Re: [RFC PATCH] fetch: stop emitting duplicate transfer.credentialsInUrl=warn warnings

From: Jeff King <peff@peff.net>
Date: Nov 1, 2022, 02:32 UTC
Message-ID: <Y2CFRJLFRXvGwFBC@coredump.intra.peff.net>
In-Reply-To: <RFC-patch-1.1-0266485bc6c-20221031T204149Z-avarab@gmail.com>

On Mon, Oct 31, 2022 at 09:47:08PM +0100, Ævar Arnfjörð Bjarmason wrote:

Show 9 quoted lines

>  * When we invoke e.g. "git-remote-https" (aka. "git-remote-curl")
>    from "git fetch". For those cases let's pass down the equivalent of a
>    "-c transfer.credentialsInUrl=allow", since we know that we've already
>    inspected our remotes in the parent process.
> 
>    See 7390f05a3c6 (fetch: after refetch, encourage auto gc repacking,
>    2022-03-28) for prior use of git_config_push_parameter() for this
>    purpose, i.e. to push config parameters before invoking a
>    sub-process.

So I guess I don't have any _specific_ thing that goes wrong with this approach, but it really feels sketchy to me. We are lying to sub-processes about the config the user asked for. And again, I see how it works, but I wonder if this kind of approach would ever backfire on us. For example, if transfer.credentialsInUrl=warn ever ended up having any side effects besides the warning, and the sub-processes ended up skipping those effects.

I know that's a hypothetical, and probably not even a likely one, but it just gets my spider sense tingling.

Show 14 quoted lines

> > Since it is not actually important how many times Git prints the
> > warning/error message, as long as it prints it at least once, let's just
> > make the test a bit more lenient and test for the latter instead of the
> > former, which works around these CI issues.
> 
> That being said your change is obviously smaller, so if we'd prefer
> that in first as a band-aid I'm fine with that.
> 
> But I'd really like to object to the "it is not actually important how
> many...", it's crappy UX to spew duplicate output at the user, and we
> should avoid it.
> 
> So it does matter, and we get it wrong not just in this but also some
> other cases.

Yeah, I think it is crappy UX, too. It's just that I think the tests should not _asserting_ the bad behavior. At most, they should tolerate the bad behavior as a band-aid. So I think Dscho's patch is doing the right thing (and I do agree that we should fix the immediate CI pain by adjusting the tests, and letting the user-visible fix proceed independently).

-Peff