Re: can we prevent reflog deletion when branch is deleted?

From: Stephen Bash <bash@genarts.com>
Date: Nov 14, 2013, 14:42 UTC
Message-ID: <2137000803.2895009.1384440156683.JavaMail.root@genarts.com>
In-Reply-To: <20131114081456.GC16327@sigill.intra.peff.net>

----- Original Message -----

Show 15 quoted lines

> From: "Jeff King" <peff@peff.net>
> Sent: Thursday, November 14, 2013 3:14:56 AM
> Subject: Re: can we prevent reflog deletion when branch is deleted?
> 
> On Thu, Nov 14, 2013 at 05:48:50AM +0530, Sitaram Chamarty wrote:
> 
> > Is there *any* way we can preserve a reflog for a deleted branch,
> > perhaps under logs/refs/deleted/<timestamp>/full/ref/name ?
> 
> At GitHub, we log each change to an "audit log" in addition to the
> regular reflog (we also stuff extra data from the environment into the
> reflog message). So even after a branch is deleted, its audit log
> entries remain, though you have to pull out the data by hand (git
> doesn't know about it at all, except as an append-only sink for
> writing).

We recently ran into a similar situation at my $dayjob, so I made our server side update hook log all pushes (including deletes) and added the new log file to logrotate(8) -- note: make sure if logrotate recreates the file that it allows everyone to write to it. I'm sure it's not as comprehensive as Peff's solution, but it's pretty simple for smaller shops that want a little more protection. Here are the relevant excerpts from the script:

#!/usr/bin/env python

import os, sys, pwd, stat from datetime import datetime

def log_push(too_many_changes):
    log_file = 'push-log.txt'
    try:
        f = open(log_file, 'a')

        try:
            # In case we just created the file, attempt to chmod it
            os.chmod(log_file, 0666)
        except OSError:
            # chmod will fail if the current user isn't the owner, but
            # if we've gotten this far we already have write permissions,
            # so just continue quietly
            pass

        # Linux/Mac okay, bad for Windows
        username = pwd.getpwuid(os.getuid())[0]
        f.write('%s: %s push by %s of %s from %s to %s\n'% \
                (datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
                'Failed' if too_many_changes else 'Successful', username,
                refname, oldsha, newsha))
        f.close()
    except IOError:
        try:
            log_stats = os.stat(log_file)
            # Figure out owner and permissions
            log_owner = pwd.getpwuid(log_stats.st_uid).pw_name
            log_perm = oct(stat.S_IMODE(log_stats.st_mode))
            print_flush('Unable to open %s for appending. Current owner ' + \
                        'is %s and permissions are %s.'%(log_file,
                        log_owner, log_perm))
        except:
            exception,desc,stack = sys.exc_info()
            print_flush('Unable to open log file.  While generating error' + \
                        ' message encountered error: %s'%(desc))

if len(sys.argv) != 4:
    print_flush('Usage: %s refname oldsha newsha'%sys.argv[0])
    sys.exit(1)

refname = sys.argv[1] oldsha = sys.argv[2] newsha = sys.argv[3]

if newsha == '0'*40:
    # Deleted ref, nothing to do
    log_push(False)
    sys.exit(0)

# ... checking for various rule/style violations ...

log_push(too_many_changes)
if too_many_changes:
    sys.exit(1)
else:
    sys.exit(0)