On Mon, Nov 15, 2021 at 04:04:18PM -0500, Jeff King wrote:
> On Mon, Nov 15, 2021 at 06:53:21AM +0000, Robin H. Johnson wrote:
> 
> > TL;DR: "git push --mirror" does not in fact push all refs, despite
> > documentation stating it does. It ONLY pushes refs in refs/heads/ and
> > refs/tags/.
> 
> Perhaps there's a bug, but it is meant to and does push all refs in a
> simple case:
...
> There I used an explicit refspec naming it. But if I used "refs/*"
> (which is what --mirror is doing under the hood), then it doesn't even
> try sending it, as the client filters it out from the wildcard
> (otherwise, everyone would get server-side errors from refs/stash).
> 
> So you probably want to choose a different refname to store your data.
> 
> I do think the status of these single-level refs is not well documented.
> The rules in git-check-ref-format(1) imply that they are not valid:
Ok, that's great, but this single-level ref have been in existence for
many years at this point. Gitolite added the save-push-signatures hook
in 2014.

- What is a meaningful name for the push-certs ref that follows the
  2-level system?
- What's a safe migration path for Gitolite?
  - How can it atomically fix each existing repo with the problem?
- What's a safe migration path for other consumers?

> 
>   They must contain at least one /. This enforces the presence of a
>   category like heads/, tags/ etc. but the actual names are not
>   restricted.
> 
> but that rule is not enforced internally, as "refs/" is sufficient for
> the internal check_refname_format() to allow it. But receive-pack has,
> since 1a7141ff28 (Ignore funny refname sent from remote, 2005-10-13),
> implemented the format check after stripping refs/. And then the client
> side followed that lead in 30affa1e9a (send-pack: do not send out
> single-level refs such as refs/stash, 2008-10-29).

And the format of the ref wasn't noticed in the hook was previously
posted back in 2014 :-(.
https://www.spinics.net/lists/git/msg244053.html
https://groups.google.com/forum/#!topic/gitolite/7cSrU6JorEY

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136