From 87fcb886b4711e1c41ce444423af82d7b69adb4b Mon Sep 17 00:00:00 2001 From: Karthik Nayak Date: Thu, 10 Sep 2026 23:54:06 +0200 Subject: [PATCH 1/5] doc: add proc-receive hook info in 'git-receive-pack.adoc' The manpage of git-receive-pack(1) documents hooks invoked when receiving a push. The manpage does not mention the 'proc-receive' hook though, which is also invoked as part of that process. Add a paragraph about this hook to plug that gap. Helped-by: Patrick Steinhardt Signed-off-by: Karthik Nayak Signed-off-by: Junio C Hamano --- Documentation/git-receive-pack.adoc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Documentation/git-receive-pack.adoc b/Documentation/git-receive-pack.adoc index 0956086d61..5806792ba7 100644 --- a/Documentation/git-receive-pack.adoc +++ b/Documentation/git-receive-pack.adoc @@ -236,6 +236,14 @@ if the repository is packed and is served via a dumb transport. exec git update-server-info ---- +PROC-RECEIVE HOOK +----------------- +This hook is invoked by linkgit:git-receive-pack[1]. If the server has +set the multi-valued config variable `receive.procReceiveRefs`, and the +commands sent to 'receive-pack' have matching reference names, these +commands will be executed by this hook, instead of by the internal +`execute_commands()` function. This hook is responsible for updating +the relevant references and reporting the results back to 'receive-pack'. QUARANTINE ENVIRONMENT ---------------------- From 57c09985947224ffdee464111d0a3d0750207341 Mon Sep 17 00:00:00 2001 From: Karthik Nayak Date: Thu, 10 Sep 2026 23:54:07 +0200 Subject: [PATCH 2/5] receive-pack: drop static variables to track report status version In 'git-receive-pack(1)', to track the report status version, we use the static variables `report_status` and `report_status_v2`. As the report status version is mutually exclusive, using an enum better suits the requirement. switch to using a new `enum report_status_version`, while also dropping the static variable to make the flow easier to understand. Helped-by: Junio C Hamano Signed-off-by: Karthik Nayak Signed-off-by: Junio C Hamano --- builtin/receive-pack.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c index e6e54ba55f..75a1788fa5 100644 --- a/builtin/receive-pack.c +++ b/builtin/receive-pack.c @@ -53,6 +53,12 @@ enum deny_action { DENY_UPDATE_INSTEAD }; +enum report_status_version { + REPORT_STATUS_UNKNOWN = 0, + REPORT_STATUS_V0, + REPORT_STATUS_V2, +}; + static int deny_deletes; static int deny_non_fast_forwards; static enum deny_action deny_current_branch = DENY_UNCONFIGURED; @@ -64,8 +70,6 @@ static int advertise_atomic_push = 1; static int advertise_push_options; static int advertise_sid; static off_t max_input_size; -static int report_status; -static int report_status_v2; static int use_sideband; static int use_atomic; static int use_push_options; @@ -2191,7 +2195,8 @@ static void queue_commands_from_cert(struct command **tail, } static struct command *read_head_info(struct packet_reader *reader, - struct oid_array *shallow) + struct oid_array *shallow, + enum report_status_version *version) { struct command *commands = NULL; struct command **p = &commands; @@ -2217,9 +2222,9 @@ static struct command *read_head_info(struct packet_reader *reader, const char *client_sid; size_t len = 0; if (parse_feature_request(feature_list, "report-status")) - report_status = 1; + *version = REPORT_STATUS_V0; if (parse_feature_request(feature_list, "report-status-v2")) - report_status_v2 = 1; + *version = REPORT_STATUS_V2; if (parse_feature_request(feature_list, "side-band-64k")) use_sideband = LARGE_PACKET_MAX; if (parse_feature_request(feature_list, "quiet")) @@ -2500,6 +2505,7 @@ int cmd_receive_pack(int argc, struct shallow_info si; struct packet_reader reader; struct odb_transaction *transaction = NULL; + enum report_status_version version = REPORT_STATUS_UNKNOWN; struct option options[] = { OPT__QUIET(&quiet, N_("quiet")), @@ -2563,7 +2569,7 @@ int cmd_receive_pack(int argc, PACKET_READ_CHOMP_NEWLINE | PACKET_READ_DIE_ON_ERR_PACKET); - if ((commands = read_head_info(&reader, &shallow))) { + if ((commands = read_head_info(&reader, &shallow, &version))) { struct string_list push_options = STRING_LIST_INIT_DUP; struct strbuf unpack_status = STRBUF_INIT; @@ -2596,10 +2602,18 @@ int cmd_receive_pack(int argc, &push_options); odb_transaction_finalize(transaction); sigchain_push(SIGPIPE, SIG_IGN); - if (report_status_v2) + + switch (version) { + case REPORT_STATUS_V2: report_v2(commands, &unpack_status); - else if (report_status) + break; + case REPORT_STATUS_V0: report(commands, &unpack_status); + break; + case REPORT_STATUS_UNKNOWN: + break; + } + sigchain_pop(SIGPIPE); run_receive_hook(commands, "post-receive", 1, NULL, &push_options); From f81e34b3f7de23f1250b11e38a6f84decf8abb13 Mon Sep 17 00:00:00 2001 From: Karthik Nayak Date: Thu, 10 Sep 2026 23:54:08 +0200 Subject: [PATCH 3/5] receive-pack: move message generation to separate function After git-receive-pack(1) has committed the reference updates, we call either `report()` or `report_v2()` to report to the client which of the references we have updated successfully and which updates have failed. The only difference between those two functions is that the latter also knows to provide a more detailed report about how exactly a given reference was updated. With this, also drop `report_v2()` as both report functions now are similar in structure with only the `report_status_version` differentiating them. In the next commit we're about to add another site that wants to generate these reports. Refactor the logic into a shared function that can easily be reused. Helped-by: Patrick Steinhardt Signed-off-by: Karthik Nayak Signed-off-by: Junio C Hamano --- builtin/receive-pack.c | 77 ++++++++++++++++++------------------------ 1 file changed, 33 insertions(+), 44 deletions(-) diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c index 75a1788fa5..8b1ae4f7f3 100644 --- a/builtin/receive-pack.c +++ b/builtin/receive-pack.c @@ -2414,67 +2414,58 @@ static void update_shallow_info(struct command *commands, free(ref_status); } -static void report(struct command *commands, const struct strbuf *unpack_status) +/* + * Generate the response to be sent to the client invoking 'git-receive-pack(1)'. + */ +static void generate_report(struct strbuf *buf, struct command *commands, + const struct strbuf *unpack_status, + enum report_status_version version) { struct command *cmd; - struct strbuf buf = STRBUF_INIT; - packet_buf_write(&buf, "unpack %s\n", - unpack_status->len ? unpack_status->buf : "ok"); - for (cmd = commands; cmd; cmd = cmd->next) { - if (!cmd->error_string) - packet_buf_write(&buf, "ok %s\n", - cmd->ref_name); - else - packet_buf_write(&buf, "ng %s %s\n", - cmd->ref_name, cmd->error_string); - } - packet_buf_flush(&buf); - - if (use_sideband) - send_sideband(1, 1, buf.buf, buf.len, use_sideband); - else - write_or_die(1, buf.buf, buf.len); - strbuf_release(&buf); -} - -static void report_v2(struct command *commands, const struct strbuf *unpack_status) -{ - struct command *cmd; - struct strbuf buf = STRBUF_INIT; - struct ref_push_report *report; - - packet_buf_write(&buf, "unpack %s\n", + packet_buf_write(buf, "unpack %s\n", unpack_status->len ? unpack_status->buf : "ok"); + for (cmd = commands; cmd; cmd = cmd->next) { + struct ref_push_report *report; int count = 0; - if (cmd->error_string) { - packet_buf_write(&buf, "ng %s %s\n", - cmd->ref_name, - cmd->error_string); + if (cmd->error_string) + packet_buf_write(buf, "ng %s %s\n", + cmd->ref_name, cmd->error_string); + else + packet_buf_write(buf, "ok %s\n", cmd->ref_name); + + if (version != REPORT_STATUS_V2 || cmd->error_string) continue; - } - packet_buf_write(&buf, "ok %s\n", - cmd->ref_name); + for (report = cmd->report; report; report = report->next) { if (count++ > 0) - packet_buf_write(&buf, "ok %s\n", + packet_buf_write(buf, "ok %s\n", cmd->ref_name); if (report->ref_name) - packet_buf_write(&buf, "option refname %s\n", + packet_buf_write(buf, "option refname %s\n", report->ref_name); if (report->old_oid) - packet_buf_write(&buf, "option old-oid %s\n", + packet_buf_write(buf, "option old-oid %s\n", oid_to_hex(report->old_oid)); if (report->new_oid) - packet_buf_write(&buf, "option new-oid %s\n", + packet_buf_write(buf, "option new-oid %s\n", oid_to_hex(report->new_oid)); if (report->forced_update) - packet_buf_write(&buf, "option forced-update\n"); + packet_buf_write(buf, "option forced-update\n"); } } - packet_buf_flush(&buf); + + packet_buf_flush(buf); +} + +static void report(struct command *commands, const struct strbuf *unpack_status, + enum report_status_version version) +{ + struct strbuf buf = STRBUF_INIT; + + generate_report(&buf, commands, unpack_status, version); if (use_sideband) send_sideband(1, 1, buf.buf, buf.len, use_sideband); @@ -2605,10 +2596,8 @@ int cmd_receive_pack(int argc, switch (version) { case REPORT_STATUS_V2: - report_v2(commands, &unpack_status); - break; case REPORT_STATUS_V0: - report(commands, &unpack_status); + report(commands, &unpack_status, version); break; case REPORT_STATUS_UNKNOWN: break; From 3bbb0864a27bcbc0d31539431ac65916ba197d1d Mon Sep 17 00:00:00 2001 From: Karthik Nayak Date: Thu, 10 Sep 2026 23:54:09 +0200 Subject: [PATCH 4/5] hook: introduce the receive-report hook When running 'git-receive-pack(1)', there is no way for the server to intercept and modify the status report before it is sent back to the client. Servers with custom logic may need to transform or gate the report based on the outcome of external logic post reference updates. This is specially needed for our usecase at GitLab where we have custom MVCC logic on top of Git which creates a new version for each push operation. The new version is only committed when certain external operations post reference transaction succeed. So reporting the correct message based on the outcome of these operations is important. The outcome of these operations is only known after `execute_commands()` has returned and before the report is written. There is no point in receive-pack where the server can act on that. We cannot use any of the existing hooks as: - The pre-receive hook runs too early, as we haven't updated references at that point yet and we need to have the full view of all resulting updates (both objects and references). - The update hook is too inefficient as it runs once per reference, and we cannot trivially determine the last update. - The reference-transaction hook is not suited for this. It fires from within `ref_transaction_commit()`, which is before the outcome we need to report is known, so there is no phase at which it could give us the answer. It also does not contain any knowledge regarding the push and cannot communicate with the clients. - The proc-receive hook replaces execute_commands() for references matching 'receive.procReceiveRefs'. We need to gate the report for the push as a whole. - The post-receive and post-update hooks cannot be used as they run too late, at the point where we have already reported success to the client. Introduce a new 'receive-report' hook. The hook receives the complete pkt-line encoded status report on standard input, after all ref updates have been applied to the repository by execute_commands() but before the report is sent to the client. See linkgit:gitprotocol-pack[5] details on the protocol structure. The hook's stdout fully replaces the report sent to the client. receive-pack fully buffers the hook's stdout before acting on the exit status, so the exit code is known before the client receives anything. This gives two distinct behaviors depending on exit status: - Exit 0: the hook's stdout is used as the report. The hook can rewrite 'ok' lines to 'ng' lines to signal per-ref rejection to the client while receive-pack itself exits cleanly. The client marks rejected refs as '[remote rejected]' and exits with a non-zero status if any ref is 'ng'. - Non-zero exit: the hook's stdout is discarded, receive-pack modifies all references to be rejected with a 'receive-report hook failed' error. In both cases, any output the hook writes to standard error is forwarded to the client over the sideband channel and appears as 'remote:' lines on the client terminal. Writing to stderr alone does not affect the push outcome. Reference updates applied by execute_commands() are not rolled back in either failure mode. The hook can cause the client to perceive the push as failed, but cannot undo server-side changes. This creates a divergence that the server cannot resolve: the client leaves its remote-tracking reference at the old value while the update is in fact applied, and a later fetch may reveal the update that the push reported as rejected. The hook is therefore only appropriate for servers which can guarantee that a rejected update is not observable by any reader. In our case the transaction committed by execute_commands() produces a candidate version which is not visible to other readers and is only published once the subsequent operations succeed, so a report of 'ng' corresponds to a version that is discarded rather than published. On a repository where a committed reference update is immediately visible, rejecting a push from this hook would instead leave the pusher with a view that does not match the server. This hook does not use the config-based hook infrastructure, which supports running multiple scripts per hook event. This hook is a bidirectional filter: it receives the report on stdin and writes a modified version to stdout. Running multiple such scripts sequentially would require piping the output of one into the input of the next, which the current hook infrastructure does not support. A single-script design is therefore a natural fit, and is consistent with how 'proc-receive' is structured for the same reason. Helped-by: Patrick Steinhardt Signed-off-by: Karthik Nayak Signed-off-by: Junio C Hamano --- Documentation/git-receive-pack.adoc | 9 + Documentation/githooks.adoc | 61 +++++++ builtin/receive-pack.c | 50 ++++++ t/meson.build | 1 + t/t5412-receive-report-hook.sh | 257 ++++++++++++++++++++++++++++ 5 files changed, 378 insertions(+) create mode 100755 t/t5412-receive-report-hook.sh diff --git a/Documentation/git-receive-pack.adoc b/Documentation/git-receive-pack.adoc index 5806792ba7..ab668ffa0c 100644 --- a/Documentation/git-receive-pack.adoc +++ b/Documentation/git-receive-pack.adoc @@ -245,6 +245,15 @@ commands will be executed by this hook, instead of by the internal `execute_commands()` function. This hook is responsible for updating the relevant references and reporting the results back to 'receive-pack'. +RECEIVE-REPORT HOOK +------------------- +This hook is invoked by 'git-receive-pack' after all the ref updates +have been applied but before the report is sent to the client. The hook +receives the complete report in pkt-line format on stdin and its stdout +replaces the report sent to the client, which allows the hook to rewrite +the outcomes or abort the push completely. See linkgit:githooks[5] for +the full protocol description. + QUARANTINE ENVIRONMENT ---------------------- diff --git a/Documentation/githooks.adoc b/Documentation/githooks.adoc index ed045940d1..145642bf05 100644 --- a/Documentation/githooks.adoc +++ b/Documentation/githooks.adoc @@ -527,6 +527,67 @@ The exit status of the hook is ignored for any state except for the status will cause the transaction to be aborted. The hook will not be called with "aborted" state in that case. +receive-report +~~~~~~~~~~~~~~ + +This hook is invoked by linkgit:git-receive-pack[1] when it reacts to +`git push` and updates references in its repository. It executes on +the repository once after all refs have been updated and after all +accepted ref changes are applied to the repository, but before the +pkt-line encoded status report is sent back to the client. + +The hook receives the complete pkt-line encoded status report on +standard input, see linkgit:gitprotocol-pack[5] for details on the +structure. The hook's standard output entirely replaces the report +that is sent to the client. The hook must write a valid pkt-line +encoded report in the same format it received. The hook's stdout is +fully buffered by `receive-pack` before any data is sent to the client, +so the hook's exit status is known before the client receives anything. + +There are three distinct ways the hook can affect the push outcome: + +* To reject the push, modify the unpack status from `ok` to the required + error message. While `git-push` will fail, individual references may + still show success messages unless modified. + +* To reject individual ref updates while keeping `receive-pack` alive, + rewrite the corresponding `ok ` lines to + `ng [ ]` lines in the output and exit with status 0. + The client will then mark those specific refs as rejected while + treating any `ok` refs as successful. The push as a whole is + considered failed if any ref is `ng`, and `git push` will exit with + a non-zero status on the client side. + +* To abort the entire push unconditionally, exit with a non-zero + status. In this case the hook's stdout is discarded, `receive-pack` + modifies all references to be rejected with a 'receive-report hook + failed' error. + +Any output written to standard error is forwarded to the client over +the sideband channel and will appear as `remote:` lines on clients +using 'git-push(1)', regardless of the hook's exit status. Writing to +standard error alone does not affect the push outcome. + +Note that by the time this hook runs, all ref updates have already been +applied to the repository. Neither a non-zero exit nor rewriting refs +to `ng` rolls back any ref changes that were already committed +server-side. The hook can cause the client to perceive the push as +failed, but cannot undo the server-side updates. + +This means that reporting a reference as `ng` makes the client believe +the update did not happen while the server has in fact applied it. The +client leaves its remote-tracking reference at its old value, and a +later `git fetch` may reveal the very update that the push reported as +rejected. Neither Git nor the server can reconcile this; only the user, +by fetching again, will find out. + +This hook is therefore only appropriate for servers which can guarantee +that a rejected update is not observable by any reader, for example +because the committed transaction produces a candidate state that is +discarded rather than published. On a repository where a committed +reference update is immediately visible, using this hook to reject a +push will leave the pusher with a view that does not match the server. + push-to-checkout ~~~~~~~~~~~~~~~~ diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c index 8b1ae4f7f3..9ac7717096 100644 --- a/builtin/receive-pack.c +++ b/builtin/receive-pack.c @@ -992,6 +992,41 @@ static int run_update_hook(struct command *cmd) return code; } +static int run_receive_report_hook(struct strbuf *report) +{ + struct child_process proc = CHILD_PROCESS_INIT; + struct async sideband_async; + int sideband_async_started = 0; + int saved_stderr = -1; + struct strbuf out = STRBUF_INIT; + const char *hook_path; + int ret; + + hook_path = find_hook(the_repository, "receive-report"); + if (!hook_path) + return 0; + + strvec_push(&proc.args, hook_path); + proc.trace2_hook_name = "receive-report"; + + prepare_sideband_async(&sideband_async, &saved_stderr, + &sideband_async_started); + + sigchain_push(SIGPIPE, SIG_IGN); + ret = pipe_command(&proc, report->buf, report->len, &out, + report->len, NULL, 0); + sigchain_pop(SIGPIPE); + + finish_sideband_async(&sideband_async, saved_stderr, + sideband_async_started); + + if (!ret) + strbuf_swap(&out, report); + + strbuf_release(&out); + return ret; +} + static struct command *find_command_by_refname(struct command *list, const char *refname) { @@ -2414,6 +2449,15 @@ static void update_shallow_info(struct command *commands, free(ref_status); } +static void override_cmds_error(struct command *commands, const char *err) +{ + for (struct command *cmd = commands; cmd; cmd = cmd->next) { + if (cmd->error_string_owned) + FREE_AND_NULL(cmd->error_string_owned); + cmd->error_string = err; + } +} + /* * Generate the response to be sent to the client invoking 'git-receive-pack(1)'. */ @@ -2467,6 +2511,12 @@ static void report(struct command *commands, const struct strbuf *unpack_status, generate_report(&buf, commands, unpack_status, version); + if (run_receive_report_hook(&buf)) { + strbuf_reset(&buf); + override_cmds_error(commands, "receive-report hook failed"); + generate_report(&buf, commands, unpack_status, version); + } + if (use_sideband) send_sideband(1, 1, buf.buf, buf.len, use_sideband); else diff --git a/t/meson.build b/t/meson.build index 7f53cca7d1..692e6011c5 100644 --- a/t/meson.build +++ b/t/meson.build @@ -652,6 +652,7 @@ integration_tests = [ 't5409-colorize-remote-messages.sh', 't5410-receive-pack.sh', 't5411-proc-receive-hook.sh', + 't5412-receive-report-hook.sh', 't5500-fetch-pack.sh', 't5501-fetch-push-alternates.sh', 't5502-quickfetch.sh', diff --git a/t/t5412-receive-report-hook.sh b/t/t5412-receive-report-hook.sh new file mode 100755 index 0000000000..2f6515b5f0 --- /dev/null +++ b/t/t5412-receive-report-hook.sh @@ -0,0 +1,257 @@ +#!/bin/sh + +test_description='test receive-report hook' + +GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main +export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME + +. ./test-lib.sh + +. "$TEST_DIRECTORY"/t5411/common-functions.sh + +URL_PREFIX="\.\." + +test_expect_success "setup workbench" ' + git init workbench && + create_commits_in workbench A B +' + +test_expect_success "no report hook, push succeeds" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + git init --bare upstream && + + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + git -C workbench push origin $B:refs/heads/main >out 2>&1 && + + make_user_friendly_and_stable_output actual && + cat >expect <<-\EOF && + To ../upstream + .. -> main + EOF + test_cmp expect actual +' + +test_expect_success "passthrough does not alter report" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + git init --bare upstream && + + test_hook -C upstream --setup receive-report <<-\EOF && + cat + EOF + + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + git -C workbench push origin $B:refs/heads/main >out 2>&1 && + + make_user_friendly_and_stable_output actual && + cat >expect <<-\EOF && + To ../upstream + .. -> main + EOF + test_cmp expect actual +' + +test_expect_success "non-zero exit reports as hook failed" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + + test_hook -C upstream --setup receive-report <<-\EOF && + exit 1 + EOF + + test_must_fail git -C workbench push origin $B:refs/heads/main >out 2>&1 && + make_user_friendly_and_stable_output actual && + cat >expect <<-\EOF && + To ../upstream + ! [remote rejected] -> main (receive-report hook failed) + EOF + test_cmp expect actual +' + +test_expect_success "hook is invoked and receives report on stdin" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + test_hook -C upstream --setup receive-report <<-EOF && + tee raw + EOF + + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + git -C workbench push origin $B:refs/heads/main >out 2>&1 && + + make_user_friendly_and_stable_output actual && + cat >expect <<-EOF && + To ../upstream + .. -> main + EOF + test_cmp expect actual && + + test-tool pkt-line unpack actual-report && + cat >expect-report <<-EOF && + unpack ok + ok refs/heads/main + 0000 + EOF + test_cmp expect-report actual-report +' + +test_expect_success "hook can modify the report sent to client" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + + test_hook -C upstream --setup receive-report <<-\EOF && + test-tool pkt-line unpack | + sed "s/^ok /ng /" | + test-tool pkt-line pack + EOF + + test_must_fail git -C workbench push origin $B:refs/heads/main >out 2>&1 && + make_user_friendly_and_stable_output actual && + cat >expect <<-\EOF && + To ../upstream + ! [remote rejected] -> main (failed) + EOF + test_cmp expect actual +' + +test_expect_success "hook can modify the unpack status" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + + test_hook -C upstream --setup receive-report <<-\EOF && + test-tool pkt-line unpack | + sed "s/^unpack ok$/unpack push failed due to server error/" | + test-tool pkt-line pack + EOF + + test_must_fail git -C workbench push origin $B:refs/heads/main >out 2>&1 && + test_grep "error: remote unpack failed: push failed due to server error" out && + make_user_friendly_and_stable_output actual && + cat >expect <<-\EOF && + To ../upstream + .. -> main + EOF + test_cmp expect actual +' + +test_expect_success "hook can report a custom failure message" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + + test_hook -C upstream --setup receive-report <<-\EOF && + echo "push rejected: service X is down" >&2 + test-tool pkt-line unpack | + sed "s/^ok \(.*\)/ng \1 service-x-is-down/" | + test-tool pkt-line pack | + tee raw + EOF + + test_must_fail git -C workbench push origin $B:refs/heads/main >out 2>&1 && + test_grep "push rejected: service X is down" out && + + test-tool pkt-line unpack actual-report && + cat >expect-report <<-\EOF && + unpack ok + ng refs/heads/main service-x-is-down + 0000 + EOF + test_cmp expect-report actual-report +' + +test_expect_success "hook stderr with zero exit status code" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + + test_hook -C upstream --setup receive-report <<-\EOF && + echo "push rejected: service X is down" >&2 + tee raw + EOF + + git -C workbench push origin $B:refs/heads/main >out 2>&1 && + test_grep "push rejected: service X is down" out && + + test-tool pkt-line unpack actual-report && + cat >expect-report <<-\EOF && + unpack ok + ok refs/heads/main + 0000 + EOF + test_cmp expect-report actual-report +' + +test_expect_success "non-zero exit with pre-existing ng from proc-receive" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + git -C upstream config receive.procReceiveRefs refs/for && + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + + # Use a proc-receive hook to generate a dynamic error string. + # This is used to capture any leaks stemming from overriding the + # error message via the receive-report. + test_hook -C upstream --setup proc-receive <<-\EOF && + test-tool proc-receive -r "ng refs/for/main/topic push-rejected-by-service-x" + EOF + + test_hook -C upstream --setup receive-report <<-\EOF && + tee raw + exit 1 + EOF + + test_must_fail git -C workbench push origin HEAD:refs/for/main/topic >out 2>&1 && + test_grep "receive-report hook failed" out && + + test-tool pkt-line unpack actual-report && + cat >expect-report <<-\EOF && + unpack ok + ng refs/for/main/topic push-rejected-by-service-x + 0000 + EOF + test_cmp expect-report actual-report +' + +test_expect_success "hook stderr is relayed to client via sideband" ' + test_when_finished "rm -rf upstream" && + test_when_finished "git -C workbench remote remove origin" && + + git init --bare upstream && + git -C workbench remote add origin ../upstream && + git -C workbench push origin $A:refs/heads/main && + + test_hook -C upstream --setup receive-report <<-\EOF && + echo "hook-stderr-message" >&2 + exit 1 + EOF + + test_must_fail git -C workbench push origin $B:refs/heads/main >out 2>&1 && + test_grep "remote: hook-stderr-message" out +' + +test_done From c090a2363c8209998fcd0f72e85dab5c289f2382 Mon Sep 17 00:00:00 2001 From: Junio C Hamano Date: Mon, 14 Sep 2026 15:36:05 -0700 Subject: [PATCH 5/5] receive-pack: coccinelle fix Let's not check the nullness of cmd->error_string_owned before calling FREE_AND_NULL(cmd->error_string_owned). It is cheap and safe to call FREE_AND_NULL(variable) for a variable that has NULL in it. Signed-off-by: Junio C Hamano --- builtin/receive-pack.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c index 9ac7717096..1d5b050beb 100644 --- a/builtin/receive-pack.c +++ b/builtin/receive-pack.c @@ -2452,8 +2452,7 @@ static void update_shallow_info(struct command *commands, static void override_cmds_error(struct command *commands, const char *err) { for (struct command *cmd = commands; cmd; cmd = cmd->next) { - if (cmd->error_string_owned) - FREE_AND_NULL(cmd->error_string_owned); + FREE_AND_NULL(cmd->error_string_owned); cmd->error_string = err; } }