Artifact e18cd5a2b0830f8b54f0aa3bf80e5901de907fe6f5cd0664fec1bd410311cc82:
- File
src/cmd/sync.zig
-
2026-08-17 16:41:53
— part of check-in
[e091f2ac80]
on branch push-policy
— serve refuses a push that violates its content policy (#88)
#81's predicates bind a checkout; nothing stopped a push from a clone that never adopted them, or from stock fossil. Fossil cannot close this at all -- its hooks are before-commit (client-side) and after-receive.
The policy is the SERVER's, resolved per round from its own settings, never from the artifacts arriving: a push carrying its own policy would otherwise arrive bearing permission to land. Only inspecting rules cross the wire; before-commit has no server-side counterpart.
A push sends artifacts by hash and only a manifest names paths, so the walk is manifest-first -- the policy gates what becomes REACHABLE, not what bytes transit. Decided before ingest, so a refusal stores nothing, and the whole round is refused rather than half of it.
Verified against fossil 2.28: it prints the refusal text verbatim and lands nothing. Note it exits 0 while doing so, where zit push exits 1. (user: dmestas, size: 590686) [annotate] [blame] [check-ins using]
-
2026-08-17 17:10:54
— part of check-in
[abc41cae82]
on branch trunk
— smoke S11: a stock fossil push refused by the content policy (#88)
Unlike S10, which its own comment notes survives deleting the server's admission check, this one genuinely exercises the decision: the violating file is ordinary new content fossil pushes because it is new.
Records the limitation in the header: fossil exits 0 after printing the refusal, so the assertions are on the store and on fossil's output rather than its exit status. zit push exits 1. (user: dmestas, size: 590686) [annotate] [blame] [check-ins using]
-
2026-08-17 16:41:53
— part of check-in
[e091f2ac80]
on branch push-policy
— serve refuses a push that violates its content policy (#88)