Advertisement
Guest User

gig update hook

a guest
Jan 22nd, 2018
76
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 4.34 KB | None | 0 0
  1. #!/usr/bin/perl
  2.  
  3. use strict;
  4. use warnings;
  5.  
  6. # === update ===
  7. # this is gitolite's update hook
  8.  
  9. # ----------------------------------------------------------------------------
  10. #       find the rc file, then pull the libraries
  11. # ----------------------------------------------------------------------------
  12.  
  13. BEGIN {
  14.     # people with shell access should be allowed to bypass the update hook,
  15.     # simply by setting an env var that the ssh "front door" will never set
  16.     exit 0 if exists $ENV{GL_BYPASS_UPDATE_HOOK};
  17.  
  18.     die "ENV GL_RC not set\n" unless $ENV{GL_RC};
  19.     die "ENV GL_BINDIR not set\n" unless $ENV{GL_BINDIR};
  20. }
  21.  
  22. use lib $ENV{GL_BINDIR};
  23. use gitolite_rc;
  24. use gitolite qw(:DEFAULT %repos);
  25.  
  26. # ----------------------------------------------------------------------------
  27. #       start...
  28. # ----------------------------------------------------------------------------
  29.  
  30. my ($perm, $creator, $wild) = repo_rights($ENV{GL_REPO});
  31. my $reported_repo = $ENV{GL_REPO} . ( $wild ? " ($wild)" : "" );
  32.  
  33. # arguments are as supplied to an update hook by git; man githooks
  34. my ($ref, $oldsha, $newsha) = @ARGV;
  35. my $merge_base = '0' x 40;
  36. # compute a merge-base if both SHAs are non-0, else leave it as '0'x40
  37. # (i.e., for branch create or delete, merge_base == '0'x40)
  38. chomp($merge_base = `git merge-base $oldsha $newsha`)
  39.     unless $oldsha eq '0' x 40
  40.         or $newsha eq '0' x 40;
  41.  
  42. # att_acc == attempted access -- what are you trying to do?  (is it 'W' or '+'?)
  43. my $att_acc = 'W';
  44. # rewriting a tag is considered a rewind, in terms of permissions
  45. $att_acc = '+' if $ref =~ m(refs/tags/) and $oldsha ne ('0' x 40);
  46. # non-ff push to ref
  47. # notice that ref delete looks like a rewind, as it should
  48. $att_acc = '+' if $oldsha ne $merge_base;
  49.  
  50. # were any 'D' perms specified?  If they were, it means we have to separate
  51. # deletes from rewinds, so if the new sha is all 0's, change the '+' to a 'D'
  52. $att_acc = 'D' if ( $repos{$ENV{GL_REPO}}{DELETE_IS_D} or $repos{'@all'}{DELETE_IS_D} ) and $newsha eq '0' x 40;
  53. # similarly C for create a branch
  54. $att_acc = 'C' if ( $repos{$ENV{GL_REPO}}{CREATE_IS_C} or $repos{'@all'}{CREATE_IS_C} ) and $oldsha eq '0' x 40;
  55.  
  56. my @allowed_refs;
  57. # @all repos: see comments in similar code in check_access
  58. push @allowed_refs, @ { $repos{$ENV{GL_REPO}}{$ENV{GL_USER}} || [] };
  59. push @allowed_refs, @ { $repos{'@all'}       {$ENV{GL_USER}} || [] };
  60. push @allowed_refs, @ { $repos{$ENV{GL_REPO}}{'@all'} || [] };
  61. push @allowed_refs, @ { $repos{'@all'}       {'@all'} || [] };
  62.  
  63. # prepare the list of refs to be checked
  64.  
  65. # previously, we just checked $ref -- the ref being updated, which is passed
  66. # to us by git (see man githooks).  Now we also have to treat each NAME being
  67. # updated as a potential "ref" and check that, if NAME-based restrictions have
  68. # been specified
  69.  
  70. my @refs = ($ref);      # the first ref to check is the real one
  71. # because making it work screws up efficiency like no tomorrow...
  72. if (exists $repos{$ENV{GL_REPO}}{NAME_LIMITS}) {
  73.     # this is special to git -- the hash of an empty tree
  74.     my $empty='4b825dc642cb6eb9a060e54bf8d69288fbee4904';
  75.     # well they're not really "trees" but $empty is indeed the empty tree so
  76.     # we can just pretend $oldsha/$newsha are also trees, and anyway 'git
  77.     # diff' only wants trees
  78.     my $oldtree = $oldsha eq '0' x 40 ? $empty : $oldsha;
  79.     my $newtree = $newsha eq '0' x 40 ? $empty : $newsha;
  80.     push @refs, map { chomp; s/^/NAME\//; $_; } `git diff --name-only $oldtree $newtree`;
  81. }
  82.  
  83. # we potentially have many "refs" to check.  The one we print in the log is
  84. # the *first* one (which is a *real* ref, like refs/heads/master), while all
  85. # the rest (if they exist) are like NAME/something.  So we do the first one
  86. # separately to capture it, then run the rest (if any)
  87. my $log_refex = check_ref(\@allowed_refs, $ENV{GL_REPO}, (shift @refs), $att_acc);
  88. check_ref                (\@allowed_refs, $ENV{GL_REPO}, $_           , $att_acc) for @refs;
  89.  
  90. # if we returned at all, all the checks succeeded.  Check secondary hooks now
  91. $UPDATE_CHAINS_TO ||= 'hooks/update.secondary';
  92. -x $UPDATE_CHAINS_TO and system ( $UPDATE_CHAINS_TO, @ARGV ) and die "$UPDATE_CHAINS_TO died\n";
  93.  
  94. # now log it and exit 0 so git can get on with it
  95. log_it("", "$att_acc\t" .  substr($oldsha, 0, 14) . "\t" . substr($newsha, 0, 14) .
  96.     "\t$reported_repo\t$ref\t$log_refex");
  97.  
  98. exit 0;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement