Conversation
… push
`info_refs_subprocess` mapped `hydrate_for_read`'s `Ok(None)` (pointer
absent = no published content yet) to 404 for both services. Git performs
the `info/refs?service=git-receive-pack` ref-discovery GET *before* it
sends any pack, so that 404 aborts the push — which makes the first-push
branch of `hydrate_for_write` in `receive_pack` unreachable. Every repo
with no content is permanently unpushable over smart HTTP, so a
relay-hosted repo can never be seeded at all.
`scripts/e2e-git-perms.sh` already asserts the correct behaviour ("Bot1
clones, creates index.html, pushes (should succeed)", with a `git init`
fallback for the empty-repo case), but it is not wired into CI.
Answer the `git-receive-pack` advertisement for a content-less repo
against an empty bare repo instead of 404ing. `git-upload-pack` still
404s — there is genuinely nothing to clone. The advertisement is produced
by the real `git receive-pack --advertise-refs` subprocess, so the
capability set stays byte-correct rather than hand-rolled.
Authorization is unchanged: `info_refs` runs `authorize_git_read` before
any of this, and push policy is still enforced by the pre-receive hook.
The new branch discloses an empty ref list to a caller who already passed
the read gate.
Also extracts the empty-bare-repo construction shared by both call sites
into `hydrate::empty_bare_repo`, and covers the advertisement shape
(zero oid, `capabilities^{}`, `report-status`) with a unit test — that
well-formedness is what makes git proceed to POST the pack.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: brendio <brendan@brendio.com>
🔐 Codex Security Review
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
… push
info_refs_subprocessmappedhydrate_for_read'sOk(None)(pointer absent = no published content yet) to 404 for both services. Git performs theinfo/refs?service=git-receive-packref-discovery GET before it sends any pack, so that 404 aborts the push — which makes the first-push branch ofhydrate_for_writeinreceive_packunreachable. Every repo with no content is permanently unpushable over smart HTTP, so a relay-hosted repo can never be seeded at all.scripts/e2e-git-perms.shalready asserts the correct behaviour ("Bot1 clones, creates index.html, pushes (should succeed)", with agit initfallback for the empty-repo case), but it is not wired into CI.Answer the
git-receive-packadvertisement for a content-less repo against an empty bare repo instead of 404ing.git-upload-packstill 404s — there is genuinely nothing to clone. The advertisement is produced by the realgit receive-pack --advertise-refssubprocess, so the capability set stays byte-correct rather than hand-rolled.Authorization is unchanged:
info_refsrunsauthorize_git_readbefore any of this, and push policy is still enforced by the pre-receive hook. The new branch discloses an empty ref list to a caller who already passed the read gate.Also extracts the empty-bare-repo construction shared by both call sites into
hydrate::empty_bare_repo, and covers the advertisement shape (zero oid,capabilities^{},report-status) with a unit test — that well-formedness is what makes git proceed to POST the pack.Summary
Related issue
Testing