{"thread":{"id":"38385","subject":"RFC: update hook for GPG signed submission on secured branches","startedAt":"2015-01-16T19:03:51Z","lastAt":"2015-01-16T22:49:46Z","messageCount":6,"participants":["Jason Pyeron","Junio C Hamano","John Keeping"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"254827","messageId":"BBE88A3EA44D47159C483F1046AC747E@black","threadId":"38385","inReplyTo":null,"subject":"RFC: update hook for GPG signed submission on secured branches","fromName":"Jason Pyeron","fromEmail":"jpyeron@pdinc.us","sentAt":"2015-01-16T19:03:51Z","receivedAt":"2015-01-16T19:03:51Z","isPatch":false,"sender":{"key":"jpyeron@pdinc.us","avatar":"https://gravatar.com/avatar/c2e53452caa53d940768a1ffc9cf76196d851b9b534b7a39cd39852a70a0508f?d=mp&s=160"},"body":"Dev & users:\n\nI would like your feedback.\n\nI am working on a continuous integration (CI) system for CipherShed.org and we want to allow any fork to submit their patch to our CI server farm which will do integration testing. We want it to be easy to submit code, but to not allow interference with other submitters branches or fetching of other people's (any for bandwidth and simplicity) branches.\n\nWhat would you change? Any bugs that you see?\n\n-Jason (no cc please, I am on the list)\n\nHere are the 2 configs.\n\n$ cat config\n[core]\n        repositoryformatversion = 0\n        filemode = true\n        bare = true\n[http]\n        receivepack = true\n        uploadpack = false\n        getanyfile = false\n\n$ cat hooks/update\n#!/bin/bash\n\n# (c) 2015 PD Inc. License found at http://www.apache.org/licenses/LICENSE-2.0 .\n\n# --- Command line\nrefname=\"$1\"\noldrev=\"$2\"\nnewrev=\"$3\"\n\n# --- Safety check\nif [ -z \"$GIT_DIR\" ]; then\n        echo \"Don't run this script from the command line.\" >&2\n        echo \" (if you want, you could supply GIT_DIR then run\" >&2\n        echo \"  $0 <ref> <oldrev> <newrev>)\" >&2\n        exit 1\nfi\n\nif [ -z \"$refname\" -o -z \"$oldrev\" -o -z \"$newrev\" ]; then\n        echo \"usage: $0 <ref> <oldrev> <newrev>\" >&2\n        exit 1\nfi\n\nsigkey=$(\\\n git cat-file $newrev -p |\\\n sed -e '/^ /{H;$!d;}; x;/^gpgsig /!d; s/^gpgsig//;' |\\\n cut -c 2- |\\\n gpg --list-packets --textmode |\\\n sed '/keyid/!d; s/.*keyid \\([0-9A-F]\\{16\\}\\).*/\\1/I' \\\n)\n\nif [ -z \"$sigkey\" ]; then\n        echo no GPG signature on commit $newrev\n        exit 1\nfi\n\nif ! gpg -k \"$sigkey\" 2> /dev/null > /dev/null; then\n        # \"$sigkey\" not known\n        RES=\"$(gpg --keyserver hkp://pgp.mit.edu --recv-keys \"$sigkey\" 2>&1)\"\n        if [ $? -ne 0 ]; then\n                echo \"$RES\"\n                exit 1\n        fi\nfi\n\nsigstatus=$(git log $newrev --pretty=format:%G? -n 1)\n\ncase \"$sigstatus\" in\n        G)\n                #ok, trusted\n                ;;\n        U)\n                #ok, untrusted\n                ;;\n        *)\n                #not ok\n                echo sigstatus: $sigstatus\n                git log $newrev --pretty=format:%GG -n 1\n                exit 1;\n                ;;\nesac\n\nif [[ $refname != refs/heads/* ]]; then\n        echo only heads may be pushed, illegal ref: $refname\n        exit 1;\nfi\n\nhead=\"${refname:11}\"\n\nshopt -s nocasematch\n\ncase \"$head\" in\n        ${sigkey}-*)\n                #ok\n                ;;\n        ${sigkey}/*)\n                #ok\n                ;;\n        ${sigkey:(-8)}-*)\n                #ok\n                ;;\n        ${sigkey:(-8)}/*)\n                #ok\n                ;;\n        *)\n                #not your branch\n                echo \"you (a.k.a. $sigkey) are not authorized to push to branch: $head\"\n                echo \"try making a branch like: $sigkey-... or $sigkey/*\"\n                echo \"you can use a less secure ${sigkey:(-8)} too\"\n                exit 1\n                ;;\nesac\n\nexit 0\n\n--\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n-                                                               -\n- Jason Pyeron                      PD Inc. http://www.pdinc.us -\n- Principal Consultant              10 West 24th Street #100    -\n- +1 (443) 269-1555 x333            Baltimore, Maryland 21218   -\n-                                                               -\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\nThis message is copyright PD Inc, subject to license 20080407P00.\n"},{"id":"254830","messageId":"xmqqsifa1px6.fsf@gitster.dls.corp.google.com","threadId":"38385","inReplyTo":"BBE88A3EA44D47159C483F1046AC747E@black","subject":"Re: RFC: update hook for GPG signed submission on secured branches","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-01-16T19:33:25Z","receivedAt":"2015-01-16T19:33:25Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Jason Pyeron\" <jpyeron@pdinc.us> writes:\n\n> What would you change? Any bugs that you see?\n\n> sigkey=$(\\\n>  git cat-file $newrev -p |\\\n\n\"-p\" being a command line option should come before revision, but\nmore importantly, because you accept pushes only to refs/heads/, you\nwould want to explicitly require commit objects, no?  i.e.\n\n\tgit cat-file commit \"$newrev\" |\n\nI am not sure if you need these unsightly backslashes.  When you\nstop talking to it after saying \"$(\", or \"$( git cat-file ... |\",\nthe shell _knows_ that you haven't stopped what you want to tell\nit.\n\n>  sed -e '/^ /{H;$!d;}; x;/^gpgsig /!d; s/^gpgsig//;' |\\\n>  cut -c 2- |\\\n\nIt always makes me feel nervous to see people pipe sed output to\nanother filter that is a mere s/.//;\n\nIs this complex pipeline the same as this (I didn't understand the\ntrailing I at the end)?\n\n\tgit cat-file commit \"$newrev\" |\n        sed -ne '/^gpgsig /,/^ -----END/{\n        \ts/^gpgsig //\n                s/^ //p\n\t}' |\n\tgpg --list-packets --textmode |\n        sed -ne '/^:signature packet:/s/.*keyid \\([0-9A-F]*\\).*/\\1/p'\n\n>  gpg --list-packets --textmode |\\\n>  sed '/keyid/!d; s/.*keyid \\([0-9A-F]\\{16\\}\\).*/\\1/I' \\\n> )\n\n> if [ -z \"$sigkey\" ]; then\n>         echo no GPG signature on commit $newrev\n>         exit 1\n> fi\n\nI am not sure if the design of this, to require signature only on\nthe tip commit, is sound.  That is not a -bug- in the script,\nthough.\n\n> if [[ $refname != refs/heads/* ]]; then\n>         echo only heads may be pushed, illegal ref: $refname\n>         exit 1;\n> fi\n>\n> head=\"${refname:11}\"\n\nIt is hard to tell where the magic number 11 comes from.  Perhaps\n\n    head=\"${refname#refs/heads/}\"\n\nreads easier?\n"},{"id":"254832","messageId":"xmqqoapy1pki.fsf@gitster.dls.corp.google.com","threadId":"38385","inReplyTo":"xmqqsifa1px6.fsf@gitster.dls.corp.google.com","subject":"Re: RFC: update hook for GPG signed submission on secured branches","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-01-16T19:41:01Z","receivedAt":"2015-01-16T19:41:01Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n> I am not sure if you need these unsightly backslashes.  When you\n> stop talking to it after saying \"$(\", or \"$( git cat-file ... |\",\n> the shell _knows_ that you haven't stopped what you want to tell\n> it.\n\nEhh, s/stopped/finished/, that is.\n"},{"id":"254833","messageId":"BD3DE7B299FE458287DC8C829CEADEC2@black","threadId":"38385","inReplyTo":"xmqqsifa1px6.fsf@gitster.dls.corp.google.com","subject":"RE: RFC: update hook for GPG signed submission on secured branches","fromName":"Jason Pyeron","fromEmail":"jpyeron@pdinc.us","sentAt":"2015-01-16T19:47:25Z","receivedAt":"2015-01-16T19:47:25Z","isPatch":false,"sender":{"key":"jpyeron@pdinc.us","avatar":"https://gravatar.com/avatar/c2e53452caa53d940768a1ffc9cf76196d851b9b534b7a39cd39852a70a0508f?d=mp&s=160"},"body":"> -----Original Message-----\n> From: Junio C Hamano\n> Sent: Friday, January 16, 2015 14:33\n> \n> \"Jason Pyeron\" <jpyeron@pdinc.us> writes:\n> \n> > What would you change? Any bugs that you see?\n> \n> > sigkey=$(\\\n> >  git cat-file $newrev -p |\\\n> \n> \"-p\" being a command line option should come before revision, but\n> more importantly, because you accept pushes only to refs/heads/, you\n> would want to explicitly require commit objects, no?  i.e.\n> \n> \tgit cat-file commit \"$newrev\" |\n\nTrue.\n\n> \n> I am not sure if you need these unsightly backslashes.  When you\n> stop talking to it after saying \"$(\", or \"$( git cat-file ... |\",\n> the shell _knows_ that you haven't stopped what you want to tell\n> it.\n> \n> >  sed -e '/^ /{H;$!d;}; x;/^gpgsig /!d; s/^gpgsig//;' |\\\n> >  cut -c 2- |\\\n> \n> It always makes me feel nervous to see people pipe sed output to\n> another filter that is a mere s/.//;\n\nIt was a very quick Lego block build.\n\n> \n> Is this complex pipeline the same as this (I didn't understand the\n> trailing I at the end)?\n\nCase insensitive, could have used [0-9a-fA-F].\n\n> \n> \tgit cat-file commit \"$newrev\" |\n>         sed -ne '/^gpgsig /,/^ -----END/{\n>         \ts/^gpgsig //\n>                 s/^ //p\n> \t}' |\n\nWill all future signature values end with a \"^ -----END\"? I was only going on the assumption that continuation lines start with a single space.\n\n> \tgpg --list-packets --textmode |\n>         sed -ne '/^:signature packet:/s/.*keyid \\([0-9A-F]*\\).*/\\1/p'\n> \n> >  gpg --list-packets --textmode |\\\n> >  sed '/keyid/!d; s/.*keyid \\([0-9A-F]\\{16\\}\\).*/\\1/I' \\\n> > )\n> \n> > if [ -z \"$sigkey\" ]; then\n> >         echo no GPG signature on commit $newrev\n> >         exit 1\n> > fi\n> \n> I am not sure if the design of this, to require signature only on\n> the tip commit, is sound.  That is not a -bug- in the script,\n> though.\n\nIt is to handle the \"all my devs worked on this, they do ________ GPG\", so as long as the tip os signed, it is an implicit I am responsible for what is submitted.\n\n> \n> > if [[ $refname != refs/heads/* ]]; then\n> >         echo only heads may be pushed, illegal ref: $refname\n> >         exit 1;\n> > fi\n> >\n> > head=\"${refname:11}\"\n> \n> It is hard to tell where the magic number 11 comes from.  Perhaps\n> \n>     head=\"${refname#refs/heads/}\"\n> \n> reads easier?\n\nMuch.\n\nThanks!\n\n-Jason\n\n--\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n-                                                               -\n- Jason Pyeron                      PD Inc. http://www.pdinc.us -\n- Principal Consultant              10 West 24th Street #100    -\n- +1 (443) 269-1555 x333            Baltimore, Maryland 21218   -\n-                                                               -\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\nThis message is copyright PD Inc, subject to license 20080407P00. \n"},{"id":"254839","messageId":"20150116195950.GK26383@serenity.lan","threadId":"38385","inReplyTo":"BD3DE7B299FE458287DC8C829CEADEC2@black","subject":"Re: RFC: update hook for GPG signed submission on secured branches","fromName":"John Keeping","fromEmail":"john@keeping.me.uk","sentAt":"2015-01-16T19:59:50Z","receivedAt":"2015-01-16T19:59:50Z","isPatch":false,"sender":{"key":"john@keeping.me.uk","avatar":"https://avatars.githubusercontent.com/u/1702081?v=4"},"body":"On Fri, Jan 16, 2015 at 02:47:25PM -0500, Jason Pyeron wrote:\n> > I am not sure if the design of this, to require signature only on\n> > the tip commit, is sound.  That is not a -bug- in the script,\n> > though.\n> \n> It is to handle the \"all my devs worked on this, they do ________\n> GPG\", so as long as the tip os signed, it is an implicit I am\n> responsible for what is submitted.\n\nIsn't this an ideal scenario for using the signed pushes introduced in\nGit 2.2.0?\n"},{"id":"254844","messageId":"xmqq7fwm1gtx.fsf@gitster.dls.corp.google.com","threadId":"38385","inReplyTo":"BD3DE7B299FE458287DC8C829CEADEC2@black","subject":"Re: RFC: update hook for GPG signed submission on secured branches","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-01-16T22:49:46Z","receivedAt":"2015-01-16T22:49:46Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Jason Pyeron\" <jpyeron@pdinc.us> writes:\n\n>> Is this complex pipeline the same as this (I didn't understand the\n>> trailing I at the end)?\n>\n> Case insensitive, could have used [0-9a-fA-F].\n\nAhh, a GNU extension.\n\n>> \tgit cat-file commit \"$newrev\" |\n>>         sed -ne '/^gpgsig /,/^ -----END/{\n>>         \ts/^gpgsig //\n>>                 s/^ //p\n>> \t}' |\n>\n> Will all future signature values end with a \"^ -----END\"?\n\nIf it bothers you, alternatively, you can stop at the end of the\ncommit object header, i.e.\n\n\t/^gpgsig /,/^$/{\n        \ts/^gigsig//\n                s/^ //p\n\t}\n\nbut I do not think it matters that much ;-)\n"}]}