March 2019 - tor-commits - lists.torproject.org

[meek/master] fmt.
by dcf＠torproject.org 05 Mar '19

05 Mar '19

commit 975c534e07f43ffa66833f46857d193f9535be78 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Mar 5 16:20:22 2019 -0700 fmt. --- meek-client-torbrowser/protocol_test.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/meek-client-torbrowser/protocol_test.go b/meek-client-torbrowser/protocol_test.go index 63e48d2..48db95f 100644 --- a/meek-client-torbrowser/protocol_test.go +++ b/meek-client-torbrowser/protocol_test.go @@ -9,6 +9,7 @@ import ( ) const timeout = 50 * time.Millisecond + var errTimedout = errors.New("timed out") type infiniteReader struct{} @@ -22,14 +23,14 @@ func (r *infiniteReader) Read(p []byte) (int, error) { func grepHelperAddrTimeout(r io.Reader) (string, error) { type result struct { - s string + s string err error } ch := make(chan result) go func() { s, err := grepHelperAddr(r) - ch <- result { - s: s, + ch <- result{ + s: s, err: err, } }() @@ -69,7 +70,7 @@ func TestGrepHelperAddr(t *testing.T) { // good tests for _, test := range []string{ "meek-http-helper: listen " + expectedAddr, - "meek-http-helper: listen " + expectedAddr+ "\njunk", + "meek-http-helper: listen " + expectedAddr + "\njunk", "junk\nmeek-http-helper: listen " + expectedAddr + "\njunk", "meek-http-helper: listen " + expectedAddr + "\nmeek-http-helper: listen 1.2.3.4:9999\n", } {

1 0

[stem/master] Add _ to internal parser constants to exclude from Sphinx generated docs.
by atagar＠torproject.org 05 Mar '19

05 Mar '19

commit de5875a8873e7a773901e264a8c453e7ad4bafea Author: hannelorestetx <hannelores.x(a)hotmail.com> Date: Thu Feb 28 01:56:50 2019 -0500 Add _ to internal parser constants to exclude from Sphinx generated docs. https://trac.torproject.org/projects/tor/ticket/25075 --- stem/descriptor/networkstatus.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/stem/descriptor/networkstatus.py b/stem/descriptor/networkstatus.py index f463530f..e970dc73 100644 --- a/stem/descriptor/networkstatus.py +++ b/stem/descriptor/networkstatus.py @@ -1067,7 +1067,7 @@ class NetworkStatusDocumentV3(NetworkStatusDocument): 'bandwidth_weights': ({}, _parse_footer_bandwidth_weights_line), } - HEADER_PARSER_FOR_LINE = { + _HEADER_PARSER_FOR_LINE = { 'network-status-version': _parse_header_network_status_version_line, 'vote-status': _parse_header_vote_status_line, 'consensus-methods': _parse_header_consensus_methods_line, @@ -1093,7 +1093,7 @@ class NetworkStatusDocumentV3(NetworkStatusDocument): 'bandwidth-file-digest': _parse_bandwidth_file_digest, } - FOOTER_PARSER_FOR_LINE = { + _FOOTER_PARSER_FOR_LINE = { 'directory-footer': _parse_directory_footer_line, 'bandwidth-weights': _parse_footer_bandwidth_weights_line, 'directory-signature': _parse_footer_directory_signature_line, @@ -1301,8 +1301,8 @@ class NetworkStatusDocumentV3(NetworkStatusDocument): def get_unrecognized_lines(self): if self._lazy_loading: - self._parse(self._header_entries, False, parser_for_line = self.HEADER_PARSER_FOR_LINE) - self._parse(self._footer_entries, False, parser_for_line = self.FOOTER_PARSER_FOR_LINE) + self._parse(self._header_entries, False, parser_for_line = self._HEADER_PARSER_FOR_LINE) + self._parse(self._footer_entries, False, parser_for_line = self._FOOTER_PARSER_FOR_LINE) self._lazy_loading = False return super(NetworkStatusDocumentV3, self).get_unrecognized_lines() @@ -1340,7 +1340,7 @@ class NetworkStatusDocumentV3(NetworkStatusDocument): if self._default_params: self.params = dict(DEFAULT_PARAMS) - self._parse(entries, validate, parser_for_line = self.HEADER_PARSER_FOR_LINE) + self._parse(entries, validate, parser_for_line = self._HEADER_PARSER_FOR_LINE) # should only appear in consensus-method 7 or later @@ -1372,7 +1372,7 @@ class NetworkStatusDocumentV3(NetworkStatusDocument): if not (keyword == 'directory-signature' and self.is_consensus): raise ValueError("Network status documents can only have a single '%s' line, got %i" % (keyword, len(values))) - self._parse(entries, validate, parser_for_line = self.FOOTER_PARSER_FOR_LINE) + self._parse(entries, validate, parser_for_line = self._FOOTER_PARSER_FOR_LINE) # Check that the footer has the right initial line. Prior to consensus # method 9 it's a 'directory-signature' and after that footers start with

1 0

[goptlib/master] Retrospective ChangeLog.
by dcf＠torproject.org 05 Mar '19

05 Mar '19

commit 737bb08d9520b27030c32884b0303c389b407671 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Mar 5 13:54:50 2019 -0700 Retrospective ChangeLog. --- ChangeLog | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/ChangeLog b/ChangeLog new file mode 100644 index 0000000..38d63eb --- /dev/null +++ b/ChangeLog @@ -0,0 +1,55 @@ +== v1.0.0 + +Changed the tag naming scheme to work better with Go modules. +https://github.com/golang/go/wiki/Modules#semantic-import-versioning + +== 0.7 + +Fixed the ProxyError function; previously it would always panic. + +Repeated transport names in TOR_PT_SERVER_BINDADDR now result in an +ENV-ERROR. +https://bugs.torproject.org/21261 + +== 0.6 + +Remove all support for the "*" transport specification. The argument to +the ClientSetup and ServerSetup functions is now unused. +https://bugs.torproject.org/15612 + +Replaced SOCKS4a with SOCKS5. +https://bugs.torproject.org/12535 + +== 0.5 + +The AcceptSocks function no longer reports non-permanent errors, such as +those caused by a faulty SOCKS handshake. + +Added support for an upstream proxy (TOR_PT_PROXY). The two new +functions are ProxyError and ProxyDone. The ClientInfo struct has a new +ProxyURL member. +https://bugs.torproject.org/12125 + +== 0.4 + +Read the ExtORPort cookie file on every call to DialOr, instead of +reading it once and caching the result. This is to work around a tor bug +where tor doesn't ensure a new cookie file is written before starting +pluggable transports. +https://bugs.torproject.org/15240 + +== 0.3 + +Made output functions panic intead of backslash-escaping. Escaping of +invalid bytes is not specified by pt-spec, and backslashes conflicted +with the specified escaping of SMETHOD ARGS. +https://bugs.torproject.org/13370 + +== 0.2 + +Added the MakeStateDir function. + +== 0.1 +== 0.0 + +Initial release.

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gk/bug_27210_v3'
by boklm＠torproject.org 05 Mar '19

05 Mar '19

commit ba9064e4b5a369b9c70201e335ef706db25f2815 Merge: 799ccf0 f4b5f7b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Mar 5 21:45:55 2019 +0100 Merge remote-tracking branch 'gk/bug_27210_v3' Conflicts: projects/orbot/build Makefile | 15 +++++++++++ projects/android-toolchain/build | 10 +++++-- projects/firefox/config | 2 +- projects/firefox/mozconfig-android-x86 | 48 ++++++++++++++++++++++++++++++++++ projects/orbot/config | 2 +- projects/release/build | 3 +++ projects/release/config | 11 ++++++++ projects/rust/build | 5 +++- projects/rust/config | 12 ++++++--- projects/tor-browser/config | 2 +- rbm.conf | 15 ++++++++++- 11 files changed, 115 insertions(+), 10 deletions(-)

1 0

[tor-browser-build/master] Bug 27210: Add support for x86 on Android
by boklm＠torproject.org 05 Mar '19

05 Mar '19

commit f4b5f7b3b38679456d97b71904b0c59d4e4600d9 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Feb 8 10:49:13 2019 +0000 Bug 27210: Add support for x86 on Android --- Makefile | 15 +++++++++++ projects/android-toolchain/build | 10 +++++-- projects/firefox/config | 2 +- projects/firefox/mozconfig-android-x86 | 48 ++++++++++++++++++++++++++++++++++ projects/orbot/build | 7 ++++- projects/orbot/config | 2 +- projects/release/build | 3 +++ projects/release/config | 11 ++++++++ projects/rust/build | 5 +++- projects/rust/config | 12 ++++++--- projects/tor-browser/config | 2 +- rbm.conf | 15 ++++++++++- 12 files changed, 121 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index 8ec5d0c..d419422 100644 --- a/Makefile +++ b/Makefile @@ -8,6 +8,9 @@ release: submodule-update release-android-armv7: submodule-update $(rbm) build release --target release --target torbrowser-android-armv7 +release-android-x86: submodule-update + $(rbm) build release --target release --target torbrowser-android-x86 + release-linux-x86_64: submodule-update $(rbm) build release --target release --target torbrowser-linux-x86_64 @@ -32,6 +35,9 @@ alpha: submodule-update alpha-android-armv7: submodule-update $(rbm) build release --target alpha --target torbrowser-android-armv7 +alpha-android-x86: submodule-update + $(rbm) build release --target alpha --target torbrowser-android-x86 + alpha-linux-x86_64: submodule-update $(rbm) build release --target alpha --target torbrowser-linux-x86_64 @@ -56,6 +62,9 @@ nightly: submodule-update nightly-android-armv7: submodule-update $(rbm) build release --target nightly --target torbrowser-android-armv7 +nightly-android-x86: submodule-update + $(rbm) build release --target nightly --target torbrowser-android-x86 + nightly-linux-x86_64: submodule-update $(rbm) build release --target nightly --target torbrowser-linux-x86_64 @@ -80,6 +89,9 @@ alpha_nightly: submodule-update alpha_nightly-android-armv7: submodule-update $(rbm) build release --target alpha_nightly --target torbrowser-android-armv7 +alpha_nightly-android-x86: submodule-update + $(rbm) build release --target alpha_nightly --target torbrowser-android-x86 + alpha_nightly-linux-x86_64: submodule-update $(rbm) build release --target alpha_nightly --target torbrowser-linux-x86_64 @@ -101,6 +113,9 @@ testbuild: submodule-update testbuild-android-armv7: submodule-update $(rbm) build release --target testbuild --target torbrowser-android-armv7 +testbuild-android-x86: submodule-update + $(rbm) build release --target testbuild --target torbrowser-android-x86 + testbuild-linux-x86_64: submodule-update $(rbm) build release --target testbuild --target torbrowser-linux-x86_64 diff --git a/projects/android-toolchain/build b/projects/android-toolchain/build index a9d3139..ff899d2 100644 --- a/projects/android-toolchain/build +++ b/projects/android-toolchain/build @@ -17,8 +17,14 @@ unzip -qq [% c("input_files_by_name/gradle_bin") %] -d $GRADLE_HOME cd $NDK_HOME mv android-ndk-r15c/* . rm -fR android-ndk-r15c -# API 16 is the minimum we currently support for Tor Browser on Android -./build/tools/make_standalone_toolchain.py --api 16 --arch arm --install-dir=./arm + +# The architectures we support +archs="arm x86" +for arch in $archs; do + # API 16 is the minimum we currently support for Tor Browser on Android for + # 32bit. + ./build/tools/make_standalone_toolchain.py --api 16 --arch $arch --install-dir=./$arch +done # Tool Archives cd $SDK_HOME diff --git a/projects/firefox/config b/projects/firefox/config index 68f2326..4d68969 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -41,7 +41,7 @@ targets: torbrowser_update_channel: default branding_directory: browser/branding/nightly - android-armv7: + android: var: arch_deps: - openjdk-8-jdk diff --git a/projects/firefox/mozconfig-android-x86 b/projects/firefox/mozconfig-android-x86 new file mode 100644 index 0000000..1fe0b93 --- /dev/null +++ b/projects/firefox/mozconfig-android-x86 @@ -0,0 +1,48 @@ +mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-i386-linux-android +mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" +export MOZILLA_OFFICIAL=1 + +ac_add_options --enable-optimize +ac_add_options --enable-official-branding + +ac_add_options --enable-application=mobile/android +ac_add_options --target=i386-linux-android +ac_add_options --with-android-ndk=/var/tmp/dist/android-toolchain/android-ndk +ac_add_options --with-android-sdk=/var/tmp/dist/android-toolchain/android-sdk-linux +ac_add_options --with-gradle=/var/tmp/dist/android-toolchain/gradle/gradle-4.1/bin/gradle +ac_add_options --with-android-version=16 +ac_add_options --with-branding=mobile/android/branding/torbrowser + +# Android NDK does not contain llvm-config so set clang path in options +ac_add_options --with-libclang-path=/var/tmp/dist/android-toolchain/android-ndk/x86/lib64 +ac_add_options --with-clang-path=/var/tmp/dist/android-toolchain/android-ndk/x86/bin/clang + +ac_add_options --with-android-distribution-directory=@TOPSRCDIR@/mobile/android/torbrowser +ac_add_options --with-l10n-base=/var/tmp/dist/locales + +if [ -z "${TB_BUILD_WITH_UPDATER}" ]; then +# Because Google Play will likely be the primary distribution medium, +# we disable updating and rely on Google Play by default. The +# Developer Policy explicitly prohibits in-app updating: +# An app distributed via Google Play may not modify, replace, or +# update itself using any method other than Google Plays update +# mechanism. +# https://play.google.com/about/privacy-security-deception/malicious-behavior/ + + ac_add_options --disable-tor-browser-update + ac_add_options --disable-signmar + ac_add_options --disable-verify-mar +fi + +ac_add_options --enable-strip +ac_add_options --disable-tests +ac_add_options --disable-debug +ac_add_options --disable-rust-debug +ac_add_options --disable-maintenance-service +ac_add_options --disable-crashreporter +ac_add_options --disable-webrtc + +ac_add_options --without-google-play-services + +# Let's make sure no preference is enabling either Adobe's or Google's CDM. +ac_add_options --disable-eme diff --git a/projects/orbot/build b/projects/orbot/build index 4e222a9..22667b5 100644 --- a/projects/orbot/build +++ b/projects/orbot/build @@ -23,7 +23,12 @@ done # Build OrbotService Native Libraries pushd /var/tmp/build/[% project %]-[% c('version') %]/orbotservice/src/main /var/tmp/dist/android-toolchain/android-ndk/ndk-build -mv libs/armeabi-v7a/pdnsd libs/armeabi-v7a/pdnsd.so +[% IF c("var/android-armv7") %] + arch=armeabi-v7a +[% ELSE %] + arch=x86 +[% END %] +mv libs/$arch/pdnsd libs/$arch/pdnsd.so popd # Build Android Libraries and Apps diff --git a/projects/orbot/config b/projects/orbot/config index 1bedbdb..5ad5bfc 100644 --- a/projects/orbot/config +++ b/projects/orbot/config @@ -24,7 +24,7 @@ var: gradle_dependencies_version: 1 targets: - android-armv7: + android: var: arch_deps: - openjdk-8-jdk diff --git a/projects/release/build b/projects/release/build index cf190a6..ca7b26d 100644 --- a/projects/release/build +++ b/projects/release/build @@ -7,6 +7,9 @@ mkdir -p "$destdir" [% IF c("var/torbrowser-android-armv7") -%] mv [% c('input_files_by_name/android-armv7') %]/* "$destdir"/ [% END -%] +[% IF c("var/torbrowser-android-x86") -%] + mv [% c('input_files_by_name/android-x86') %]/* "$destdir"/ +[% END -%] [% IF c("var/torbrowser-windows-i686") -%] mv [% c('input_files_by_name/windows-i686') %]/* "$destdir"/ mv [% c('input_files_by_name/windows-expert-bundle') %]/* "$destdir"/ diff --git a/projects/release/config b/projects/release/config index 65e297d..1a742ac 100644 --- a/projects/release/config +++ b/projects/release/config @@ -15,9 +15,13 @@ targets: - torbrowser-windows-x86_64 - torbrowser-osx-x86_64 - torbrowser-android-armv7 + - torbrowser-android-x86 torbrowser-android-armv7: var: torbrowser-android-armv7: 1 + torbrowser-android-x86: + var: + torbrowser-android-x86: 1 torbrowser-linux-x86_64: var: torbrowser-linux-x86_64: 1 @@ -91,6 +95,13 @@ input_files: - '[% c("var/build_target") %]' - torbrowser-android-armv7 + - name: android-x86 + project: tor-browser + enable: '[% c("var/torbrowser-android-x86") %]' + target: + - '[% c("var/build_target") %]' + - torbrowser-android-x86 + - name: linux-x86_64 project: tor-browser enable: '[% c("var/torbrowser-linux-x86_64") %]' diff --git a/projects/rust/build b/projects/rust/build index 3c1d130..0df84a1 100644 --- a/projects/rust/build +++ b/projects/rust/build @@ -67,8 +67,11 @@ cd /var/tmp/build/rustc-[% c('version') %]-src [% END %] [% IF c("var/android") %] - patch -p1 < $rootdir/0001-Make-sure-dl_iterate_phdr-is-undefined-on-Android.patch patch -p1 < $rootdir/replace_pagesize_in_mmap.patch + # The additional Rust patch is not necessary for x86. + [% IF c("var/android-armv7") %] + patch -p1 < $rootdir/0001-Make-sure-dl_iterate_phdr-is-undefined-on-Android.patch + [% END %] [% END %] mkdir build diff --git a/projects/rust/config b/projects/rust/config index 48912ab..3d78ad3 100644 --- a/projects/rust/config +++ b/projects/rust/config @@ -15,15 +15,21 @@ var: use_container: 1 targets: - android-armv7: + android: var: rust_arch: x86_64 arch_deps: - libssl-dev - pkg-config - zlib1g-dev + android-armv7: + var: configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=armv7-linux-androideabi --set=target.armv7-linux-androideabi.cc=$ANDROID_NDK_HOME/arm/bin/arm-linux-androideabi-gcc + android-x86: + var: + configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=i686-linux-android --set=target.i686-linux-android.cc=$ANDROID_NDK_HOME/x86/bin/i686-linux-android-gcc + linux: var: arch_deps: @@ -92,7 +98,7 @@ input_files: enable: '[% c("var/windows-i686") && !c("input_file_var/unwind_128") %]' - filename: unwind_128.patch enable: '[% c("input_file_var/unwind_128") %]' - - filename: 0001-Make-sure-dl_iterate_phdr-is-undefined-on-Android.patch - enable: '[% c("var/android") %]' - filename: replace_pagesize_in_mmap.patch enable: '[% c("var/android") %]' + - filename: 0001-Make-sure-dl_iterate_phdr-is-undefined-on-Android.patch + enable: '[% c("var/android-armv7") %]' diff --git a/projects/tor-browser/config b/projects/tor-browser/config index c4f25ff..9b26bc8 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -41,7 +41,7 @@ targets: windows-x86_64: var: mar_osname: win64 - android-armv7: + android: build: '[% INCLUDE build.android %]' var: arch_deps: diff --git a/rbm.conf b/rbm.conf index 03c105e..1b82e60 100644 --- a/rbm.conf +++ b/rbm.conf @@ -159,11 +159,23 @@ targets: torbrowser-android-armv7: - android-armv7 + - android android-armv7: arch: armv7 var: - android: 1 + android-armv7: 1 osname: android-armv7 + torbrowser-android-x86: + - android-x86 + - android + android-x86: + arch: x86 + var: + android-x86: 1 + osname: android-x86 + android: + var: + android: 1 compiler: android-toolchain snowflake: 0 fteproxy: 0 @@ -178,6 +190,7 @@ targets: - libtool - zip - unzip + torbrowser-linux-x86_64: - linux-x86_64 - linux

1 0

[meek/master] Tests for grepHelperAddr.
by dcf＠torproject.org 05 Mar '19

05 Mar '19

commit a07bb28ba27c4f3336c7d685f0016a75e985811d Author: David Fifield <david(a)bamsoftware.com> Date: Tue Mar 5 13:17:35 2019 -0700 Tests for grepHelperAddr. --- meek-client-torbrowser/protocol_test.go | 88 +++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) diff --git a/meek-client-torbrowser/protocol_test.go b/meek-client-torbrowser/protocol_test.go new file mode 100644 index 0000000..e127c4f --- /dev/null +++ b/meek-client-torbrowser/protocol_test.go @@ -0,0 +1,88 @@ +package main + +import ( + "bytes" + "errors" + "io" + "testing" + "time" +) + +const timeout = 50 * time.Millisecond +var errTimedout = errors.New("timed out") + +type infiniteReader struct{} + +func (r *infiniteReader) Read(p []byte) (int, error) { + for i := range p { + p[i] = '\n' + } + return len(p), nil +} + +func grepHelperAddrTimeout(r io.Reader) (string, error) { + type result struct { + s string + err error + } + ch := make(chan result) + go func() { + s, err := grepHelperAddr(r) + ch <- result { + s: s, + err: err, + } + }() + + select { + case result := <-ch: + return result.s, result.err + case <-time.After(timeout): + return "", errTimedout + } +} + +func TestGrepHelperAddr(t *testing.T) { + const expectedAddr = "127.0.0.1:1000" + + // bad tests + for _, test := range []string{ + "", + "xmeek-http-helper: listen " + expectedAddr + "\n", + "meek-http-helper: listen 127.0.0.1:\n", + "meek-http-helper: listen " + expectedAddr + " \n", + "meek-http-helper: listen " + expectedAddr + "abc\n", + } { + b := bytes.NewBufferString(test) + s, err := grepHelperAddrTimeout(b) + if err != io.EOF { + t.Errorf("%q → (%q, %v), should have been %v", test, s, err, io.EOF) + } + // test again with an endless reader + b = bytes.NewBufferString(test) + s, err = grepHelperAddrTimeout(io.MultiReader(b, &infiniteReader{})) + if err != errTimedout { + t.Errorf("%q → (%q, %v), should have been %v", test, s, err, errTimedout) + } + } + + // good tests + for _, test := range []string{ + "meek-http-helper: listen " + expectedAddr, + "meek-http-helper: listen " + expectedAddr+ "\njunk", + "junk\nmeek-http-helper: listen " + expectedAddr + "\njunk", + "meek-http-helper: listen " + expectedAddr + "\nmeek-http-helper: listen 1.2.3.4:9999\n", + } { + b := bytes.NewBufferString(test) + s, err := grepHelperAddrTimeout(b) + if err != nil || s != expectedAddr { + t.Errorf("%q → (%q, %v), should have been %q", test, s, err, expectedAddr) + } + // test again with an endless reader + b = bytes.NewBufferString(test) + s, err = grepHelperAddrTimeout(io.MultiReader(b, &infiniteReader{})) + if err != nil || s != expectedAddr { + t.Errorf("%q → (%q, %v), should have been %q", test, s, err, expectedAddr) + } + } +}

1 0

[tor/master] Update git pre-push hook so that only upstream branches can get pushed to origin
by dgoulet＠torproject.org 05 Mar '19

05 Mar '19

commit ae5a0f39cd3d0098ca684c7dfb83ebfe3acca8b6 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Wed Feb 20 09:35:27 2019 +0200 Update git pre-push hook so that only upstream branches can get pushed to origin --- changes/feature29532 | 4 ++++ scripts/maint/pre-push.git-hook | 21 ++++++++++++++++++--- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/changes/feature29532 b/changes/feature29532 new file mode 100644 index 000000000..4d95e6bca --- /dev/null +++ b/changes/feature29532 @@ -0,0 +1,4 @@ + o Minor features (developer tooling): + - Modify git pre-push hook script to disallow pushing branches other than + master, release-* and maint-* to origin remote. Implements feature + 29532. diff --git a/scripts/maint/pre-push.git-hook b/scripts/maint/pre-push.git-hook index 26296023f..78d62527e 100755 --- a/scripts/maint/pre-push.git-hook +++ b/scripts/maint/pre-push.git-hook @@ -1,17 +1,32 @@ #!/bin/bash +# git pre-push hook script to prevent "fixup!" and "squash!" commit +# from ending up in master, or in any branch if CUR_BRANCH check is removed. +# Furthermore, it disallows pushing branches other than master, release-* +# and maint-* to origin (e.g. gitweb.torproject.org) +# # To install this script, copy it into .git/hooks/pre-push path in your # local copy of git repository. Make sure it has permission to execute. # -# This is git pre-push hook script to prevent "fixup!" and "squash!" commits -# from ending up in upstream branches (master, release-* or maint-*). -# # The following sample script was used as starting point: # https://github.com/git/git/blob/master/templates/hooks--pre-push.sample z40=0000000000000000000000000000000000000000 +remote="$1" CUR_BRANCH=$(git rev-parse --abbrev-ref HEAD) + +# Only allow pushing master, release-* and maint-* branches to origin. +if [ "$remote" == "origin" ] +then + if [ "$CUR_BRANCH" != "master" ] && [[ $CUR_BRANCH != release-* ]] && + [[ $CUR_BRANCH != maint-* ]] + then + echo >&2 "Not pushing $CUR_BRANCH to origin" + exit 1 + fi +fi + if [ "$CUR_BRANCH" != "master" ] && [[ $CUR_BRANCH != release-* ]] && [[ $CUR_BRANCH != maint-* ]] then

1 0

[tor/master] Also disallow pushing to/from upstream branch when branch names do not match
by dgoulet＠torproject.org 05 Mar '19

05 Mar '19

commit 7f0516022bb84378df13136273b42019e54157f9 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Fri Feb 22 17:05:07 2019 +0200 Also disallow pushing to/from upstream branch when branch names do not match --- scripts/maint/pre-push.git-hook | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/maint/pre-push.git-hook b/scripts/maint/pre-push.git-hook index 24043978b..e7a72efa0 100755 --- a/scripts/maint/pre-push.git-hook +++ b/scripts/maint/pre-push.git-hook @@ -44,8 +44,9 @@ do range="$remote_sha..$local_sha" fi - if ref_is_upstream_branch "$local_ref" == 0 || - ref_is_upstream_branch "$remote_ref" == 0 + if (ref_is_upstream_branch "$local_ref" == 0 || + ref_is_upstream_branch "$remote_ref" == 0) && + [ "$local_ref" != "$remote_ref" ] then if [ "$remote" == "origin" ] then

1 0

[tor/master] In pre-push hook script, actually check local and remote refs
by dgoulet＠torproject.org 05 Mar '19

05 Mar '19

commit f3eac74ed9c68212a9df1a1acbdf146662469a5a Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Wed Feb 20 19:48:52 2019 +0200 In pre-push hook script, actually check local and remote refs --- scripts/maint/pre-push.git-hook | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/scripts/maint/pre-push.git-hook b/scripts/maint/pre-push.git-hook index 78d62527e..14bc0690c 100755 --- a/scripts/maint/pre-push.git-hook +++ b/scripts/maint/pre-push.git-hook @@ -11,29 +11,20 @@ # The following sample script was used as starting point: # https://github.com/git/git/blob/master/templates/hooks--pre-push.sample +echo "Running pre-push hook" + z40=0000000000000000000000000000000000000000 remote="$1" -CUR_BRANCH=$(git rev-parse --abbrev-ref HEAD) -# Only allow pushing master, release-* and maint-* branches to origin. -if [ "$remote" == "origin" ] -then - if [ "$CUR_BRANCH" != "master" ] && [[ $CUR_BRANCH != release-* ]] && - [[ $CUR_BRANCH != maint-* ]] +ref_is_upstream_branch() { + if [ "$1" == "refs/heads/master" ] || + [[ "$1" == refs/heads/release-* ]] || + [[ "$1" == refs/heads/maint-* ]] then - echo >&2 "Not pushing $CUR_BRANCH to origin" - exit 1 + return 1 fi -fi - -if [ "$CUR_BRANCH" != "master" ] && [[ $CUR_BRANCH != release-* ]] && - [[ $CUR_BRANCH != maint-* ]] -then - exit 0 -fi - -echo "Running pre-push hook" +} # shellcheck disable=SC2034 while read -r local_ref local_sha remote_ref remote_sha @@ -52,6 +43,19 @@ do range="$remote_sha..$local_sha" fi + if ref_is_upstream_branch "$local_ref" == 0 || + ref_is_upstream_branch "$remote_ref" == 0 + then + if [ "$remote" == "origin" ] + then + echo >&2 "Not pushing: $local_ref to $remote_ref" + echo >&2 "If you really want to push this, use --no-verify." + exit 1 + else + continue + fi + fi + # Check for fixup! commit commit=$(git rev-list -n 1 --grep '^fixup!' "$range") if [ -n "$commit" ]

1 0

[tor/master] Merge branch 'tor-github/pr/717'
by dgoulet＠torproject.org 05 Mar '19

05 Mar '19

commit db2e916afe34c2b2fd3078a0cd4f8e5ba7193904 Merge: f1890707c 7f0516022 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Mar 5 14:26:59 2019 -0500 Merge branch 'tor-github/pr/717' changes/feature29532 | 4 ++++ scripts/maint/pre-push.git-hook | 41 +++++++++++++++++++++++++++++++---------- 2 files changed, 35 insertions(+), 10 deletions(-)

1 0