Re: Server-side preventing some files from being overwritten

6 messages, 4 authors, 2016-07-15 · open the first message on its own page

Re: Server-side preventing some files from being overwritten

From: Junio C Hamano <hidden>
Date: 2016-07-14 18:28:01

Thorsten Glaser [off-list ref] writes:
Although I’m ordinarily loath to write GNU bash scripts, this
helps avoiding temporary files. This works:

-----cutting here may damage your screen surface-----
#!/bin/bash
export LC_ALL=C
subdir=x/y
while IFS=' ' read -r old new name; do
	test x"$name" = x"refs/heads/master" || continue
	if test x"0" != x"$(comm -23z \
	    <(git ls-tree -r -z "$old" "$subdir" | sort -z) \
	    <(git ls-tree -r -z "$new" "$subdir" | sort -z) | wc -c)"; then
		echo >&2 'Untouchable files touched, commit rejected!'
		exit 1
	fi
Can't this become simpler, e.g.

	if ! git diff-tree --quiet "$old" "$new" -- "$subdir"
	then
		echo >&2 "Ooh, $subdir is touched"
		exit 1
	fi
done
exit 0
-----cutting here may damage your screen surface-----

Of course, set “subdir” in line 3 correctly, and GNU coreutils
are required for the NUL line termination, which is not an issue
here. (BSD has “-R ''” for sort(1), for example.)

bye,
//mirabilos

Re: Server-side preventing some files from being overwritten

From: Junio C Hamano <hidden>
Date: 2016-07-14 18:44:41

On Thu, Jul 14, 2016 at 11:27 AM, Junio C Hamano [off-list ref] wrote:
Thorsten Glaser [off-list ref] writes:
quoted
      if test x"0" != x"$(comm -23z \
          <(git ls-tree -r -z "$old" "$subdir" | sort -z) \
          <(git ls-tree -r -z "$new" "$subdir" | sort -z) | wc -c)"; then
              echo >&2 'Untouchable files touched, commit rejected!'
              exit 1
      fi
Can't this become simpler, e.g.

        if ! git diff-tree --quiet "$old" "$new" -- "$subdir"
        then
                echo >&2 "Ooh, $subdir is touched"
                exit 1
        fi
Ehh, you need to tell diff-tree to recurse, i.e. "diff-tree -r".

Re: Server-side preventing some files from being overwritten

From: Thorsten Glaser <hidden>
Date: 2016-07-14 18:50:32

On Thu, 14 Jul 2016, Junio C Hamano wrote:
Can't this become simpler, e.g.

	if ! git diff-tree --quiet "$old" "$new" -- "$subdir"
Thought about diff-tree, but additions are permitted,
and diffing the actual file content has overhead too.

Just counting the number of object hashes removed from
the old tree (recursed) works out just fine.

bye,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-235
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

Re: Server-side preventing some files from being overwritten

From: Stefan Beller <hidden>
Date: 2016-07-14 18:50:36

On Thu, Jul 14, 2016 at 11:44 AM, Junio C Hamano [off-list ref] wrote:
On Thu, Jul 14, 2016 at 11:27 AM, Junio C Hamano [off-list ref] wrote:
quoted
Thorsten Glaser [off-list ref] writes:
quoted
      if test x"0" != x"$(comm -23z \
          <(git ls-tree -r -z "$old" "$subdir" | sort -z) \
          <(git ls-tree -r -z "$new" "$subdir" | sort -z) | wc -c)"; then
              echo >&2 'Untouchable files touched, commit rejected!'
              exit 1
      fi
Can't this become simpler, e.g.

        if ! git diff-tree --quiet "$old" "$new" -- "$subdir"
        then
                echo >&2 "Ooh, $subdir is touched"
No need to go for >&2 here, as it makes no difference to
the client.
quoted
                exit 1
        fi
Ehh, you need to tell diff-tree to recurse, i.e. "diff-tree -r".

Re: Server-side preventing some files from being overwritten

From: Ævar Arnfjörð Bjarmason <hidden>
Date: 2016-07-15 14:03:02

On Thu, Jul 14, 2016 at 8:44 PM, Junio C Hamano [off-list ref] wrote:
On Thu, Jul 14, 2016 at 11:27 AM, Junio C Hamano [off-list ref] wrote:
quoted
Thorsten Glaser [off-list ref] writes:
quoted
      if test x"0" != x"$(comm -23z \
          <(git ls-tree -r -z "$old" "$subdir" | sort -z) \
          <(git ls-tree -r -z "$new" "$subdir" | sort -z) | wc -c)"; then
              echo >&2 'Untouchable files touched, commit rejected!'
              exit 1
      fi
Can't this become simpler, e.g.

        if ! git diff-tree --quiet "$old" "$new" -- "$subdir"
        then
                echo >&2 "Ooh, $subdir is touched"
                exit 1
        fi
Ehh, you need to tell diff-tree to recurse, i.e. "diff-tree -r".
Note that although this is literally what Thorsten is asking for, I
think it's worth noting for the list explicitly that all these
examples that do "diff $old..$new" will *not* prevent your repository
from having *commits* that touch those files, but they will prevent
you from having *pushes* where the end state is a net change in those
files.

I.e. it allows pushing a series which is a series of two commits which:

  1. Change the forbidden file(s)
  2. Undo changes to the forbidden file(s)

This *can* be critically important or not matter at all depending on
your use case, i.e. does it matter that disallowed and potentially
malicious changes come up in "git bisect", or will you ever be rolling
out anything but the latest tip of the branch you're testing in
production?

If the answer to either of those is "yes" you need something that does
a "git log --stat $old..$new" and parses out if *any* of the commits
make changes to those files.

See e.g. my https://github.com/avar/pre-receive-reject-binaries for
one example of that, although it rejects binaries you could easily
modify it to check the filename(s) instead.

Re: Server-side preventing some files from being overwritten

From: Thorsten Glaser <hidden>
Date: 2016-07-15 15:30:39

On Fri, 15 Jul 2016, Ævar Arnfjörð Bjarmason wrote:
I.e. it allows pushing a series which is a series of two commits which:

  1. Change the forbidden file(s)
  2. Undo changes to the forbidden file(s)
That’s precisely allowed.

bye,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-235
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help