Subject: Re: [PATCH v2] refspec: safely parse refspecs outside a repository

From: Junio C Hamano <[email-masked]>
Date: Sat, 21 Mar 2026 20:31:08 -0700

K Jayatheerth <[email-masked]> writes:

> Additionally, while looking into the remote-curl execution path,
> take the opportunity to remove an unused `#include "git-curl-compat.h"`
> from `remote-curl.c`.

I wish you didn't do this in the same patch.  It is completely
unrelated, isn't it?

>  refspec.c                   |  4 ++--
>  remote-curl.c               |  1 -
>  t/t5551-http-fetch-smart.sh | 15 +++++++++++++++
>  3 files changed, 17 insertions(+), 3 deletions(-)

> +test_expect_success 'ls-remote outside repo does not segfault with fetch refspec' '
> +	GIT_CEILING_DIRECTORIES=$(pwd) &&
> +	export GIT_CEILING_DIRECTORIES &&
> +	mkdir nongit &&
> +	(
> +		cd nongit &&
> +		env GIT_CONFIG_NOSYSTEM=1 \
> +			GIT_CONFIG_GLOBAL=/dev/null \
> +			GIT_CONFIG_COUNT=1 \
> +			GIT_CONFIG_KEY_0=remote.origin.fetch \
> +			GIT_CONFIG_VALUE_0="+refs/tags/*:refs/tags/*" \
> +			git ls-remote "$HTTPD_URL/smart/repo.git"

This complex "env" dance is probably uncalled for.  Wouldn't
something like

	mkdir nongit &&
	git -C nongit -c remote.origin.fetch=+refs/*:refs/* \
		ls-remote "$HTTPD_URL/smart/repo.git"

be sufficient?