From: Junio C Hamano <gitster@pobox.com>
Date: Tue, 29 Mar 2011 23:59:19 GMT
Subject: Re: denyNonFastForwards & co fail outside refs/<heads,tags>
Message-ID: <7vy63xo4vc.fsf@alter.siamese.dyndns.org>
In-Reply-To: <hbf.20110329j1zo@bombur.uio.no>

Hallvard B Furuseth <h.b.furuseth@usit.uio.no> writes:

> config options receive.<denyNonFastForward, denyDeletes> do not work in
> nonstandard ref namespaces.  I stumbled over it in refs/notes/, but the
> problem is general.  Or if it this intentional, it is the git-config(1)
> doc of these options which needs fixing.

I think it is very deliberate that denyNonFastForward does not check
anything outside local branch namespace, because there may not even be
ancestry relationship between the object a tag currently points at and the
new object the tag is trying to update (think: a tag can point at a tree
or a blob) and more importantly because pushing into refs/remotes/origin/*
namespace (which is the right way to simulate a "git fetch" from the
repository with a "git push" from outside into the repository in a
firewalled environment where you cannot initiate a connection in one
direction) should be allowed (just like "remote.*.fetch" line in
.git/config get a leading plus sign '+' by default).

I suspect that the restriction on deny_deletes was inherited by a mindless
cut & paste from the deny_non_fast_forwards codepath; I don't think of a
sane rationale to justify the limitation offhand, other than "it has been
wide open since November of 2008 and people may now be relying on that".