Merge branch 'hx/push-atomic-with-cert'
"git push" that wants to be atomic and wants to send push
certificate learned not to prepare and sign the push certificate
when it fails the local check (hence due to atomicity it is known
that no certificate is needed).
* hx/push-atomic-with-cert:
send-pack: run GPG after atomic push checking
diff --git a/send-pack.c b/send-pack.c
index 2d2f999..c969807 100644
--- a/send-pack.c
+++ b/send-pack.c
@@ -303,7 +303,12 @@
return CHECK_REF_STATUS_REJECTED;
case REF_STATUS_UPTODATE:
return CHECK_REF_UPTODATE;
+
default:
+ case REF_STATUS_EXPECTING_REPORT:
+ /* already passed checks on the local side */
+ case REF_STATUS_OK:
+ /* of course this is OK */
return 0;
}
}
@@ -510,13 +515,6 @@
if (ref->deletion && !allow_deleting_refs)
ref->status = REF_STATUS_REJECT_NODELETE;
- if (!args->dry_run)
- advertise_shallow_grafts_buf(&req_buf);
-
- if (!args->dry_run && push_cert_nonce)
- cmds_sent = generate_push_cert(&req_buf, remote_refs, args,
- cap_buf.buf, push_cert_nonce);
-
/*
* Clear the status for each ref and see if we need to send
* the pack data.
@@ -552,31 +550,35 @@
ref->status = REF_STATUS_EXPECTING_REPORT;
}
+ if (!args->dry_run)
+ advertise_shallow_grafts_buf(&req_buf);
+
/*
* Finally, tell the other end!
*/
- for (ref = remote_refs; ref; ref = ref->next) {
- char *old_hex, *new_hex;
+ if (!args->dry_run && push_cert_nonce)
+ cmds_sent = generate_push_cert(&req_buf, remote_refs, args,
+ cap_buf.buf, push_cert_nonce);
+ else if (!args->dry_run)
+ for (ref = remote_refs; ref; ref = ref->next) {
+ char *old_hex, *new_hex;
- if (args->dry_run || push_cert_nonce)
- continue;
+ if (check_to_send_update(ref, args) < 0)
+ continue;
- if (check_to_send_update(ref, args) < 0)
- continue;
-
- old_hex = oid_to_hex(&ref->old_oid);
- new_hex = oid_to_hex(&ref->new_oid);
- if (!cmds_sent) {
- packet_buf_write(&req_buf,
- "%s %s %s%c%s",
- old_hex, new_hex, ref->name, 0,
- cap_buf.buf);
- cmds_sent = 1;
- } else {
- packet_buf_write(&req_buf, "%s %s %s",
- old_hex, new_hex, ref->name);
+ old_hex = oid_to_hex(&ref->old_oid);
+ new_hex = oid_to_hex(&ref->new_oid);
+ if (!cmds_sent) {
+ packet_buf_write(&req_buf,
+ "%s %s %s%c%s",
+ old_hex, new_hex, ref->name, 0,
+ cap_buf.buf);
+ cmds_sent = 1;
+ } else {
+ packet_buf_write(&req_buf, "%s %s %s",
+ old_hex, new_hex, ref->name);
+ }
}
- }
if (use_push_options) {
struct string_list_item *item;
diff --git a/t/t5534-push-signed.sh b/t/t5534-push-signed.sh
index 030331f..7e928af 100755
--- a/t/t5534-push-signed.sh
+++ b/t/t5534-push-signed.sh
@@ -273,4 +273,27 @@
test_cmp expect dst/push-cert-status
'
+test_expect_success GPG 'failed atomic push does not execute GPG' '
+ prepare_dst &&
+ git -C dst config receive.certnonceseed sekrit &&
+ write_script gpg <<-EOF &&
+ # should check atomic push locally before running GPG.
+ exit 1
+ EOF
+ test_must_fail env PATH="$TRASH_DIRECTORY:$PATH" git push \
+ --signed --atomic --porcelain \
+ dst noop ff noff >out 2>&1 &&
+
+ test_i18ngrep ! "gpg failed to sign" out &&
+ sed -n -e "/^To dst/,$ p" out >actual &&
+ cat >expect <<-EOF &&
+ To dst
+ = refs/heads/noop:refs/heads/noop [up to date]
+ ! refs/heads/ff:refs/heads/ff [rejected] (atomic push failed)
+ ! refs/heads/noff:refs/heads/noff [rejected] (non-fast-forward)
+ Done
+ EOF
+ test_i18ncmp expect actual
+'
+
test_done
