From: Ian Jackson <ijackson@chiark.greenend.org.uk>
Date: Sat, 2 May 2015 16:44:11 +0000 (+0100)
Subject: Policy hook sets mode of NEW repos (and policy protocol passes new repo pathname... 
X-Git-Tag: debian/0.30~207
X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=dgit.git;a=commitdiff_plain;h=2965f30cca23b1cb7c1cf1d764b4f6b571f0a78e

Policy hook sets mode of NEW repos (and policy protocol passes new repo pathname for this purpose)
---

diff --git a/infra/dgit-repos-policy-debian b/infra/dgit-repos-policy-debian
index cdfa80e7..41a5551f 100755
--- a/infra/dgit-repos-policy-debian
+++ b/infra/dgit-repos-policy-debian
@@ -247,6 +247,10 @@ sub action_push () {
 }
 
 sub action_push_confirm () {
+    getpackage();
+    die unless @ARGV;
+    my $freshrepo = shift @ARGV;
+
     my $initq = $poldbh->prepare(<<END);
         SELECT taint_id, gitobjid FROM taints t
             WHERE (package = ? OR package = '')
@@ -355,6 +359,17 @@ END
         return 1;
     }
 
+    if (length $freshrepo) {
+	if (!good_suite_has_vsn_in_our_history()) {
+	    stat $freshrepo or die "$freshrepo $!";
+	    my $oldmode = ((stat _)[2]);
+	    my $oldwrites = $oldmode & 0222;
+	    # remove r and x bits which have corresponding w bits clear
+	    my $newmode = $oldmode & ($oldwrites << 1) & ($oldwrites > 1);
+	    chmod $newmode, $freshrepo or die $!;
+	}
+    }
+
     return 0;
 }
 
diff --git a/infra/dgit-repos-server b/infra/dgit-repos-server
index 0d55aa13..3f9298f2 100755
--- a/infra/dgit-repos-server
+++ b/infra/dgit-repos-server
@@ -120,8 +120,10 @@ $SIG{__WARN__} = sub { die $_[0]; };
 # ie.
 #   POLICY-HOOK-SCRIPT ... check-list [...]
 #   POLICY-HOOK-SCRIPT ... check-package PACKAGE [...]
-#   POLICY-HOOK-SCRIPT ... push|push-confirm PACKAGE \
+#   POLICY-HOOK-SCRIPT ... push PACKAGE \
 #         VERSION SUITE TAGNAME DELIBERATELIES [...]
+#   POLICY-HOOK-SCRIPT ... push-confirm PACKAGE \
+#         VERSION SUITE TAGNAME DELIBERATELIES FRESH-REPO|'' [...]
 #
 # Exit status is a bitmask.  Bit weight constants are defined in Dgit.pm.
 #    NOFFCHECK   (2)
@@ -138,7 +140,14 @@ $SIG{__WARN__} = sub { die $_[0]; };
 # to-be-pushed objects have been received; TAGNAME is the
 # version-based tag
 #
+# FRESH-REPO is '' iff the repo for this package already existed, or
+# the pathname of the newly-created repo which will be renamed into
+# place if everything goes well.  (NB that this is generally not the
+# same repo as the cwd, because the objects are first received into a
+# temporary repo so they can be examined.)
+# 
 # if push requested FRESHREPO, push-confirm happens in said fresh repo
+# and FRESH-REPO is guaranteed not to be ''.
 #
 # policy hook for a particular package will be invoked only once at
 # a time - (see comments about DGIT-REPOS-DIR, above)
@@ -739,7 +748,8 @@ sub checks () {
 	mkrepo_fromtemplate $destrepo;
     }
 
-    policyhook(0, 'push-confirm', @policy_args);
+    my $willinstall = ($destrepo eq realdestrepo ? '' : $destrepo);
+    policyhook(0, 'push-confirm', @policy_args, $willinstall);
 }
 
 sub onwardpush () {