Subject: Re: [PATCH 14/16] promisor-remote: trust known remotes matching acceptFromServerUrl

From: Junio C Hamano <[email-masked]>
Date: Tue, 31 Mar 2026 15:03:27 -0700

Christian Couder <[email-masked]> writes:

>> Between the first sentence and the second one, I think there needs
>> to be an explanation on what "trusted" means in this context.  Is it
>> trusted so that the URL can feed random configuration variable=value
>> pairs for the client to blindly apply?  Or is it trusted to do very
>> limited things that other remotes can do, and if so what are these
>> limited things?  Without knowing that, the end-users cannot assess
>> the security implications of setting this option.
>
> Yeah, in the current version, the following is used, which is more explicit:
> ...

Do you mean by "the current version", the one you are preparing as
an updated iteration?

If so, let me mark the topic to be expecting a reroll.  From the
reviews by Patrick, I am not sure if I should also add the usual
"(hopefully small and final)" in this case, not just yet, though.

Thanks.