From 96128cad7be0f83f4d1ac66544589cacafcdc614 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 17 Oct 2026 17:09:14 -1000
Subject: Hold a signature download to max-blob-size

A signature is a note a pusher stored, and the download read it whole
without the size check every other blob a page inflates goes through.
---
 tests/t0110-snapshot.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'tests')

diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh
index 2ce8316..c38b3c3 100755
--- a/tests/t0110-snapshot.sh
+++ b/tests/t0110-snapshot.sh
@@ -190,4 +190,16 @@ test_expect_success 'a snapshot name leads to the tag ahead of a branch' '
 	test "$(gzip -dc tag.tar.gz | git -C repos/vtags get-tar-commit-id)" = "$(git -C repos/vtags rev-parse refs/tags/v1.0^{commit})"
 '
 
+# A signature is a note a pusher stored, held to max-blob-size like any blob.
+test_expect_success 'a signature past max-blob-size is refused' '
+	big=$(test_seq 1 2000 | git -C repos/vtags hash-object -w --stdin) &&
+	git -C repos/vtags notes --ref signatures/tar.gz add -C $big v1.0 &&
+	{
+		echo "max-blob-size=1" &&
+		cat vtagsrc
+	} >sigrc &&
+	CGIT_CONFIG="$PWD/sigrc" QUERY_STRING="url=vtags/snapshot/vtags-1.0.tar.gz.asc" cgit >tmp &&
+	grep "^Status: 413" tmp
+'
+
 test_done
-- 
cgit