Policy hook sets mode of NEW repos (and policy protocol passes new repo pathname...

diff --git a/infra/dgit-repos-policy-debian b/infra/dgit-repos-policy-debian
index cdfa80e702f9efdf66a84aca3b38c56cb8449950..41a5551faa005c591dfb0fed62467b9387e88dff 100755 (executable)
--- a/infra/dgit-repos-policy-debian
+++ b/infra/dgit-repos-policy-debian
@@ -247,6 +247,10 @@ sub action_push () {
 }
 
 sub action_push_confirm () {
+    getpackage();
+    die unless @ARGV;
+    my $freshrepo = shift @ARGV;
+
     my $initq = $poldbh->prepare(<<END);
         SELECT taint_id, gitobjid FROM taints t
             WHERE (package = ? OR package = '')
@@ -355,6 +359,17 @@ END
         return 1;
     }
 
+    if (length $freshrepo) {
+       if (!good_suite_has_vsn_in_our_history()) {
+           stat $freshrepo or die "$freshrepo $!";
+           my $oldmode = ((stat _)[2]);
+           my $oldwrites = $oldmode & 0222;
+           # remove r and x bits which have corresponding w bits clear
+           my $newmode = $oldmode & ($oldwrites << 1) & ($oldwrites > 1);
+           chmod $newmode, $freshrepo or die $!;
+       }
+    }
+
     return 0;
 }
 

diff --git a/infra/dgit-repos-server b/infra/dgit-repos-server
index 0d55aa133b01679ffaeb5b6d88d01d2ae2189964..3f9298f2aa3bc61f645235e72c28e813b9b97fcf 100755 (executable)
--- a/infra/dgit-repos-server
+++ b/infra/dgit-repos-server
@@ -120,8 +120,10 @@ $SIG{__WARN__} = sub { die $_[0]; };
 # ie.
 #   POLICY-HOOK-SCRIPT ... check-list [...]
 #   POLICY-HOOK-SCRIPT ... check-package PACKAGE [...]
-#   POLICY-HOOK-SCRIPT ... push|push-confirm PACKAGE \
+#   POLICY-HOOK-SCRIPT ... push PACKAGE \
 #         VERSION SUITE TAGNAME DELIBERATELIES [...]
+#   POLICY-HOOK-SCRIPT ... push-confirm PACKAGE \
+#         VERSION SUITE TAGNAME DELIBERATELIES FRESH-REPO|'' [...]
 #
 # Exit status is a bitmask.  Bit weight constants are defined in Dgit.pm.
 #    NOFFCHECK   (2)
@@ -138,7 +140,14 @@ $SIG{__WARN__} = sub { die $_[0]; };
 # to-be-pushed objects have been received; TAGNAME is the
 # version-based tag
 #
+# FRESH-REPO is '' iff the repo for this package already existed, or
+# the pathname of the newly-created repo which will be renamed into
+# place if everything goes well.  (NB that this is generally not the
+# same repo as the cwd, because the objects are first received into a
+# temporary repo so they can be examined.)
+# 
 # if push requested FRESHREPO, push-confirm happens in said fresh repo
+# and FRESH-REPO is guaranteed not to be ''.
 #
 # policy hook for a particular package will be invoked only once at
 # a time - (see comments about DGIT-REPOS-DIR, above)
@@ -739,7 +748,8 @@ sub checks () {
        mkrepo_fromtemplate $destrepo;
     }
 
-    policyhook(0, 'push-confirm', @policy_args);
+    my $willinstall = ($destrepo eq realdestrepo ? '' : $destrepo);
+    policyhook(0, 'push-confirm', @policy_args, $willinstall);
 }
 
 sub onwardpush () {