Hub sends tags signed by certified keys to old clients, breaking 0.5.0 clones issue #131 closed: completed andymccall opened this 15 days ago · 0 comments

Since issue #129 a release tag can be signed by a ten-minute certified key. oxy 0.5.0 and older refuse such a tag at adopt_tag (only direct grants, delegates and predecessors) and the refusal fails the whole clone/fetch: 'key 789b118b5c45 may not create tags/v0.5.0 under this repository's policy'. andymccall/oxygen can no longer be cloned by released clients, and submodule update of deps/oxygen fails the same way. Fix: clients declare User-Agent and Oxy-Features: certified-tags; servers (hub and oxy serve) leave out of the refs answer every tag an old client would refuse when the header is absent.