Re: denyNonFastForwards & co fail outside refs/<heads,tags>

Hallvard B Furuseth [off-list ref] writes:

config options receive.<denyNonFastForward, denyDeletes> do not work in
nonstandard ref namespaces.  I stumbled over it in refs/notes/, but the
problem is general.  Or if it this intentional, it is the git-config(1)
doc of these options which needs fixing.

I think it is very deliberate that denyNonFastForward does not check
anything outside local branch namespace, because there may not even be
ancestry relationship between the object a tag currently points at and the
new object the tag is trying to update (think: a tag can point at a tree
or a blob) and more importantly because pushing into refs/remotes/origin/*
namespace (which is the right way to simulate a "git fetch" from the
repository with a "git push" from outside into the repository in a
firewalled environment where you cannot initiate a connection in one
direction) should be allowed (just like "remote.*.fetch" line in
.git/config get a leading plus sign '+' by default).

I suspect that the restriction on deny_deletes was inherited by a mindless
cut & paste from the deny_non_fast_forwards codepath; I don't think of a
sane rationale to justify the limitation offhand, other than "it has been
wide open since November of 2008 and people may now be relying on that".