From patchwork Wed Jun 19 15:18:17 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Keeping X-Patchwork-Id: 1118771 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=busybox.net (client-ip=140.211.166.133; helo=hemlock.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=metanate.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=metanate.com header.i=@metanate.com header.b="jmkw+5hF"; dkim-atps=neutral Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 45TTBM2XW0z9s5c for ; Thu, 20 Jun 2019 01:19:06 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 2CD6787B3C; Wed, 19 Jun 2019 15:19:02 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kzmJevOeYHWq; Wed, 19 Jun 2019 15:19:00 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by hemlock.osuosl.org (Postfix) with ESMTP id 6190387B39; Wed, 19 Jun 2019 15:19:00 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by ash.osuosl.org (Postfix) with ESMTP id 42DA81BF5F5 for ; Wed, 19 Jun 2019 15:18:59 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 3B4112076B for ; Wed, 19 Jun 2019 15:18:59 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3bMH9vU79f0W for ; Wed, 19 Jun 2019 15:18:58 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from metanate.com (dougal.metanate.com [90.155.101.14]) by silver.osuosl.org (Postfix) with ESMTPS id 300C720764 for ; Wed, 19 Jun 2019 15:18:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=simple/simple; d=metanate.com; s=stronger; h=Content-Transfer-Encoding:MIME-Version:Message-Id:Date:Subject :Cc:To:From:Sender:Reply-To:Content-Type:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=aVvExcnm/EDvM0XaMW72rmfw22o6Pm8FFO7nru+ruSM=; b=jmkw+5hFBmY74I2ROcrmLtozWS TD0Z+i8i0UImOiQVk8j0ZtHGaUy3N7U5AzGd3inCZD0I5QQag1ootPYrsrdh3rcuaoEfpxPtrBiJb 8lW73yKBePpdUY/p6CIcD1MJJ/bQo7jfmq479u3G6RA4a1cwJJ4PBNDtgzDv7rrEtrMWxazdADqJO QRpKu6p76XvlWimxc5VZGarWj602tQoGr0bsnvTKboJK43sTkr+xuDeWuIErMu20g7ZPOLnKiYegs mkkA4om57lf6uYN0UPB0+i5Acj+SAQn6AmnqJBzl9Hv3+9XcgBkkziGZUSgpobqcrR/YtTm9xcf4j 86uhp/XQ==; Received: from dougal.metanate.com ([192.168.88.1] helo=localhost.localdomain) by shrek.metanate.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.90_1) (envelope-from ) id 1hdcMM-0006g1-0a; Wed, 19 Jun 2019 16:18:50 +0100 From: John Keeping To: buildroot@buildroot.org Date: Wed, 19 Jun 2019 16:18:17 +0100 Message-Id: <20190619151817.6331-1-john@metanate.com> X-Mailer: git-send-email 2.22.0 MIME-Version: 1.0 X-Authenticated: YES Subject: [Buildroot] [RFC PATCH] download/git: ban branch references X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: John Keeping , "Yann E . MORIN" Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" As described in the manual, using a branch name as a version is not supported. However, nothing enforces this so it is easy to specify a branch name either accidentally or because new developers have not read through the manual. For Git it is reasonably easy to catch most violations of this rule and fail the fetch phase. This isn't intended to be a comprehensive filter (it can be bypassed with, for example, FOO_VERSION=origin/master), but should catch accidental use of a branch version and prompt switching to an immutable reference. Signed-off-by: John Keeping --- support/download/git | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/support/download/git b/support/download/git index 075f665bbf..3f26613e61 100755 --- a/support/download/git +++ b/support/download/git @@ -134,6 +134,25 @@ if ! _git rev-parse --quiet --verify "'${cset}^{commit}'" >/dev/null 2>&1; then exit 1 fi +# Check that the specified version is not a branch. We expect a tag or +# raw commit hash, and accept some special refs as above. Using a branch +# is forbidden because these are mutable references. +case "${cset}" in + refs/heads/*) + printf >&2 "Refusing to use Git branch '%s'.\n" "${cset#refs/heads/}" + exit 1 + ;; + refs/*) + : pass + ;; + *) + if _git rev-parse --quiet --verify "refs/heads/${cset}" >/dev/null 2>&1; then + printf >&2 "Refusing to use Git branch '%s'.\n" "${cset}" + exit 1 + fi + ;; +esac + # The new cset we want to checkout might have different submodules, or # have sub-dirs converted to/from a submodule. So we would need to # deregister _current_ submodules before we checkout.