From 0ec5cab132599cf644f0697c5f189366c1ebc773 Mon Sep 17 00:00:00 2001
From: Ludovic Courtès <ludo@gnu.org>
Date: Sun, 8 Jun 2025 17:41:20 +0200
Subject: git authenticate: Gracefully handle passing an annotated tag to
 ‘--end’.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Partly fixes <https://issues.guix.gnu.org/74583>.

Previously, passing an annotated tag to ‘--end’, as can happen when
‘guix git authenticate’ is invoked by the pre-push hook when pushing
tags, would lead to an error:

  guix git: error: Git error: the requested type does not match the type in the ODB

* guix/scripts/git/authenticate.scm (ensure-commit-id): New procedure.
(guix-git-authenticate): Use it.
* tests/guix-git-authenticate.sh: Test with $v1_2_0_annotated_tag.

Change-Id: I22e8eb665609522c80c1f0dcb9e77a46c23c0c3c
---
 guix/scripts/git/authenticate.scm | 10 +++++++++-
 tests/guix-git-authenticate.sh    |  9 ++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/guix/scripts/git/authenticate.scm b/guix/scripts/git/authenticate.scm
index 3bc72a70b1..5f05428461 100644
--- a/guix/scripts/git/authenticate.scm
+++ b/guix/scripts/git/authenticate.scm
@@ -233,6 +233,14 @@ known-broken version is installed."
         (display %pre-push-hook port)
         (chmod port #o755)))))
 
+(define (ensure-commit-id repository oid)
+  "If OID refers to an annotated tag, return its target commit; otherwise
+return OID."
+  (let ((obj (object-lookup repository oid)))
+    (if (= OBJ-TAG (object-type obj))
+        (tag-target-id (tag-lookup repository oid))
+        oid)))
+
 (define (show-stats stats)
   "Display STATS, an alist containing commit signing stats as returned by
 'authenticate-repository'."
@@ -337,7 +345,7 @@ expected COMMIT and SIGNER~%")))
             (end         (match (assoc-ref options 'end-commit)
                            (#f  (reference-target
                                  (repository-head repository)))
-                           (oid oid)))
+                           (oid (ensure-commit-id repository oid))))
             (history     (match (assoc-ref options 'historical-authorizations)
                            (#f '())
                            (file (call-with-input-file file
diff --git a/tests/guix-git-authenticate.sh b/tests/guix-git-authenticate.sh
index 7b8951b9aa..6cbb7b59c1 100644
--- a/tests/guix-git-authenticate.sh
+++ b/tests/guix-git-authenticate.sh
@@ -1,5 +1,5 @@
 # GNU Guix --- Functional package management for GNU
-# Copyright © 2020, 2022, 2024 Ludovic Courtès <ludo@gnu.org>
+# Copyright © 2020, 2022, 2024-2025 Ludovic Courtès <ludo@gnu.org>
 #
 # This file is part of GNU Guix.
 #
@@ -53,6 +53,13 @@ guix git authenticate				\
      --cache-key="$cache_key" --stats		\
      --end="$v1_2_0_commit"
 
+# Likewise, but pass the OID of the annotated tag 'v1.2.0' instead of that of
+# the commit--this mimics what the pre-push hook gets when pushing tags.
+v1_2_0_annotated_tag="d5b556eef57321d0be89fdb07db447b2db2718ed"
+guix git authenticate				\
+     --cache-key="$cache_key" --stats		\
+     --end="$v1_2_0_annotated_tag"
+
 rm "$XDG_CACHE_HOME/guix/authentication/$cache_key"
 
 # Commit and signer of the 'v1.0.0' tag.
-- 
cgit v1.2.3