X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=dgit.git;a=blobdiff_plain;f=tests%2Ftests%2Ftrustingpolicy-replay;h=e0bf334beac8e4b75af47293db0f1e5f215986ad;hp=f6053aaffa51272c8f2038846333174128115467;hb=d45a224aee98c04bf3038dcda9b258ba5abf0d70;hpb=c1e9b51c128cde4b5359618c28405981d690127e

diff --git a/tests/tests/trustingpolicy-replay b/tests/tests/trustingpolicy-replay
index f6053aaf..e0bf334b 100755
--- a/tests/tests/trustingpolicy-replay
+++ b/tests/tests/trustingpolicy-replay
@@ -4,6 +4,7 @@ set -e
 
 t-tstunt-parsechangelog
 
+t-dsd
 t-policy dgit-repos-policy-trusting
 t-prep-newpackage example 1.0
 
@@ -14,7 +15,7 @@ git tag start
 t-dgit build
 t-dgit push --new
 
-t-commit 'Prep v2 which will be rewound'
+t-commit 'Prep v1.1 which will be rewound'
 t-dgit build
 t-dgit push
 
@@ -25,10 +26,58 @@ t-dgit push --deliberately-fresh-repo
 
 remote="`git config dgit-distro.test-dummy.git-url`/$p.git"
 
-t-expect-fail 'Replay of previously-rewound upload' \
+t-expect-push-fail 'Replay of previously-rewound upload' \
 git push "$remote" \
 	debian/1.1 \
 	debian/1.1~0:refs/dgit/sid
 
+git checkout master
+
+
+: "More subtle replay prevention checks"
+
+prepare-replay () {
+	delib=$1
+
+	# We have to stop the pushes succeeding because if they work they
+	# record the tag, which prevents the replays.  We are simulating
+	# abortive pushes (since we do want to avoid a situation where
+	# dangerous old signed tags can exist).
+	t-policy false
+
+	t-commit "request with $delib that we will replay"
+	t-dgit build
+	t-expect-push-fail E:'policy-hook.*No such file or directory' \
+	t-dgit push $delib
+
+	t-policy dgit-repos-policy-trusting
+
+	replayv=$v
+}
+
+attempt-replay () {
+	local mpat=$1
+	git show debian/$replayv | grep -e $delib
+	t-expect-push-fail "$mpat" \
+	git push "$remote" \
+		debian/$replayv \
+		+debian/$replayv~0:refs/dgit/sid
+}
+
+prepare-replay --deliberately-fresh-repo
+
+# simulate some other thing that we shouldn't delete
+git push $tmp/git/$p.git +master:refs/heads/for-testing
+
+attempt-replay 'does not declare previously heads/for-testing'
+
+prepare-replay --deliberately-not-fast-forward
+
+t-commit 'later version to stop not fast forward rewinding'
+t-dgit build
+t-dgit push
+
+attempt-replay "does not declare previously tags/debian/$v"
+
+
 echo ok.
-echo xxx want to check replay prevention insufficient proofs in tag