die $!;
}
+sub recorderror ($) {
+ my ($why) = @_;
+ my $w = $ENV{'DGIT_DRS_WORK'}; # we are in stunthook
+ if (defined $w) {
+ chomp $why;
+ open ERR, ">", "$w/drs-error" or die $!;
+ print ERR $why, "\n" or die $!;
+ close ERR or die $!;
+ return 1;
+ }
+ return 0;
+}
+
sub reject ($) {
my ($why) = @_;
- debug " rejecting $why";
+ recorderror "reject: $why";
die "dgit-repos-server: reject: $why\n";
}
-sub runcmd {
+sub debugcmd {
if ($debug) {
use Data::Dumper;
local $Data::Dumper::Indent = 0;
local $Data::Dumper::Terse = 1;
debug "|".Dumper(\@_);
}
+}
+
+sub runcmd {
+ debugcmd @_;
$!=0; $?=0;
my $r = system @_;
die "@_ $? $!" if $r;
mkrepotmp();
$destrepo = "$dgitrepos/_tmp/${package}_prospective";
acquiretree($destrepo, 1);
- my $r = system qw(cp -a --), "$dgitrepos/_template", "$destrepo";
+ my $template = "$dgitrepos/_template";
+ debug "fixmissing copy tempalate $template -> $destrepo";
+ my $r = system qw(cp -a --), $template, $destrepo;
!$r or die "create new repo failed failed: $r $!";
}
sub maybeinstallprospective () {
return if $destrepo eq $realdestrepo;
- debug " show-ref ...";
+ if (open REJ, "<", "$workrepo/drs-error") {
+ local $/ = undef;
+ my $msg = <REJ>;
+ REJ->error and die $!;
+ print STDERR $msg;
+ exit 1;
+ } else {
+ $!==&ENOENT or die $!;
+ }
+
+ debug " show-ref ($destrepo) ...";
my $child = open SR, "-|";
defined $child or die $!;
die;
die if $got{$wh}++;
}
- die if grep { !$_ } values %got;
- $!=0; $?=0; close SR or die "$? $!";
+ $!=0; $?=0; close SR or $?==256 or die "$? $!";
+ debug "installprospective ?";
+ die Dumper(\%got)." -- missing refs in new repo"
+ if grep { !$_ } values %got;
+
+ debug "install $destrepo => $realdestrepo";
rename $destrepo, $realdestrepo or die $!;
remove "$destrepo.lock" or die $!;
}
debug " updates ...";
while (<STDIN>) {
chomp or die;
- debug " updates| $_";
+ debug " upd.| $_";
m/^(\S+) (\S+) (\S+)$/ or die "$_ ?";
my ($old, $sha1, $refname) = ($1, $2, $3);
if ($refname =~ m{^refs/tags/(?=debian/)}) {
- die if defined $tagname;
+ reject "pushing multiple tags!" if defined $tagname;
$tagname = $'; #';
$tagval = $sha1;
reject "tag $tagname already exists -".
" not replacing previously-pushed version"
if $old =~ m/[^0]/;
} elsif ($refname =~ m{^refs/dgit/}) {
- die if defined $suite;
+ reject "pushing multiple heads!" if defined $suite;
$suite = $'; #';
$oldcommit = $old;
$commit = $sha1;
} else {
- die;
+ reject "pushing unexpected ref!";
}
}
STDIN->error and die $!;
- die unless defined $tagname;
- die unless defined $suite;
+ reject "push is missing tag ref update" unless defined $tagname;
+ reject "push is missing head ref update" unless defined $suite;
debug " updates ok.";
}
}
}
$!=0; $_=<T>; defined or die $!;
- m/^($package_re) release (\S+) for (\S+) \[dgit\]$/ or die;
+ m/^($package_re) release (\S+) for \S+ \((\S+)\) \[dgit\]$/ or
+ reject "tag message not in expected format";
die unless $1 eq $package;
$version = $2;
- die unless $3 eq $suite;
+ die "$3 != $suite " unless $3 eq $suite;
for (;;) {
print PT or die $!;
- $!=0; $_=<T>; defined or die $!;
+ $!=0; $_=<T>; defined or die "missing signature? $!";
last if m/^-----BEGIN PGP/;
}
for (;;) {
debug " checksig keyring $keyringfile...";
- open P, "-|", (qw(gpgv --status-fd=1 --keyring),
+ our @cmd = (qw(gpgv --status-fd=1 --keyring),
$keyringfile,
- qw(dgit-tmp/plaintext.asc dgit-tmp/plaintext))
+ qw(dgit-tmp/plaintext.asc dgit-tmp/plaintext));
+ debugcmd @cmd;
+
+ open P, "-|", @cmd
or die $!;
while (<P>) {
- next unless s/^\[GNUPG:\]: //;
+ next unless s/^\[GNUPG:\] //;
chomp or die;
debug " checksig| $_";
my @l = split / /, $_;
while (<DT>) {
m/^fingerprint:\s+$keyid$/oi
..0 or next;
- m/^\S/
- or reject "key $keyid missing Allow section in permissions!";
+ if (s/^allow:/ /i..0) {
+ } else {
+ m/^./
+ or reject "key $keyid missing Allow section in permissions!";
+ next;
+ }
# in right stanza...
- s/^allow:/ /i
- ..0 or next;
- s/^\s+//
+ s/^[ \t]+//
or reject "package $package not allowed for key $keyid";
# in allow field...
s/\([^()]+\)//;
}
sub checksuite () {
- debug "checksuite";
+ debug "checksuite ($suitesfile)";
open SUITES, "<", $suitesfile or die $!;
while (<SUITES>) {
chomp;
reject "unknown suite";
}
+sub tagh1 ($) {
+ my ($tag) = @_;
+ my $vals = $tagh{$tag};
+ reject "missing header $tag in signed tag object" unless $vals;
+ reject "multiple headers $tag in signed tag object" unless @$vals == 1;
+ return $vals->[0];
+}
+
sub checks () {
debug "checks";
checksuite();
- tagh1('type') eq 'commit' or die;
- tagh1('object') eq $commit or die;
- tagh1('tag') eq $tagname or die;
+ tagh1('type') eq 'commit' or reject "tag refers to wrong kind of object";
+ tagh1('object') eq $commit or reject "tag refers to wrong commit";
+ tagh1('tag') eq $tagname or reject "tag name in tag is wrong";
my $v = $version;
$v =~ y/~:/_%/;
}
sub onwardpush () {
+ my @cmd = (qw(git send-pack), $destrepo,
+ "$commit:refs/dgit/$suite",
+ "$tagval:refs/tags/$tagname");
+ debugcmd @cmd;
$!=0;
- my $r = system (qw(git send-pack),
- $destrepo,
- "$commit:refs/dgit/$suite",
- "$tagval:refs/tags/$tagname");
+ my $r = system @cmd;
!$r or die "onward push failed: $r $!";
}
verifytag();
checks();
onwardpush();
+ debug "stunthook done.";
}
#----- git-upload-pack -----
sub parseargsdispatch () {
die unless @ARGV;
+ delete $ENV{'GIT_DIR'}; # if not run via ssh, our parent git process
+ delete $ENV{'GIT_PREFIX'}; # sets these and they mess things up
+
if ($ENV{'DGIT_DRS_DEBUG'}) {
$debug='=';
open DEBUG, ">&STDERR" or die $!;
defined($destrepo = $ENV{'DGIT_DRS_DEST'}) or die;
defined($keyrings = $ENV{'DGIT_DRS_KEYRINGS'}) or die $!;
open STDOUT, ">&STDERR" or die $!;
- stunthook();
+ eval {
+ stunthook();
+ };
+ if ($@) {
+ recorderror "$@" or die;
+ die $@;
+ }
exit 0;
}
~ianmdlvl / dgit.git / blobdiff