threads / patch / 25605

patchAdd support in sample hook script for denying annotated tags.

Subject: [PATCH] Add support in sample hook script for denying annotated tags.

## tl;dr

3 messages between Oct 31, 2010 and Nov 1, 2010. Diffs are folded; open one to read it.

replies: 2people: 2as markdown or json

Boyd Stephen Smith Jr.· Oct 31, 2010, 19:57 UTC · lore

Signed-off-by: "Boyd Stephen Smith Jr." <bss@iguanasuicide.net>
---
 templates/hooks--update.sample |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

In one project I'm in we are using a centralized Git repository that many developers have access to. As such, we want to prevent tags from being created by push operations and have them created by the administrators.

This is a modification to the sample update hook to allow this to simply be a configuration option.

receive.denyCreate actually seems to be what my project wants, but I can see more fine-grained support being nice-to-have. For example, we might want to allow developers to create branches in a developer-specific namespace but still disallow pushing annotated tags.

Show changes to templates/hooks--update.sample +9 −0

diff --git a/templates/hooks--update.sample b/templates/hooks--update.sample
index fd63b2d..c783973 100755
--- a/templates/hooks--update.sample
+++ b/templates/hooks--update.sample
@@ -7,6 +7,9 @@
 #
 # Config
 # ------
+# hooks.allowannotated
+#   This boolean sets whether annotated tags will be allowed into the
+#   repository.  By default they won't be.
 # hooks.allowunannotated
 #   This boolean sets whether unannotated tags will be allowed into the
 #   repository.  By default they won't be.
@@ -43,6 +46,7 @@ if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then
 fi
 
 # --- Config
+allowannotated=$(git config --bool hooks.allowannotated)
 allowunannotated=$(git config --bool hooks.allowunannotated)
 allowdeletebranch=$(git config --bool hooks.allowdeletebranch)
 denycreatebranch=$(git config --bool hooks.denycreatebranch)
@@ -86,6 +90,11 @@ case "$refname","$newrev_type" in
 		;;
 	refs/tags/*,tag)
 		# annotated tag
+		if [ "$oldrev" = "$zero" -a "$allowannotated" != "true" ]; then
+			echo "*** Creating a tag is not allowed in this repository" >&2
+			exit 1
+		fi
+
 		if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1
 		then
 			echo "*** Tag '$refname' already exists." >&2

-- 
1.7.1
-- 
Boyd Stephen Smith Jr.                   ,= ,-_-. =.
bss@iguanasuicide.net                   ((_/)o o(\_))
ICQ: 514984 YM/AIM: DaTwinkDaddy         `-'(. .)`-'
http://iguanasuicide.net/                    \_/

Jonathan Nieder· Oct 31, 2010, 20:24 UTC · re: Boyd Stephen Smith Jr. · lore

Re: [PATCH] Add support in sample hook script for denying annotated tags.

Hi,

Boyd Stephen Smith Jr. wrote:

Show 11 quoted lines

> Signed-off-by: "Boyd Stephen Smith Jr." <bss@iguanasuicide.net>
> ---
>  templates/hooks--update.sample |    9 +++++++++
>  1 files changed, 9 insertions(+), 0 deletions(-)
> 
> In one project I'm in we are using a centralized Git repository that many 
> developers have access to.  As such, we want to prevent tags from being 
> created by push operations and have them created by the administrators.
> 
> This is a modification to the sample update hook to allow this to simply be 
> a configuration option.

This kind of justification belongs above the "---", I think.

No opinion on the functionality itself.  Just:

Show 9 quoted lines

> --- a/templates/hooks--update.sample
> +++ b/templates/hooks--update.sample
> @@ -7,6 +7,9 @@
>  #
>  # Config
>  # ------
> +# hooks.allowannotated
> +#   This boolean sets whether annotated tags will be allowed into the
> +#   repository.  By default they won't be.

hooks.denyannotated (defaulting to false) would be more consistent with hooks.denycreatebranch, no?

Or maybe hooks.denycreatetag --- a situation in which unannotated tags should be allowed but annotated denied seems hard to imagine.

Hope that helps, Jonathan

Boyd Stephen Smith Jr.· Nov 1, 2010, 07:29 UTC · re: Jonathan Nieder · lore

Re: [PATCH] Add support in sample hook script for denying annotated tags.

In <20101031202433.GB21240@burratino>, Jonathan Nieder wrote:

Show 15 quoted lines

>Boyd Stephen Smith Jr. wrote:
>> Signed-off-by: "Boyd Stephen Smith Jr." <bss@iguanasuicide.net>
>> ---
>> 
>>  templates/hooks--update.sample |    9 +++++++++
>>  1 files changed, 9 insertions(+), 0 deletions(-)
>> 
>> In one project I'm in we are using a centralized Git repository that many
>> developers have access to.  As such, we want to prevent tags from being
>> created by push operations and have them created by the administrators.
>> 
>> This is a modification to the sample update hook to allow this to simply
>> be a configuration option.
>
>This kind of justification belongs above the "---", I think.

Eh, poop. I wasn't sure were it went since it's been so long since I sent a patch in. I thought only the "commit message" went above the "---" and my explanation seemed a bit over-long for a commit message.

I'll STFW next time and get it correct; I'd like to make it easy to use git am or git apply on the mail so that it is easier to review.

Show 15 quoted lines

>No opinion on the functionality itself.  Just:
>> --- a/templates/hooks--update.sample
>> +++ b/templates/hooks--update.sample
>> @@ -7,6 +7,9 @@
>> 
>>  #
>>  # Config
>>  # ------
>> 
>> +# hooks.allowannotated
>> +#   This boolean sets whether annotated tags will be allowed into the
>> +#   repository.  By default they won't be.
>
>hooks.denyannotated (defaulting to false) would be more consistent
>with hooks.denycreatebranch, no?

Most of the flags were allow* and that seems to be a better way to approach access restrictions like this. denycreatebranch is the odd one out, and I was considering a patch that would change it to an allow* as well.

Still, I'm happy to change the new flag to a deny* if there's consensus that it is better implemented that way.

>Or maybe hooks.denycreatetag ---

That's probably better if you think of this as being analogous to denycreatebranch. When I wrote the patch I was thinking of this flag as being analogous to allowunannotated.

>a situation in which unannotated
>tags should be allowed but annotated denied seems hard to imagine.

Agreed.

-- 
Boyd Stephen Smith Jr.                   ,= ,-_-. =.
bss@iguanasuicide.net                   ((_/)o o(\_))
ICQ: 514984 YM/AIM: DaTwinkDaddy         `-'(. .)`-'
http://iguanasuicide.net/                    \_/