From: Junio C Hamano <gitster@pobox.com>
Date: Thu, 01 Sep 2011 18:39:22 GMT
Subject: Re: Dropping '+' from fetch = +refs/heads/*:refs/remotes/origin/*?
Message-ID: <7vhb4ww1id.fsf@alter.siamese.dyndns.org>
In-Reply-To: <7vliu8w25g.fsf@alter.siamese.dyndns.org>

Junio C Hamano <gitster@pobox.com> writes:

> Suggested reading:
>
>   http://git-blame.blogspot.com/2011/08/how-to-inject-malicious-commit-to-git.html
>
> I am wondering if we are better off applying something along the lines of
> this patch, so that with the default configuration, users can notice if
> their upstream unexpectedly rewound their branches.
>
> It would produce
>
> 	[remote]
>         	url = git://.../git.git/
>                 fetch = refs/heads/*:refs/remotes/origin/*
>
> upon cloning from my repository, and your "git fetch" will fail because
> the pu (proposed updates) branch is constantly unwinding, but that can be
> easily fixed with
>
>
> 	[remote]
>         	url = git://.../git.git/
>                 fetch = refs/heads/*:refs/remotes/origin/*
>                 fetch = +refs/heads/pu:refs/remotes/origin/pu
>
> as the explicit refspec trumps the wildcard one.

It appears that we have a glitch somewhere in the implementation. We
should make the explicit refspec trump the wildcarded ones.