/structs"
 
 	_ "code.gitea.io/gitea/models/actions"
@@ -235,7 +234,7 @@ func TestGetBlobBySHA(t *testing.T) {
 	ctx.SetParams(":id", "1")
 	ctx.SetParams(":sha", sha)
 
-	gitRepo, err := git.OpenRepository(ctx, repo_model.RepoPath(ctx.Repo.Owner.Name, ctx.Repo.Repository.Name))
+	gitRepo, err := gitrepo.OpenRepository(ctx, ctx.Repo.Repository)
 	if err != nil {
 		t.Fail()
 	}
diff --git a/services/repository/files/file_test.go b/services/repository/files/file_test.go
index 4e67ad1410856..675ddbddb3e8e 100644
--- a/services/repository/files/file_test.go
+++ b/services/repository/files/file_test.go
@@ -8,7 +8,7 @@ import (
 
 	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/contexttest"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 
@@ -109,7 +109,7 @@ func TestGetFileResponseFromCommit(t *testing.T) {
 	repo := ctx.Repo.Repository
 	branch := repo.DefaultBranch
 	treePath := "README.md"
-	gitRepo, _ := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, _ := gitrepo.OpenRepository(ctx, repo)
 	defer gitRepo.Close()
 	commit, _ := gitRepo.GetBranchCommit(branch)
 	expectedFileResponse := getExpectedFileResponse()
diff --git a/services/repository/files/patch.go b/services/repository/files/patch.go
index 14f8caaa8cf73..f6d5643dc91ce 100644
--- a/services/repository/files/patch.go
+++ b/services/repository/files/patch.go
@@ -13,6 +13,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/structs"
 	asymkey_service "code.gitea.io/gitea/services/asymkey"
@@ -42,7 +43,7 @@ func (opts *ApplyDiffPatchOptions) Validate(ctx context.Context, repo *repo_mode
 		opts.NewBranch = opts.OldBranch
 	}
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return err
 	}
diff --git a/services/repository/files/update.go b/services/repository/files/update.go
index 1892043304e29..f223daf3a9fdf 100644
--- a/services/repository/files/update.go
+++ b/services/repository/files/update.go
@@ -16,6 +16,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -78,7 +79,7 @@ func ChangeRepoFiles(ctx context.Context, repo *repo_model.Repository, doer *use
 		opts.NewBranch = opts.OldBranch
 	}
 
-	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo.RepoPath())
+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/repository/fork.go b/services/repository/fork.go
index a8ff2717b0688..f9c13a109eba7 100644
--- a/services/repository/fork.go
+++ b/services/repository/fork.go
@@ -14,6 +14,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/structs"
@@ -167,7 +168,7 @@ func ForkRepository(ctx context.Context, doer, owner *user_model.User, opts Fork
 			return fmt.Errorf("createDelegateHooks: %w", err)
 		}
 
-		gitRepo, err := git.OpenRepository(txCtx, repo.RepoPath())
+		gitRepo, err := gitrepo.OpenRepository(txCtx, repo)
 		if err != nil {
 			return fmt.Errorf("OpenRepository: %w", err)
 		}
@@ -190,7 +191,7 @@ func ForkRepository(ctx context.Context, doer, owner *user_model.User, opts Fork
 		log.Error("Copy language stat from oldRepo failed: %v", err)
 	}
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		log.Error("Open created git repository failed: %v", err)
 	} else {
diff --git a/services/repository/hooks.go b/services/repository/hooks.go
index 7b82f36b43fdd..97e9e290a3e3d 100644
--- a/services/repository/hooks.go
+++ b/services/repository/hooks.go
@@ -10,7 +10,7 @@ import (
 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"
 
@@ -52,13 +52,13 @@ func SyncRepositoryHooks(ctx context.Context) error {
 
 // GenerateGitHooks generates git hooks from a template repository
 func GenerateGitHooks(ctx context.Context, templateRepo, generateRepo *repo_model.Repository) error {
-	generateGitRepo, err := git.OpenRepository(ctx, generateRepo.RepoPath())
+	generateGitRepo, err := gitrepo.OpenRepository(ctx, generateRepo)
 	if err != nil {
 		return err
 	}
 	defer generateGitRepo.Close()
 
-	templateGitRepo, err := git.OpenRepository(ctx, templateRepo.RepoPath())
+	templateGitRepo, err := gitrepo.OpenRepository(ctx, templateRepo)
 	if err != nil {
 		return err
 	}
diff --git a/services/repository/lfs.go b/services/repository/lfs.go
index b437fda15d578..4504f796bd2f0 100644
--- a/services/repository/lfs.go
+++ b/services/repository/lfs.go
@@ -12,6 +12,7 @@ import (
 	git_model "code.gitea.io/gitea/models/git"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/lfs"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -69,7 +70,7 @@ func GarbageCollectLFSMetaObjectsForRepo(ctx context.Context, repo *repo_model.R
 		}
 	}()
 
-	gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
 		log.Error("Unable to open git repository %-v: %v", repo, err)
 		return err
diff --git a/services/repository/push.go b/services/repository/push.go
index e86eebde8110b..bedcf6f2524b5 100644
--- a/services/repository/push.go
+++ b/services/repository/push.go
@@ -16,6 +16,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -86,17 +87,15 @@ func pushUpdates(optsList []*repo_module.PushUpdateOptions) error {
 		return fmt.Errorf("GetRepositoryByOwnerAndName failed: %w", err)
 	}
 
-	repoPath := repo.RepoPath()
-
-	gitRepo, err := git.OpenRepository(ctx, repoPath)
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 	if err != nil {
-		return fmt.Errorf("OpenRepository[%s]: %w", repoPath, err)
+		return fmt.Errorf("OpenRepository[%s]: %w", repo.FullName(), err)
 	}
 	defer gitRepo.Close()
 
 	objectFormat, err := gitRepo.GetObjectFormat()
 	if err != nil {
-		return fmt.Errorf("unknown repository ObjectFormat [%s]: %w", repoPath, err)
+		return fmt.Errorf("unknown repository ObjectFormat [%s]: %w", repo.FullName(), err)
 	}
 
 	if err = repo_module.UpdateRepoSize(ctx, repo); err != nil {
diff --git a/services/wiki/wiki.go b/services/wiki/wiki.go
index ce54a00da73b4..50d52d3140fe8 100644
--- a/services/wiki/wiki.go
+++ b/services/wiki/wiki.go
@@ -191,7 +191,7 @@ func updateWikiPage(ctx context.Context, doer *user_model.User, repo *repo_model
 
 	committer := doer.NewGitSig()
 
-	sign, signingKey, signer, _ := asymkey_service.SignWikiCommit(ctx, repo.WikiPath(), doer)
+	sign, signingKey, signer, _ := asymkey_service.SignWikiCommit(ctx, repo, doer)
 	if sign {
 		commitTreeOpts.KeyID = signingKey
 		if repo.GetTrustModel() == repo_model.CommitterTrustModel || repo.GetTrustModel() == repo_model.CollaboratorCommitterTrustModel {
@@ -314,7 +314,7 @@ func DeleteWikiPage(ctx context.Context, doer *user_model.User, repo *repo_model
 
 	committer := doer.NewGitSig()
 
-	sign, signingKey, signer, _ := asymkey_service.SignWikiCommit(ctx, repo.WikiPath(), doer)
+	sign, signingKey, signer, _ := asymkey_service.SignWikiCommit(ctx, repo, doer)
 	if sign {
 		commitTreeOpts.KeyID = signingKey
 		if repo.GetTrustModel() == repo_model.CommitterTrustModel || repo.GetTrustModel() == repo_model.CollaboratorCommitterTrustModel {
diff --git a/services/wiki/wiki_test.go b/services/wiki/wiki_test.go
index 277fa086ac13c..59c77060f2c27 100644
--- a/services/wiki/wiki_test.go
+++ b/services/wiki/wiki_test.go
@@ -12,6 +12,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 
 	_ "code.gitea.io/gitea/models/actions"
 
@@ -164,7 +165,7 @@ func TestRepository_AddWikiPage(t *testing.T) {
 			webPath := UserTitleToWebPath("", userTitle)
 			assert.NoError(t, AddWikiPage(git.DefaultContext, doer, repo, webPath, wikiContent, commitMsg))
 			// Now need to show that the page has been added:
-			gitRepo, err := git.OpenRepository(git.DefaultContext, repo.WikiPath())
+			gitRepo, err := gitrepo.OpenWikiRepository(git.DefaultContext, repo)
 			if !assert.NoError(t, err) {
 				return
 			}
@@ -212,7 +213,7 @@ func TestRepository_EditWikiPage(t *testing.T) {
 		assert.NoError(t, EditWikiPage(git.DefaultContext, doer, repo, "Home", webPath, newWikiContent, commitMsg))
 
 		// Now need to show that the page has been added:
-		gitRepo, err := git.OpenRepository(git.DefaultContext, repo.WikiPath())
+		gitRepo, err := gitrepo.OpenWikiRepository(git.DefaultContext, repo)
 		assert.NoError(t, err)
 		masterTree, err := gitRepo.GetTree(DefaultBranch)
 		assert.NoError(t, err)
@@ -236,7 +237,7 @@ func TestRepository_DeleteWikiPage(t *testing.T) {
 	assert.NoError(t, DeleteWikiPage(git.DefaultContext, doer, repo, "Home"))
 
 	// Now need to show that the page has been added:
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repo.WikiPath())
+	gitRepo, err := gitrepo.OpenWikiRepository(git.DefaultContext, repo)
 	if !assert.NoError(t, err) {
 		return
 	}
@@ -251,7 +252,7 @@ func TestRepository_DeleteWikiPage(t *testing.T) {
 func TestPrepareWikiFileName(t *testing.T) {
 	unittest.PrepareTestEnv(t)
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repo.WikiPath())
+	gitRepo, err := gitrepo.OpenWikiRepository(git.DefaultContext, repo)
 	if !assert.NoError(t, err) {
 		return
 	}
diff --git a/tests/integration/api_packages_cargo_test.go b/tests/integration/api_packages_cargo_test.go
index 6b8154af457a6..c0705e0de5cf4 100644
--- a/tests/integration/api_packages_cargo_test.go
+++ b/tests/integration/api_packages_cargo_test.go
@@ -18,7 +18,7 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/json"
 	cargo_module "code.gitea.io/gitea/modules/packages/cargo"
 	"code.gitea.io/gitea/modules/setting"
@@ -78,7 +78,7 @@ func testPackageCargo(t *testing.T, _ *neturl.URL) {
 	assert.NoError(t, err)
 
 	readGitContent := func(t *testing.T, path string) string {
-		gitRepo, err := git.OpenRepository(db.DefaultContext, repo.RepoPath())
+		gitRepo, err := gitrepo.OpenRepository(db.DefaultContext, repo)
 		assert.NoError(t, err)
 		defer gitRepo.Close()
 
diff --git a/tests/integration/api_releases_test.go b/tests/integration/api_releases_test.go
index e070bd05b5a42..5b1ab76ce97b3 100644
--- a/tests/integration/api_releases_test.go
+++ b/tests/integration/api_releases_test.go
@@ -18,6 +18,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/tests"
 
@@ -109,7 +110,7 @@ func TestAPICreateAndUpdateRelease(t *testing.T) {
 	session := loginUser(t, owner.LowerName)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
 
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
@@ -172,7 +173,7 @@ func TestAPICreateReleaseToDefaultBranchOnExistingTag(t *testing.T) {
 	session := loginUser(t, owner.LowerName)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
 
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
diff --git a/tests/integration/api_repo_file_create_test.go b/tests/integration/api_repo_file_create_test.go
index f78909eb32582..0d192a1fe84ac 100644
--- a/tests/integration/api_repo_file_create_test.go
+++ b/tests/integration/api_repo_file_create_test.go
@@ -18,7 +18,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 
@@ -167,7 +167,7 @@ func TestAPICreateFile(t *testing.T) {
 			req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s", user2.Name, repo1.Name, treePath), &createFileOptions).
 				AddTokenAuth(token2)
 			resp := MakeRequest(t, req, http.StatusCreated)
-			gitRepo, _ := git.OpenRepository(stdCtx.Background(), repo1.RepoPath())
+			gitRepo, _ := gitrepo.OpenRepository(stdCtx.Background(), repo1)
 			commitID, _ := gitRepo.GetBranchCommitID(createFileOptions.NewBranchName)
 			latestCommit, _ := gitRepo.GetCommitByPath(treePath)
 			expectedFileResponse := getExpectedFileResponseForCreate("user2/repo1", commitID, treePath, latestCommit.ID.String())
@@ -285,7 +285,7 @@ func TestAPICreateFile(t *testing.T) {
 			AddTokenAuth(token2)
 		resp = MakeRequest(t, req, http.StatusCreated)
 		emptyRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{OwnerName: "user2", Name: "empty-repo"}) // public repo
-		gitRepo, _ := git.OpenRepository(stdCtx.Background(), emptyRepo.RepoPath())
+		gitRepo, _ := gitrepo.OpenRepository(stdCtx.Background(), emptyRepo)
 		commitID, _ := gitRepo.GetBranchCommitID(createFileOptions.NewBranchName)
 		latestCommit, _ := gitRepo.GetCommitByPath(treePath)
 		expectedFileResponse := getExpectedFileResponseForCreate("user2/empty-repo", commitID, treePath, latestCommit.ID.String())
diff --git a/tests/integration/api_repo_file_update_test.go b/tests/integration/api_repo_file_update_test.go
index 7e88f6cd80360..195a1090c7c03 100644
--- a/tests/integration/api_repo_file_update_test.go
+++ b/tests/integration/api_repo_file_update_test.go
@@ -17,7 +17,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 
@@ -135,7 +135,7 @@ func TestAPIUpdateFile(t *testing.T) {
 			req := NewRequestWithJSON(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s", user2.Name, repo1.Name, treePath), &updateFileOptions).
 				AddTokenAuth(token2)
 			resp := MakeRequest(t, req, http.StatusOK)
-			gitRepo, _ := git.OpenRepository(stdCtx.Background(), repo1.RepoPath())
+			gitRepo, _ := gitrepo.OpenRepository(stdCtx.Background(), repo1)
 			commitID, _ := gitRepo.GetBranchCommitID(updateFileOptions.NewBranchName)
 			lasCommit, _ := gitRepo.GetCommitByPath(treePath)
 			expectedFileResponse := getExpectedFileResponseForUpdate(commitID, treePath, lasCommit.ID.String())
diff --git a/tests/integration/api_repo_files_change_test.go b/tests/integration/api_repo_files_change_test.go
index d500d48b36091..ab5cf19a9c88d 100644
--- a/tests/integration/api_repo_files_change_test.go
+++ b/tests/integration/api_repo_files_change_test.go
@@ -16,7 +16,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
-	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 
@@ -96,7 +96,7 @@ func TestAPIChangeFiles(t *testing.T) {
 			req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/contents", user2.Name, repo1.Name), &changeFilesOptions).
 				AddTokenAuth(token2)
 			resp := MakeRequest(t, req, http.StatusCreated)
-			gitRepo, _ := git.OpenRepository(stdCtx.Background(), repo1.RepoPath())
+			gitRepo, _ := gitrepo.OpenRepository(stdCtx.Background(), repo1)
 			commitID, _ := gitRepo.GetBranchCommitID(changeFilesOptions.NewBranchName)
 			createLasCommit, _ := gitRepo.GetCommitByPath(createTreePath)
 			updateLastCommit, _ := gitRepo.GetCommitByPath(updateTreePath)
diff --git a/tests/integration/api_repo_get_contents_list_test.go b/tests/integration/api_repo_get_contents_list_test.go
index 86313f5e3b209..1ba74490a30da 100644
--- a/tests/integration/api_repo_get_contents_list_test.go
+++ b/tests/integration/api_repo_get_contents_list_test.go
@@ -14,6 +14,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	repo_service "code.gitea.io/gitea/services/repository"
@@ -71,7 +72,7 @@ func testAPIGetContentsList(t *testing.T, u *url.URL) {
 	token4 := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository)
 
 	// Get the commit ID of the default branch
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repo1.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo1)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
diff --git a/tests/integration/api_repo_get_contents_test.go b/tests/integration/api_repo_get_contents_test.go
index ffbdfcb0fab81..68a8608117208 100644
--- a/tests/integration/api_repo_get_contents_test.go
+++ b/tests/integration/api_repo_get_contents_test.go
@@ -14,6 +14,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	repo_service "code.gitea.io/gitea/services/repository"
@@ -73,7 +74,7 @@ func testAPIGetContents(t *testing.T, u *url.URL) {
 	token4 := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository)
 
 	// Get the commit ID of the default branch
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repo1.RepoPath())
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo1)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
diff --git a/tests/integration/api_repo_git_tags_test.go b/tests/integration/api_repo_git_tags_test.go
index 2e8510ab1b3ae..937f6a829c2cc 100644
--- a/tests/integration/api_repo_git_tags_test.go
+++ b/tests/integration/api_repo_git_tags_test.go
@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/tests"
@@ -32,7 +33,7 @@ func TestAPIGitTags(t *testing.T) {
 	_ = git.NewCommand(git.DefaultContext, "config", "user.name").AddDynamicArguments(user.Name).Run(&git.RunOpts{Dir: repo.RepoPath()})
 	_ = git.NewCommand(git.DefaultContext, "config", "user.email").AddDynamicArguments(user.Email).Run(&git.RunOpts{Dir: repo.RepoPath()})
 
-	gitRepo, _ := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+	gitRepo, _ := gitrepo.OpenRepository(git.DefaultContext, repo)
 	defer gitRepo.Close()
 
 	commit, _ := gitRepo.GetBranchCommit("master")
diff --git a/tests/integration/mirror_pull_test.go b/tests/integration/mirror_pull_test.go
index 1e0edd9a2dd07..2e71b80fbb5db 100644
--- a/tests/integration/mirror_pull_test.go
+++ b/tests/integration/mirror_pull_test.go
@@ -12,6 +12,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/migration"
 	"code.gitea.io/gitea/modules/repository"
 	mirror_service "code.gitea.io/gitea/services/mirror"
@@ -54,7 +55,7 @@ func TestMirrorPull(t *testing.T) {
 	mirror, err := repository.MigrateRepositoryGitData(ctx, user, mirrorRepo, opts, nil)
 	assert.NoError(t, err)
 
-	gitRepo, err := git.OpenRepository(git.DefaultContext, repoPath)
+	gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo)
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
diff --git a/tests/integration/mirror_push_test.go b/tests/integration/mirror_push_test.go
index c6f0c856163bd..3dc719593c306 100644
--- a/tests/integration/mirror_push_test.go
+++ b/tests/integration/mirror_push_test.go
@@ -17,6 +17,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	gitea_context "code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/services/migrations"
 	mirror_service "code.gitea.io/gitea/services/mirror"
@@ -55,14 +56,14 @@ func testMirrorPush(t *testing.T, u *url.URL) {
 	ok := mirror_service.SyncPushMirror(context.Background(), mirrors[0].ID)
 	assert.True(t, ok)
 
-	srcGitRepo, err := git.OpenRepository(git.DefaultContext, srcRepo.RepoPath())
+	srcGitRepo, err := gitrepo.OpenRepository(git.DefaultContext, srcRepo)
 	assert.NoError(t, err)
 	defer srcGitRepo.Close()
 
 	srcCommit, err := srcGitRepo.GetBranchCommit("master")
 	assert.NoError(t, err)
 
-	mirrorGitRepo, err := git.OpenRepository(git.DefaultContext, mirrorRepo.RepoPath())
+	mirrorGitRepo, err := gitrepo.OpenRepository(git.DefaultContext, mirrorRepo)
 	assert.NoError(t, err)
 	defer mirrorGitRepo.Close()
 
diff --git a/tests/integration/pull_merge_test.go b/tests/integration/pull_merge_test.go
index 2aa6742a56ac0..fcd7fecd52dd5 100644
--- a/tests/integration/pull_merge_test.go
+++ b/tests/integration/pull_merge_test.go
@@ -25,6 +25,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/models/webhook"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/test"
 	"code.gitea.io/gitea/modules/translation"
@@ -255,7 +256,7 @@ func TestCantMergeConflict(t *testing.T) {
 			BaseBranch: "base",
 		})
 
-		gitRepo, err := git.OpenRepository(git.DefaultContext, repo_model.RepoPath(user1.Name, repo1.Name))
+		gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo1)
 		assert.NoError(t, err)
 
 		err = pull.Merge(context.Background(), pr, user1, gitRepo, repo_model.MergeStyleMerge, "", "CONFLICT", false)
@@ -348,7 +349,7 @@ func TestCantMergeUnrelated(t *testing.T) {
 		session.MakeRequest(t, req, http.StatusCreated)
 
 		// Now this PR could be marked conflict - or at least a race may occur - so drop down to pure code at this point...
-		gitRepo, err := git.OpenRepository(git.DefaultContext, path)
+		gitRepo, err := gitrepo.OpenRepository(git.DefaultContext, repo1)
 		assert.NoError(t, err)
 		pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{
 			HeadRepoID: repo1.ID,
diff --git a/tests/integration/repofiles_change_test.go b/tests/integration/repofiles_change_test.go
index e0edf07299b50..19fbd1754cc2f 100644
--- a/tests/integration/repofiles_change_test.go
+++ b/tests/integration/repofiles_change_test.go
@@ -14,6 +14,7 @@ import (
 	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/contexttest"
 	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	files_service "code.gitea.io/gitea/services/repository/files"
@@ -262,7 +263,7 @@ func TestChangeRepoFilesForCreate(t *testing.T) {
 
 		// asserts
 		assert.NoError(t, err)
-		gitRepo, _ := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+		gitRepo, _ := gitrepo.OpenRepository(git.DefaultContext, repo)
 		defer gitRepo.Close()
 
 		commitID, _ := gitRepo.GetBranchCommitID(opts.NewBranch)
@@ -299,7 +300,7 @@ func TestChangeRepoFilesForUpdate(t *testing.T) {
 
 		// asserts
 		assert.NoError(t, err)
-		gitRepo, _ := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+		gitRepo, _ := gitrepo.OpenRepository(git.DefaultContext, repo)
 		defer gitRepo.Close()
 
 		commit, _ := gitRepo.GetBranchCommit(opts.NewBranch)
@@ -335,7 +336,7 @@ func TestChangeRepoFilesForUpdateWithFileMove(t *testing.T) {
 
 		// asserts
 		assert.NoError(t, err)
-		gitRepo, _ := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+		gitRepo, _ := gitrepo.OpenRepository(git.DefaultContext, repo)
 		defer gitRepo.Close()
 
 		commit, _ := gitRepo.GetBranchCommit(opts.NewBranch)
@@ -386,7 +387,7 @@ func TestChangeRepoFilesWithoutBranchNames(t *testing.T) {
 
 		// asserts
 		assert.NoError(t, err)
-		gitRepo, _ := git.OpenRepository(git.DefaultContext, repo.RepoPath())
+		gitRepo, _ := gitrepo.OpenRepository(git.DefaultContext, repo)
 		defer gitRepo.Close()
 
 		commit, _ := gitRepo.GetBranchCommit(repo.DefaultBranch)

From 61f8ca4906c4c51f9e7e9598417a9674556e670a Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sun, 28 Jan 2024 00:20:17 +0100
Subject: [PATCH 13/17] Add screenshot for "Profile Readmes" to docs (#28964)

introduced in #23260 ... the docs still looks to empty:
https://docs.gitea.com/usage/profile-readme

this changes it :)
---
 docs/content/usage/profile-readme.en-us.md |   4 ++++
 docs/content/usage/profile-readme.png      | Bin 0 -> 33680 bytes
 2 files changed, 4 insertions(+)
 create mode 100644 docs/content/usage/profile-readme.png

diff --git a/docs/content/usage/profile-readme.en-us.md b/docs/content/usage/profile-readme.en-us.md
index 339176f7d4a7f..fe42fa2723f16 100644
--- a/docs/content/usage/profile-readme.en-us.md
+++ b/docs/content/usage/profile-readme.en-us.md
@@ -19,3 +19,7 @@ To display a Markdown file in your Gitea user or organization profile page, crea
 Gitea will automatically display the contents of the file on your profile, in a new "Overview" above your repositories.
 
 Making the `.profile` repository private will hide the Profile README.
+
+Example of user with `.profile/README.md`:
+
+![profile readme screenshot](./profile-readme.png)
diff --git a/docs/content/usage/profile-readme.png b/docs/content/usage/profile-readme.png
new file mode 100644
index 0000000000000000000000000000000000000000..f8043ad02af3bf13d68b927c3b431b123236c5e6
GIT binary patch
literal 33680
zcmc%wbx>SS^fw3(NeCW-OGqFDNYKG8xCD0@eDEM41oweJa18{P;33%H4uiY9li=<)
z%na=0`+J_Z-mTiIt*zRs{cEPXPao^kr*D7mx#8-nas;^4xBvivKtWzc699M$0{|Xv
zVn0Urd<CuAp&KZ5Wo=mwZZUL^popTZBB;52@ZsSBP&U80zJB({ARr*X*~uw5I5;9E
zwZfSyA~FtvKrH>)f3T2?1ppo%#$(4G0I_4(IJibeM(^Iedl-v->{bT=LBEw)sH>~1
zsHjxzK0rZ$A&OTR&ei(*`a4h%z8_i*(Dn6oOMBb1fDRoU-G?10j(79e!-Gm}>+`@a
z5CAY13uuOwV2kH~pxa<D7yyX9y}i}a(t7IAKpfN^YACkzu=DV+yZi8v**?g@^O1vF
zn$xv3%~?DkD#e~#thqWpwAjc#XHZbYKt;oZknlMNkH5aCVsmQ)fLFRK)=F2zmlXSP
zWc0VtszJbWvgT}mZf<Uypj0={Z)w>j5#bTCGBPVGD_q=SZqcdoB8rkcVn;_uK)qBY
zZZS$SY$aK0dHWbGUa>ORAP2YdhBA||QSimZMP2(~d1<M>v0cz7{fHn>QAxFdfdO}S
z_tDWYcVp$6${IdpFF_I8f`S4o3u_vhSNh(m@87?7Dz*s8(k_AxMta+QR8cawc5eC|
z?cm_>#I(`XFD$-s$Vx>FoYq|h8_b4iR5f(^l@9Q|!A?s2;pgL>o0TEyWBl1#Oqg4&
zCdEneTZ2ccv6rumLzEr|kKWAeLU4={NKuMKSqu0fTH2??#t|arnE7zL;S}&AKitYy
zTHGSj{E6PT&meh!b+NUTVa+&mwO3@uUd>!)IayVGK`vHd`7LJdG5xE1TCRyaHhSi~
zVxQwH-r4@1tI#a0>El;)6p*pfx9}Fl#rd5Y7QgXOxpd9J<DQ&Xi$ThfFtDFq)b4C<
zz@w+BkT=;Mqq9B|W0+tXEU&^Lp(LT>T9YJ?-Epk)&6vn6&S>Ha(=BVcuUucZuu@ys
zuXQ&hsT!NZHPVReVS6HWYz)VHEWrmxXP-LNn53x}8qUms<GnHttH%;f>{aD;U?j&W
z+>8ap=7FN+IW1Qn9ujoQdZp+JglNkog_=oUC|Sy95|IObG^~zkoebATWcb7aKq<0!
z9sodqs)CH9w&&vE!dIMjPW;D`8_G$tP2X-pHElwkHyW-J6+aCSxx<v8M?IqZ4#9|%
zhXLgC!2pIyAb@y}0uX+Q7a;ThH(YclP~Fct1(<t}N?TC-{%7IQ(=T^?#+x=6kIO-*
zROWa+)Ap--$Ps-w##1BcU9~URO!qO+$4&VO0RM^PyL+8qUL*o|OxZ{G-k;7W)OVmN
z_mB3GwF6*@Oc*~Lujpcq$sfb*esL3+Jqk`oVot;D6JP<t{to99KVQC|b$I@?Q?T4*
z{`MPEU4Q?b@nlYN!Ag^B#o%){`Cr_eXHQd+bbd7<EGlHAj8aVJRL24x0j{0xwCZ;I
zHDKFG2y;Q9Dk72TC|UFW+<}9t@=Bme;A><wquKcOc0n<g$5+8g|D=cg$Wu^`CF+`0
z=L}&rw{63Iz_l|jTg5eM9%0)%zi|s%6x5fPHBMkS0;T1O>mWx{j31v&)EMTreX*M!
zy?0qhU?N9Ytq-dnwc}^AC=kSAFp<e15{u_i<`($70K`j$8}pr!S*CGlSG#$yJ7%0A
zefs0z6k21WFI&CeweWVa^omMQiyX(=B9Ud|kV>x9yf?{I8_dgn8(kq%E5%@FPtU^f
zPu-#HuOG`lg*wOqS4!vR*TznOymW?-FCrj1F4=Xhqf-<s@-ays(|s@a-$qWm6vXto
zd3156bnupr&1jzLh_%?GCcS&=o-aUYuSb9J#na<&=$&z^PF&i~4Q;QF1Yu1i2sm_8
z89)E#wp6Oz-evUk$Vs_7E;>|!q&J9lxTp2W_pk5R@CG?k4T&v-`DEhGYAQgOYIg*s
zzwR%WjQ48o*DZhLT}Vvw8SAV#f^_B_i}#PR?#dq+hISSF1*ZC5w$z;<?vDw<mA0<y
zh`D)~4iT(QQ2X^zhU+~N*NY+OCEK51{c3R>(~Ci_p{ZdwU%z0i>!w^Yp!J@6XsYqN
zL@QSMhm78ssFO)g(*+*$MdTUHZSV{fNmeoNs{B;>3I~$dkT_<7iEO&;mb#cN;67Js
z_$-58EZ$iD==+y-)BI#f;O^&im7J54R)i3uo@FzcBINI@o8t<eBK|ZgX890sB~I@z
zxDG*=Nqgug1HKZi8v!>TYu5PphmVH)rW?;9haanLw2)lj9uB&<3n9Jp>vSItx&GPQ
zaIwL26S~HAkyze*RW3#2b=MUHX8gQWJtux~uuXzD0u~tRgL+q8_xOn`OKqDx3H5!5
zt<5|0!>CA}x6mbmeMtzy{@5fdK<%;)O3%63nsSr-h-jm+@FbhMWxd9x)D9@iP6rY1
zi~+Z(sN9{^qH?Rs=f8uCmNpK$w6J84sp^6Y1fP|7AC<&7@I`Gf7Tf&TzYP7A#_YuU
zvy~XaZcV6EqO`RE`g5|ce!1Bs*;7uNavL4m_Q3ck<+<-^!^smY$b_}<NHTa{Spe{!
z6;}N9d^KQShp2oJ*=f!A(2tfJK5w!^^!AmZ#j}qPzO|;sn%s|Lz;d#ZA@y_TDA6}C
z#pS_|Q2*^Y61+sot&KVMhgtEX?!&*1EZRQro|?XG%OG2BI1z6c<Zqk5L0vg^?@%C{
z{a0`N5qDV+00qYrgkwY$jN5uLY?&VG85Z@djKOy9@7ozEH56IG%f5~*Y)95+xq1KL
z>^0dhR)$xWhBS5uQLA6bX8D^!=e!I(qC?-b()N8Z?EA7!p~~3whY-})VxLMk7KC>i
zqebzh7RTkg=j5LhJr|<U)$pr4u+m_V*zjM9FB&iQ&Zj=^bm;_tUnCc|-rF_cdETo!
z?G~34iXE;z#e(~32dfJ>&2ZM1`CH%MVUm1;;oW)@{o}zf`kAH;L(umgUoRVPk5i5M
z;Mak}twSeHBFmCNOWxl^l_PJh(x?+letYGo@|t=Ux6P1kUqlk;V$6KNeqVP!kTo+n
zWi<y@waSPjM>YXiXkoJ?bMQD&G^2>qUV9N<d*ElpJ#_6v2^w{CjDzpTUP$V3!zJ<<
zwt9ov{A3+scD_*`0sgW5L}OjNpHcAbI?ZM;a5>C*z|!S;Hqhp*Hk+2<(Skn>uVCjn
z`KyaI`SZ%A>bG(ogVwH?D=uyqHiVv?nXNq|nSS%9S;UBD?i%vw3aI=sQW!gAx95Wd
zacZ`(8iT<C(fh^iM={<@p>hO{Jl?t{I~tF<dO8;f8t{A1Z~07!{2JzBKVXPi{N4U-
zGd_o045T7uFHK@>4LqQeCL->^+{k=Fp;Fdw@|Xwt2+Ri27$Js9j7Gc@r!M(wY)WZK
zZ$A-6m^W0?PhZU(L1(iV_$nJigkvAuNS3YO9p4WbmHml4p_cjTbJ9{%g^~JO>&Jgo
zW;|FWsxP!v=F2jOb90QK5lQW#&&p_M<1|i}?6y8BZOe>X{{OrhRV~uOAFto__2eM#
zH8De&s|rCLATRkz!K-DnS_+v*M3*PI_3Go^kGojO@_BEgx^Qa31;6*nen#4z)$P01
z+?Xi&k%>z*xW6=O?C^{HL*Vt%UXyOw+B@i3VO54}wD4Vwn0w!d={gA7_i6x0L!qlv
z&rV`W#%63~+FMseqp7P<O%u)a5kwMdO+B%l%v_sirS+p`@=+A86_&yTr<OsG%HVkA
zZIE#cE~lqLX}&=rNeOG+tt?;q`dktL&G1X=r<(blBvsj$S6pY`+xT36tK(W>4F8Gb
z#qr$24f^8wiT}5*&PctdTSFSh2cl^Q>K7%6hB!K+bVk#I-(UDtPNv#!)l3TJN4ZP{
zf+-{zw<&x+&f)i*!-F-Z_^vY^j#=?ZyD0JBRNu50P+Zbe^<zeaD||R*$^0N=OcJUG
zdwc$~p*&ycj`kUmw%@VdasvCzMy?!REA2}5^OXf0!U{}*NmQYHkdvn2`H)68u*?@S
zlScW8`R%i%C(ly~$HpBb$zjWux3U%)A`lho1~Kl>L(fSv)Aw)REmCIVzmc{r8&n}G
zyzp*1GK^K*Gr4*mR)aQQ30ajytWhnU5JXP`(IC$VzO{;Y-1u?^M+*?C>XmB>Iq9;p
zex^2OZMWJ0*Wy}_WkD}~>Nh|pM@pxzs&cR5$Ku3v4HgzMs-0h$Fphx1K46--Wqmx|
z2<_qqP{<|B-_iWL5)P8PEj&f2JNuw`6T}p4y1GAvn0s|69!Y1j!!Wv0^HgZeKWDAG
zUW3u`eFs6^eq>!+biL;m)zgVg_MJ1j%SG>GctrV3;zj7tu&gR_{kbZ`Si;B76#H5$
z5W(JbMe7~C3)!fuJK6<;`E$^xtpHFuz2(%4Qw}lpnqykNSN-Z|3rmukAK7ufd40!a
z!H-KDEa$I=|Fhq2p*(~A&OqWj6{M1V%7X+p?L_t_BhfC->m*5xCP$JO#uU^V@M0r)
zx;`P}F665&Yd!J4cY9q?VgiOddeN~kK*VOLP9_GY_F3L{y@?bacc@GX=(6YC_wd1f
zp!1A6vdRNDH2U(6q69;_Uh+4|+QY8j@3F7!>Z$~-kZyUUbJm3II(e7%2XFdi5zePB
zr1h@e_ovx8K4J2<d_zDP?v+%t-_(T9rZOFx<PLdUfFa;jRfa3J507HTV(nCAzJ~PV
zWj!o5##36QW;f9}^29eup(wAsFakE{u^?V%4et6^*2^WO1dkq(;&Yo2kvf#>7;<ZS
zkzf9LO&J2rvO_(#2ZZdvW;vI(+ks0;lj{1{aMIMj6cr&vbv;0%CYpiw5q3$6^OH}M
zlzN$eb+mr@$PnH4%tcb@D!OcCkOyZ9$?|!NiA%LeJmss6czlyG)lM!ZY`b7iymc9x
zKMh0L-f!SqZBoF;=6+tTeJ`{`?l``^4}D?x?kT?LrN6YY6#qKKJfm*C$s{tDcXDSV
z9pT{*hdgw6AoQeNNSIQkG*3ujm(Bzu<LbcBleF8QVNq72(nWGu2!0@;bP|~U?cSFs
zbI-9BTJ`RcuPtw_(gBc(#&_~siX?1{@B6=kx8vRsr_jR_sr?=Jb?bO077fzuhDnKk
zPWHXmzW08Y{p<~q+yCUv(ln_aT{jCV?g$1*szN8%BPxj5+=sl8WwL}Wvsm0D%dqd%
zp9L;%Wv^PLkX43WEU#bh(e0AgJ5&36d9XoV<7@Ob+H^qSyOZ1<k<aTg<SMw&@y37$
z0pr3!yKt*gn~4i>Ho0yGqydY?79<mP8(dH}SJ6~(D{GrShAO#vRodqCaI7X6m&Z0&
zWAqTs)K`oz+L;eh7$-}?q0W8kOQyQE5W%?j-jFu<+Z!@_Z^!}@C8FjXc1fw}_aYz0
zW^XSf{oAh`FOAG)#H5uczSS4*(JRQ{f!rR6I)$-^-!dXT8Y5HF7$L7&#;{rAZwr9C
zz^|N<V9I#Dp32PNuX%8%+PG~(g>L9Kjtw?gKR5R)TXu;4Ry3(=SgvkN2?JZ9L1Tn&
zZq&tiAoyau;DroSDlqXocmR=?G>ZunGadH!Cl%Zjhq>1T-#GUB?Bu{=&PY5jkCV+W
zR!X{o>PN<BrxaSq!Tb*G&3nF0xu|p_)Xra~Ur2nh#stsbIn^Vc)^561@+%A23-_V3
znPtwsC8cj-X)?mWS9C0YKrs)0C9^p`@yvWrg>DP%c1G%e#4apBqRLb$f0OG8f;>Uw
zG;mr)wFc!&Js<B*18&k_nG%)J2nN$K4YLUFW?kpfKl4+CM=b-?NA~*3&+urUZuZ2v
z=XB(zRGZeL?VrzjENabmMyM=KZFa$`6BRaFrg>axD8$Hn9~x>y8(fxwBn(~99qlbX
zQi+ekgP{B`?^L(GFN$DRXr7nsqFOhDFnssM9!c+yXx?+YLeN9L>S5bMG^lH_HtI-H
z+jUNrBZWw-Ra;+eohq$d)E?|(P_VUMJRh@nlF4mWSHpijzb1ow!RJ1Vkn7u}Dw$ug
zn$29n71@-L`%@MkfVcoBMci7Y2KcGOuwqv{w*CVL9wJX|KIUmiPV&1DwZbUew_0Gy
z=x4h#zT)#A7Hv{v{>-#O5l<V{IdWQ_al7J;@#oYmlll<rDS5At?<2#(cLN34x!Z(3
zh1TKV;+Q=+P&u6Ob%czKl}q+dl+=xy34S5_AIm8sy?`NPLmFRw8Q7ol)ZO{E()Y{f
zv29QjB~iDFtK*SE^`WjR4wus6u4As%`x@s@Uwr<g@s!cjhCkhMNRNu#f!zx<HR{5#
zuGZ?}ljFgk)Grat2|$U8E7~NgZ#XhXpXTqBWe&ysGuD$+t$ESuASL4464o|pX6w!b
zOos%08AA!s`G$Az^CbPW`ZbOl1;o%T|Kn>Wwf~is?_0xYWkHnd$ElKMr`Cbt&qxoH
zkyXlZ2&U*wD{{^tP&tdop_xN|d=oD0=X%dz`Fu4*JovU?MT$uh6zt?4M09(n#XCqu
z{ztf9J)y7BT2{r>g6Y|tV=m$|JiB78dLHzFp-G;a9Ax>?$cZw7)JvQf$^DqnH@`0X
zso>}%NCGX0WN>+~HV;5nKN8<H_rb<r=m4C0rwb~w>;1g-<GDlPD!113pi1T|XqMd;
zUt$*bs2m<d)V<Z1IS#YJ`MhKq1|CQf#(_!o(XPw=;(SYXIwV=`kNZ}to`Ef_Bm;{m
zJ=#X}G%6xU&(R8TqCIq0y_Q|otX?@IPvJtQ^Kknu<oxGkAUIaz8_**l@dx-*1#5_W
z{jF)c<7@4hm~T%YIvqfPkxZ}#>PN2aEuSTi?%Qnxr_d4QQ%l5&?V<p=+;=jFGWsyf
z@&A>MQp~v%m=YQs1nT<tsa>kVA=skihY>(rn70V%wF@b7%$j4vyxsbjT43b4$%U<}
zr&D&tpSiWe6|T>noTLF}IqqI8E~bAem$S8m08$atmG;S>iVTBAxi;||CCRM%J4Yg<
z57l4f)YQ01JP61<-y;b73knQ!`YOvLY8k2Vu>!?ivRQY7SnH^Z?J7xL2wi)17q$#-
z<}^i3X*dju4|Y!3T^WLphNQ2X?5|r|_?mBa4&d6Cc;d;W1<6-MJbxf7q*KrX?dU$*
zAXu@jdyjyBk(<kEFCi!aco&S9KdB|`yh{NXhxW%SXXNUBVC?<tW*m{o_&E%M0YF8t
zk^R!eO1$A{0px)J60mhe=StiH#j{<M0(+US*{}a*HYBZ27Zb;NxZD1(Hq$yU$e`&5
z6jvvVuTtw053mc;R)8!6iOQOcf>DD<l&D95JF*$=K!}bREW`Hw2N)m#BAe)q683)>
zFOxtcM-s5yG&qXeRimUycm}HfzbN>UV>n`eK6Y7PDd2JJ`%iWe|GMqZ$2?f<Use7$
zn@q@hiBJ-8|035NCgAb_fu_SJMF~eDLIIrWmj^8m#;_cH7=~|^N1tHyV+}yan_t{y
zi3(k-^u!K!v;n>A#Ja-t$u<X#c#DBuN9BOO-M!DEKQh7FI3`=}=H89*?}E%<^<M7`
zJs>Wi7KjT%T8lf(Y_JAj7i8-UdG0Vc+up;%v^VF>{{}U<j?$=SHhfG`l9CS|`rWB^
zM^+rmg_;C5X!bCm3<ggT%n!E^-1hoQR;o5IPBvJm7$Hz*)()W+#nSat-J?MJW%d$k
zaB`o4r2b61|F5lk<Ref~F9};U8B#+)50W7myP!|TUWLc@Xg^-EHaU1D?X03#Zx`e`
zqv92kUM!FcM!S3M^^fY#9Pu3V|HObk=h<x=iGSpnv1SmDJhgv+aYFrsUT3VfUE)c=
zCe_8&KE0a#_3H}V(406LavC`;{l}BLnCZvkzaUX(?SE5VyLnK=th>!c&nf+Da;0xW
z5X7BB*KG^FK4=i|l2z@WYlP4^AZic|4DNzr{xNs{Apu)-C#cA%W8dBdJzc*kaqv)M
z4JZ&f+J0OJrV3ky*6Crem89UMK&<H8(WICaHH|O+HN0W&XgadHMA$sa0C9pBW@@ZF
z3B{K=nZq^Bg8Z}14d)WC;lo{`IO<XP1lWCattb3l*oNV!ou6hFR%Z5Q@v;l_PcVsa
zhy~4wf@I3y6S3vWM8TbkOf{b{{G|&d_qH=*z{SG-$asCvK5FT{UfNtvB<sF%@~gqp
zW2e=xaosP)ubS|FQ0$ZfKo{E%UckD41lT0HWks}u0RbY9{H<tj@c?mhf1rnt{V@RN
z*vLe`KR|%QtFN#sLL?@j|II1r`YRgZ_j>aGj7ilIbfes7z2-t((|N_>tpE-NpdBoP
zd9V1`XDBlPtxb44m~QLdd%|Po`x|9<<N9;uHi11v>W4+7+cG1^bOvAW#W9m~+Oo)D
zbN49f*RrQ~1a&J~6Zt3ikM^$TLOHzltEBsDj=k5$Vl|WfCs1A6%(eWdbC#0lnj*J&
z0V4r0i6)fJCF2e*({63eK1kc@p&#4>q`296aT`e~s5s@}e*|UzEqDlBKfAAVXxua3
z>i`3~ANhZEMGR5-k2QL8I2GpnVpY3Ogk389Sx`YT!gJLfn?D~=NH-1YZ&e26#b&HG
zM-El|7;+`Je?<4{7B7DpJXN=C6wEP{eXcxJHL6REs&!Fh%k2wQke(!~QkAZ5p+aJ|
zhx}(dOUB%{kXKY$uY(C(;RmG&AN<|id+H_A2c<%Oq*NJKFonPX^Z5TURaK*C?`3%Y
zlgY;^b#w*<zGD9K=PdT#8>Uyc+u7yw?Ba9f=D8RS-a0OxfpqiPkAy5n+0pvho&Xx3
zBP;g9rymG%GR30@cRQ8sfPwqbs^N|WRzK1{jKW?NE6x4vZa9B*!=#Qy|CVaE!zz!z
zn)Kak9|UhzXzWV>0GY@$xdW|dPt8hi<`s<%!mMzj3s+EUt#Uy1kUcN|qwphS#Gcxt
z`~~*!ii1U~lDjrmSL(C-_|f1A-EQ!w{EjB?t{2b{Uj1Z5!r**g-9}?|Dy+^g`FqSd
z>Z-B+9*x)kf%<+I^S3SVg_DkKOx00#C(o5KiG5U@iFF{4JOgPI-v6!G@}^<LlD-!-
zOlTO42UZi1m$N26HE`DWtxMPyd$m8qlDYO<mv(hywDx^;<^8&NrradiZzjq~<qz_g
zmsPJO;GX_RI^x&x9i0;aU1#C^pzD1B<TM!UWjY;3h64zIIm_N5(b2-^y_D<q)7pJj
z`E|cjuVkU*uf5zmCFi<9{?uZj3&DtTlO#>?ta+iB7qdl~+dMvg$6tMt=GRNDy3J={
z`4>FMfMenMYx?`*dN`9a@7(Leh0bD&sovzF%6nX>KM@wgkiOFWOSFcSN=*aaSm;gR
zMelb%sR>_I)ECW4l_i>GE+FqKVq<E)^ctHFAS=*9y*r&NVmgxHA2If#7fRTAw`W1R
z11*Fd`+6(pQ(Pz4SZYnAxXSlr;Rhb}-GtvMX|u?o{eP`uOLPE4Ws<<T0DxOowfu3g
zk>trlhAKQx^}%95av!88W=E`slJ%aFWqc3AO4|SAWE5wV`1rByR4%MeS52zxKAs6F
zYd%df3m#P-O%gPlemzl@yj=B5;MUKdKznCeV;W4I%jFq>jSdo^<}NU6MD7!pD#sww
zJ5e!vlR65fXnnW+rZ(eA%Y@*YH=+gPm1Hkx!Nqt>Zr$K54mn;w9)^MNQD;piYAxSm
zvp4>>&6<HQhHq*)KVG3Vc0_Be8mq!>ZKd#(?+<)M={(sN`&$0d{WN(0X$k%T@b{mh
z>MtW@*2}b8v6pjoabFLJ(0gkey|=FJy@w(VA)Lms0|Zn2nb?y*-*_bU^@4qkE97X}
zH5INwJLS$h8o97fbF<(ok^16Q&iXXxZM`2lEvNT)nPspYV9Ovr+A7c_+NxqlCoUPz
zzdt=+4Z|H(qO&s}wi3BYu$%9%-gSUUo)s}3!d@#mxFk^V=iaZ&g<^@A9sqUcT9yf5
zWy1p6d8jtnXxdsI#V*fF#OdQWQFN+BZ}m#Ia$|jFCGxmuD$G6o^Sz`cFQ6%TcVtPj
zfv{ca8WI@p+g`4#P+yL9AhZ4EKEV-4)WsTVg}ZdcmVExO3=Z=2_uH+C=!x71s%(`j
z>7ZW>-w%@5UQ&qj&=h}+fK(8KsIFYFFH8)yz?6UHmoBNE-p@H9?&rb<!qLIGcd=J|
z(Hc|%n+{||+=I6CyTQ52ojj<BTb57}=b$z_zoRL}U$^($kZEvkei1CKq`RyaSo|C2
zDjgTN>H06CK>3s4E7n}L#8f?bVuFPL3)`Euar3snb`JzD3@=z2Z<So>UwpaLe;wiN
z(%{0~lG(S64o=KPPSjxk)+ZTL@&h0hyz+Hs<ZUD$OS;41B@F7%4%b#9M#n2MkyUdK
zDg{cERbI082rogDON7TIV*a8Fq!2Ft^gjH)%7@XwUqK^8kGCb$936%t0;v6s52E%t
z>>kF!^+f#l>nr?Wg8tzj;Oq8Uu(RyuReB--z<(>!@o*Wc$ZJO0{`YS)&dFcAv?p9g
zyv^1f3=xzy`0vOM?y#CCOv$U=f$i2yh%a)U9d0^oK__P-V^wCU!L}D0R?mJ7Lije~
zOP!g7fS_`<<2yOudUSr8y7t){B8Q)syq~vgI{`VKSp5=Tpb;IZ`Mu^U-m2wcc(3{S
z&KBlAH)vnufwJoZw;0*ipR7G|S(!Q89=<PXb3ph-Z{P9h)J=>H)3&kCoT#$LK0+z}
z8ik+;j^_0+rxjuAQ_!3rj39~VOI9%y^=R&mraC(+LJbx&xq6sl7izZ$^1b5=o9OM)
z7Y{Noe#ue*KHHn4`|zT0F~{zX>?ef4+|{=DWpN?8n<DNzq~{k{;={jw461)KF)j1|
zKOUHwgLXX(!OW@*f(N7@`+k5GwSd!Ehs4i82tIbbCBVgH<RIe8F)cpWtZfaP$yTO&
z?)51^=uY+sWuSk{m{4FKBG7_<PA*sZW=7K&bgr(=86=<0NN~xvC;&31Z=;GAmyr45
zRH<Jjs1Rbn%o|tvOtmaX>$g&JP@unraT-3Eozpv8o0kzY=2%3SZ?S&vw6+b*C|R)o
zFiBh6=}&LIITl@MYbj6<;Jn16Uj@E(;{DhFUZ4bg%K<+>gD^fC<dNl$C~#i4RDgZ>
z@Zs~B)7=^u09zWC?Q_Rxm|u8M9ZquX#lUS2cpd_goJMRh5Z`~?7S;goX*T-W7RTc8
zTkOOl_IxQ&k9OI2K{t^GFdF-$3!N$o##Qu%;UR9I)g$KQ;<R5p#?CjiFF|}97~nn*
z+>M7MM#>~-7UJZ#ZCu*-{8T!d6GzO{RGx<PsWG3kAF6>|-gjlrC$1m717_f_)C<5X
zpZ$*x$(QyayKN-u^eiu7;M#}1x%!rYNW+_M;iH#jVE2OgY+x41V*(h^F9mA?Ya?_-
zD%R2z1zog7Ah7Me<5#ud0~yl(p<h3YT#rFETi(7x?|mB}j;81v)2-Srg-i>0@Qg5*
zICkoOCi*SKG`>bBOmVC3M?#K$%p#3S34XY}$QVj<bo*Ud?Y1tGBs5tNcs{4;+@W?m
z_WnGjWr(H@OyC%hKo&Nc{8tzD0VU-(1T4Q;_>w5!_N@HJwnKB5<V>)#iSAu+0*b<M
zV%-rAvxx7Xat?uDxCZ|7aBb{vpe6-^iL{vp2AzH~QA1p)Rs6xWz+^L7o5}dMw(ee9
z>Q1gP+^vmI;DPI=O;ZSJ2dbMM5n<P1;p2YuQK?|_m3Vg4SUIC%x%-aJpx;eaEJwp}
zy@-R)s(K={wWLP?3p9B2ak5{wzSh}nt~u?dPxj_ux9;Gxy6?i1u`L;IU;aIV|AK(-
z4&{u5tmy8$=RgmO_Syn1tT~u1F8ZkbaWk^<KiWbvez|MeP5}p!b-y-}CHz7`*fT+8
z8tWb)lceKupsiAgRO8R`rTPA&FWC^nMkZ+yu0OAgm?IfJ9n_2)HC7A|E}liNL2s)L
ztmifokgG4nN}A2lD<Syg4s+rp`4myWA?kH^d0)N$4fj&1vwQ0fZlN$!CocarEEOVp
zd1199h0<i<EI-ZAOj~o(gE46M+9`a@f1j`nm9<rg*c_^2b-1KH&yP(fqjZ2VjpX^D
z-}^og9l`*@k}$e+)a1xd+Ny!~YR4kX%<dicNcDrnWnK2n(gNDpa@$&|J;kk8Z&f}r
z=o`!~2~7e0<Y9K37l?v`qr2J;M&TOp!dFt@&d?XwwGqPY8)QZxj2(RseEHwT+VhiP
zWX}?16`3&)>7Qs*{(RmSZ!*$41hl<}uQkjz=h<czUb38dd{MpYX#l6C7r2=kq2G?v
z_ts)x4Sj|^JD?cy&hp>`R%3zEmgG*7k-1{Oz7V1}*%MSC#~$cAuE9GuLt8F6S$5^0
z5uiFxwiK2!+a>5S0v_9)+|k&DNPI13|NG+#N}6T!=h=0noX;1S=jO4ckh*(a$DBXZ
z6+R^9`0TUpmmd%-l-n}!LPq?-B-9V@4s-n39j5Ullqy%@rFzv1?xa!;;YRV}!aDIU
z#WpY<;)?c+{KE>!$eeOJx9t*8iRA}b6>6|fKDMe3ynP+xcl&4X-p!!jISnEJ8mxJ#
z0z=+ds=$hUwrd#?y!Q}XiTAq{t_m<>*<87%J^BI2umRVWeqyWcxn#t<8<yHN;P1)n
z(AnibEJW<JN6D`Y8JQvjQ3h|N(=?-D!|uDFJjG8wbT14R8q(fI0144s-rD%sM;xs-
z&Ofz*erMjMSp2fCt)=PPtUDuuqZZDkn!oX5qL&sb2OBM2RGC;sMBO=lV{N&A`QhVy
zV+y0rdVO>zGDSL6GGvwc_Qk3T&uc+&PNFll(ILSlR$mBP{7rw5^tPFo!2bv#IstK~
zPT%hkVU=?7rOOYuv3+T?K15cEXP!7q<T`f)=<rd2yEj9M!x~dYLSDJ~;O|6_|7G8%
zU*LiKPc1Tkt=<Ws5tD3iEBhqMd@GW~q2A<wwe3*UO3$)JHE5}+_melKVF&-S3)fM?
z0-nMRV2v~3r-0Y!B-IM8tn7Fr)Qsx9#>-~E#LHcU&NsdxJ1o5}iCLkLFhrBU&^2pj
zyA;{zpWQkA00@Qz5S<Wd(SS`WHfkS&7I;a2S%N@c=*J_+p~s>BR|L7@Xp}8>k&`mO
z%t~UScGAnGx~4?qW)O*`WXuCla*qtoilZ}c$!tztTRg$rj9{s4MzyL1k?azBTJ^c@
zf#7H<k-Pu*KgGMrKOOlefB^EuW#Gvbv5C0%3Y8KS>XE6&0E*aRjnP3z(Za42y}8&}
zn!#=F%YL@qC_GMTnXy9GJhkU`B4(iVUFR3|w#3_3>P^Kq#b)SoDA|IWgUP19-s3_k
zmP&ksvkXxXjEbUDNaoM_(cr&Z757f8DM;&LV-;!il~vmrmapA<snos90sJ*m6WX=7
z{~9e`YXFtD>R*dTk<q`D+_hAg5U4+dKIu#~J5c9~(2skdC}-Qw^1fe=dB{(t{|Uvs
zDM>|Ky?!>gv9vGZZHR%!^w^5?!NT8Y3QU)hSL}CG9R8tiY%DPFXL6}9)lJma^sf(;
zztKt0RAT{Umk+-A!fyUWgSODB`$k8AiFGLKpDk85Lu+?r8yhriSUZbbh#gwLNgO>?
z0_Q*T;}KgY7to@)WuVune(2HIRWYrf*2Djpy9vQL0!4kkW7{OpT`i>T{F108G-^={
z!TkUO=xMvdE|CNdv&Q(6-26wfG$C|dS36s7Q!|hv(tqmwMeS#at@^WHcKi+=Z9BhY
ztVi6arB@y^|8He`r^J-noLvQ6+Ljpxr75rb)OPkPyA9U9{aZ@1MQEe+Z*k-6AcP_Q
zRAfbINmyhNuv6FKjc?+E0?$7IIjFloS{_YoOQj=&9V1e+%=)8~l||sCF4uDH%+RT+
z{{jN)6R!Cni$~t|{QfX!E^WXQnuc7_O(H^U`sIQjWMKf(+<6FGJWma^Kj&1U#qQSJ
z^L(?(FIt~ABza@Wx)caTJ5ZtL+I~G<$ZW&fPw#V(&t*k6Wv!Ld{IQ7uYF-<C^i~ud
zLPX__VP1>%(w_KwDGyfF%bC>Wh!tj?y5y{X<7p6_wanROzZb_Pp=l+rd-u#<C;LvH
zitxL&KKXBvi@>XhX+Lx>tzS^_A*=;+@9KJ^@`CWpJWo>mQ7=%B)Wags&&tehA6L|%
z3xf+iz6Z(M_VlR1=C&%WJ#-CUq}~2ptAYg(v-ugvvxV?RuyZ)&MvmjYaN@my&&LZA
z5Lw7syphFpH{+4H>xMZKhfy4*a#I`;8HsD|chUmRrwreTzy85e4bqVe3g60;#AP23
z%nj$~kIoIREllJ6p6{+<?7H{xXS87KVioac@1?cnJ{FJ1s22Cl>cv@>%Q3^w+|BY$
z78+qaKQESJi~<J`-`B$Y)(-G2aJT5%r2b+<qFtE=;C83~QK&J-fTN>D=+VeYaMtUP
zkp%Nzj=|gD9dI~(%1&}}GDwug49Ok1K$THJ*f&=A213<wD+ht!MsuJ4H=l?x63j$&
zsJ9b@>1kTW*h+fNDmm6hO)UazX=&Nl8rT5kp*m1aE;(QL7Xvr=dmKF<4o)`VTU%Q?
zZxpFvohYxR_a`tH$ftKNkN1XdVEvphNCTc1#LLTTCXBcb`hkPy_~(wQW}ORA?CKtL
zIW#<RXXY#=7(W6{QsU{z@#D*TOZ(aTFo{L%yAY+4*BN%NUrAxHYV6^)A@W^q9rURy
zcdZ_a{b^?Ss-H>0CR`^_^mXF1Wh#e`@2d81ejm|VK7%J#tW}nZK}4TFsrEPaL!OEQ
z##7%0F3%<^QW2{Mdnk?32TgT+9NqHoghH*;+NPFKp8kSqB$D<cXC+%Qg|$hyR}=5;
z;q)=@?9KnoMw!T$c|vr4+NFU5Q`WZ|zs&ost%w3<)YqOj%32dy0+J!<dX(MEvlnE=
z&Jd^0Bvq`fU**X#=5S)EfFzdfx#i_$d|@tiA=q?*|0wjQ*mJqUpk+ArR^u4SFf_T%
zc7+V)>F+TBJsjA=c*%Md#StOo1TlVJzY9;qo?(G0M^EIm8aw(Ofhi9<wl$>vYynX|
z@~Lx}z6FT8Q>tVCdD~j#of&3v3fRS8C5N5%Nf#rNc_O6g({>s6rj6Ve7O<05?Op6G
z<0sLw_s@qvB;0B{qAd*!2{JxYx~Ug|bqCgA>`-dyds~kER^*BzN8OpxYY!nKOfEZV
zgZLL?TTx=}V!Wnb!IzB<;f~debivQ4INcHb_xUJ*9^ZM1{q4A>Yb8+>?ZRV-B(2(d
z!$%}>*{(Es2;tV7Tt+w?q;q;eEy7s#=J*1sSZ9|Ce(neDzuIpjG5o-_{^cD*5~{#S
zF-x*x|9v`@xG(UhA7dZfu1FPPyjMZS<Fh&C$~^x9QtN8@?D!?D#z5Xaly+OQ(5?UC
zKzw@+lT2j6effg*Z?O}EPwE5IXANvR{-OF7lSsdlBJX*qw{s}%q1brVJ9j=_?YFQj
zv6mT>k4vS~njj6X4A{<~*`xJc0Uqp1N?Coy3;j~Plz}}x9&bGE^bZ#c(F1f1+yM-5
zJ#Y1GPKL;E8j9E(an7!AKE$~|SHyn6mM&|RQ>p^|d9CAL`i81<4h+HB#IbchL==-v
zN^KtuyV^$7WsB-eX@Xj06C%{XHU1jO;Z8d(8uTobWLOv}?1Ix}R1p}oX7bY7LjD(-
zbm!@`=CoX4Gg8<tvx6W!mWZk<%p6_$!LUkRs8V)f-|_lJ-$Z0uz<tYudw$Ynx%(!~
zFZ}nLJg>>2>HV5@-jh?Mo8;8B&(HGi=HThKiK3~B1+z^Gfuu9n+O9O5O~yv51x!->
zC~whVm$*&($;dnb?R<x_8yeeQ-tnQD{%yxUmZ_*s>B=9&pXWX*C9xa*{=t~CMdpiX
zZJRn$TC(jviL18oe3XI!+NYtm$Jszb9j^0-Zowf_m2G<^G%#tQOnIx5e<WuXx^q~^
zV8S;Byth=WhtyXIIdo7P@ot9uJu7&9fA0MGexyFu$z#nD<!zOCey|bRrQrUY#F*F3
z&zqs&%|Yd9qfPFsy+s;`_u4Pxbjh3&du_KBbB*oJvm+|M;y0oBrmn)23u%&Z*oRnU
z8tK)t_j6c{V>n?z2VGH~m+iB&oO#0C&?FK`Ynl*McBe@cUBJx1aK{nHOFzoK5?}AP
zL&_3fY%!Ckj7fxP!vl*cl~tJM+VtIfAu3l@9xdD4x$oPHeAefN2(hZ)Rf;aYE%i|8
zE9+`8vxJ+5$-WSFWLP5LF5`f`%9O#AQ|IFUP-h%K#_!PM`L$fZ#tJgodpV3Hq{r8b
z4A!N5$?@p}(i;-*Botd=2#Pj%VVvx=>Nf5WjFJEDYepIDwg55I#zkT(Hhpk@AhmQ}
zJi+4Q$2U{g)U;TVw^f(~;!=WEuvyz?K*tO04uCPM74)U4X?m;Ma|1ITre;@y`X6Va
zSt%r0G9$qPnzONPshDQdbi}%=wie=HN(Oe3#gX6zm)S27JFpOfGAawm2hr4E$rtu5
zQrC~hyzssdmWI_@&}XCsVsIs_d^nC@Fi}aZ1(n%53}ET8Uqn*o9$ejd7Gj++3uxUP
zSw%31E$wbtK(jiH5z!{?psHNLk{{p&Th+*ntHQehV3yS_?DFt&7o8z5R{dctJ5x^t
zvzC_}=fvwFBksxIYHPsTZyk_!`6%#<Q?)M|DLjN5HH9vb`<#%Rgo;orQKQof(vLCq
zqmK2$FUK*2F1EqQG;n>L^Ugv9mB?csje6;)221-ueK>ZMA77V=7}0PqR?#sLF(nbT
zs~t)0;T#)Qm!|%k^`~6&9Q24^gi)U0fww{9!!*OD`D{Be-yLYbku9e{$fb4Cc(V`E
zhlUOQ3Nd}oj$Egp4%D!gMK*mpUb(rH6%u)cUsS1U3VBH(VK8y`8o}RF7u#9a1svIC
zJ-d<~a!B7TTr!`!xr$@)57Rx{B`68SHz0x4Ky17OC$+`#OW79SPYBI8h@_=T!@;*T
zz2XMl%-Cu5g9p|)6r7!`X9rCfgH4`6trp@7bu$V26LvjifNJGF3|fJ9re_kooy?kg
z9+|0Za=B&W{8$Ql2453slsa{~klem6o6%-)g;=Nj>IoX}A<U1nu7~kE-`+poc4r(#
z=S@wB8F3eWKUFcG_hnAlmE`C;ySJEbH?Urh3x>@c9~3^^C5v4y$0pUeH5Z#~&5h+H
z859_!f+&)J{QcoqGngM}{@AMV@`46GBE-xDFL|H8yc_5O;Mw^e?A(4}(I7)%{#g44
zJDgTH0NbO6?XyXGe19o~0M2Wl#T1=~U=zi7P=C|v6*cuKez;)kt)5Qi@+(2X$j)!1
zW<6}~Ds69~*CP^f-u@2mnnF1nPB?tT+CWZv7q9TSYa-VfO369|VLy}}uy}-={wmVE
z!I&*gc`5jt;v$l%=*8cHqPGxzf}C&2T%y{y!q0Q;WSM%@-Q)?<I8xqN)jgf>^(LKz
zZEBDI>2fAPQODxOsZx{i%qW<T3lrt0r{aL3&xefOt=m7ytATkIdaR_lmF_7xy5vmj
z`F>{lC&aeum2la%fuyBt&xdsDhvn#CxjiBg$r+=s{Gln}O7kA%`e89AwlKee;4m>U
zaf<0+^kOg-z9=1w{YxH5W(bBxNBj!LH;yHWN^B%;7Q(@W0~>CY0DU>ZSV!-!m@&Xb
zzd0q`y!PTnc9WcZl=~C4=CVppSIhH1O2AJe1TG`fzJ^_ok@Ggo)DaaWJN^RE6P#}V
zC3>I!R6EmHwci$Kt@yeysw|+3$(uw-1d+~$mC#ZdWXLQCQ}Ha)^iSmzSQJ50CYIMO
zVPg}={W6{3;rF<9(hZ8CS01SzM^7o%jUZPCHc02+^tbvUY`=ZhLDz)TGD4lIe@F)B
zc_bC)wK3<v+NXeax+_;xFx}+4@)QaNZ8~-GkP%Xxi)&)b7LM<h4hDaGwSVUzQ(cl(
zIc)40stU4r<OdB2vD=z!JE`=Rqm?A#liyayZu_8qD@?lsYSGI8bCT{*3@see`1pHm
zCYn&;<Nb8rwmFZaCEj)?>fa-#9owvl3?&Y1JX6`ANF%MBR*VAEc)iLTUD8(h(T!!3
zY;Z}^wmh-;oxlu(qo1^H_mC>Gk-NEjOJv}0vYu*Ig9Yh)jxKAV=4WI`+7C3SA<>M~
zw0h!nTDhLz1*|7)J}S6nG-xs=ua{v-1`q1gb&|TyWu$m<TPnDC;y|o4Qi-|R%foff
zl&of|%oK-->$|z^WfSkp3Z?jylDi5dKRB}C7<N9Ff7215g<(xKFyZhvzM7Ld=v|o?
z<S5&23uJLSaeIwCs^=pCEpMnJ<0*Pg?<xtK-xKnZ>!?gWqtO`z-eLK&)RMr?$q6Xm
zap#c2&YS-x!(YGnlfTI=lcHfZGI2+_hkNzOQ7M$=w-PQ(4d)Yfc(B=bG?g!p>SUev
zLac(Yn1udcd<a>69w|(sWO+`>?gyvY+e6(bIcZAv4&cYAFV{`<FH2Lvl%Nc-uXCbT
zL2~#r*s`wY($HDS)z7n`b&Rc`BhprlEU-h#ck;ih0YGKeF=!8LD;Wud8{xir-4R1^
zVJ~I88?8e(vN-H!7^7IqcGM1)9fNWg>q0abG<H`0B$vHtvI{v~5YSEW*E;R&(8x94
zMIQpDgUm?V{ks8u0crZH4ID9NXCg9S9Ui1IQ@_RX+DjiY@sh0;Qe^5unV6wVR97?}
zcEs4VCkQ*tYjEH=i6(}IWC&EoQPO4)LBWMY`|1(keA91|hMwsTdjPBjd%a{MN*kTg
zmwBSW2`pO_Y8%LPN=v;Y*Br@5lg)bK!<lP*u=C1->VpWaFj+@zLq>Rkj(951<1Kh?
z9SO`*A@ZlL*4XwYy?&9I|0l_dGz(6X4s+?Y@q$hF_xo`yJ`l3s#c<5;;L}!`uSQR6
zE{`nU(7Myg@5blk?Qc<Z;`6)g@VQxKHU#TZ@N%%3_qg`}>HqW$NW-0x>l$Y-<Zxc6
z7hR2}2(!QVTw>>t&Tt*@b`%&8;akb9?;w|q$7Vfjm?HW37+@vKD_JCzQo{q&n?L-!
zoGUDziDOKu7diBZhm<Ubt9Zb0g94#8J6<&Dn#ZPr)MTynXuw#chwQ2F*VZdRoN{$j
zURmig<_eI)`@T({y%4T9x4P}=MR@#~i#dByYK_u<<NcxFnVDw<EZdySawIw|N*eE_
zxu4V2MTxx52(&j0Z0q10MtDdvvpn22zj7kpogFRXW$^yDH#~TNKgv3?Z_J|HPT%UO
z#YW1AX1w7i0VF+<GwgMa2+T&|>_W{x*ZR;0IK{z5^Als8TpY@g3D2L49tQQl<|Nsn
z=t4O6OVKpn7Q7l8`Lg=!K|rp%2W$5n&yS=%0tIX;=8bisr?1DP8KR~T-a)*CypG<L
z2s)-*2rm@y>=SF%d<{!s$P<8r4>?I3rU~PmKC?cp{*4jC{{?P!14?bV+Ly`zJ7>FU
zyNXgQ-4UI{fh-^Q_efRl5=f8cCOX|R>X}_XbjFkvL2qjCbxXB|ft`JmVg^xX2cVv@
z>Lw(Ryn@r`a_WP9YjgIq*DHY=wwylB6J>xVH&)Jg5sRb4;Eft+uU`DC<n<l1>Hj<i
z%pUklAwIQ9kt;O1-3vYun_bnzI<+e@hv*m8-dZ`{?w1)TFa7l?sn%tC_bJ#!rgVPo
zg4G#^_b7RTqEc(Txr$$7iPiF&+HJcfhtAs{{UzvL1w|H_ZijvfV+=2fd?&fo@hRTt
zrR`#UX?}C!w_*~>V4Bnq#5;2u+P~mMw;$+s9r35A8@B~@VFdR1$CO<dr1RG~xbTAF
z-LK7%{%0S1q0iLL;K_bOZ$O5QcCwDaI}jIm0d#p49HOzZP6><R!?)d?``);7d;a;`
zn^s<BHqNQ&)wp`%HsQl^S`!QE4IDFTveb|liytd7vhwbpA<bh}!R~OY3EKTcgU0^c
zidbK2BiUoc%b2rotAhMNG>@WxOWCaW-K6H_+rB8Ewg}vxs@VZm7H5DjVe;kjdpXuN
zyVt{i5$_eCckQ67bJq9K`s&C)lREZ1Hn!8@f}xJ<a=D+vJ`xQ*?tMTLd!jNLSPf{x
zW;M0Q;i6!;lVXu(@H$yD`RQ5{jZR!HDkEY;;8Qw7lFrg(4YIO>L@J7>of7t>B6FRv
zt1PSTMPi>hRmJru8`;8fe+T@nsPAGEh1cW7ap2Oyw94Bq+E3}f*Q6m%AYfs0S%uds
z&ka1e&Dmk0U<Dchw>r7*oSFRID6+Awu=vH+%h;vPU8Fm)qsMi`9qgRt&m~SjBDbTt
zSjoJIAK}u*W&0LlyHl8WObJs*g|Ioy;S2n1vJtF;uw*}^T?fTWKI<sUb||hXBUORg
z{xGwsso0#oK`u(p3<5Xe;b2kUiO5HNw@uDqHS7BkRSp^^*8Yn8;_u)GC?)FJi*buj
z!$*e&Gx#uCrd~6Ct|!${FgXf5lZ~e{8EaYe0WQ060qqjq+vZ#!7n}{vCb%_;mPy{3
zD=Q+02eSuW@KwwClqtP1JPsecV13p4cYn@qA*%CY=t8M#2VB=7GH-R+X#tc{+AWSG
z>-OGBzE&-kVaFdlE!JKP@^sYB0-x<huV=Rw$L%EVBxjR~J>b^IC=#x;nTp3gVsuU~
zB0fj1lXoP}E>Md7xNTK=FcuYh$P)c4T;&l{a;p>m6x1v|S87o47rq5&<ckMO`z`NP
zyyby}9+BucUKYDRYJFYY8ak<Jx1R6^*qv9)TbUynEO6oRl2(g`kk&4Fv8BOWVKkxy
zmz6#7zd9X(wq-4^5S~{iH_JhdZ?C#=bzG2AQHU3bIzld;5W|TQdMj{~a2{vxV9hV&
zAlR^Ox3w7FCJGaQE#FGtnFKe#+85CkI6D_88T}8YsxQ`n1h3z>`t8m2o_Ov`w6>HO
zv5f(NK<J$|`$Y*6?5Fe1!rbbKh%R9>O;Y@SpqXEB2wXPypk3PISbSDpz|s4N;eX8_
zxEKP=uCD6&V}uF}TnrtkT_2msInd#DRS-_vF;IKFDXxi`lrwrlQ9;0a8P-e35LA?V
z6n@Y;n{r4@#1P+^w6o*$vobr+&+X~bV;jX<@M=w#1|$Z8G5+Hd?DNfF<d}&y8Y(Sh
zKx{b*ycl$R>5hi)RTQodVvyT8Xhb(H{*Ypz35}N9C{}@gw&1*sKS#sF*~~K#c=K4y
zr7{{)euw7jf1@b;4|2`tMHCp7$o=EUi@-#GoBR@`NQ<VIZv;0kH=;`y-)SC$`qEFB
z13mQ6+#@Uzi35jLXeKtqhsiL%pVmP_>};gyc?qU4F?N&K<T@&;CH~}sV5xs3$8%L~
z>2`Dn0(ik_1M-)E{-0M`Xu4Zku7?btqh&H}L5y{0==cw!-=j+-Z{ObW{U`^+cA&|t
zgT<B)&jI&A5Q42mXt~MC{u=O_koG8T5ksgr-T12@_RYc7`sWSM!jAbp%PW<-<JJY0
zugJqRkNQl~u&*|-7TC4Dj?Tq-lee)|ZTaoP!Kx)pm^!W`uLMVrR2y+s>96O8aR6P^
zKFA9uHiOlDww7qKE-93FB7?BnhK~6sW+tzeRHt(Lqt3S5Uc^=BAvEYj79b1j$P4wk
zt2WrNTpOfXef?lAho8<7A^r7~7qL}Vox%=d!*UkWe|L6ezeXKbU&rx0%NjO(aS#7^
zcQbT^-@i0UhOJf$?jSs(R{n-cLz6J0BGBrJ-M-en)km*#UM~21+%br0mx7b!jtpl4
z0?&A6S_p10+66J7KXoR%!;Ff6$Ob|RV*iIW8@!kIZ*&fLy`TM5f-V3<Z#)$6YPVgS
ziDM|KhRL84j6h;)+_U_J`rQY<^G`gT6Z4n+0aLuS{|TcT1T!LQ$H33Gpv3o!JHW7W
z5RU)R1%(W}<Qwc7j+cwn`G0Y`@TM0GvHo!<#%uXo4j|@$KuwpJc~w2hdQaj9N(Ls)
zpc~S@{<88pDYHz}0yEFgT9FsY({_`E#$S$6p~NIuu0trx^;b82^U&082z>3=`2o3k
zl3?Bg`@r*9K>DjQe476~_A?oBL}rfH^nvbJ;^w=>Jw~k00<@5XC|CPTz%%8FRVR$G
zMZJP8QDzu{`Q<0uwLN(y_<pAVoW7bX`+qd|m0?kJ(Z7gd0E!?m(j_4^NSCOjbg3X9
zhmb}IX=H|!?ndblL>MVSK#p{G4Bg!wQ`~vux%dC!_Px(@?<Y9t?7jBdYp=ETnjOD&
z^L0?v;V&g9s_G#tJ<q)97-F8Hhz{dp^U0ij#_nYzm_8ax<+w+U76~7RULFlWxnMb?
zER!$wBJMZG8y^*KIC1H4C&L$z#Ud?w<H;{ev63?S^@%R;c4y2$OLFuI9ENfYQ>-kd
zx>IsR_<{2kO|MQUq2j6QQ^>BQ#|VfTRY{n+Lf~IZaJm)W3hQM(?Y_hu^H8xF7zU}N
zS%rEB*^=O^AY^lR@9clY4MP2kYA3ItPdfiIb*cpG0fXn#Yh1Jh`pVm40>|2)xD=!o
z<0)0l81KD!^*!r;A8+rv!C<0GYh^%;K+7TV8Ifx$+b66b!Av$4#b`bamiue-YL1rW
z$zDM!J*Xl~4yv=TCVYEd*;^0?<N9z!HjjzMrYUSEUtVlLDht{DJ$$)@`YFsS`WLmH
zk0jDo=*mp)Q+)>lGmNIRd9?EgyjZBx3${LMs=afga1|We7pB_eUO<hexgV}L6ii6U
zPek3FMZa9L?n?6p{lgn15N)$;|Bgx#V2O}Ujc0#krs_>``$^@`+K=z3RED;ba(TCO
zqsKX4eRnuEHc=`P%*-_fucTMV<dm}K^wg?y^acl{(~!s`p)B2QknD!E^aA>i9UQNB
zpH&;RhfH|=p8Ui2qV)_#KcwSWVPF+<;PpFDH_*BIyHq3Ww;X=e$PC2v>w?x5ZQ4TA
z!_Kx!tn02X(ubRrm`0Pd*xnr<h=+~7MGa=1khm@VY$YuF%)e)!_Vx2J3Bk?D1%(m>
zbjsK019r$xD$9mxxH2-`vhLvsoxE>a!{s;R4S~$QxQ!ew=C&&{>6b0-QZ4_Cv-FAG
zH1AxFk@YWH!UED=*sva#o_vC*cnt@0guWHl@y>Uk@+WyDhw4t_GRmUCQR;?(%TCpY
zpf_1NiA%{6b2n>2sh!fwxCi4=Ddn(<ZR3Pas5<`{M;TBNf<1f!U=0R{*}2*kUU>u%
zmgQrQAJD#xd0H~@#k3>`E)}{t<<ckPkw<=E<&0&GYGPlPY>C?qu#*}+D88CiJT#u}
z256l<&`)ZD!bHM9<Ug22=SM0yy=|O*@b6F+1C>s&Ok#r>>)O&ptgQXFEO+}{z%+2-
z7S|TUsPZLINwR%jf8XyJY8R#27jZQG^x$@5gX33;9iAejRXot^_{kYVOf1RJcFWP>
z?!N{$3N^4U(TFwPCJh#R8911Ur7-(QDRxn%cm2WOpMEp>ME~BC;<>wOVp$oe6^##U
z$vMNzdP8ih2M3>zFpeF(V<Wf4FU|k4yap5zgPBpvs5-Y6J=?UOC9A=^c8WuupSi*V
zW_%wi^34x<xE>*b8)@t<!+mb(79C*(I=7v7egV6})rxm3#-O$D6vN&#fQ1De${O?a
z|Js1(7Gxtn`}wo0lu2CC0+n+0zLC-?u%&3TlHN;P8pc1dWmoY2b<t+^hLkpB*q1Vd
z0bjQUkN%n_CaqwmDH!G&4=nRBXvS_qsz^6@*L?ofJwuSz&r|sQFKg{Cr?YwY&~FWy
z59$c)4S0``V%yeV5-s|MEK}LKY6cwuN#AF`G1n|F>rsRP^s=;KG%`ow1$?^&6MdFK
zZKhr@F4_UuiQeNWl!bKNW~OQJIHEe_AN$3c>_vGR2KnLL@uzr&jFu7y8@++4%ntX$
zmaeD2J*w-qUfjxwnEA^ai$W+ySaf3@KY+cr{OsYW;vAE(XHl~Rjqvae?7}6Dm|U7$
zZGePSUYjsO+E0TpDod@^nh1aQ2RT>XpT}p2w6WH9drp~-NPCm?k|3Qp>clP=n<uj?
z6;9t>atW#nS#)fP%@XI?Z~^zypgDqzI*B0)5|WPJr08|o&&c36Hjw<!!9|DzXls!1
zrKwnyzNhb=vG_a@g&Ke+Qd$aLdkK1lOZyn2g=-vt7|`gGev}(9QbZYpW5L>ldbjx}
zh4#JL1y&>vwtkAj{s298e^_*t?jFR$cKnZdU<apLnG0M*60@iLAB#j-ENw~m4&FCB
zFR0&vcZl8id@tHxw+^FL<@Sw}PG++Hch8!7K~MCdm5C;<rFBH_3{BL3;jDjpMQ=^p
zka$gI-=etw>ET247Vppqut#~CHsH2DXwV{iTM&(+$^+_{v0*?x7WJt9_Y1<$hYIE8
zp7r~AfD{WhEc3V<z08;QGeM^&@GdiU^45kPCJ#7r#$P|Y_i|RwQ6S__AVCalClJpw
z*&N~l)Kj9JgIoQZs+4-jCe?rZ<TdQ-lh{VWemPAcw1L#X%kFF+i;}Z8BEnx)z0ERN
zl*H+Ni{q~rkPvUzr+Bod0D?mJR<&cT+^y5!mn7x?$CLl!c(Gi<%|(HTW;L3?MiUw}
zf7jw_M}Mvmi(;!E>k9V9t;<wuv_y{s`O7U{>$}H9@1c*R7a|?78+tw{qHO#{9PBqu
zkU0Uyo(-IAKmvyl4~~mvu>M-8MEp6fufSauFm3>WIwq0b(4#=T%!EDT!m7xEo5RqX
z`GE5J{}vHo0Tzk8o$~&uPQ^UUZtbY%O|^{y9o#*CD*A6WUhW{f?dAg812D5>m!rr*
zBll(_rms>TGu|D!)h}4;*D<~7gTi?=8EYS}|HTwA2zz`IIe@s1s?z7pta~#2S05VE
zu(j)k*}&ZPbeZ~9?Yj!vqS@EFZ?)c)ddkYd;dGmFLGpQ_Ux;M~vyuki52Pq<KU(Ii
zuR0<FXZvX#Iddlb877hqTnM6FrAV=~xxiMx4L{aa7Cclqwfl0B59A)(;RuEi9LGGs
zThQ1cI2#B!wtL*052&x}HFUrx0Q7n?HVF16r~~GCIjIEJ!?OWBmI|O5BZI&f-P&?W
zQw7ro5Fb;qv};6aAimLI@{6Ir30i~GbLXF7zd%2H{Snx^ekK`GlZ)xORrv38`wHn%
zGz$}GxUIkQ@yx>R5re|tWPbfMW~2VFm0>8?-%Q{KQ3o{|`2YQjFQbUjmX(rYk~@P4
z^7K)}O3Mo0$=?sXyUAC^Mm80}`MX%!!PnSYu|NEKieOd}4Ey6lo4CeR?faHtDI<+h
zZ}a~U<vfcW>re?gBcx2Kx%!JJ_<8&%!u;&lp>+14zJ%68c{6xesN{Dk@VWJcV8zsv
z_l+JNnF-=F{o<)s8$PKA;<1iQa6d80Yv|<qk4GjWxHR{fX|4c|-^O$n;+u$TzpB6l
zr$^V}uI)X})2ZIE$*XrL-&rVj6jvj4yJ6<Los0FNavrGj&UB5w3ZeK1n+Pr~IJ*i4
zm&PR6Zp!~*w&l>;O-1Gf%Qlq$n??ulxx2{R&g*;9tj3}7o#cJJ0gcFaH!cG)RR)Xa
zo6r^NLNMV0#<e3Q;Q4oU(Tk#pk0KRRjJ^Ii*;Dx(jUYXwt|i?u<i_!>Ap7-o+XDuv
z=TD8Ai=lPJWnY)zvREpjO@w^tEKv8o{r!GDwX<6X5DuYIB+pk4!dA9(tRtR&B*ZP=
z|AZNpmTJbiz&Hv)#Q+qKcFvg|$G(-J+GXO`dprh|DeUr{{rNLF<SUblgAti!*s{u#
zSE}2JMLZ83zDuOGJn<b@LvIIxg=Fu79&t(#F(~L4`hLs)B%&?zkX#1+qfwTbWA^D$
zb|-M#fXx}~n+l6+{Yu*ZQPQ!8u<jsAGv;%Q+A=Z_#X~#-gi_RjGFJYjnfw>7%9=QG
zxz0Eq8&Ri&MN@@bzgBi&$+>@=Rd;QtnV5YU+BGBMv-$EEH>rU(x@1p<uGdp384g+(
z72Q6eJXi>A$vr{J)v?3Vk(9Ml5g>=AwP>03lbY*5S@$gpeDklm&raV&DNRT{3%S^=
zQzksoqbvj|*xlf+sV1Dm>`w&?DCYeAl2kvukh`t~qfWiQF_u&g+BUm>0c|Nv$uGxA
z>OT`3pJ7{}jv^|3D60F8I!Y4Uh0huVtmn@lViYBJMQ{YCW&w$eA0^X%=158ug|7x3
z$+sDABCP+?if!Dag+GaBC$X;Y^YjE`Y-m-9N9^@c*)aL3TD?vU3#``yW<|Ok*Ay^`
zNXpgcsLmu7Z32Y-tfitogxOzb^jOfYGbZXQ_W@jfuP`{-H-RCB*+gwFSccsI)d=sI
zL8I>zK)zID5LUD(3m1m(Urx&|Vs{zCLh-G;=)D}$+P1&LcbM%L*`XZCpIPGbZtCdy
z!{iAKB4^xP*>;li70X8o?{iy?yQWl1TO5&K9?0bt^9IhxRm}=#vGwR5Jr@qdScJXh
zhZlj1PqB$yW$5m={=a@u{Pa73c($)W^E!1n#<D;y>dV`vTlcoaYP{DOjM->CdQk`H
z@YyAnc^W+sB)ImlL3SJv|HGwNyNQU+!l@*zV_joU#5>So58n($P#T8bi~<R&mRo3#
zA*122D>Zf4?y{tC-T|8XH-2C0>(IPOqgZ;qfcUWX00e(51%mQy+_%woyvekqz|voA
z4WjK}l+DnB)EWh%Q*Bf*5Uy%4vv7nQUbBLaoNh$ip*Ymjj$R^@7@J*y$Ue1wy@0!7
z5F8pZkkbgIQV3sm`;Nld@))G}v7PU29imCT`eJ`h#)}8wYSZ$Mg6aP?@?+d4B5Mz4
zU}T-`ZPv;T)xJtqkCUZKAZVcCU4|MuTtjUFSL!~VaMDteOlO?L*Sa4urlTyq({#lz
z_{B~kGXlXTrjU0ulFVX>xWy{g-&0*`<G?vb=(;MF>c(G|JO^NIgxtWApc>)6H6mx%
z{b>R!mgN62a~eM|;$r%ZkxOQzpzq1)j2m{c5WJp)Qz6F>dqfk^^+p?hTLGKMiYKHE
zf4GU5+a7&%JCJ}tp{%>}870Sl<`1ku+0jtidH@)Pp<037hl^bBbO8c5+e5ts&;&EO
zjNpPdo)>ol+Bp9My?8JOL$rk8fGb>(v;pe4utP`$nD&2MajVsn9(j4DF6O<4X4R!^
zJMjJ`_PYLurG2$}f-+s~1i!-%nEi54OP=!J^Y0kj2kNgxp^6ijp69P^RF?HvF0>CT
zxWe|CtPfQTJXwsr8_vG?^f1`%k{W;cknYgi^K0#kmBU)9WM;;iwENh8cSnfDIh7_2
zY;^FLuqgjsbbdA|7!jfW2{=f=UpQVnh7g|E)qHG*vauyC=t*0gztsEnm~GA1#AmYA
z#9+U;GGAvxr#zBYZ}q6XagQl;LQ%bIpC>BpHu#FSN9K33yO+DJcj)l%qo}3r98nu4
zS9hbC=Ou^DIc%1^4f0Donpv&~w|eW1qfMXP7abi^rQI+7D#)*u-;U!<6O}mOv<#)G
zc=yi5u72Q5ZKUV)LO0Dd(CRWWj-+7xGMW@j(26*BweH0Y?nNW&ufWo|Gh{HZ&%?Jr
z@)>z<c0J})CHTCu&Gb8a{1I8n8*|a=*9zx3W9z}11A0oshQvV<5~`d<{fHs)R~t|+
zVRy^gE8T%xwHY`JN;Ko;ZJ#;zeBbXJ7epX|)b0J^-`)2#3Jmjaga0(U@}0Hmi|h42
z2wx=#HUE@tqUI2tDKW3qk7O?gCZ-?M47Vh0UPd2sI;VJA=f2cr<GQvrOl;D1WVcwu
zZGlSwl(!28lR7D%u1%zc=Rn6yr~)}EDF8;XcBo}F*_JhoJ>;^?F=s(9f|3n(MVVPU
z>OAqb{)g}8j0@kUWZ_O!nmzsi8Lu_^(BgAIYPu@hohB3)VTEwqAx8Ev=H-Phj9n-8
z0K%h8S2flZff#Ey(7~UF>hYUmy$C9L!?=3?BMt0f-u;6uEe#WUp@Xe!wT^cbucW?6
zlFTUexp=V0JEgXuzc(W^a<CXe&pxD3sEH5~7`<R`g1+MDLHrUT*JEL4cYED;sjy7u
z6MIM1qe05t%{zHZuzY!L!BcqG{C@mFoS%_nZbC_cOz^o#$JVCGho}*3APFydF;Q8W
zxQDU_2XAH*R3oeWUdOf_(*I#opby%uyuI2#@QP6i>FR>zF-rDThMG-Vs_Q2}g-a2`
z`t%W4n+jA&YB1b6p5$iARf!xn4;MB+Xl1pP6nGOs-AA_eMHW7l@uj{)n^-%STYmK7
zCGk-)<!W;D8%jfKmF@DKJ$pI`ImTJ{Sh3D&@lZ-)KU;(zeo%i}s?As>-3f&_2y2|l
za%iag&@&BbMqgnf9MF%metD!Se$tz;z$5yWFgE>Z1~_40zUY14yl|KL`tnM*qxf$^
z*sn%I$(j^&Uligm{rG<2N{xwoH_!Vd=AMw2yT@geP)xJJ$WgbP9n+xBdPQaICZ?8Z
z6`5oUbGnLVb@$~X$248ro*ECd8xD$tOGmFgST2p6H=BI>(j00n(1Wmg^5(jI2f=Xi
zBa0BArZDloX{jpbpL7DPj%&Ihz&UYL=Xt{IkN%u<q)AV$F-H-9Nvr@vdpFpS2chkE
zy(-8u^jlPp{8)}ix@tG4P1hbfBhI$_QQyc}06*p%9lZ0J8S$h0JCP-V64aeg&9}q8
zk4Xbp!&MssvRIC~<9&~8uD*IT*M#YM0qr|^;5<)OZ@UPsWIbp9%~8*<KHlC`_q;nU
zSl6DvBo(On!=%FfIZy->7H`%CeKBYVIhqi1X`<39t~af?+1k~;fhn$M^pKjk_#;V2
zIc8Yhj~#o)_k@QGO@dA0*GUIb1wgMRj7p7-@HL&7YUjt#=sVn<<^?}u>z9)`6~9G+
zEuUyxp_{MH&Wl$ucJ0uWovfQ<{uV*!K_V61ar_T^3CzIqdx5C}roqZE(`(nYG3D_G
zGB`nuj@+XaBuw(8HhE8)IE-O0%c}9N%R6qjFSUo?lGAvocWFPYFcR-V(p|ieZ#-9A
zkR{Ug@qI(<*VJ5L6Q;1BO|oD7cMMl-7j>ze^anAE@hsyxgEzrK&56jf*CD_hyr}d+
zb?Eh^d#ex`TUpi9!sr77SXn4DqrA9k6Twm}rU{Zg7=Tx2FYW@&W&w(Ht+KFl+>;YJ
zbv_umR&1kqu^`&M@i^p1*k@NBvR2dw=2Q-y3?P4DIQR>ic<9B5m#kq9DM8vQgp8GK
z>^>-vv)w?)J-<$q1n4VLXV&~ty{1ubPhA&;w!3JRE9c7^*T+zWuTkMuQqTUJz121N
zQtMZeZ20`t7uoRq(1bO;ldC3)j%vQ@FJ9alLKh}XllxRlz}Sa-_*{fr5H{(B5N#1$
zxsX&_h0F&Bv{Wa<Mpz5i>vlmG%a!cB@`BTJp4Tagrg%`e=hgG!PaP;hnaa(RW)6G@
zyY`F8Id2o0#1j*}!7-(vFy+;b2MaBeDw1!%&l30C^^=zfUK8s?d^0Z(r0WP@M!v0L
zGTg-D3IO^C1EERLWaKr356!p|_xD4yfxwe;y=Kfeky!n+Al=+^qTqHK;1gimv0ohJ
ztUGnB^wZ%d?_&vqVPC+lh~gTsdSm_bfYn|5_Op!ICy577uy;*!1u<c{upjR2qQqCV
zDHUFq<nA=y)}KsZz4_3WgNu-S@Lu8-LCj5F7V;kHzEIxacq7m67r6jQn_=~;PjmCq
zjq%D&IWlbR<a@Zsu%}ILkB8SYkYWSr-|PBz#Qdrg?C2}7i?ILFkNA4bqx}|?u@H-@
zyD&xlh9XD0?|NZT8e5l1nkH)l2#$3<F06kJkb2CM0DCrwP(x9vfLZH$99ZIfK<k(%
z9u|aO=tm_ggR&bCN^DmikbO)N2D2DKXrYJ{K*5dwx#~sPupP1A)3+zC{@qyG2J%3d
zw0WaO7OeU4;eEECf+_u6b5hIj{bc1|BM;amh0^nk+DmS!bIRX{Y`Hr0EY1nR#%4~M
zEw20vASUB~n0)k<oZXW{AtNE?hG*;^h|K6Wo)VQyso1`NJ*u!eHJF?9E;>0XsXDz`
zz=jhfl*5erWS8i32_-H<p9wG=B$MA?L<GGp6%y*7@1<w~{7pm`p=<)pK*`UUc0wQf
zy3xO13jgyGy%Y2$q@?WHK{E6G$n)--5&L>#Z{K_gb*+G9b{^>rkE*7pnpGDj+p5XL
zOxleWkYlUf8Oool@Aih?1S8LRBJM9BQhz=kcJH7EXWmbpB_FL>@VpZ+n+8vjn{@Bo
zU~i(HME_*4<b}YoeDHTulb^>W1<vikhCv`q@Z<9w#anmIZjh#>M5H_&PBv}+<P(Lv
z8q~T7f93O5H_z`boW_qF_bm?2&_8bIHTT2n`}r;cBfGdi3*Saq>`VlxO74`m1BL_p
z)A@}!!P`gJQMjW+avAm{_Qwr!1jm<WOToA}5T%{fg1F!jZM-!RQP6vWq#q~w`2KJj
z6jTzLnNQIcZyT+3SDhOm*Lc)W+UA2igm@A84c=$qXayFbLIO>I{>f&6+RrxQLUeWs
zyH&o@6r=%NoX>a^+@79bGn_ZVcdEy}au1GWfZty4wI7uyZ{HdQ=Mk`bpPHnqutBfV
zoun0mNG<!;Ox5Dshm^n4#kqLgsSclNbl-eS1#grP*J}m>GPqTnJ{^QG;{>k@VH92?
zE8h<wh39b1FKLvRE5e16kVru9OrmZ3$Ja0r7YSZJJ^jJP+<zeiKM1vqs1w0bZQX*O
z2pIyg>p%8BW*lK<mJ-q7>?SNO1HCE@Bk@?O@yPXjTig&yyF9*I@py&sz}cy9m5zz*
z%6M6x<`KTi8lp+*+(R5s*uAS1b!%EfbXMDh^1{<M6X{pJ*g}`Ja(;}cWbWpD;+L3B
z^*Wsl=^iVfyP4g8tGuK}WCq|?JH<KA0F-u23UeXUYiqpKo|S<l9|*HDbbD>Y>iX7N
zJ{=-i5a1n8J=1YuPw7{@XBlG$tH78UW4H{3vimENs{#zqp7<r@K2ReGK78b*6mzXw
zq+Gr=;pXvayt!gFz5n1GWRoyvZa!?Y=ZmRv&aAYqjdjm?c0ij_`Xy0)ddds2gH=wP
zSrywY-N$oeGhvdMTy**9Qx|R>M4n7&7);4QIG0B&U9LtbD%&j`ukNG=NEG&`*`-&w
zDg1}DaPD{Ri3x=@hw-A{X`qIBIoaN?8Jp_m=L{B{!74NUx&{JdzY35$8es}wsnv7T
zne|sB;a5A;$tVgA*FGXZ4|V=IG{)Q@VHo3D<<qk87^*jEQG54`mzGN!G`~O(b0P@e
z$B3Y<qjsAf)*&jKup-6PZKC~L%KJT#)iwdwmD1go^o3WcHa%1|Ja>xNU(kHIC$6zx
z>G=4b?KY!}9#u;X*$u}fBfq3puRB3Z0}nW84&t<k0OSmyo(9U;g>t;77E@^7EHHP{
zQ+aZhtQ)8)yP5Jdf9f~IOPP;?FD~Z@%pR?~+ZI|Gc``MMUn7q4q`md%A5UPH4Q)-U
zN(z>GR|;+y$-oz;KQ60Vol!-3U|cc2OM#uoirl%<)}wwH*v)X6IUAle=9(rQojzQy
zD$m2APPQxEKo`KZb*6V?+B#oqJC_k2Tgt3sr~AlNJMnidIQ*-;i5v-ZRk|3zdB8hX
zgQG1(+xaC4U8zxwEE~AdrW;Y&<;c|<<zHJFmIi7WlLa5%{Axi_nky5bb3vu&TjI!g
zFnZ%AWo(`Ax<I5vh7?v({>@hkAxscS+e^I3sy<vjE%jdVf;VZ0yjlGI@`TN{=<XxE
zH`aAmR%u!RMUy}f6;pj!QfIkq+dDic9NxG*MTT>(E*l;iSE!Ot`n`UD9Q9G+Bizd?
z9pTd%$Wi8d9`L@TODiW|kd-*Xd<AOx(k9UMlk9>pMqzIfcR`)_hTP-qe5-P@IK<ty
zUX99fy5N&WRWctE;L1vKfeNPE7{PZ2uvOxJfB|azXK=^6?RO1gZ#hs0f{R})Umie$
z<vd5!ZI7(QBQaq@5-;5CD!>8Ww^=_gM$@5<xF#aw#!6F#*BTD<ISaACS@LAoLLog%
zmE@+m(DI#dyYBF9D8^MTX1VDvzpb{fS6s4_S>5k}eTg&02_Sx!J>jBGDxVq$`l3ks
zzDO2MCTv$+O(3LNTeFtcd^RU5!F@HYj&&U1ndVYD#vW~TJb%Cx(`kHqUM!#aM^I87
znIr|9Uw^5BalBQJTQTMb-d;t(-;rcI3H&6C{R2Fv?*KNLwP|v*8P0hcsUCUd6mk-D
z*)C`qcS0L)9~di?YK;QcLB?C^@w<qdOQ@V7?QdeJ#tP*bp!Ar9>l8vN@3Fj8Dw31(
z^C6{EjjRZKP>cn@QNUCEuHe#?i;d@&+`ksJq*jfAmH9;vjp5l3th8R#*e4PzN$LzI
zS0%@)?Kq7)`roS?McSkHZ*7T<fsRC&+vsq+EaKD8(~_eyyU)s6yJBu)aZRSV=wfge
z@p{&V8w3}nd)MYj){Y>}`TMlDk0EX2;!lRIEt+dx>H4+-{TMv>yJ33x_@wpBg|=lu
z<$C79pfa!B&YX3W5+R1jtp3*A<Mm)-abOsz$<umrmjgcqU&Sa?1lLJ3xqF^5XZSzy
zKVv!^qO=nCSV(QVp};FcMe;e^;+s$voA+Qk>D!HiJ$n;)aOO}*_Z2jmM5B%cS3x`Q
z9v5^>iX4fpP3)tTp^i3KM0|^e`;|-@OJ;(Of0j!6fiiAf)6=d*7r2x3C1V571L}Wp
z4Pd%7OT)iG4wj*&F~rIGtw8;c`|D7dAnWNpFa@sA1Hb<aLq%9S3v4a$WcE+1he$_@
z(FvNt52#7pu{<kpE^CL|wg4@)O^MzGZN`L$y!o^b=w|@t+qnX$7WU~vG>Ijt(dFj;
zcerV_`KQw;m%I$b7gR1-*hJ(?a(f$r3znW*v+{&*HO6-6A{+%2WtwnL?cpHJ%Ux@?
z(|gx1!sULUuV2N8Nau?}H_auC_uuisPs|NRlD!R3D`$G&7ZW|$nVK1196%(K*msYR
zS#{H2jpRlA9PBQ(T!puvbg<wA{Y%e~1{$FFm8Dzq`U|pAw{xxJb-B@G(W~QthtnC8
z<i<ccdGy0I6{|y}!50&a$l~^KVCDlRMsP`mSb3sAIcNp%&pKw{&ne8{+4dHf3w$XL
zpV)BopR)9<oIx(eA9~l8_+hDN&fl1j9GB@oo^5T?7W!yw?NSYj=wA6KRsNzE;A%@6
z#I&-Az*&eFk*5#@%V;Xc<x;orhtg|vVVjZqtc$4P8~f<M%&#QJ5FAz9bmTXgGiyG$
zDIT5-g;(omNOUpPMiP|8?gaDW`r}?#IsCdMVu@z$0wMZVZX2q$SF{Fp*~SgZY~Jrm
zOiKsk$=<75z%9yeY{c@(5BM3DhbOt@q|E_01J*!C?QQ7Dc(7INBu|oTsn{=TNYu4+
zlGU8GzH%|z2_W{hVd8JMZij(O!L#XyE$)YO$6zQvSWB5l)aS<sgZd`bQ`_4_V-R#W
z{QA{3X`D0sx_LJ{$#==8KmWL77%WQeVuaiK=<$1<mocC2XuMhCss-;B%-n9qmn_Q=
z3ox2l``(wBHAn!@e|fBEd`UP(O?Ll>{`QGf&oAUL`{aXD)VmhIG;a$#TH;y&S9H>J
zFMi~BIxQ5r27Pv}Ne-v^OB{YqZoUHesP!E9E6_VH-g+M0R?o(UqX@ht!pE^8V6A`W
zjWPP^isiJDe0<RIp9}KnSN*QIE%h|XfDs?y?t}QCiSR)0IXV0mAsddEa}g24ilexu
zh@sMG0az3;>^CFMdA@{zvSH_{ckdtQiIc;FDDe@mz#_tt6-WFKPuZjeSdhn1>EOxz
z2?3k%!paK)uleB%-utf+K8Z}PKswQe<OqC{7k<$g^+P9yHRpASJaf*Zy+SMX3(Do&
z>oGCwIy!r*%qp`4l6hJLWCUFPNrVp!h*!_k<P<#~v0URwK2lcRzNmQ2)B9CQ$T+hD
z(1-;CnGcgSm!V%f0NJ}2-JFNXy30_O5X{QGi|&Vq$#>;(hoP7i$_v$-tndqYoO2k4
z{aP&ekrghXfTQs50AympFXi`e2Gd6T4*Y^;*Ri=5n8M6Zkyua~U&i7F#?{WV%FL4o
zt#IgkV(;9L{7%;R{VSh6=TqbcAh0^YR51Qs=tl6;HYkfzA;h=2f!-PmE*4>;rb%__
z?%{Gg{)$a>uNz)KoNo=a#$sLS*1S8<w{Gs{{OPE|I*q#eX;U+-oDP5gN|-;1X*Ehv
zvg!a1^#t*KQ=SE|Sy1Bd{mZwMIzE!%{6A=w^a25L5!(ZLG+jZ&HYS4*BI=9o_aFAJ
zSqT*TtQBl2KBi(JnYB65Gq&6Ef#&z=LoT{m@FIyjgK&^_#&yQKquF#j8W)&O@dt?w
z-j1#!lxb966QwXGjxRQGE0uwc#ecr2p22?Ij1<}E%y9JIUL~~0nuHj|=vaLZ$E@Hb
z{IC<fWh;MKm#{mopPKAx<2T?EvT$;=;9~udg=yH!+d+GO5|%PT%NF(LppZ7{#tnxU
zxJ3B8NhEVmsaDo*b=x2XzlHEQ3Dw<DO0HlbQEknM#EDarbA{D1aNsIwabe!ay_1EG
zD7v?OLtOh#Oq#wol$JjudicsE?aG?&{}wHO>*jr;_kr<iC!oAvjFaSZ3m?H&g<z|)
z%$k0P|74-@_mHU+FHXTvXOPiK{d4Xz+JIwbvX3uoA2!X0#=1D__eMn0y4&k}f640E
zYE##Tn!!`I_KSGtQPI4em{yLawaH@paL1Eyc^t7A>Alpv)G)f%CDDuSI5qEW^~w)!
zZzE0k1-ZNDqo@uyCRiw~ao_4@0xykm6zW_!iaI9vOa#`|#zN-@t#7lQu`|7>riEw9
zSg}w=7oF&rMS8_l={vdBW$qIrK?&F4P6CQPqJ4i@4<W>(e)K$QS+^+r)ZY{ke6dgW
z+(y8bp)Gkebki!!(Bna6oS9?ioxXu)4^&$@byhi{y~UfLJEql;K6B^=4-MW1@^+!&
zU`H<%Jg97-ZMJ+?d5~dBSnqjJpy`;bb~s~<;ZsW}G$*O(<^&(E{M{Y47fQL$qc9e~
zIxJm_)!_@~>LwKLrh4Gi@Km6S2}=b2M0GR9)pm3IxMzAI*=0^)I}B`}ax1z;VG^(5
zwMyp<S#ocU%=^9{3A)kIh9xeDTI=-=^|wB13)$?(XJlypwleU?7TqWpv&Ii?8Eg6y
z!P<F|8k4bAs1Z@S;YwjE@Wbb#8DmPtK1Nu+(iBHn&bg3!(Jh(W4fL#BGy4q6mY=QQ
z`*!>9z9C4b);e!+Oqn6+NOP*%)}eW71=G*&w*#+b(gF{?5oBIv;7wP`E|H7k!zJ-k
z2&BgVOXOZD&oDIuJ}YiPi}AMcYEFaXd2{Q~26(%XiGl(4WxGvAEEx9`=d5ywGmsw+
zjs^MOeEc|&3;r0Ag<E)5o$R4e$ih>db7{KZl3C5>g-{%~HE0Qc6pll!oEP^^@E;Yd
zK)>CjG`d$gRc;8aJzMfNm#HnC0D26b;80Ab6WxF^GhBk*6K>JHegZ{xN4!kqzYDyX
z0!|=FMfP9+1ft2Z*>{VXEI3i!ryP#@QCJZVf6>Kr5{MxD=f##!blMb0BmzG1j?{Rx
zy6G&rdvCM%^Xk#v?xBxmcxHd8>0UX#>s2)h5aBq&K>2%z$&L#MTpVf>zdcD;A<At|
zV~MhXw*p!tHIt*-Ib48<pqQ!J`(sE+%T8b!Sfkxy!qt}CWPnL@pV$}O=r{M7;5$s`
z!2>~M-|FlVZvAx6`zHtd&9dOcx9{gMd^qBjFI%d3pwYj59ZxrPcb75h#<AVrLdq7?
z00QqM$njt5=Am3_hX$V;mQVKnk#ASjxoSwd{69|ef6_6t!f!oWhGyEYBfQD1Dm1J_
zy*>64o)iD$%-^!XXX<8IkQP7kV*Z&0L=TWNOB!n)Zs^^aDIxlq$LvGT{&DgXe*iMs
z5m&k!^KRmvjw%lV{+R_1rEob7mOPzSO_C|BKV1GL1DgWQqNFOsEyg6qX!Y@)`0t4Y
z+(CRuk7Az{hv|!rZhVnqZzy+vpDikHN}oCSoK|x@IK3&LQZ>*`XII`?!ZW5jn@^j6
zqlSI?Rp5_mHcG|>qv)oqo=#AO1ZfXB#ssV7*B7{>$jh=+AIqutLQ7~1sS4!x*FqH<
zC7BK-4vMk@aGL9n;1=<U*s54NfQ0?d60JVNmGQBF;UuX?YD^NNk9vSlv06PqXqGlS
z{cQ3JH{4Hjum0$9GqE`?3oP(vh)hqPR}a-*o0iZJx#xg5tgqTq9hdR(u3md=#Q38A
z^+EkRy&s+nip6UTPnPm-A0?aKJ<=1k83Fhzsj;n1X*gDJ5MbyfJCZy@224@mp)5HV
zAKGv6PfC*dsGt435c_Sz!(cTQ*mQ8!f&1C;%DV>pDCy-q(*HupP{8Lo-028`F7_O)
zk9*%IIX+edb{Q{hkl_r<1#eC>mvokVQ0dDvHLepr@hqZ*8dmKE=6<nzyzw8YJWu*s
zDJt0|*^i#W(O$SLuM9j25=%$fp_+x_7ZA@$j9p)8GI{d+VCH<l*_TM+>uaA8FNhb;
zvmRh#8HshBjjwN}d4x-&<Yjv-eXqu3(%GrGGFmVlS^qUq((e6FXWh+rugTz7N)<|G
z=zqHIW|V3V0tjweTIKMy`iDkCwG^)acD`5x95<x2%VLLTK~_rRH>#tfXcda@Y6?iv
zh3IE;dp-Wi-N8i?UQ@d*0<Co!j<<M#+FCUL)UGb^PVq@uyw}7ymFkFlZCEZC2fLQ;
zwHb_X?>P>PedfdG*V@-elEg1_geWS<8<LTc7<}eGaX`cgDW5P>A@0D_74LPw>RmV?
z3^YS0!G4EynQ~gBfTRH_V0kBE*&*gP-)w}&k=Sl!UjQ-xi?<37kCTJrwzxbfJr*m~
z7CQ?(Zgi_xMkPHTVlB88OhowQzWs-s1NsqawaX%qnz=)YJ;-_Ur`vav)^n0#!y5US
zU`2wYraQr~sbAi6&i}Eg{`eG(X9rPRY-VpVh*JHT#oGBr{6_OLW?g!x*z5Ag5S4Qw
zVHKJi0{}%ApHjJk)F|6?;h@cqosa_vYdy1%9GN9sd|%Or*2)Y{S~a?d2YR~kc9;i3
zZ<aF6aVpoqQ;gukQFkm(Hc&w#5a%zn931j(`yp$x^U>%g=5`YAl#k9-j+y>JLV^Z&
zI7`*Xp>X!-DTCjh2GBNOAD^0$2tBWuvE(x0T_fzc8+J80<7ZU;W?qEwxt&s`dIMP0
zf9I_Fk;fnA>MLGkG`j_X4O7t<INac)$vrW*EHrvO-JOnE?0wefH+ZX>N6s=SoZ||g
z!yjQy1+hU{508<@mX}ZeP<e&p7OB$;7Z4TqR?}lNmAg3^W49x7t9c9__W^~ocQk#f
zajx+9&kmJ4#%`6%;`fc_5v{Nev+4jdM24iL8<APAw%iIQ@dvIBB?%I=Ii}TX<5W+V
z36K~&>qn7b$u3(iipNFHcT&IzN#zi5(+dv8<{v<0^KZhb?oXS*V#myErNj-TaA^-7
zr3rsu(ZAqsRCK){IZ83OLG6+P=W38VZhn&&zKs73uZhCUL%H+kJnnD2)2t3za2z?h
z$+z;lt^m~6G|+sc{`uq38QDd+VmpF$7Vtc~Y{4Ynq&<S@L(VS03fyAYdc7Z48sM`B
z?X4mZ9{wJ13~_VD@(ckfh9AWt{_?+)m`xwd0yWHD#6oFlE*`Sgy#Ra+kis~u)9pZ`
z(r-2^*2FG55}XbJBEc>t$!78w%lgBa2asqbt2R_|^+osj!?;C+7w%G}M&aYU8ZHg)
zQGOf%=BY5phSF&nw)pitL6OA9tTN4hTY&0!$ldA^F_9Zm_zntxvva3UE61N!*Yv}B
z_`7eZHooj|%@1!ulVo3$px%Mv0zI#fGCmWj(ScJvItW@cL$WlZBiFX^uFb0)44Em6
zAmiXt3jAOeN}p8p@p{RNI<GHh%wpjW|2*3!8)@R-dAKvW7^7znkUbT{+<&D^gU;yf
zl8}jH61&Tn-DwNAd3<c8;oeQux%T@-ALlRKUcjc{3Ov^JT?TTj+;OHhh;Q8NSYg-R
zyPo(?V;#`}MvsSg|2H@v(WLF!K41UGs8<R4nBgJ;7suJOk3qf{)@=p`*k~0cetw4V
z{VK~p#jx;B^!ZouUD@$FiejpHXoI!3{!EQXrZrq{;wd5lDfSSlFe)kA3!bmJjEYO-
zRf3}W40c8V%g~D<^x_AGiAQJnR34_kVM}!@%{B@jYd0~hZEt#XIbz;4JQc;RLuapI
zUIvzoGf7;00<$<IWUsM3Mrzsz(oE8tQo$kHX--Hl+vq2B9kZN;oa(>`>=it;&vERU
z`?m|8Ui@ZAd0DWMm*Y-&i0VEoslcthUh5>a(3|ju75eg{g~P1b_w_sJTL8-W4yA+$
zHpp`Fbrd!6PI@Uk-L|32KgQE~#m&wmv^j-5G<j%gavOUDP60kx?p37~hxI2*v8~zc
z=d>%(>!gw|%#Yg~i_ImU#gBJ;eb2=;CBv4K9(btOR{{#dXSl`3SvO2>|JHn~^K^Jp
zU4m;XO}-+x?M`6ri*0h8*;)4M$Es0f>4Z;gzm_wOJ*>JDbqC6tIj<oC&riLMRR~CT
zu!(j3k#uB(%1rJa);SY)KE+gxBg~xSF|Dj2sy9?0MjYtP-sTJR*OseFxfgT4-ZOzw
z9=_77B5`0LIKjwJF$C1#I8Y)P2}F<JVxE|4Fxx_oTBYyY?X^yBKUYON-@T*snTrDx
zm3z#LB4K(g^DEsJry}Hv=8;nSBGuk0qkM+E1BNx=w>_ZQZtJ-@*RANYAGsXT<#N&g
zS$@yI(Q>Y;5?8B}+sFBy6Gw~qW(6-S5*F+wV`QH54r}^`$tUBA$O^556MSx!7~n!>
zm}q_n<EDyM5yD4IsIBeY5k5<c0YDu_C1iIIZeT{C__lDsTPqLLqKK+88VWsu&^}+j
zYI@}3x9u(!4$6@BD&ZH`G=@aIqT+fY$wzUl!pZmfy8xqzWe3h#pmXQNkzU#b8TJGo
zgI`Azj4*c!z;O%0Wrl$1(Yo1ll4XjEFZ#n}ArJLt)e^xUKiPqCCWhhf<$H|p&+=U?
z)ZvXE#Kk9p=~l+56Fq0CQB0y`4?x3yfJ^i2;cT}YJ4VJk1~Rz5tKoMbkILZA<btm#
zI(CxSxTX0*@Hpv@@1bR*8e+SY&N_B{)(|EP(O5sJuSq{bzml+GTQSrwnh79kW|aCF
zxMm<W2He`kvm1twqY_%s;T5JmGRs}mI+I@RL~%6*z{x>=;RAw+0IxyZkcHq_bFw~s
zAwrqKM#-HEu5|Lb>{9}G1lfgkD4hm(D=oyZ6iP-PLq5xM%A@S0lRI7Lyq7SE%YSJS
z<Va6ZxdEJJKx2K?rHpbl+=8_2n7kb>HO+8ctgDEKI70X@^&_;y+$_A|cI%VIo;SJG
z4!|^01V(YBNBtLj!sp!rLtz&@<SC$F*hRNM$OX^m|EvFwY$4*z^FrhPr9HBNh>WLa
zQ+Jsd&&NlSz_^sT(N{laQgbbNrfn`RLLGU^XR(A~ti&PmJ7Hnhoe1!NIq?HJ&R6d|
zy)x}bLa<2K^R|<W<hs<A)R}d3o|4C@eTHD{s&|F?+Ld{P+WHp43c}2(F$TdA{sB@4
zhJn*93{gjL_&LeE)cKb5#s+ln55M5m?f_1lWjgUcg_;41arTY?u<YMT%>V&Dc><gr
zpHo2&pELoJNODd>ice9nug5<R6~N~y_yhd%1^?XrtI!JJf2~l+{ShF3wJFF_=MVWv
zuZsc1k@tLyz7e?lC<}k)lxf%VK$G;9F`q_O?GvbT4y=A!h+R&}AMC>eos&0T6yq@a
zPZ^LCv8GjSb>;0m<~-R8zATiU@Y!O?emA}TY)P^1tNpo4Vh#}zt(`RAPE%!qNwJI=
z*H81%ko!GAd_P(1T4#Sj>hJ1HkH<Ixeo^CR)q93vM<uRhzXW%e5JQ;cCnq}cgvF<u
z->5k)J1XqI^4;0jd-YFsvL3_5Rx(sALlw#Fryw@j?6cKbPu^OrMRwhX{bUEmu!3TR
z%}kaRn*UORjbkuI@wZ%Iad=K*BoS8+HHsr8aelKac?NsomY*&JUD$hne#E`oRdYDZ
zDE$)=O})J)maE<6V^D$dtBVfzy*4T&S6ZdX<IP*O!ZqP)Y5kKfa(#GTkNYo{x&ZZU
z#43^_OR_MJej_Djv-0sPFOQAZQ(UoA;f4blZqn%Y22N+%?c{K5a?7i*FBkiy8cR3#
zRV`^lkd<2Vl61nq`-r)E!mjnSQ_I6!W*&-<HqJ>{@!Oojr^uir10#mX0G;#~s;;GX
zMkg45H+ZE-X12@8y1x1nJtEzv8AQaW#WC$2w9_0?>zLp-OLN$1Hd1w=t?A_ciQ5ZL
zjN+Um@P5N(+Rsx8I>fhy!&<|w(oK8v2ITrMGq4amI_!Bc`t8T_(Fw2#)%7t|us@kR
zo(-E%8bq_ymiIu~JgK^r^qt-*y)US91^%o>3-@j6l+5+w6BkJJl1hU~dnek)U2QmB
zfal1JF2Tx_mh1$7I+gt~4rOz>Z-8E*TX-KZ1@DLf_hY&`kV!dxq!Z3<z&Q`YKIG;j
z%n6+nITe5ADNFR`AqQ^=CjVFJrsof1Jy$n4$F#{vEa-y$1X>Sr%5~){Mr`)i3NG*6
z6boEHy!eCH*A%dTZwV@Lj{&DsNH~ef*F7|Ich&H2I;ye2<dX=?D}7pq-YSJ(wz{64
z^E}*#$dfKX*V@s^xv5CjX%J({sB&~Vit=`foUtT&NhN-Y+^#xhMWgND5QiqL-lJbX
zDN)xRx~7fhSbb`GXX-xI6=v0~JM);OzW0XnJR<NP79I%rU_L3DnEL9X<nI3pq)Rlo
z_LI!|1gRmHg~J_Yrj$2?<ut$skhwL3L)UHe@GLzM8RA>?T4BJIiysGpaeoQb5jRA=
zSm`?}Z6JxfxP~%s1lDfi{6n5$*g0;)WmfbzuX|$Q`+5|3jho-oBg8wCKY+<i3=uws
z#1*(73qG|8u8RmmgwOGT2g!%*L+%s8@gB$MzgY;FsFR!dnay=)N$^M8)HV4ld?B*m
zp7&A`Re6W}Ibc0{tmE{0@HwNoxg7i0b&7_|gB=ZTPH1(SaK91?rZatxGOpf^XW+>P
zv<ILec=Swc7#{kX9*=IUM|n)LxDLT5C&~iuDuMW<Iz(81aXj!Yf@>Ypf=Bg+Dd2&d
z@wb_ed5BR&PRAtptU&)eBw}dFfx55e!}OVMqfZ1<U&2kjykFyq-b4lU_+o9z)Yk@H
zK}FZB5_zH2-Qkk2?e&rpg}=KWk!?L0Y3G2T^G{rTyp=&bpSeH>DH8G1Nz(_r={2<T
zPA@4xA>$r4t-w4V#>eE^cRQO9OB@Yj5z+@wdwI~Zpv=bC)akk7v+iX3(oz!aVJE)#
zk$-=`)5{Yq3pRYOow?|3$HDRgl3_OnP!{g@kfIp#{LJ`d@9<f%Om|p8B=zLp@D}=8
zsa3xitq4A|lv56#i&4az_+L^p2!-13lSV!}d&&JL0rz+Y<mHY&yA#KkWa0rK!H=_U
zu88J)ziVNmGnOT$>6>_5QY<YGzSmmVNwL%$dwN*jJv}7FyVZQyguMAiIYY0pN2z3n
za%Qs3?FwB@-CFxbe3ttiB9w^jF-dARYE(4!rz6(l486^|xr42()gT$(R!=WEc#|&1
zcLJN>DVZyEx#J6qq{hmwf&l#Ftb5bU96Yl#2zT=-<-lylLDgChqd^yEb-pvz?u&Dh
zW4o4h2=Vm`jGf+k@^#CfLQrWid*`(S$m=RP5?LVD3Y*Am{BW8D<SKwMG;2q}B;M%4
zoluxf(vv51!_X&r6t5h%^=cVz{VSC*MBVm5vopA@v;G1c(!K9i{}t#yL(cML>TDui
zdLhnu=4i08mRYb)xuwZ(<4}gOp*+~=(7hye+MO+A&?{?sdrt#kJJ~W8I)FI%ThP!6
zP`ds~i!7+<hab50v;OM#=7sTHZsz+a5#nPK8r&sbgZ=*(G#HWj*XeWu0s_J;T**m!
z09}GFE!+<@J`ewY@uvyKkSj`hRqK9I2lJ$F`+$(=`etMB`hbb_TfSckeUs|)pPvR;
z9Qe3<VCpLdptBngJi_!kWbc^dc#HQqT*n*yX%|>lVmR-CQYiWjpczf=(VG80=%T^|
z%GuTZmNp>yr?5B1ckY{`Vc6?YUjgARY?sWiSGd5psRSG$!vNG^1!jS)e4KQX&4AGm
zb@TWsXdR1wnYMRJ(KYkxn*r$LGAwa*O|sErY>j>37B(kQ;wsf~`0hGH>lwI?cM<=C
z2PE9v&86unX^YmtIkzg?`zEa1^Q#9<ey<zV$i0{diI2nGj!C%i%?v`b@J%a$zJ%Bu
z2JHXphjgpkzEerCgE1Vb@6>7rd;_B7P3AkLaWMq#JEbRZSI3$)RG%IDT{-(cw@tqe
zsq%eHa7MYA4-mY?16NSsae+hea29x+>!++(LS}r1uNXXZ#&bM`^n?G-=VPLdn>XT~
U60S7hb&5b)K|{V&*2Mom0nOr+O8@`>

literal 0
HcmV?d00001


From d9b3849454e04c1f498c12e29b8c19660cbae328 Mon Sep 17 00:00:00 2001
From: wackbyte <wackbyte@pm.me>
Date: Sun, 28 Jan 2024 07:36:44 -0500
Subject: [PATCH 14/17] Fix inconsistent naming of OAuth 2.0 `ENABLE` setting
 (#28951)

Renames it to `ENABLED` to be consistent with other settings and
deprecates it.

I believe this change is necessary because other setting groups such as
`attachment`, `cors`, `mailer`, etc. have an `ENABLED` setting, but
`oauth2` is the only one with an `ENABLE` setting, which could cause
confusion for users.

This is no longer a breaking change because `ENABLE` has been set as
deprecated and as an alias to `ENABLED`.
---
 custom/conf/app.example.ini                   |  2 +-
 .../config-cheat-sheet.en-us.md               |  2 +-
 .../config-cheat-sheet.zh-cn.md               |  2 +-
 modules/setting/oauth2.go                     | 19 +++++++++++++------
 routers/web/user/setting/applications.go      |  4 ++--
 routers/web/web.go                            | 10 +++++-----
 6 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index b0875123b7b8b..7032e709dbc04 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -524,7 +524,7 @@ INTERNAL_TOKEN=
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Enables OAuth2 provider
-ENABLE = true
+ENABLED = true
 ;;
 ;; Algorithm used to sign OAuth2 tokens. Valid values: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, EdDSA
 ;JWT_SIGNING_ALGORITHM = RS256
diff --git a/docs/content/administration/config-cheat-sheet.en-us.md b/docs/content/administration/config-cheat-sheet.en-us.md
index eb9b8d1ae9a43..33732d080bff5 100644
--- a/docs/content/administration/config-cheat-sheet.en-us.md
+++ b/docs/content/administration/config-cheat-sheet.en-us.md
@@ -1107,7 +1107,7 @@ This section only does "set" config, a removed config key from this section won'
 
 ## OAuth2 (`oauth2`)
 
-- `ENABLE`: **true**: Enables OAuth2 provider.
+- `ENABLED`: **true**: Enables OAuth2 provider.
 - `ACCESS_TOKEN_EXPIRATION_TIME`: **3600**: Lifetime of an OAuth2 access token in seconds
 - `REFRESH_TOKEN_EXPIRATION_TIME`: **730**: Lifetime of an OAuth2 refresh token in hours
 - `INVALIDATE_REFRESH_TOKENS`: **false**: Check if refresh token has already been used
diff --git a/docs/content/administration/config-cheat-sheet.zh-cn.md b/docs/content/administration/config-cheat-sheet.zh-cn.md
index 415cba14edced..2cee70daabe98 100644
--- a/docs/content/administration/config-cheat-sheet.zh-cn.md
+++ b/docs/content/administration/config-cheat-sheet.zh-cn.md
@@ -1043,7 +1043,7 @@ Gitea 创建以下非唯一队列：
 
 ## OAuth2 (`oauth2`)
 
-- `ENABLE`: **true**：启用OAuth2提供者。
+- `ENABLED`: **true**：启用OAuth2提供者。
 - `ACCESS_TOKEN_EXPIRATION_TIME`：**3600**：OAuth2访问令牌的生命周期，以秒为单位。
 - `REFRESH_TOKEN_EXPIRATION_TIME`：**730**：OAuth2刷新令牌的生命周期，以小时为单位。
 - `INVALIDATE_REFRESH_TOKENS`：**false**：检查刷新令牌是否已被使用。
diff --git a/modules/setting/oauth2.go b/modules/setting/oauth2.go
index 10cadf03dd32b..0d15e91ef0d6c 100644
--- a/modules/setting/oauth2.go
+++ b/modules/setting/oauth2.go
@@ -93,7 +93,7 @@ func parseScopes(sec ConfigSection, name string) []string {
 }
 
 var OAuth2 = struct {
-	Enable                     bool
+	Enabled                    bool
 	AccessTokenExpirationTime  int64
 	RefreshTokenExpirationTime int64
 	InvalidateRefreshTokens    bool
@@ -103,7 +103,7 @@ var OAuth2 = struct {
 	MaxTokenLength             int
 	DefaultApplications        []string
 }{
-	Enable:                     true,
+	Enabled:                    true,
 	AccessTokenExpirationTime:  3600,
 	RefreshTokenExpirationTime: 730,
 	InvalidateRefreshTokens:    false,
@@ -114,16 +114,23 @@ var OAuth2 = struct {
 }
 
 func loadOAuth2From(rootCfg ConfigProvider) {
-	if err := rootCfg.Section("oauth2").MapTo(&OAuth2); err != nil {
-		log.Fatal("Failed to OAuth2 settings: %v", err)
+	sec := rootCfg.Section("oauth2")
+	if err := sec.MapTo(&OAuth2); err != nil {
+		log.Fatal("Failed to map OAuth2 settings: %v", err)
 		return
 	}
 
-	if !OAuth2.Enable {
+	// Handle the rename of ENABLE to ENABLED
+	deprecatedSetting(rootCfg, "oauth2", "ENABLE", "oauth2", "ENABLED", "v1.23.0")
+	if sec.HasKey("ENABLE") && !sec.HasKey("ENABLED") {
+		OAuth2.Enabled = sec.Key("ENABLE").MustBool(OAuth2.Enabled)
+	}
+
+	if !OAuth2.Enabled {
 		return
 	}
 
-	OAuth2.JWTSecretBase64 = loadSecret(rootCfg.Section("oauth2"), "JWT_SECRET_URI", "JWT_SECRET")
+	OAuth2.JWTSecretBase64 = loadSecret(sec, "JWT_SECRET_URI", "JWT_SECRET")
 
 	if !filepath.IsAbs(OAuth2.JWTSigningPrivateKeyFile) {
 		OAuth2.JWTSigningPrivateKeyFile = filepath.Join(AppDataPath, OAuth2.JWTSigningPrivateKeyFile)
diff --git a/routers/web/user/setting/applications.go b/routers/web/user/setting/applications.go
index 69a93dbf03ae0..a7e31fd505181 100644
--- a/routers/web/user/setting/applications.go
+++ b/routers/web/user/setting/applications.go
@@ -95,9 +95,9 @@ func loadApplicationsData(ctx *context.Context) {
 		return
 	}
 	ctx.Data["Tokens"] = tokens
-	ctx.Data["EnableOAuth2"] = setting.OAuth2.Enable
+	ctx.Data["EnableOAuth2"] = setting.OAuth2.Enabled
 	ctx.Data["IsAdmin"] = ctx.Doer.IsAdmin
-	if setting.OAuth2.Enable {
+	if setting.OAuth2.Enabled {
 		ctx.Data["Applications"], err = db.Find[auth_model.OAuth2Application](ctx, auth_model.FindOAuth2ApplicationsOptions{
 			OwnerID: ctx.Doer.ID,
 		})
diff --git a/routers/web/web.go b/routers/web/web.go
index ff0ce0c2586bb..92cf5132b45b6 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -304,7 +304,7 @@ func registerRoutes(m *web.Route) {
 	validation.AddBindingRules()
 
 	linkAccountEnabled := func(ctx *context.Context) {
-		if !setting.Service.EnableOpenIDSignIn && !setting.Service.EnableOpenIDSignUp && !setting.OAuth2.Enable {
+		if !setting.Service.EnableOpenIDSignIn && !setting.Service.EnableOpenIDSignUp && !setting.OAuth2.Enabled {
 			ctx.Error(http.StatusForbidden)
 			return
 		}
@@ -768,7 +768,7 @@ func registerRoutes(m *web.Route) {
 				m.Post("/delete", admin.DeleteApplication)
 			})
 		}, func(ctx *context.Context) {
-			if !setting.OAuth2.Enable {
+			if !setting.OAuth2.Enabled {
 				ctx.Error(http.StatusForbidden)
 				return
 			}
@@ -779,7 +779,7 @@ func registerRoutes(m *web.Route) {
 			addSettingsRunnersRoutes()
 			addSettingsVariablesRoutes()
 		})
-	}, adminReq, ctxDataSet("EnableOAuth2", setting.OAuth2.Enable, "EnablePackages", setting.Packages.Enabled))
+	}, adminReq, ctxDataSet("EnableOAuth2", setting.OAuth2.Enabled, "EnablePackages", setting.Packages.Enabled))
 	// ***** END: Admin *****
 
 	m.Group("", func() {
@@ -891,7 +891,7 @@ func registerRoutes(m *web.Route) {
 						m.Post("/delete", org.DeleteOAuth2Application)
 					})
 				}, func(ctx *context.Context) {
-					if !setting.OAuth2.Enable {
+					if !setting.OAuth2.Enabled {
 						ctx.Error(http.StatusForbidden)
 						return
 					}
@@ -943,7 +943,7 @@ func registerRoutes(m *web.Route) {
 						m.Post("/rebuild", org.RebuildCargoIndex)
 					})
 				}, packagesEnabled)
-			}, ctxDataSet("EnableOAuth2", setting.OAuth2.Enable, "EnablePackages", setting.Packages.Enabled, "PageIsOrgSettings", true))
+			}, ctxDataSet("EnableOAuth2", setting.OAuth2.Enabled, "EnablePackages", setting.Packages.Enabled, "PageIsOrgSettings", true))
 		}, context.OrgAssignment(true, true))
 	}, reqSignIn)
 	// ***** END: Organization *****

From dfc1ae15b6a15aaa8487b770b2d2f7b36e171c5e Mon Sep 17 00:00:00 2001
From: Arnaud Morin <arnaud.morin@gmail.com>
Date: Sun, 28 Jan 2024 15:58:00 +0100
Subject: [PATCH 15/17] Fixing small space missing in sample config file
 (#28967)

---
 custom/conf/app.example.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index 7032e709dbc04..363bbcb15133a 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -431,7 +431,7 @@ SECRET_KEY =
 ;SECRET_KEY_URI = file:/etc/gitea/secret_key
 ;;
 ;; Secret used to validate communication within Gitea binary.
-INTERNAL_TOKEN=
+INTERNAL_TOKEN =
 ;;
 ;; Alternative location to specify internal token, instead of this file; you cannot specify both this and INTERNAL_TOKEN, and must pick one
 ;INTERNAL_TOKEN_URI = file:/etc/gitea/internal_token

From 34633d85f18ff77643302302379078128dd4ddb7 Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Mon, 29 Jan 2024 04:18:15 +0800
Subject: [PATCH 16/17] Fix bug for generated repository object format (#28969)

A repository generated from a template repository should have the same
git ObjectFormat.
---
 modules/repository/generate.go | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/modules/repository/generate.go b/modules/repository/generate.go
index b32c4e058e503..013dd8f76f49f 100644
--- a/modules/repository/generate.go
+++ b/modules/repository/generate.go
@@ -224,8 +224,7 @@ func generateRepoCommit(ctx context.Context, repo, templateRepo, generateRepo *r
 		}
 	}
 
-	// FIXME: fix the hash
-	if err := git.InitRepository(ctx, tmpDir, false, git.Sha1ObjectFormat.Name()); err != nil {
+	if err := git.InitRepository(ctx, tmpDir, false, templateRepo.ObjectFormatName); err != nil {
 		return err
 	}
 
@@ -327,18 +326,19 @@ func (gro GenerateRepoOptions) IsValid() bool {
 // GenerateRepository generates a repository from a template
 func GenerateRepository(ctx context.Context, doer, owner *user_model.User, templateRepo *repo_model.Repository, opts GenerateRepoOptions) (_ *repo_model.Repository, err error) {
 	generateRepo := &repo_model.Repository{
-		OwnerID:       owner.ID,
-		Owner:         owner,
-		OwnerName:     owner.Name,
-		Name:          opts.Name,
-		LowerName:     strings.ToLower(opts.Name),
-		Description:   opts.Description,
-		DefaultBranch: opts.DefaultBranch,
-		IsPrivate:     opts.Private,
-		IsEmpty:       !opts.GitContent || templateRepo.IsEmpty,
-		IsFsckEnabled: templateRepo.IsFsckEnabled,
-		TemplateID:    templateRepo.ID,
-		TrustModel:    templateRepo.TrustModel,
+		OwnerID:          owner.ID,
+		Owner:            owner,
+		OwnerName:        owner.Name,
+		Name:             opts.Name,
+		LowerName:        strings.ToLower(opts.Name),
+		Description:      opts.Description,
+		DefaultBranch:    opts.DefaultBranch,
+		IsPrivate:        opts.Private,
+		IsEmpty:          !opts.GitContent || templateRepo.IsEmpty,
+		IsFsckEnabled:    templateRepo.IsFsckEnabled,
+		TemplateID:       templateRepo.ID,
+		TrustModel:       templateRepo.TrustModel,
+		ObjectFormatName: templateRepo.ObjectFormatName,
 	}
 
 	if err = CreateRepositoryByExample(ctx, doer, owner, generateRepo, false, false); err != nil {
@@ -358,8 +358,7 @@ func GenerateRepository(ctx context.Context, doer, owner *user_model.User, templ
 		}
 	}
 
-	// FIXME - fix the hash
-	if err = CheckInitRepository(ctx, owner.Name, generateRepo.Name, git.Sha1ObjectFormat.Name()); err != nil {
+	if err = CheckInitRepository(ctx, owner.Name, generateRepo.Name, generateRepo.ObjectFormatName); err != nil {
 		return generateRepo, err
 	}
 

From 2a50d780f93957223da9494c61bb3181ffa7ff65 Mon Sep 17 00:00:00 2001
From: GiteaBot <teabot@gitea.io>
Date: Mon, 29 Jan 2024 00:24:21 +0000
Subject: [PATCH 17/17] [skip ci] Updated licenses and gitignores

---
 options/license/fmt-exception | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 options/license/fmt-exception

diff --git a/options/license/fmt-exception b/options/license/fmt-exception
new file mode 100644
index 0000000000000..6036f7d360a53
--- /dev/null
+++ b/options/license/fmt-exception
@@ -0,0 +1,6 @@
+--- Optional exception to the license ---
+
+As an exception, if, as a result of your compiling your source code, portions
+of this Software are embedded into a machine-executable object form of such
+source code, you may redistribute such embedded portions in such object form
+without including the above copyright and permission notices.