From 68dedc43f8ab73c27001dae8adbd14b7fa9b1e46 Mon Sep 17 00:00:00 2001
From: Stephen Haberman <stephen@exigencecorp.com>
Date: Sun, 24 Aug 2008 12:46:26 -0500
Subject: [PATCH] Don't let in tags that are not within a branch.

---
 server/update-ensure-tag-in-branch         | 31 ++++++++++++++++
 server/update-prefer-rebase                |  1 -
 tests/t3100-server-ensure-tag-in-branch.sh | 43 ++++++++++++++++++++++
 3 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 server/update-ensure-tag-in-branch
 create mode 100644 tests/t3100-server-ensure-tag-in-branch.sh

diff --git a/server/update-ensure-tag-in-branch b/server/update-ensure-tag-in-branch
new file mode 100644
index 0000000..268bfae
--- /dev/null
+++ b/server/update-ensure-tag-in-branch
@@ -0,0 +1,31 @@
+#!/bin/sh
+#
+# Tags should only be allowed to point to commits that are within a branch.
+#
+
+refname="$1"
+oldrev="$2"
+newrev="$3"
+
+# Only interested in tags
+if [[ "$refname" =~ refs/tags/(.*) ]] ; then
+	short_refname=${BASH_REMATCH[1]}
+else
+	exit 0
+fi
+
+# Except if they're getting deleted
+if [ "$newrev" == "0000000000000000000000000000000000000000" ] ; then
+	exit 0
+fi
+
+contains=$(git branch --contains "$newrev" | wc -l)
+if [ $contains -eq 0 ] ; then
+	echo "----------------------------------------------------"
+	echo
+	echo "The tag $short_refname is not included in any branch."
+	echo
+	echo "----------------------------------------------------"
+	exit 1
+fi
+
diff --git a/server/update-prefer-rebase b/server/update-prefer-rebase
index 318536b..0c9126a 100644
--- a/server/update-prefer-rebase
+++ b/server/update-prefer-rebase
@@ -32,7 +32,6 @@
 #
 # * --- * --- * --- oldrev --- new --- new --- newrev
 
-# Command line
 refname="$1"
 oldrev="$2"
 newrev="$3"
diff --git a/tests/t3100-server-ensure-tag-in-branch.sh b/tests/t3100-server-ensure-tag-in-branch.sh
new file mode 100644
index 0000000..55b8621
--- /dev/null
+++ b/tests/t3100-server-ensure-tag-in-branch.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+test_description='server update tags in branch check'
+
+. ./test-lib.sh
+
+test_expect_success 'setup' '
+	echo "setup" >a &&
+	git add a &&
+	git commit -m "setup" &&
+	git clone ./. server &&
+	rm -fr server/.git/hooks &&
+	git remote add origin ./server
+'
+
+install_update_hook 'update-ensure-tag-in-branch'
+
+test_expect_success 'push only tag fails' '
+	echo "$test_name" >a &&
+	git commit -a -m "$test_name moved master" &&
+	git tag -a -m "tagged move as r1" r1 &&
+	! git push --tags 2>push.err &&
+	cat push.err | grep "The tag r1 is not included in any branch." &&
+
+	# But now it works if we push the commit first
+	git push &&
+	git push --tags
+'
+
+test_expect_success 'push works if done at the same time' '
+	echo "$test_name" >a &&
+	git commit -a -m "$test_name moved master" &&
+	git tag -a -m "tagged move as r2" r2 &&
+	git push origin master r2
+'
+
+test_expect_success 'moving branch back and deleting tag works' '
+	git reset --hard HEAD^ &&
+	git push --force origin master:master :r2
+'
+
+test_done
+
-- 
2.39.5