deac/gitolite
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

vref: code

Browse source 
- compile: VREF/ is special, like NAME/
  - update hook: use a new "check_vrefs" sub to
      - spawn helpers for each vref in @allowed_refs
      - for each vref returned by the helper, call check_ref
This commit is contained in:
Sitaram Chamarty 2012-02-25 19:59:23 +05:30
parent 29b2c2fdce
commit 56f975d14c
3 changed files with 105 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

77
hooks/common/update
View file

@ -75,32 +75,12 @@ push @allowed_refs, @ { $repos{'@all'} {$ENV{GL_USER}} || [] };
push @allowed_refs, @ { $repos{$ENV{GL_REPO}}{'@all'} || [] };
push @allowed_refs, @ { $repos{'@all'} {'@all'} || [] };
# prepare the list of refs to be checked
# first check the main ref (this is a *real* ref, like refs/heads/master, and
# is what we print in the log)
my $log_refex = check_ref(\@allowed_refs, $ENV{GL_REPO}, $ref, $att_acc);
# previously, we just checked $ref -- the ref being updated, which is passed
# to us by git (see man githooks). Now we also have to treat each NAME being
# updated as a potential "ref" and check that, if NAME-based restrictions have
# been specified
my @refs = ($ref); # the first ref to check is the real one
# because making it work screws up efficiency like no tomorrow...
if (exists $repos{$ENV{GL_REPO}}{NAME_LIMITS}) {
# this is special to git -- the hash of an empty tree
my $empty='4b825dc642cb6eb9a060e54bf8d69288fbee4904';
# well they're not really "trees" but $empty is indeed the empty tree so
# we can just pretend $oldsha/$newsha are also trees, and anyway 'git
# diff' only wants trees
my $oldtree = $oldsha eq '0' x 40 ? $empty : $oldsha;
my $newtree = $newsha eq '0' x 40 ? $empty : $newsha;
push @refs, map { chomp; s/^/NAME\//; $_; } `git diff --name-only $oldtree $newtree`;
}
# we potentially have many "refs" to check. The one we print in the log is
# the *first* one (which is a *real* ref, like refs/heads/master), while all
# the rest (if they exist) are like NAME/something. So we do the first one
# separately to capture it, then run the rest (if any)
my $log_refex = check_ref(\@allowed_refs, $ENV{GL_REPO}, (shift @refs), $att_acc);
check_ref (\@allowed_refs, $ENV{GL_REPO}, $_ , $att_acc) for @refs;
# then we check all virtual refs
check_vrefs(\@allowed_refs, $ENV{GL_REPO}, $att_acc);
# if we returned at all, all the checks succeeded. Check secondary hooks now
$UPDATE_CHAINS_TO ||= 'hooks/update.secondary';
@ -111,3 +91,50 @@ log_it("", "$att_acc\t" . substr($oldsha, 0, 14) . "\t" . substr($newsha, 0, 14
"\t$reported_repo\t$ref\t$log_refex");
exit 0;
# ----------------------------------------------------------------------
sub check_vrefs {
my ( $ar_ref, $repo, $aa ) = @_;
# these will be passed on as args 1, 2, 4 to check_ref. Arg-3 will be
# the new ref being checked.
# this sub uses $ref, $oldsha, and $newsha globals; they're pretty much
# 'constant' once you enter an update hook anyway
my $empty = '4b825dc642cb6eb9a060e54bf8d69288fbee4904'; # this is special to git -- the hash of an empty tree
my $oldtree = $oldsha eq '0' x 40 ? $empty : $oldsha;
my $newtree = $newsha eq '0' x 40 ? $empty : $newsha;
my @first6 = ( $ref, $oldsha, $newsha, $oldtree, $newtree, $aa );
# first, handle the VREF thats's been in "core" forever...
if ( $repos{ $ENV{GL_REPO} }{NAME_LIMITS} ) {
for my $ref ( map { chomp; s/^/NAME\//; $_; } `git diff --name-only $oldtree $newtree` ) {
check_ref( $ar_ref, $repo, $ref, $aa );
}
}
my %vref_seen;
for my $vr ( grep { m(^VREF/) } map { $_->[1] } sort { $a->[0] <=> $b->[0] } @{$ar_ref} ) {
next if $vref_seen{$vr}++;
# find code pertaining to $vr and run it; see docs for details
my ( $dummy, $pgm, @args ) = split '/', $vr;
$pgm = "$ENV{GL_BINDIR}/gl-VREF-$pgm";
-x $pgm or die "can't find helper program for $vr\n";
open( my $fh, "-|", $pgm, @first6, $vr, @args ) or die "can't spawn helper program for $vr: $!\n";
while (<$fh>) {
my ( $vref, $deny_message ) = split( ' ', $_, 2 );
my $ret = check_ref( $ar_ref, $repo, $vref, $aa, 1 );
die "$ret\n" . ( $deny_message || '' ) if $ret =~ /DENIED/ and $ret !~ /by fallthru/;
# I could change check_ref to take one more argument, say
# 'fallthru_is_pass', but I want to keep these changes as
# isolated as possible for now
}
close($fh) or die $!
? "Error closing sort pipe: $!"
: "Exit status $? from VREF helper program for $vr";
}
}