Adapt sync command to sync latest valid revision

In case git verification is enabled and the HEAD revision of the
configured branch could not be verified, we still want to synchronize
up till the latest valid commit and report back to the user that;

1. we found a commit with an invalid signature
2. we synchronized up till the latest valid commit we found

On all other errors we still fail.

cmd/fluxctl/await.go

@@ -70,6 +70,7 @@ func awaitJob(ctx context.Context, client api.Server, jobID job.ID) (job.Result,
 		}
 		switch j.StatusString {
 		case job.StatusFailed:
+			result = j.Result
 			return false, j
 		case job.StatusSucceeded:
 			if j.Err != "" {

cmd/fluxctl/sync_cmd.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -60,12 +61,17 @@ func (opts *syncOpts) RunE(cmd *cobra.Command, args []string) error {
 	}
 	result, err := awaitJob(ctx, opts.API, jobID)
 	if err != nil {
-		fmt.Fprintf(cmd.OutOrStderr(), "Failed to complete sync job (ID %q)\n", jobID)
-		return err
+		switch isUnverifiedHead(err) {
+		case true:
+			fmt.Fprintf(cmd.OutOrStderr(), "Warning: %s\n", err)
+		default:
+			fmt.Fprintf(cmd.OutOrStderr(), "Failed to complete sync job (ID %q)\n", jobID)
+			return err
+		}
 	}
 
 	rev := result.Revision[:7]
-	fmt.Fprintf(cmd.OutOrStderr(), "HEAD of %s is %s\n", gitConfig.Remote.Branch, rev)
+	fmt.Fprintf(cmd.OutOrStderr(), "Revision of %s to apply is %s\n", gitConfig.Remote.Branch, rev)
 	fmt.Fprintf(cmd.OutOrStderr(), "Waiting for %s to be applied ...\n", rev)
 	err = awaitSync(ctx, opts.API, rev)
 	if err != nil {
@@ -74,3 +80,9 @@ func (opts *syncOpts) RunE(cmd *cobra.Command, args []string) error {
 	fmt.Fprintln(cmd.OutOrStderr(), "Done.")
 	return nil
 }
+
+func isUnverifiedHead(err error) bool {
+	return err != nil &&
+		(strings.Contains(err.Error(), "branch HEAD in the git repo is not verified") &&
+			strings.Contains(err.Error(), "last verified commit was"))
+}

daemon/daemon.go

@@ -257,7 +257,7 @@ func (d *Daemon) executeJob(id job.ID, do jobFunc, logger log.Logger) (job.Resul
 	d.JobStatusCache.SetStatus(id, job.Status{StatusString: job.StatusRunning})
 	result, err := do(ctx, id, logger)
 	if err != nil {
-		d.JobStatusCache.SetStatus(id, job.Status{StatusString: job.StatusFailed, Err: err.Error()})
+		d.JobStatusCache.SetStatus(id, job.Status{StatusString: job.StatusFailed, Err: err.Error(), Result: result})
 		return result, err
 	}
 	d.JobStatusCache.SetStatus(id, job.Status{StatusString: job.StatusSucceeded, Result: result})
@@ -353,17 +353,25 @@ func (d *Daemon) sync() jobFunc {
 		if err != nil {
 			return result, err
 		}
-		head, err := d.Repo.Revision(ctx, d.GitConfig.Branch)
+		syncHead, err := d.Repo.Revision(ctx, d.GitConfig.SyncTag)
 		if err != nil {
 			return result, err
 		}
-		if latestVerifiedRev, _, err := latestValidRevision(ctx, d.Repo, d.GitConfig, head); err != nil {
+		var latestVerifiedRev string
+		if latestVerifiedRev, _, err = latestValidRevision(ctx, d.Repo, d.GitConfig, syncHead); err != nil {
+			return result, err
+		} else if head, err := d.Repo.Revision(ctx, d.GitConfig.Branch); err != nil {
 			return result, err
 		} else if head != latestVerifiedRev {
-			return result, fmt.Errorf("unable to sync to invalid HEAD revision (%s) latest valid revision is: %s", head, latestVerifiedRev)
-		}
-		result.Revision = head
-		return result, nil
+			result.Revision = latestVerifiedRev
+			return result, fmt.Errorf(
+				"The branch HEAD in the git repo is not verified, and fluxd is unable to sync to it. The last verified commit was %.8s. HEAD is %.8s.",
+				latestVerifiedRev,
+				head,
+			)
+		}
+		result.Revision = latestVerifiedRev
+		return result, err
 	}
 }