helpSavannah Administration - Support: sr #109104, Add Git 'update' hook for Guix...

 
 

sr #109104: Add Git 'update' hook for Guix repositories

Submitted by:  Ludovic Courtès <civodul>
Submitted on:  Sun 24 Jul 2016 10:09:45 PM UTC  
 
Category:  Source code repositories - developer access Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Assigned to:  Bob Proulx <rwp> Operating System:  None
Open/Closed:  Closed

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 17 Aug 2016 09:38:36 AM UTC, comment #5: 

Hi Mike,

The hook is indeed super naive.  The goal was just to avoid accidental pushes of unsigned commits, under the assumption that those with commit access are well-behaved.  :-)

But yeah, the goal is to ultimately scan the Git history and ensure only authorized keys are used: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=22883#103 .

Thanks,
Ludo'.

Ludovic Courtès <civodul>
Sun 07 Aug 2016 05:53:39 AM UTC, comment #4: 

Unfortunately, this hook can be easily defeated.  Here's some example output from the current tip of master:

$ git cat-file -p HEAD
tree c65e675351fe76b2630df24eddcb2449774eb344
parent e87c7ec2de815f05d7a84e2792e2da700bb26a38
author Leo Famulari <leo@famulari.name> 1470169005 -0400
committer Leo Famulari <leo@famulari.name> 1470538536 -0400
gpgsig -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAABCAAGBQJXpqMoAAoJECZG+jC6yn8Ihn8P+wfUhS5HOL7181KC8ZRdTFC5
5XjavRq/08LJzO2mxer1r5oVcWYuZAvnPKZltO1vdIp0ncvU40c4nmaNpQiB/w6B
8slSkqBsoCVE7GEKHoAWju7Rwwlqw4fUSgDWw5JpJ/3S2PhRj+tvy8o/wCeBEwTL
c90yivRmpKZcdcRgSPHqhHhMJ7lIJxbvHKlb30SPz9vdQTj13EUeeyyJQc/7lu7D
kUiUu9MOjC3o8dPE8E7otMnD51xfj8SNvs5h7cZAMByS0Qk06RwK+O5POkBlXUMV
lVxgPJsC7LfqJJ/VGLb5uOIoXMUCGV3mzdDXA+Pe+xvTTGOT+8rNsPl7kwxAGYqC
vPVrY1dC6CzRX8/7etvb99UHf2nx0NbYRAvetZzh9j6WBbMqGBgHMndRh6i6Y7Fl
BioG+J22sXCQjf3ydRvjd8cznlfvBCTqo9zSqeoG7Ha/qSh1pX16KAUxLi1YGzK6
I79iqOEvpoxwS/9Ym+GB+4rLTimqhtDKN7v3XaQudJ8t6hMlGi+pqjiLhNI8q2c9
dd3RthLu+Zom4duwnGo0BJEVC+CDLYGcdiwCKOpLaI9KtQbCv6useALPBk5RKPHr
pE1Y7nTmBw7Rxl2GuaNOH9x5cHOuULfWW+HLm3JSwTjD4cpAxnFDP7qYINSo7XGR
HGWK/43B5syf6FhZws8N
=h+H0
-----END PGP SIGNATURE-----

gnu: Add python-pythondialog.

* gnu/packages/python.scm (python-pythondialog): New variable.
(python2-pythondialog): Inherit from PYTHON-PYTHONDIALOG.

Co-authored-by: Vincent Legoll <vincent.legoll@idgrilles.fr>

The hook currently greps for `^gpgsig '.  It will indeed find a GPG signature if it exists, but to circumvent it, an attacker need only put `gpgsig' in the commit message at column 0---the commit messages aren't indented in the output.

You can replace the entire loop in the hook with this:

git log --pretty='%GK %h %s' "$rev_old^..$rev_new" \
  | awk '/^ / {
           e=1
           print "error: missing signature:" $0 > "/dev/stderr"
         }
         END { exit e }'

If the commit is not signed, then `%GK` (GPG key id) will yield an empty string.

Here's some example output (run with HEAD~15..):

error: missing signature: 7ccb874 gnu: zsh: Move to shells.scm.
error: missing signature: 7977d76 Update NEWS.

Mike Gerwitz <mikegerwitz>
Site Administrator
Mon 25 Jul 2016 09:00:23 AM UTC, comment #3: 

That was fast, thanks a lot, Bob!

Ludovic Courtès <civodul>
Sun 24 Jul 2016 10:57:48 PM UTC, comment #2: 

Done. Commits to those repositories will be required to be gpg signed now. Let us know if you need anything else.

Bob Proulx <rwp>
Site AdministratorIn charge of this item.
Sun 24 Jul 2016 10:51:42 PM UTC, comment #1: 

Sure thing. I will add it to this list.

guix.git
guix/dhcp.git
guix/gnunet.git
guix/guix-artwork.git
guix/maintenance.git

Bob Proulx <rwp>
Site AdministratorIn charge of this item.
Sun 24 Jul 2016 10:09:45 PM UTC, original submission:  

Hello,

Could you add the attach file as an 'update' hook for all the Guix repositories?

Thanks in advance,
Ludo'.

Ludovic Courtès <civodul>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #38011:  assert-commit-signed added by civodul (764B - application/octet-stream - Git 'update' hook to reject unsigned commits)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mikegerwitz (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by civodul (Submitted the item)
  • -email is unavailable- added by civodul
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-07-24 rwp StatusIn Progress => Done
        Open/ClosedOpen => Closed
    2016-07-24 rwp StatusNone => In Progress
        Assigned toNone => rwp
    2016-07-24 civodul Attached File- => Added assert-commit-signed, #38011
        Carbon-Copy- => Added 22883@debbugs.gnu.org

    Back to the top


    Powered by Savane 3.5