From: Shawn Pearce Date: Thu, 01 Sep 2011 19:14:06 GMT Subject: Re: Dropping '+' from fetch = +refs/heads/*:refs/remotes/origin/*? Message-ID: In-Reply-To: <7vhb4ww1id.fsf@alter.siamese.dyndns.org> On Thu, Sep 1, 2011 at 11:39, Junio C Hamano wrote: > Junio C Hamano writes: > >> Suggested reading: >> >>   http://git-blame.blogspot.com/2011/08/how-to-inject-malicious-commit-to-git.html >> >> I am wondering if we are better off applying something along the lines of >> this patch, so that with the default configuration, users can notice if >> their upstream unexpectedly rewound their branches. >> >> It would produce >> >>       [remote] >>               url = git://.../git.git/ >>                 fetch = refs/heads/*:refs/remotes/origin/* >> >> upon cloning from my repository, and your "git fetch" will fail because >> the pu (proposed updates) branch is constantly unwinding, but that can be >> easily fixed with >> >> >>       [remote] >>               url = git://.../git.git/ >>                 fetch = refs/heads/*:refs/remotes/origin/* >>                 fetch = +refs/heads/pu:refs/remotes/origin/pu >> >> as the explicit refspec trumps the wildcard one. > > It appears that we have a glitch somewhere in the implementation. We > should make the explicit refspec trump the wildcarded ones. This is a great idea. :-) -- Shawn.