From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Thu, 31 May 2018 06:52:44 GMT
Subject: Re: [PATCH] fsckObjects tests: show how v2.17.1 can exploit downstream
Message-ID: <876034fhab.fsf@evledraar.gmail.com>
In-Reply-To: <20180531055451.GD17344@sigill.intra.peff.net>


On Thu, May 31 2018, Jeff King wrote:

> On Tue, May 29, 2018 at 11:59:07PM +0200, Ævar Arnfjörð Bjarmason wrote:
>
>> > I'm not sure what testing this buys us. [...]
>>
>> Half of what I'm trying to do here is clarifying the v2.17.1 release
>> notes. The initial version Junio had & my proposed amendment on
>> git-security was:
>
> I think that's a fine goal, but I doubt that adding a test is going to
> help much. That's why I say this seems like it should be a documentation
> patch and not a test one. People are much less likely to crawl through
> our tests than they are to crawl through the documentation.
>
>> The other half, which is why I think this patch is needed, is making
>> this aspect of it clearer to future maintainers. Before I started
>> hacking on my recent fsck series[1] I didn't realize the intricacies of
>> how *.fsckObjects worked in various situations, and I think explicitly
>> calling this case out in code helps.
>
> I agree we should be testing that, but I don't think it should be tied
> into this test that is specific to one particular fsck check. Don't we
> already check the behavior of the various fsckObjects options elsewhere,
> like in t5504?

Okey, I'll turn this into some documentation in my re-rolled
fetch.fsck.* series.