From 6e47a1924b71c44b989769e6af41459b0f5da6d2 Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorickpeterse@gmail.com>
Date: Wed, 4 May 2016 10:44:43 +0200
Subject: [PATCH 1/3] Updated gitlab_git to 10.1.0

---
 CHANGELOG    | 2 ++
 Gemfile.lock | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 5469723bec..769ffb2476 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,8 @@ Please view this file on the master branch, on stable branches it's out of date.
 v 8.8.0 (unreleased)
   - Project#open_branches has been cleaned up and no longer loads entire records into memory.
   - Log to application.log when an admin starts and stops impersonating a user
+  - Updated gitlab_git to 10.1.0
+  - GitAccess#protected_tag? no longer loads all tags just to check if a single one exists
   - Make build status canceled if any of the jobs was canceled and none failed
   - Upgrade Sidekiq to 4.1.2
   - Sanitize repo paths in new project error message
diff --git a/Gemfile.lock b/Gemfile.lock
index a8f7bfe43b..fe083c2b56 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -353,7 +353,7 @@ GEM
       posix-spawn (~> 0.3)
     gitlab_emoji (0.3.1)
       gemojione (~> 2.2, >= 2.2.1)
-    gitlab_git (10.0.2)
+    gitlab_git (10.1.0)
       activesupport (~> 4.0)
       charlock_holmes (~> 0.7.3)
       github-linguist (~> 4.7.0)

From 93ce229665f875efcd7ee25b006834300c2e37be Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorickpeterse@gmail.com>
Date: Fri, 29 Apr 2016 21:41:39 +0200
Subject: [PATCH 2/3] Use tag_exists? in GitAccess#protected_tag?

This removes the need for retrieving the entire list of tags just to
check if a specific one exists.
---
 lib/gitlab/git_access.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 3ed1eec517..ad2da2b81c 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -176,7 +176,7 @@ module Gitlab
     end
 
     def protected_tag?(tag_name)
-      project.repository.tag_names.include?(tag_name)
+      project.repository.tag_exists?(tag_name)
     end
 
     def user_allowed?

From 003671207db67eee5f3ceb605a061346dfad945d Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorickpeterse@gmail.com>
Date: Wed, 4 May 2016 12:06:40 +0200
Subject: [PATCH 3/3] Fix passing nil to protected_tag?

Previously this method would directly receive the output of tag_name().
This method could either return a String or nil. In the previous setup
this would somehow magically work but because Rugged::TagCollection#[]
doesn't accept nil values it started to fail.

To work around this the elsif in change_access_check() assigns the
result of tag_name() to a local and then _only_ calls protected_tag?()
if the tag name is not nil. The extra parenthesis are put in place to
ensure that things are parsed correctly, without these the code would be
parsed as follows:

    elsif tag_ref = (tag_name(ref) && protected_tag(tag_ref))

During runtime this would basically resolve to:

    elsif tag_ref = (tag_name(ref) && protected_tag(nil))

This is because when you refer to the variable you're assigning _in_ the
assignment Ruby returns nil instead of raising an error.
---
 lib/gitlab/git_access.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index ad2da2b81c..6cb4123987 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -128,7 +128,7 @@ module Gitlab
       action =
         if project.protected_branch?(branch_name(ref))
           protected_branch_action(oldrev, newrev, branch_name(ref))
-        elsif protected_tag?(tag_name(ref))
+        elsif (tag_ref = tag_name(ref)) && protected_tag?(tag_ref)
           # Prevent any changes to existing git tag unless user has permissions
           :admin_project
         else