commit 44740114875c96dd82e588aab0025e97c25d3997
from: Stefan Sperling <stsp@stsp.name>
date: Wed Apr 17 17:41:47 2024 UTC

fix previous; pledge("stdio") must wait until after the TLS handshake

commit - 29b6cbbaee05814fbac85312d69ee8ec76c92d82
commit + 44740114875c96dd82e588aab0025e97c25d3997
blob - f443ed57aaa607502d7aade2e884676a1cfe4b79
blob + a5f2e1b28bbc8c0f51f1f3e9385f4f165dbd0b1b
--- libexec/got-fetch-http/got-fetch-http.c
+++ libexec/got-fetch-http/got-fetch-http.c
@@ -431,11 +431,7 @@ upload_request(int https, const char *host, const char
 
 	if ((sock = dial(https, host, port)) == -1)
 		return -1;
-#ifndef PROFILE
-	/* TODO: can we push this upwards such that get_refs() is covered? */
-	if (pledge("stdio", NULL) == -1)
-		err(1, "pledge");
-#endif
+
 	if (bufio_init(&bio)) {
 		warnx("bufio_init");
 		goto err;
@@ -445,7 +441,11 @@ upload_request(int https, const char *host, const char
 		warnx("bufio_starttls");
 		goto err;
 	}
-
+#ifndef PROFILE
+	/* TODO: can we push this upwards such that get_refs() is covered? */
+	if (pledge("stdio", NULL) == -1)
+		err(1, "pledge");
+#endif
 	if (http_open(&bio, https, "POST", host, port, path, "/git-upload-pack",
 	    NULL, UPLOAD_PACK_REQ) == -1)
 		goto err;