Re: [BUG] git push --mirror ignores refs outside head & tags

From: Jeff King <peff@peff.net>
Date: Nov 15, 2021, 21:04 UTC
Message-ID: <YZLLUtPVQt2XtgQX@coredump.intra.peff.net>
In-Reply-To: <robbat2-20211115T063838-612792475Z@orbis-terrarum.net>

On Mon, Nov 15, 2021 at 06:53:21AM +0000, Robin H. Johnson wrote:

> TL;DR: "git push --mirror" does not in fact push all refs, despite
> documentation stating it does. It ONLY pushes refs in refs/heads/ and
> refs/tags/.

Perhaps there's a bug, but it is meant to and does push all refs in a simple case:

  git init
  git commit --allow-empty -m foo
  git update-ref refs/heads/other-branch HEAD
  git update-ref refs/foo/bar HEAD

  git init --bare dst.git
  git push --mirror dst.git

produces:

  To dst.git
   * [new reference]   refs/foo/bar -> refs/foo/bar
   * [new branch]      main -> main
   * [new branch]      other-branch -> other-branch

> I was surprised to find, on the new server presently configured as
> replica, but intended to take over as the primary, that the
> refs/push-certs was missing on every single repo.

Ah. You are not likely to have success pushing a single-level ref like that, as receive-pack rejects it:

  $ git update-ref refs/push-certs HEAD
  $ git push dst.git refs/push-certs
  Total 0 (delta 0), reused 0 (delta 0), pack-reused 0
  remote: error: refusing to create funny ref 'refs/push-certs' remotely
  To dst.git
   ! [remote rejected] refs/push-certs -> refs/push-certs (funny refname)
  error: failed to push some refs to 'dst.git'

There I used an explicit refspec naming it. But if I used "refs/*" (which is what --mirror is doing under the hood), then it doesn't even try sending it, as the client filters it out from the wildcard (otherwise, everyone would get server-side errors from refs/stash).

So you probably want to choose a different refname to store your data.

I do think the status of these single-level refs is not well documented. The rules in git-check-ref-format(1) imply that they are not valid:

  They must contain at least one /. This enforces the presence of a
  category like heads/, tags/ etc. but the actual names are not
  restricted.

but that rule is not enforced internally, as "refs/" is sufficient for the internal check_refname_format() to allow it. But receive-pack has, since 1a7141ff28 (Ignore funny refname sent from remote, 2005-10-13), implemented the format check after stripping refs/. And then the client side followed that lead in 30affa1e9a (send-pack: do not send out single-level refs such as refs/stash, 2008-10-29).

-Peff