Tag change: Double check agreement in rpush protocol

Send the tag format as a param and check that it is the same at both
ends.  This check _ought_ not ever to fail, but I want to be sure.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

1 files changed, 11 insertions, 0 deletions

diff --git a/dgit b/dgit
index 65e8666..a2771c5 100755
--- a/dgit
+++ b/dgit
@@ -66,6 +66,7 @@ our $we_are_responder;
 our $initiator_tempdir;
 our $patches_applied_dirtily = 00;
 our $tagformat_want;
+our $tagformat;
 our $tagformatfn;
 
 our %format_ok = map { $_=>1 } ("1.0","3.0 (native)","3.0 (quilt)");
@@ -245,6 +246,7 @@ sub quiltmode_splitbrain () {
 #
 #  > param head HEAD
 #  > param csuite SUITE
+#  > param tagformat old|new
 #
 #  > previously REFNAME=OBJNAME       # if --deliberately-not-fast-forward
 #                                     # goes into tag, for replay prevention
@@ -1259,6 +1261,7 @@ sub select_tagformat () {
 	    or grep { $_ eq $fmt } @supported;
 
     $tagformat_want = undef;
+    $tagformat = $fmt;
     $tagformatfn = ${*::}{"debiantag_$fmt"};
 
     fail "trying to use unknown tag format \`$fmt' ($why) !"
@@ -2107,6 +2110,7 @@ END
     responder_send_file('changes',$changesfile);
     responder_send_command("param head $head");
     responder_send_command("param csuite $csuite");
+    responder_send_command("param tagformat $tagformat");
 
     if (deliberately_not_fast_forward) {
 	git_for_each_ref(lrfetchrefs, sub {
@@ -2552,6 +2556,13 @@ sub i_want_signed_tag {
     my $head = $i_param{'head'};
     die if $head =~ m/[^0-9a-f]/ || $head !~ m/^../;
 
+    select_tagformat();
+    if ($protovsn >= 4) {
+	my $p = $i_param{'tagformat'} // '<undef>';
+	$p eq $tagformat
+	    or badproto \*RO, "tag format mismatch: $p vs. $tagformat";
+    }
+
     die unless $i_param{'csuite'} =~ m/^$suite_re$/;
     $csuite = $&;
     push_parse_dsc $i_dscfn, 'remote dsc', $i_version;