#4071: Block pushes to origin/ in gitolite ACLs -----------------------+----------------------- Reporter: jkeating | Owner: rel-eng@… Type: task | Status: new Milestone: | Component: git Resolution: | Keywords: Blocked By: | Blocking: -----------------------+-----------------------

Comment (by till):

This update-hook should allow this: {{{ #! /bin/sh

refname="${1}" sha1_old="${2}" sha1_new="${3}"

echo "${refname}" | grep -q '^origin/' && exit 1 || exit 0 }}}

#4071: Block pushes to origin/ in gitolite ACLs -----------------------+----------------------- Reporter: jkeating | Owner: rel-eng@… Type: task | Status: new Milestone: | Component: git Resolution: | Keywords: meeting Blocked By: | Blocking: -----------------------+-----------------------

Comment (by bochecha):

The above patch adds the update hook to ansible, and sets it up for dist- git.

After this is deployed, new git repos would use the hook and block pushes of {{{origin/*}}} branches.

However, existing git repos wouldn't.

How do we want to go about doing that? Run a one-time script that sets the hooks for older repos? Should that be part of the Ansible deployment of dist-git?

#4071: Block pushes to origin/ in gitolite ACLs -----------------------+----------------------- Reporter: jkeating | Owner: rel-eng@… Type: task | Status: new Milestone: | Component: git Resolution: | Keywords: meeting Blocked By: | Blocking: -----------------------+-----------------------

Comment (by bochecha):

Here are the new patches, based on the discussion in the last releng meeting.

First patch is the same as before: it implements the hook (now with a better regexp than before) and sets it to be deployed in '''newly created''' git repositories.

Second patch is just some reorganization of a role in Ansible, to make the existing git check script easier to reuse.

Third patch adds to the git check script a new test, to verify that the update hooks are properly set up, and optionally fix it if not. This is what we can use to go over all '''existing''' git repositories and add the new hook to them. The command to run would be:

{{{ $ git check-perms --check=update-hook [--fix] /srv/git/rpms }}}

Fourth patch is completely optional, but I figured I'd throw it out there, in case it is useful. It just schedules a weekly execution of the check script, to ensure that we don't have any repositories left that somehow don't have the right update hooks.