1#!/bin/sh 2 3# A hook script to verify what is about to be pushed. Called by "git 4# push" after it has checked the remote status, but before anything has been 5# pushed. If this script exits with a non-zero status nothing will be pushed. 6# 7# This hook is called with the following parameters: 8# 9# $1 -- Name of the remote to which the push is being done 10# $2 -- URL to which the push is being done 11# 12# If pushing without using a named remote those arguments will be equal. 13# 14# Information about the commits which are being pushed is supplied as lines to 15# the standard input in the form: 16# 17# <local ref> <local sha1> <remote ref> <remote sha1> 18 19remote="$1" 20url="$2" 21 22zero=0000000000000000000000000000000000000000 23 24upstream_pattern="github\.com.flashrom/flashrom(\.git)?|flashrom\.org.git/flashrom(\.git)?" 25 26# Only care about the upstream repositories 27if echo "$url" | grep -q -v -E "$upstream_pattern" ; then 28 exit 0 29fi 30 31while read local_ref local_sha remote_ref remote_sha ; do 32 33 # Only allow the stable and staging branches as well as versioned stable branches (e.g., 0.0.x). 34 # The matching expression's RE is always anchored to the first character (^ is undefined). 35 # The outer parentheses are needed to print out the whole matched string. 36 version=$(expr ${remote_ref#*refs/heads/} : '\(\([0-9]\+\.\)\{2,\}x\)$') 37 if [ "$remote_ref" != "refs/heads/staging" ] && \ 38 [ "$remote_ref" != "refs/heads/stable" ] && \ 39 [ -z "$version" ]; then 40 echo "Feature branches not allowed ($remote_ref)." >&2 41 exit 1 42 fi 43 44 if [ "$local_sha" = $zero ]; then 45 echo "Deletion of branches is prohibited." >&2 46 exit 1 47 fi 48 49 # Check for Signed-off-by and Acked-by 50 commit=$(git rev-list -n 1 --all-match --invert-grep -E \ 51 --grep '^Signed-off-by: .+ <.+@.+\..+>$' \ 52 --grep '^Acked-by: .+ <.+@.+\..+>$' \ 53 "$remote_sha..$local_sha") 54 if [ -n "$commit" ]; then 55 echo "Commit $local_sha in $local_ref is missing either \"Signed-off-by\"" \ 56 " or \"Acked-by\" lines, not pushing." >&2 57 exit 1 58 fi 59 60 # Make _really_ sure we do not rewrite history of any head/branch 61 if [ "${remote_ref#*refs/heads/}" != "$remote_ref" ]; then 62 nonreachable=$(git rev-list $remote_sha ^$local_sha | head -1) 63 if [ -n "$nonreachable" ]; then 64 echo "Only fast-forward pushes are allowed on branches." >&2 65 echo "At least $nonreachable is not included in $remote_sha while pushing to " \ 66 "$remote_ref" >&2 67 exit 1 68 fi 69 fi 70 71 # FIXME: check commit log format (subject without full stop at the end etc). 72 # FIXME: do buildbot checks if authorized? 73done 74 75exit 0 76