Push errors name the bookmark and the failing step be451356e3ef

    /// Check an update's attestation against the latest one for its

    /// reference and store it as the new latest. Failures say what was

    /// being done, for which reference, so a refused push can be diagnosed

    /// from its reason alone.

    fn record_update_attest(

        &self,

        u: &RefUpdate,

        sa: &SignedAttest,

    ) -> std::result::Result<(), String> {

        let name = &u.name;

        let last = self

            .latest_ref_attest(name)

            .map_err(|e| format!("reading the last attestation of {name:?}: {e}"))?

            .and_then(|(_, a)| match a.attest.body {

                AttestBody::Ref { serial, .. } => Some(serial),

                _ => None,

            });

        self.check_ref_attest(sa, name, &u.old_state, &u.new_state, last, false)?;

        let store = |e: &dyn std::fmt::Display| format!("storing the attestation of {name:?}: {e}");

        let r = self.store.put_attest(&sa.attest).map_err(|e| store(&e))?;

        for sig in &sa.sigs {

            self.store.put_signature(&r, sig).map_err(|e| store(&e))?;

        }

        self.set_ref_attest(name, &r).map_err(|e| store(&e))

    }

            self.record_update_attest(u, sa)?;

            self.record_update_attest(u, sa)?;

        use oxy_core::repo::RepoError;

        // The server's own storage failing is not the client's fault.

        let status = match &e {

            RepoError::Io(_) | RepoError::Store(_) => StatusCode::INTERNAL_SERVER_ERROR,

            _ => StatusCode::BAD_REQUEST,

        };

        Failure(status, e.to_string())

        let repo = name.clone();

            server.respond(&repo, endpoint, body, claimed, &request_headers)

        let failure = match result {

            Ok(Ok(r)) => return r,

            Ok(Err(f)) => f,

            Err(e) => Failure(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()),

        };

        // Name the operation and repository, in the log and for the client.

        let f = Failure(

            failure.0,

            format!("{} of {name}: {}", endpoint.name(), failure.1),

        );

        eprintln!("oxy-server: {}: {}", f.0.as_u16(), f.1);

        f.into_response()

                }

                for r in report.results.iter().filter(|r| !r.ok) {

                    eprintln!(

                        "oxy-server: push to {name}: {} refused: {}",

                        r.name, r.reason

                    );

/// A push the server cannot store says which bookmark and what failed, so

/// it can be diagnosed from the client's message alone.

#[cfg(unix)]

#[test]

fn a_refused_push_names_the_bookmark_and_the_step() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let served = root.join("served");

    Repo::init_bare(&served.join("lib")).unwrap();

    // Break the server's attestation store for writing only: reading finds

    // nothing there, storing a new attestation fails.

    let attest = served.join("lib/.oxy/attest");

    fs::create_dir_all(&attest).unwrap();

    {

        use std::os::unix::fs::PermissionsExt;

        fs::set_permissions(&attest, fs::Permissions::from_mode(0o555)).unwrap();

    }

    let base = start(&served, vec![]);

    let work = root.join("work");

    let mut client = Repo::clone(&format!("{base}/lib"), &work)

        .unwrap()

        .with_home(root.join("home"));

    client

        .create_identity(

            "Ada",

            "[email protected]",

            oxy_core::repo::IdentityScope::Repo,

        )

        .unwrap();

    write(&work, "a.txt", b"a\n");

    client.commit("a", &[]).unwrap();

    client.bookmark_create("feature/x", None).unwrap();

    let r = client.push_bookmark("origin", "feature/x", false).unwrap();

    assert!(!r[0].ok);

    assert!(

        r[0].reason.contains("\"feature/x\"") && r[0].reason.contains("storing the attestation"),

        "{}",

        r[0].reason

    );

    {

        use std::os::unix::fs::PermissionsExt;

        fs::set_permissions(&attest, fs::Permissions::from_mode(0o755)).unwrap();

    }

}

On push, the server MUST, in order: verify that every change has a valid signature or seal from a key embedded in policy and satisfies the author-or-delegate rule (§14.4), verify the attestation for each reference, check that `old_state` matches its current state (compare-and-swap), check policy rules for the reference including `allow_conflicts`, check that every dependency of every change is either included or already stored, and only then update references atomically. A failure rejects the whole push. A refusal's reason names the reference and, for a failure of the server's own storage, the step that failed; the reference server also logs every refusal and every failed request with its repository and operation, and answers a storage failure with 500 rather than 400.