git-review hook to prevent accidental pushing of security patches
ActivePublic
Actions

Authored by Tgr on Sat, Oct 3, 10:26 AM.

Project Tags

Referenced Files

	F106400567: git-review hook to prevent accidental pushing of security patches
	Mon, Oct 5, 9:45 AM

	F106007638: git-review hook to prevent accidental pushing of security patches
	Sat, Oct 3, 10:26 AM

Subscribers

None

	#!/bin/bash

	# Simple git-review hook to prevent accidentally pushing patches with commit summaries starting with 'SECURITY'.
	# Can be skipped with PUBLIC_SECURITY_PATCH=1.
	# To enable, copy this into ~/.config/git-review/hooks/pre-review and make sure it is executable.
	#
	# Relies on @{u} being accurate. This is somewhat fragile because 1) git-review will do a fetch and rebase before
	# pushing but after calling this hook; 2) depending on its command line parameters (e.g. `git review REL1_43`), it
	# might be pushing to somewhere else. Should work most of the time, though.

	set -eu

	if [[ ${PUBLIC_SECURITY_PATCH:-} == 1 ]]; then
	exit 0
	fi

	upstream=$(git rev-parse '@{u}' 2>/dev/null) \|\| {
	echo >&2 "Cannot determine upstream branch; refusing to review."
	exit 1
	}

	bad_commit_log=$(
	git log --format='%h %s' "$upstream..HEAD" \|
	ack --no-color -i '^[\da-f]+ (SECURITY:\|\[SECURITY\])' \|\| true
	)

	if [[ -n $bad_commit_log ]]; then
	echo >&2 "Refusing to upload security patch(es) to Gerrit:"
	echo >&2 "$bad_commit_log"
	echo >&2
	echo >&2 "See https://wikitech.wikimedia.org/wiki/How_to_deploy_code#Creating_a_Security_Patch on proper handling of security patches."
	echo >&2 "If you are sure you want to make the patch(es) public, you can override this check with"
	echo >&2 " PUBLIC_SECURITY_PATCH=1 git review ..."
	exit 1
	fi

Event Timeline