From: "Omar Polo" <op@omarpolo.com>
Subject: gitproto: match on capabilities value as well
To: gameoftrees@openbsd.org
Date: Fri, 06 Feb 2026 16:10:38 +0100

Hello,

This is a required step in supporting sha256 in the networking protocol.

I'm extracting this out because it's a bit tricky.

I'll soon add the object-format=sha256 capability to fetch and send, but
the current matching logic only looks at the capability name and ignore
the value.  So, if the server advertises object-format=sha1 we would
match it, even if we really wanted to "just" match on object-format=sha256.

Hence, I think that we should also match on the capabilities value.  ok?

diff /home/op/w/got
path + /home/op/w/got
commit - bfa23824c7174c1c9f479745a8dc928acd272cb1
blob - f8a58e05685c1a15956029d0833c3014e3008d78
file + lib/gitproto.c
--- lib/gitproto.c
+++ lib/gitproto.c
@@ -238,6 +238,15 @@ match_capability(char **my_capabilities, const char *c
 	if (equalsign) {
 		if (strncmp(capa, mycapa->key, equalsign - capa) != 0)
 			return NULL;
+
+		/*
+		 * require an exact match on capabilities value,
+		 * except for agent.
+		 */
+		if (strcmp(mycapa->key, "agent") != 0 &&
+		    strcmp(equalsign + 1, mycapa->value) != 0)
+			return NULL;
+
 	} else {
 		if (strcmp(capa, mycapa->key) != 0)
 			return NULL;