allod patch receive can continue after destination repo resolution failure #80

New issue

Closed

opened 2026-07-01 16:37:19 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-07-01 16:37:19 +01:00

Contributor

Problem

allod patch receive <host>:<source-repo> <dest-repo> can continue after destination repo resolution fails and then apply/identity-check against the current working repo. This produces a misleading repo identity mismatch.

Observed

From ~/work/allod/profiles:

allod patch receive nix-dev:/home/vnprc/work/allod/memory ~/work/allod/memory

Output included:


allod: not a directory: /home/vnprc/work/allod/memory
allod: repo identity mismatch
allod: manifest remote: ssh://git@forge.anarch.diy:2222/Allod/memory.git
allod: destination remote: ssh://git@forge.anarch.diy:2222/vnprc/profiles.git

Diagnosis

patch_receive calls patch_apply under set +e to capture its status. Inside patch_apply, destination repo resolution is performed via command substitution (repo=$(resolve_git_repo ...)). If resolve_git_repo calls die, the assignment fails but the function can continue while errexit is disabled by the caller. It then uses an empty repo path, so git -C "" effectively checks the caller cwd, here profiles.
This is a tooling bug, not a repository registry mismatch. A rebuild may update the installed tool, but the source still needs a hardening fix unless this was already fixed elsewhere.

Suggested Fix

Preflight and resolve <destination-repo> in patch_receive before remote fetch begins, so bad destination paths fail before artifacts are fetched.
Make patch_apply fail immediately when resolve_git_repo fails, even when called under set +e.
Add regression coverage for destination resolution failure from a cwd that is a different repo; it must not print repo identity mismatch for the cwd repo.

## Problem `allod patch receive <host>:<source-repo> <dest-repo>` can continue after destination repo resolution fails and then apply/identity-check against the current working repo. This produces a misleading repo identity mismatch. ## Observed From `~/work/allod/profiles`: ```sh allod patch receive nix-dev:/home/vnprc/work/allod/memory ~/work/allod/memory ``` Output included: ```text allod: not a directory: /home/vnprc/work/allod/memory allod: repo identity mismatch allod: manifest remote: ssh://git@forge.anarch.diy:2222/Allod/memory.git allod: destination remote: ssh://git@forge.anarch.diy:2222/vnprc/profiles.git ``` ## Diagnosis `patch_receive` calls `patch_apply` under `set +e` to capture its status. Inside `patch_apply`, destination repo resolution is performed via command substitution (`repo=$(resolve_git_repo ...)`). If `resolve_git_repo` calls `die`, the assignment fails but the function can continue while `errexit` is disabled by the caller. It then uses an empty repo path, so `git -C ""` effectively checks the caller cwd, here `profiles`. This is a tooling bug, not a repository registry mismatch. A rebuild may update the installed tool, but the source still needs a hardening fix unless this was already fixed elsewhere. ## Suggested Fix - Preflight and resolve `<destination-repo>` in `patch_receive` before remote fetch begins, so bad destination paths fail before artifacts are fetched. - Make `patch_apply` fail immediately when `resolve_git_repo` fails, even when called under `set +e`. - Add regression coverage for destination resolution failure from a cwd that is a different repo; it must not print repo identity mismatch for the cwd repo.