X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=dgit.git;a=blobdiff_plain;f=dgit;h=f6bf3a7cbe2e4d48075a585a5c8dc41cc88e2ce1;hp=c84fb80e40f4cd4359c064d0d696261c21426545;hb=7a226db27fb1e8b59a65bed06fa3aace2c266cb0;hpb=e81d275459a9414975c97cf6958b8a968062c496

diff --git a/dgit b/dgit
index c84fb80e..f6bf3a7c 100755
--- a/dgit
+++ b/dgit
@@ -450,8 +450,15 @@ our %defcfg = ('dgit.default.distro' => 'debian',
 	       'dgit-distro.debian.git-path' => '/dgit/debian/repos',
 	       'dgit-distro.debian.git-check' => 'ssh-cmd',
  'dgit-distro.debian.archive-query-url', 'https://api.ftp-master.debian.org/',
- 'dgit-distro.debian.archive-query-tls-key',
-    '/etc/ssl/certs/%HOST%.pem:/etc/dgit/%HOST%.pem',
+# 'dgit-distro.debian.archive-query-tls-key',
+#    '/etc/ssl/certs/%HOST%.pem:/etc/dgit/%HOST%.pem',
+# ^ this does not work because curl is broken nowadays
+# Fixing #790093 properly will involve providing providing the key
+# in some pacagke and maybe updating these paths.
+#
+# 'dgit-distro.debian.archive-query-tls-curl-args',
+#   '--ca-path=/etc/ssl/ca-debian',
+# ^ this is a workaround but works (only) on DSA-administered machines
 	       'dgit-distro.debian.diverts.alioth' => '/alioth',
 	       'dgit-distro.debian/alioth.git-host' => 'git.debian.org',
 	       'dgit-distro.debian/alioth.git-user-force' => '',
@@ -706,16 +713,25 @@ sub archive_api_query_cmd ($) {
     my $url = access_cfg('archive-query-url');
     if ($url =~ m#^https://([-.0-9a-z]+)/#) {
 	my $host = $1;
-	my $keys = access_cfg('archive-query-tls-key','RETURN-UNDEF');
+	my $keys = access_cfg('archive-query-tls-key','RETURN-UNDEF') //'';
 	foreach my $key (split /\:/, $keys) {
 	    $key =~ s/\%HOST\%/$host/g;
 	    if (!stat $key) {
 		fail "for $url: stat $key: $!" unless $!==ENOENT;
 		next;
 	    }
-	    push @cmd, "--ca-certificate=$key", "--ca-directory=/dev/enoent";
+	    fail "config requested specific TLS key but do not know".
+		" how to get curl to use exactly that EE key ($key)";
+#	    push @cmd, "--cacert", $key, "--capath", "/dev/enoent";
+#           # Sadly the above line does not work because of changes
+#           # to gnutls.   The real fix for #790093 may involve
+#           # new curl options.
 	    last;
 	}
+	# Fixing #790093 properly will involve providing a value
+	# for this on clients.
+	my $keys = access_cfg('archive-query-tls-curl-ca-args','RETURN-UNDEF');
+	push @cmd, split / /, $keys if defined $keys;
     }
     push @cmd, $url.$subpath;
     return @cmd;
@@ -1693,7 +1709,7 @@ sub dopush ($) {
 	create_remote_git_repo();
     }
     runcmd_ordryrun @git, qw(push),access_giturl(),
-        $forceflag."HEAD:".rrref(), "refs/tags/$tag";
+        $forceflag."HEAD:".rrref(), $forceflag."refs/tags/$tag";
     runcmd_ordryrun @git, qw(update-ref -m), 'dgit push', lrref(), 'HEAD';
 
     if ($we_are_responder) {