commit 44740114875c96dd82e588aab0025e97c25d3997
from: Stefan Sperling <stsp@stsp.name>
date: Wed Apr 17 17:41:47 2024 UTC

fix previous; pledge("stdio") must wait until after the TLS handshake

commit - 29b6cbbaee05814fbac85312d69ee8ec76c92d82
commit + 44740114875c96dd82e588aab0025e97c25d3997
blob - f443ed57aaa607502d7aade2e884676a1cfe4b79
blob + a5f2e1b28bbc8c0f51f1f3e9385f4f165dbd0b1b
--- libexec/got-fetch-http/got-fetch-http.c
+++ libexec/got-fetch-http/got-fetch-http.c
@@ -431,21 +431,21 @@ upload_request(int https, const char *host, const char
 
 	if ((sock = dial(https, host, port)) == -1)
 		return -1;
+
+	if (bufio_init(&bio)) {
+		warnx("bufio_init");
+		goto err;
+	}
+	bufio_set_fd(&bio, sock);
+	if (https && bufio_starttls(&bio, host, 0, NULL, 0, NULL, 0) == -1) {
+		warnx("bufio_starttls");
+		goto err;
+	}
 #ifndef PROFILE
 	/* TODO: can we push this upwards such that get_refs() is covered? */
 	if (pledge("stdio", NULL) == -1)
 		err(1, "pledge");
 #endif
-	if (bufio_init(&bio)) {
-		warnx("bufio_init");
-		goto err;
-	}
-	bufio_set_fd(&bio, sock);
-	if (https && bufio_starttls(&bio, host, 0, NULL, 0, NULL, 0) == -1) {
-		warnx("bufio_starttls");
-		goto err;
-	}
-
 	if (http_open(&bio, https, "POST", host, port, path, "/git-upload-pack",
 	    NULL, UPLOAD_PACK_REQ) == -1)
 		goto err;