Re: [RFC/PATCH] receive-pack.c: only accept push-cert if push_cert_nonce was advertised

[Junio C Hamano <gitster@pobox.com>]

Stefan Beller <sbeller@google.com> writes:

> Your proposal to acknowledge the correctness of the message leads
> to more questions. How would we proceed?

How would it fail if we pretend that "push-cert" line had to be
old/new/ref line?  Failing the same way, but with a better
diagnosis, would be sufficient.

> I expect such behavior only from malicious clients which actively
> want to abuse a feature which wasn't advertised,...

Do not assume malice; it is not 2005 anymore.  You have to remember
that we are mature enough that there are many reimplementations of
Git, all of which (us included ;-) start with a buggy version.

>> When the protocol exchange gets to this state, in practice, we know
>> we are talking with somebody who has push privilege into the
>> repository,
>
> Yeah but what is one repository compared to the whole server?

Huh?  If an auth good enough for one repository allows things to
another repository, then I consider that to that other repository
the pusher also has push privilege.  So what is the problem?

But again, our first version could just be "pretend we do not know
anything about push-cert", with discussions on alternative
considered in its log message.  I do not think it is a blocker to
lack the "more helpful diagnosis" feature.