Re: [BUG] git push --mirror ignores refs outside head & tags

From: Robin H. Johnson <robbat2@gentoo.org>
Date: Nov 16, 2021, 06:28 UTC
Message-ID: <robbat2-20211116T061554-223495439Z@orbis-terrarum.net>
In-Reply-To: <YZLLUtPVQt2XtgQX@coredump.intra.peff.net>

On Mon, Nov 15, 2021 at 04:04:18PM -0500, Jeff King wrote:

Show 8 quoted lines

> On Mon, Nov 15, 2021 at 06:53:21AM +0000, Robin H. Johnson wrote:
> 
> > TL;DR: "git push --mirror" does not in fact push all refs, despite
> > documentation stating it does. It ONLY pushes refs in refs/heads/ and
> > refs/tags/.
> 
> Perhaps there's a bug, but it is meant to and does push all refs in a
> simple case:

...

Show 9 quoted lines

> There I used an explicit refspec naming it. But if I used "refs/*"
> (which is what --mirror is doing under the hood), then it doesn't even
> try sending it, as the client filters it out from the wildcard
> (otherwise, everyone would get server-side errors from refs/stash).
> 
> So you probably want to choose a different refname to store your data.
> 
> I do think the status of these single-level refs is not well documented.
> The rules in git-check-ref-format(1) imply that they are not valid:

Ok, that's great, but this single-level ref have been in existence for many years at this point. Gitolite added the save-push-signatures hook in 2014.

- What is a meaningful name for the push-certs ref that follows the
  2-level system?
- What's a safe migration path for Gitolite?
  - How can it atomically fix each existing repo with the problem?
- What's a safe migration path for other consumers?

Show 11 quoted lines

> 
>   They must contain at least one /. This enforces the presence of a
>   category like heads/, tags/ etc. but the actual names are not
>   restricted.
> 
> but that rule is not enforced internally, as "refs/" is sufficient for
> the internal check_refname_format() to allow it. But receive-pack has,
> since 1a7141ff28 (Ignore funny refname sent from remote, 2005-10-13),
> implemented the format check after stripping refs/. And then the client
> side followed that lead in 30affa1e9a (send-pack: do not send out
> single-level refs such as refs/stash, 2008-10-29).

And the format of the ref wasn't noticed in the hook was previously posted back in 2014 :-(. https://www.spinics.net/lists/git/msg244053.html https://groups.google.com/forum/#!topic/gitolite/7cSrU6JorEY

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136