Add require signed commit for protected branch (#9708)
* Add require signed commit for protected branch * Fix fmt * Make editor show if they will be signed * bugfix * Add basic merge check and better information for CRUD * linting comment * Add descriptors to merge signing * Slight refactor * Slight improvement to appearances * Handle Merge API * manage CRUD API * Move error to error.go * Remove fix to delete.go * prep for merge * need to tolerate \r\n in message * check protected branch before trying to load it * Apply suggestions from code review Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com> * fix commit-reader Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>
This commit is contained in:
parent
6b1fa12359
commit
66ee9b87f9
29 changed files with 618 additions and 122 deletions
|
@ -46,6 +46,7 @@ type ProtectedBranch struct {
|
|||
RequiredApprovals int64 `xorm:"NOT NULL DEFAULT 0"`
|
||||
BlockOnRejectedReviews bool `xorm:"NOT NULL DEFAULT false"`
|
||||
DismissStaleApprovals bool `xorm:"NOT NULL DEFAULT false"`
|
||||
RequireSignedCommits bool `xorm:"NOT NULL DEFAULT false"`
|
||||
|
||||
CreatedUnix timeutil.TimeStamp `xorm:"created"`
|
||||
UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
|
||||
|
|
|
@ -916,6 +916,22 @@ func (err ErrUserDoesNotHaveAccessToRepo) Error() string {
|
|||
return fmt.Sprintf("user doesn't have acces to repo [user_id: %d, repo_name: %s]", err.UserID, err.RepoName)
|
||||
}
|
||||
|
||||
// ErrWontSign explains the first reason why a commit would not be signed
|
||||
// There may be other reasons - this is just the first reason found
|
||||
type ErrWontSign struct {
|
||||
Reason signingMode
|
||||
}
|
||||
|
||||
func (e *ErrWontSign) Error() string {
|
||||
return fmt.Sprintf("wont sign: %s", e.Reason)
|
||||
}
|
||||
|
||||
// IsErrWontSign checks if an error is a ErrWontSign
|
||||
func IsErrWontSign(err error) bool {
|
||||
_, ok := err.(*ErrWontSign)
|
||||
return ok
|
||||
}
|
||||
|
||||
// __________ .__
|
||||
// \______ \____________ ____ ____ | |__
|
||||
// | | _/\_ __ \__ \ / \_/ ___\| | \
|
||||
|
|
|
@ -298,6 +298,8 @@ var migrations = []Migration{
|
|||
NewMigration("Add owner_name on table repository", addOwnerNameOnRepository),
|
||||
// v121 -> v122
|
||||
NewMigration("add is_restricted column for users table", addIsRestricted),
|
||||
// v122 -> v123
|
||||
NewMigration("Add Require Signed Commits to ProtectedBranch", addRequireSignedCommits),
|
||||
}
|
||||
|
||||
// Migrate database to current version
|
||||
|
|
18
models/migrations/v122.go
Normal file
18
models/migrations/v122.go
Normal file
|
@ -0,0 +1,18 @@
|
|||
// Copyright 2020 The Gitea Authors. All rights reserved.
|
||||
// Use of this source code is governed by a MIT-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package migrations
|
||||
|
||||
import (
|
||||
"xorm.io/xorm"
|
||||
)
|
||||
|
||||
func addRequireSignedCommits(x *xorm.Engine) error {
|
||||
|
||||
type ProtectedBranch struct {
|
||||
RequireSignedCommits bool `xorm:"NOT NULL DEFAULT false"`
|
||||
}
|
||||
|
||||
return x.Sync2(new(ProtectedBranch))
|
||||
}
|
|
@ -152,16 +152,18 @@ func (pr *PullRequest) LoadProtectedBranch() (err error) {
|
|||
}
|
||||
|
||||
func (pr *PullRequest) loadProtectedBranch(e Engine) (err error) {
|
||||
if pr.BaseRepo == nil {
|
||||
if pr.BaseRepoID == 0 {
|
||||
return nil
|
||||
}
|
||||
pr.BaseRepo, err = getRepositoryByID(e, pr.BaseRepoID)
|
||||
if err != nil {
|
||||
return
|
||||
if pr.ProtectedBranch == nil {
|
||||
if pr.BaseRepo == nil {
|
||||
if pr.BaseRepoID == 0 {
|
||||
return nil
|
||||
}
|
||||
pr.BaseRepo, err = getRepositoryByID(e, pr.BaseRepoID)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
}
|
||||
pr.ProtectedBranch, err = getProtectedBranchBy(e, pr.BaseRepo.ID, pr.BaseBranch)
|
||||
}
|
||||
pr.ProtectedBranch, err = getProtectedBranchBy(e, pr.BaseRepo.ID, pr.BaseBranch)
|
||||
return
|
||||
}
|
||||
|
||||
|
|
|
@ -11,16 +11,16 @@ import (
|
|||
)
|
||||
|
||||
// SignMerge determines if we should sign a PR merge commit to the base repository
|
||||
func (pr *PullRequest) SignMerge(u *User, tmpBasePath, baseCommit, headCommit string) (bool, string) {
|
||||
func (pr *PullRequest) SignMerge(u *User, tmpBasePath, baseCommit, headCommit string) (bool, string, error) {
|
||||
if err := pr.GetBaseRepo(); err != nil {
|
||||
log.Error("Unable to get Base Repo for pull request")
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
repo := pr.BaseRepo
|
||||
|
||||
signingKey := signingKey(repo.RepoPath())
|
||||
if signingKey == "" {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{noKey}
|
||||
}
|
||||
rules := signingModeFromStrings(setting.Repository.Signing.Merges)
|
||||
|
||||
|
@ -30,92 +30,101 @@ func (pr *PullRequest) SignMerge(u *User, tmpBasePath, baseCommit, headCommit st
|
|||
for _, rule := range rules {
|
||||
switch rule {
|
||||
case never:
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{never}
|
||||
case always:
|
||||
break
|
||||
case pubkey:
|
||||
keys, err := ListGPGKeys(u.ID)
|
||||
if err != nil || len(keys) == 0 {
|
||||
return false, ""
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if len(keys) == 0 {
|
||||
return false, "", &ErrWontSign{pubkey}
|
||||
}
|
||||
case twofa:
|
||||
twofa, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil || twofa == nil {
|
||||
return false, ""
|
||||
twofaModel, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if twofaModel == nil {
|
||||
return false, "", &ErrWontSign{twofa}
|
||||
}
|
||||
case approved:
|
||||
protectedBranch, err := GetProtectedBranchBy(repo.ID, pr.BaseBranch)
|
||||
if err != nil || protectedBranch == nil {
|
||||
return false, ""
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if protectedBranch == nil {
|
||||
return false, "", &ErrWontSign{approved}
|
||||
}
|
||||
if protectedBranch.GetGrantedApprovalsCount(pr) < 1 {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{approved}
|
||||
}
|
||||
case baseSigned:
|
||||
if gitRepo == nil {
|
||||
gitRepo, err = git.OpenRepository(tmpBasePath)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
defer gitRepo.Close()
|
||||
}
|
||||
commit, err := gitRepo.GetCommit(baseCommit)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
verification := ParseCommitWithSignature(commit)
|
||||
if !verification.Verified {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{baseSigned}
|
||||
}
|
||||
case headSigned:
|
||||
if gitRepo == nil {
|
||||
gitRepo, err = git.OpenRepository(tmpBasePath)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
defer gitRepo.Close()
|
||||
}
|
||||
commit, err := gitRepo.GetCommit(headCommit)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
verification := ParseCommitWithSignature(commit)
|
||||
if !verification.Verified {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{headSigned}
|
||||
}
|
||||
case commitsSigned:
|
||||
if gitRepo == nil {
|
||||
gitRepo, err = git.OpenRepository(tmpBasePath)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
defer gitRepo.Close()
|
||||
}
|
||||
commit, err := gitRepo.GetCommit(headCommit)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
verification := ParseCommitWithSignature(commit)
|
||||
if !verification.Verified {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{commitsSigned}
|
||||
}
|
||||
// need to work out merge-base
|
||||
mergeBaseCommit, _, err := gitRepo.GetMergeBase("", baseCommit, headCommit)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
commitList, err := commit.CommitsBeforeUntil(mergeBaseCommit)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
for e := commitList.Front(); e != nil; e = e.Next() {
|
||||
commit = e.Value.(*git.Commit)
|
||||
verification := ParseCommitWithSignature(commit)
|
||||
if !verification.Verified {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{commitsSigned}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return true, signingKey
|
||||
return true, signingKey, nil
|
||||
}
|
||||
|
|
|
@ -25,6 +25,7 @@ const (
|
|||
headSigned signingMode = "headsigned"
|
||||
commitsSigned signingMode = "commitssigned"
|
||||
approved signingMode = "approved"
|
||||
noKey signingMode = "nokey"
|
||||
)
|
||||
|
||||
func signingModeFromStrings(modeStrings []string) []signingMode {
|
||||
|
@ -95,122 +96,140 @@ func PublicSigningKey(repoPath string) (string, error) {
|
|||
}
|
||||
|
||||
// SignInitialCommit determines if we should sign the initial commit to this repository
|
||||
func SignInitialCommit(repoPath string, u *User) (bool, string) {
|
||||
func SignInitialCommit(repoPath string, u *User) (bool, string, error) {
|
||||
rules := signingModeFromStrings(setting.Repository.Signing.InitialCommit)
|
||||
signingKey := signingKey(repoPath)
|
||||
if signingKey == "" {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{noKey}
|
||||
}
|
||||
|
||||
for _, rule := range rules {
|
||||
switch rule {
|
||||
case never:
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{never}
|
||||
case always:
|
||||
break
|
||||
case pubkey:
|
||||
keys, err := ListGPGKeys(u.ID)
|
||||
if err != nil || len(keys) == 0 {
|
||||
return false, ""
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if len(keys) == 0 {
|
||||
return false, "", &ErrWontSign{pubkey}
|
||||
}
|
||||
case twofa:
|
||||
twofa, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil || twofa == nil {
|
||||
return false, ""
|
||||
twofaModel, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if twofaModel == nil {
|
||||
return false, "", &ErrWontSign{twofa}
|
||||
}
|
||||
}
|
||||
}
|
||||
return true, signingKey
|
||||
return true, signingKey, nil
|
||||
}
|
||||
|
||||
// SignWikiCommit determines if we should sign the commits to this repository wiki
|
||||
func (repo *Repository) SignWikiCommit(u *User) (bool, string) {
|
||||
func (repo *Repository) SignWikiCommit(u *User) (bool, string, error) {
|
||||
rules := signingModeFromStrings(setting.Repository.Signing.Wiki)
|
||||
signingKey := signingKey(repo.WikiPath())
|
||||
if signingKey == "" {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{noKey}
|
||||
}
|
||||
|
||||
for _, rule := range rules {
|
||||
switch rule {
|
||||
case never:
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{never}
|
||||
case always:
|
||||
break
|
||||
case pubkey:
|
||||
keys, err := ListGPGKeys(u.ID)
|
||||
if err != nil || len(keys) == 0 {
|
||||
return false, ""
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if len(keys) == 0 {
|
||||
return false, "", &ErrWontSign{pubkey}
|
||||
}
|
||||
case twofa:
|
||||
twofa, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil || twofa == nil {
|
||||
return false, ""
|
||||
twofaModel, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if twofaModel == nil {
|
||||
return false, "", &ErrWontSign{twofa}
|
||||
}
|
||||
case parentSigned:
|
||||
gitRepo, err := git.OpenRepository(repo.WikiPath())
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
defer gitRepo.Close()
|
||||
commit, err := gitRepo.GetCommit("HEAD")
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
if commit.Signature == nil {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{parentSigned}
|
||||
}
|
||||
verification := ParseCommitWithSignature(commit)
|
||||
if !verification.Verified {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{parentSigned}
|
||||
}
|
||||
}
|
||||
}
|
||||
return true, signingKey
|
||||
return true, signingKey, nil
|
||||
}
|
||||
|
||||
// SignCRUDAction determines if we should sign a CRUD commit to this repository
|
||||
func (repo *Repository) SignCRUDAction(u *User, tmpBasePath, parentCommit string) (bool, string) {
|
||||
func (repo *Repository) SignCRUDAction(u *User, tmpBasePath, parentCommit string) (bool, string, error) {
|
||||
rules := signingModeFromStrings(setting.Repository.Signing.CRUDActions)
|
||||
signingKey := signingKey(repo.RepoPath())
|
||||
if signingKey == "" {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{noKey}
|
||||
}
|
||||
|
||||
for _, rule := range rules {
|
||||
switch rule {
|
||||
case never:
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{never}
|
||||
case always:
|
||||
break
|
||||
case pubkey:
|
||||
keys, err := ListGPGKeys(u.ID)
|
||||
if err != nil || len(keys) == 0 {
|
||||
return false, ""
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if len(keys) == 0 {
|
||||
return false, "", &ErrWontSign{pubkey}
|
||||
}
|
||||
case twofa:
|
||||
twofa, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil || twofa == nil {
|
||||
return false, ""
|
||||
twofaModel, err := GetTwoFactorByUID(u.ID)
|
||||
if err != nil {
|
||||
return false, "", err
|
||||
}
|
||||
if twofaModel == nil {
|
||||
return false, "", &ErrWontSign{twofa}
|
||||
}
|
||||
case parentSigned:
|
||||
gitRepo, err := git.OpenRepository(tmpBasePath)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
defer gitRepo.Close()
|
||||
commit, err := gitRepo.GetCommit(parentCommit)
|
||||
if err != nil {
|
||||
return false, ""
|
||||
return false, "", err
|
||||
}
|
||||
if commit.Signature == nil {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{parentSigned}
|
||||
}
|
||||
verification := ParseCommitWithSignature(commit)
|
||||
if !verification.Verified {
|
||||
return false, ""
|
||||
return false, "", &ErrWontSign{parentSigned}
|
||||
}
|
||||
}
|
||||
}
|
||||
return true, signingKey
|
||||
return true, signingKey, nil
|
||||
}
|
||||
|
|
|
@ -173,6 +173,7 @@ type ProtectBranchForm struct {
|
|||
ApprovalsWhitelistTeams string
|
||||
BlockOnRejectedReviews bool
|
||||
DismissStaleApprovals bool
|
||||
RequireSignedCommits bool
|
||||
}
|
||||
|
||||
// Validate validates the fields
|
||||
|
|
|
@ -74,14 +74,57 @@ func RepoMustNotBeArchived() macaron.Handler {
|
|||
}
|
||||
}
|
||||
|
||||
// CanCommitToBranchResults represents the results of CanCommitToBranch
|
||||
type CanCommitToBranchResults struct {
|
||||
CanCommitToBranch bool
|
||||
EditorEnabled bool
|
||||
UserCanPush bool
|
||||
RequireSigned bool
|
||||
WillSign bool
|
||||
SigningKey string
|
||||
WontSignReason string
|
||||
}
|
||||
|
||||
// CanCommitToBranch returns true if repository is editable and user has proper access level
|
||||
// and branch is not protected for push
|
||||
func (r *Repository) CanCommitToBranch(doer *models.User) (bool, error) {
|
||||
protectedBranch, err := r.Repository.IsProtectedBranchForPush(r.BranchName, doer)
|
||||
func (r *Repository) CanCommitToBranch(doer *models.User) (CanCommitToBranchResults, error) {
|
||||
protectedBranch, err := models.GetProtectedBranchBy(r.Repository.ID, r.BranchName)
|
||||
|
||||
if err != nil {
|
||||
return false, err
|
||||
return CanCommitToBranchResults{}, err
|
||||
}
|
||||
return r.CanEnableEditor() && !protectedBranch, nil
|
||||
userCanPush := true
|
||||
requireSigned := false
|
||||
if protectedBranch != nil {
|
||||
userCanPush = protectedBranch.CanUserPush(doer.ID)
|
||||
requireSigned = protectedBranch.RequireSignedCommits
|
||||
}
|
||||
|
||||
sign, keyID, err := r.Repository.SignCRUDAction(doer, r.Repository.RepoPath(), git.BranchPrefix+r.BranchName)
|
||||
|
||||
canCommit := r.CanEnableEditor() && userCanPush
|
||||
if requireSigned {
|
||||
canCommit = canCommit && sign
|
||||
}
|
||||
wontSignReason := ""
|
||||
if err != nil {
|
||||
if models.IsErrWontSign(err) {
|
||||
wontSignReason = string(err.(*models.ErrWontSign).Reason)
|
||||
err = nil
|
||||
} else {
|
||||
wontSignReason = "error"
|
||||
}
|
||||
}
|
||||
|
||||
return CanCommitToBranchResults{
|
||||
CanCommitToBranch: canCommit,
|
||||
EditorEnabled: r.CanEnableEditor(),
|
||||
UserCanPush: userCanPush,
|
||||
RequireSigned: requireSigned,
|
||||
WillSign: sign,
|
||||
SigningKey: keyID,
|
||||
WontSignReason: wontSignReason,
|
||||
}, err
|
||||
}
|
||||
|
||||
// CanUseTimetracker returns whether or not a user can use the timetracker.
|
||||
|
|
|
@ -97,7 +97,7 @@ func (c *Command) RunInDirTimeoutEnvFullPipeline(env []string, timeout time.Dura
|
|||
|
||||
// RunInDirTimeoutEnvFullPipelineFunc executes the command in given directory with given timeout,
|
||||
// it pipes stdout and stderr to given io.Writer and passes in an io.Reader as stdin. Between cmd.Start and cmd.Wait the passed in function is run.
|
||||
func (c *Command) RunInDirTimeoutEnvFullPipelineFunc(env []string, timeout time.Duration, dir string, stdout, stderr io.Writer, stdin io.Reader, fn func(context.Context, context.CancelFunc)) error {
|
||||
func (c *Command) RunInDirTimeoutEnvFullPipelineFunc(env []string, timeout time.Duration, dir string, stdout, stderr io.Writer, stdin io.Reader, fn func(context.Context, context.CancelFunc) error) error {
|
||||
|
||||
if timeout == -1 {
|
||||
timeout = DefaultCommandExecutionTimeout
|
||||
|
@ -135,7 +135,11 @@ func (c *Command) RunInDirTimeoutEnvFullPipelineFunc(env []string, timeout time.
|
|||
defer process.GetManager().Remove(pid)
|
||||
|
||||
if fn != nil {
|
||||
fn(ctx, cancel)
|
||||
err := fn(ctx, cancel)
|
||||
if err != nil {
|
||||
cancel()
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if err := cmd.Wait(); err != nil && ctx.Err() != context.DeadlineExceeded {
|
||||
|
|
|
@ -33,7 +33,7 @@ type Commit struct {
|
|||
CommitMessage string
|
||||
Signature *CommitGPGSignature
|
||||
|
||||
parents []SHA1 // SHA1 strings
|
||||
Parents []SHA1 // SHA1 strings
|
||||
submoduleCache *ObjectCache
|
||||
}
|
||||
|
||||
|
@ -94,7 +94,7 @@ func convertCommit(c *object.Commit) *Commit {
|
|||
Committer: &c.Committer,
|
||||
Author: &c.Author,
|
||||
Signature: convertPGPSignature(c),
|
||||
parents: c.ParentHashes,
|
||||
Parents: c.ParentHashes,
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -111,10 +111,10 @@ func (c *Commit) Summary() string {
|
|||
// ParentID returns oid of n-th parent (0-based index).
|
||||
// It returns nil if no such parent exists.
|
||||
func (c *Commit) ParentID(n int) (SHA1, error) {
|
||||
if n >= len(c.parents) {
|
||||
if n >= len(c.Parents) {
|
||||
return SHA1{}, ErrNotExist{"", ""}
|
||||
}
|
||||
return c.parents[n], nil
|
||||
return c.Parents[n], nil
|
||||
}
|
||||
|
||||
// Parent returns n-th parent (0-based index) of the commit.
|
||||
|
@ -133,7 +133,7 @@ func (c *Commit) Parent(n int) (*Commit, error) {
|
|||
// ParentCount returns number of parents of the commit.
|
||||
// 0 if this is the root commit, otherwise 1,2, etc.
|
||||
func (c *Commit) ParentCount() int {
|
||||
return len(c.parents)
|
||||
return len(c.Parents)
|
||||
}
|
||||
|
||||
func isImageFile(data []byte) (string, bool) {
|
||||
|
|
108
modules/git/commit_reader.go
Normal file
108
modules/git/commit_reader.go
Normal file
|
@ -0,0 +1,108 @@
|
|||
// Copyright 2020 The Gitea Authors. All rights reserved.
|
||||
// Use of this source code is governed by a MIT-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package git
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"io"
|
||||
"strings"
|
||||
|
||||
"gopkg.in/src-d/go-git.v4/plumbing"
|
||||
)
|
||||
|
||||
// CommitFromReader will generate a Commit from a provided reader
|
||||
// We will need this to interpret commits from cat-file
|
||||
func CommitFromReader(gitRepo *Repository, sha plumbing.Hash, reader io.Reader) (*Commit, error) {
|
||||
commit := &Commit{
|
||||
ID: sha,
|
||||
}
|
||||
|
||||
payloadSB := new(strings.Builder)
|
||||
signatureSB := new(strings.Builder)
|
||||
messageSB := new(strings.Builder)
|
||||
message := false
|
||||
pgpsig := false
|
||||
|
||||
scanner := bufio.NewScanner(reader)
|
||||
// Split by '\n' but include the '\n'
|
||||
scanner.Split(func(data []byte, atEOF bool) (advance int, token []byte, err error) {
|
||||
if atEOF && len(data) == 0 {
|
||||
return 0, nil, nil
|
||||
}
|
||||
if i := bytes.IndexByte(data, '\n'); i >= 0 {
|
||||
// We have a full newline-terminated line.
|
||||
return i + 1, data[0 : i+1], nil
|
||||
}
|
||||
// If we're at EOF, we have a final, non-terminated line. Return it.
|
||||
if atEOF {
|
||||
return len(data), data, nil
|
||||
}
|
||||
// Request more data.
|
||||
return 0, nil, nil
|
||||
})
|
||||
|
||||
for scanner.Scan() {
|
||||
line := scanner.Bytes()
|
||||
if pgpsig {
|
||||
if len(line) > 0 && line[0] == ' ' {
|
||||
_, _ = signatureSB.Write(line[1:])
|
||||
continue
|
||||
} else {
|
||||
pgpsig = false
|
||||
}
|
||||
}
|
||||
|
||||
if !message {
|
||||
// This is probably not correct but is copied from go-gits interpretation...
|
||||
trimmed := bytes.TrimSpace(line)
|
||||
if len(trimmed) == 0 {
|
||||
message = true
|
||||
_, _ = payloadSB.Write(line)
|
||||
continue
|
||||
}
|
||||
|
||||
split := bytes.SplitN(trimmed, []byte{' '}, 2)
|
||||
var data []byte
|
||||
if len(split) > 1 {
|
||||
data = split[1]
|
||||
}
|
||||
|
||||
switch string(split[0]) {
|
||||
case "tree":
|
||||
commit.Tree = *NewTree(gitRepo, plumbing.NewHash(string(data)))
|
||||
_, _ = payloadSB.Write(line)
|
||||
case "parent":
|
||||
commit.Parents = append(commit.Parents, plumbing.NewHash(string(data)))
|
||||
_, _ = payloadSB.Write(line)
|
||||
case "author":
|
||||
commit.Author = &Signature{}
|
||||
commit.Author.Decode(data)
|
||||
_, _ = payloadSB.Write(line)
|
||||
case "committer":
|
||||
commit.Committer = &Signature{}
|
||||
commit.Committer.Decode(data)
|
||||
_, _ = payloadSB.Write(line)
|
||||
case "gpgsig":
|
||||
_, _ = signatureSB.Write(data)
|
||||
_ = signatureSB.WriteByte('\n')
|
||||
pgpsig = true
|
||||
}
|
||||
} else {
|
||||
_, _ = messageSB.Write(line)
|
||||
}
|
||||
}
|
||||
commit.CommitMessage = messageSB.String()
|
||||
_, _ = payloadSB.WriteString(commit.CommitMessage)
|
||||
commit.Signature = &CommitGPGSignature{
|
||||
Signature: signatureSB.String(),
|
||||
Payload: payloadSB.String(),
|
||||
}
|
||||
if len(commit.Signature.Signature) == 0 {
|
||||
commit.Signature = nil
|
||||
}
|
||||
|
||||
return commit, scanner.Err()
|
||||
}
|
|
@ -55,9 +55,26 @@ func DeleteRepoFile(repo *models.Repository, doer *models.User, opts *DeleteRepo
|
|||
BranchName: opts.NewBranch,
|
||||
}
|
||||
}
|
||||
} else if protected, _ := repo.IsProtectedBranchForPush(opts.OldBranch, doer); protected {
|
||||
return nil, models.ErrUserCannotCommit{
|
||||
UserName: doer.LowerName,
|
||||
} else {
|
||||
protectedBranch, err := repo.GetBranchProtection(opts.OldBranch)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if protectedBranch != nil && !protectedBranch.CanUserPush(doer.ID) {
|
||||
return nil, models.ErrUserCannotCommit{
|
||||
UserName: doer.LowerName,
|
||||
}
|
||||
}
|
||||
if protectedBranch != nil && protectedBranch.RequireSignedCommits {
|
||||
_, _, err := repo.SignCRUDAction(doer, repo.RepoPath(), opts.OldBranch)
|
||||
if err != nil {
|
||||
if !models.IsErrWontSign(err) {
|
||||
return nil, err
|
||||
}
|
||||
return nil, models.ErrUserCannotCommit{
|
||||
UserName: doer.LowerName,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
@ -219,7 +219,7 @@ func (t *TemporaryUploadRepository) CommitTreeWithDate(author, committer *models
|
|||
|
||||
// Determine if we should sign
|
||||
if version.Compare(binVersion, "1.7.9", ">=") {
|
||||
sign, keyID := t.repo.SignCRUDAction(author, t.basePath, "HEAD")
|
||||
sign, keyID, _ := t.repo.SignCRUDAction(author, t.basePath, "HEAD")
|
||||
if sign {
|
||||
args = append(args, "-S"+keyID)
|
||||
} else if version.Compare(binVersion, "2.0.0", ">=") {
|
||||
|
@ -268,7 +268,7 @@ func (t *TemporaryUploadRepository) DiffIndex() (*gitdiff.Diff, error) {
|
|||
var finalErr error
|
||||
|
||||
if err := git.NewCommand("diff-index", "--cached", "-p", "HEAD").
|
||||
RunInDirTimeoutEnvFullPipelineFunc(nil, 30*time.Second, t.basePath, stdoutWriter, stderr, nil, func(ctx context.Context, cancel context.CancelFunc) {
|
||||
RunInDirTimeoutEnvFullPipelineFunc(nil, 30*time.Second, t.basePath, stdoutWriter, stderr, nil, func(ctx context.Context, cancel context.CancelFunc) error {
|
||||
_ = stdoutWriter.Close()
|
||||
diff, finalErr = gitdiff.ParsePatch(setting.Git.MaxGitDiffLines, setting.Git.MaxGitDiffLineCharacters, setting.Git.MaxGitDiffFiles, stdoutReader)
|
||||
if finalErr != nil {
|
||||
|
@ -276,6 +276,7 @@ func (t *TemporaryUploadRepository) DiffIndex() (*gitdiff.Diff, error) {
|
|||
cancel()
|
||||
}
|
||||
_ = stdoutReader.Close()
|
||||
return finalErr
|
||||
}); err != nil {
|
||||
if finalErr != nil {
|
||||
log.Error("Unable to ParsePatch in temporary repo %s (%s). Error: %v", t.repo.FullName(), t.basePath, finalErr)
|
||||
|
|
|
@ -151,8 +151,27 @@ func CreateOrUpdateRepoFile(repo *models.Repository, doer *models.User, opts *Up
|
|||
if err != nil && !git.IsErrBranchNotExist(err) {
|
||||
return nil, err
|
||||
}
|
||||
} else if protected, _ := repo.IsProtectedBranchForPush(opts.OldBranch, doer); protected {
|
||||
return nil, models.ErrUserCannotCommit{UserName: doer.LowerName}
|
||||
} else {
|
||||
protectedBranch, err := repo.GetBranchProtection(opts.OldBranch)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if protectedBranch != nil && !protectedBranch.CanUserPush(doer.ID) {
|
||||
return nil, models.ErrUserCannotCommit{
|
||||
UserName: doer.LowerName,
|
||||
}
|
||||
}
|
||||
if protectedBranch != nil && protectedBranch.RequireSignedCommits {
|
||||
_, _, err := repo.SignCRUDAction(doer, repo.RepoPath(), opts.OldBranch)
|
||||
if err != nil {
|
||||
if !models.IsErrWontSign(err) {
|
||||
return nil, err
|
||||
}
|
||||
return nil, models.ErrUserCannotCommit{
|
||||
UserName: doer.LowerName,
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// If FromTreePath is not set, set it to the opts.TreePath
|
||||
|
|
|
@ -130,7 +130,7 @@ func initRepoCommit(tmpPath string, repo *models.Repository, u *models.User) (er
|
|||
}
|
||||
|
||||
if version.Compare(binVersion, "1.7.9", ">=") {
|
||||
sign, keyID := models.SignInitialCommit(tmpPath, u)
|
||||
sign, keyID, _ := models.SignInitialCommit(tmpPath, u)
|
||||
if sign {
|
||||
args = append(args, "-S"+keyID)
|
||||
} else if version.Compare(binVersion, "2.0.0", ">=") {
|
||||
|
|
|
@ -748,6 +748,7 @@ editor.name_your_file = Name your file…
|
|||
editor.filename_help = Add a directory by typing its name followed by a slash ('/'). Remove a directory by typing backspace at the beginning of the input field.
|
||||
editor.or = or
|
||||
editor.cancel_lower = Cancel
|
||||
editor.commit_signed_changes = Commit Signed Changes
|
||||
editor.commit_changes = Commit Changes
|
||||
editor.add_tmpl = Add '<filename>'
|
||||
editor.add = Add '%s'
|
||||
|
@ -780,6 +781,9 @@ editor.unable_to_upload_files = Failed to upload files to '%s' with error: %v
|
|||
editor.upload_file_is_locked = File '%s' is locked by %s.
|
||||
editor.upload_files_to_dir = Upload files to '%s'
|
||||
editor.cannot_commit_to_protected_branch = Cannot commit to protected branch '%s'.
|
||||
editor.no_commit_to_branch = Unable to commit directly to branch because:
|
||||
editor.user_no_push_to_branch = User cannot push to branch
|
||||
editor.require_signed_commit = Branch requires a signed commit
|
||||
|
||||
commits.desc = Browse source code change history.
|
||||
commits.commits = Commits
|
||||
|
@ -1068,6 +1072,7 @@ pulls.merge_pull_request = Merge Pull Request
|
|||
pulls.rebase_merge_pull_request = Rebase and Merge
|
||||
pulls.rebase_merge_commit_pull_request = Rebase and Merge (--no-ff)
|
||||
pulls.squash_merge_pull_request = Squash and Merge
|
||||
pulls.require_signed_wont_sign = The branch requires signed commits but this merge will not be signed
|
||||
pulls.invalid_merge_option = You cannot use this merge option for this pull request.
|
||||
pulls.merge_conflict = Merge Failed: There was a conflict whilst merging: %[1]s<br>%[2]s<br>Hint: Try a different strategy
|
||||
pulls.rebase_conflict = Merge Failed: There was a conflict whilst rebasing commit: %[1]s<br>%[2]s<br>%[3]s<br>Hint:Try a different strategy
|
||||
|
@ -1109,6 +1114,19 @@ milestones.filter_sort.most_complete = Most complete
|
|||
milestones.filter_sort.most_issues = Most issues
|
||||
milestones.filter_sort.least_issues = Least issues
|
||||
|
||||
signing.will_sign = This commit will be signed with key '%s'
|
||||
signing.wont_sign.error = There was an error whilst checking if the commit could be signed
|
||||
signing.wont_sign.nokey = There is no key available to sign this commit
|
||||
signing.wont_sign.never = Commits are never signed
|
||||
signing.wont_sign.always = Commits are always signed
|
||||
signing.wont_sign.pubkey = The commit will not be signed because you do not have a public key associated with your account
|
||||
signing.wont_sign.twofa = You must have two factor authentication enabled to have commits signed
|
||||
signing.wont_sign.parentsigned = The commit will not be signed as the parent commit is not signed
|
||||
signing.wont_sign.basesigned = The merge will not be signed as the base commit is not signed
|
||||
signing.wont_sign.headsigned = The merge will not be signed as the head commit is not signed
|
||||
signing.wont_sign.commitssigned = The merge will not be signed as all the associated commits are not signed
|
||||
signing.wont_sign.approved = The merge will not be signed as the PR is not approved
|
||||
|
||||
ext_wiki = Ext. Wiki
|
||||
ext_wiki.desc = Link to an external wiki.
|
||||
|
||||
|
@ -1416,6 +1434,8 @@ settings.protect_approvals_whitelist_users = Whitelisted reviewers:
|
|||
settings.protect_approvals_whitelist_teams = Whitelisted teams for reviews:
|
||||
settings.dismiss_stale_approvals = Dismiss stale approvals
|
||||
settings.dismiss_stale_approvals_desc = When new commits that change the content of the pull request are pushed to the branch, old approvals will be dismissed.
|
||||
settings.require_signed_commits = Require Signed Commits
|
||||
settings.require_signed_commits_desc = Reject pushes to this branch if they are unsigned or unverifiable
|
||||
settings.add_protected_branch = Enable protection
|
||||
settings.delete_protected_branch = Disable protection
|
||||
settings.update_protect_branch_success = Branch protection for branch '%s' has been updated.
|
||||
|
|
|
@ -639,6 +639,15 @@ func MergePullRequest(ctx *context.APIContext, form auth.MergePullRequestForm) {
|
|||
}
|
||||
}
|
||||
|
||||
if _, err := pull_service.IsSignedIfRequired(pr, ctx.User); err != nil {
|
||||
if !models.IsErrWontSign(err) {
|
||||
ctx.Error(http.StatusInternalServerError, "IsSignedIfRequired", err)
|
||||
return
|
||||
}
|
||||
ctx.Error(http.StatusMethodNotAllowed, fmt.Sprintf("Protected branch %s requires signed commits but this merge would not be signed", pr.BaseBranch), err)
|
||||
return
|
||||
}
|
||||
|
||||
if len(form.Do) == 0 {
|
||||
form.Do = string(models.MergeStyleMerge)
|
||||
}
|
||||
|
|
|
@ -6,7 +6,10 @@
|
|||
package private
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
|
@ -18,10 +21,101 @@ import (
|
|||
"code.gitea.io/gitea/modules/repofiles"
|
||||
"code.gitea.io/gitea/modules/util"
|
||||
pull_service "code.gitea.io/gitea/services/pull"
|
||||
"gopkg.in/src-d/go-git.v4/plumbing"
|
||||
|
||||
"gitea.com/macaron/macaron"
|
||||
)
|
||||
|
||||
func verifyCommits(oldCommitID, newCommitID string, repo *git.Repository, env []string) error {
|
||||
stdoutReader, stdoutWriter, err := os.Pipe()
|
||||
if err != nil {
|
||||
log.Error("Unable to create os.Pipe for %s", repo.Path)
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
_ = stdoutReader.Close()
|
||||
_ = stdoutWriter.Close()
|
||||
}()
|
||||
|
||||
err = git.NewCommand("rev-list", oldCommitID+"..."+newCommitID).
|
||||
RunInDirTimeoutEnvFullPipelineFunc(env, -1, repo.Path,
|
||||
stdoutWriter, nil, nil,
|
||||
func(ctx context.Context, cancel context.CancelFunc) error {
|
||||
_ = stdoutWriter.Close()
|
||||
err := readAndVerifyCommitsFromShaReader(stdoutReader, repo, env)
|
||||
if err != nil {
|
||||
log.Error("%v", err)
|
||||
cancel()
|
||||
}
|
||||
_ = stdoutReader.Close()
|
||||
return err
|
||||
})
|
||||
if err != nil && !isErrUnverifiedCommit(err) {
|
||||
log.Error("Unable to check commits from %s to %s in %s: %v", oldCommitID, newCommitID, repo.Path, err)
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
func readAndVerifyCommitsFromShaReader(input io.ReadCloser, repo *git.Repository, env []string) error {
|
||||
scanner := bufio.NewScanner(input)
|
||||
for scanner.Scan() {
|
||||
line := scanner.Text()
|
||||
err := readAndVerifyCommit(line, repo, env)
|
||||
if err != nil {
|
||||
log.Error("%v", err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
return scanner.Err()
|
||||
}
|
||||
|
||||
func readAndVerifyCommit(sha string, repo *git.Repository, env []string) error {
|
||||
stdoutReader, stdoutWriter, err := os.Pipe()
|
||||
if err != nil {
|
||||
log.Error("Unable to create pipe for %s: %v", repo.Path, err)
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
_ = stdoutReader.Close()
|
||||
_ = stdoutWriter.Close()
|
||||
}()
|
||||
hash := plumbing.NewHash(sha)
|
||||
|
||||
return git.NewCommand("cat-file", "commit", sha).
|
||||
RunInDirTimeoutEnvFullPipelineFunc(env, -1, repo.Path,
|
||||
stdoutWriter, nil, nil,
|
||||
func(ctx context.Context, cancel context.CancelFunc) error {
|
||||
_ = stdoutWriter.Close()
|
||||
commit, err := git.CommitFromReader(repo, hash, stdoutReader)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
log.Info("have commit %s", commit.ID.String())
|
||||
verification := models.ParseCommitWithSignature(commit)
|
||||
if !verification.Verified {
|
||||
log.Info("unverified commit %s", commit.ID.String())
|
||||
cancel()
|
||||
return &errUnverifiedCommit{
|
||||
commit.ID.String(),
|
||||
}
|
||||
}
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
||||
type errUnverifiedCommit struct {
|
||||
sha string
|
||||
}
|
||||
|
||||
func (e *errUnverifiedCommit) Error() string {
|
||||
return fmt.Sprintf("Unverified commit: %s", e.sha)
|
||||
}
|
||||
|
||||
func isErrUnverifiedCommit(err error) bool {
|
||||
_, ok := err.(*errUnverifiedCommit)
|
||||
return ok
|
||||
}
|
||||
|
||||
// HookPreReceive checks whether a individual commit is acceptable
|
||||
func HookPreReceive(ctx *macaron.Context, opts private.HookOptions) {
|
||||
ownerName := ctx.Params(":owner")
|
||||
|
@ -35,6 +129,30 @@ func HookPreReceive(ctx *macaron.Context, opts private.HookOptions) {
|
|||
return
|
||||
}
|
||||
repo.OwnerName = ownerName
|
||||
gitRepo, err := git.OpenRepository(repo.RepoPath())
|
||||
if err != nil {
|
||||
log.Error("Unable to get git repository for: %s/%s Error: %v", ownerName, repoName, err)
|
||||
ctx.JSON(http.StatusInternalServerError, map[string]interface{}{
|
||||
"err": err.Error(),
|
||||
})
|
||||
return
|
||||
}
|
||||
defer gitRepo.Close()
|
||||
|
||||
// Generate git environment for checking commits
|
||||
env := os.Environ()
|
||||
if opts.GitAlternativeObjectDirectories != "" {
|
||||
env = append(env,
|
||||
private.GitAlternativeObjectDirectories+"="+opts.GitAlternativeObjectDirectories)
|
||||
}
|
||||
if opts.GitObjectDirectory != "" {
|
||||
env = append(env,
|
||||
private.GitObjectDirectory+"="+opts.GitObjectDirectory)
|
||||
}
|
||||
if opts.GitQuarantinePath != "" {
|
||||
env = append(env,
|
||||
private.GitQuarantinePath+"="+opts.GitQuarantinePath)
|
||||
}
|
||||
|
||||
for i := range opts.OldCommitIDs {
|
||||
oldCommitID := opts.OldCommitIDs[i]
|
||||
|
@ -51,7 +169,7 @@ func HookPreReceive(ctx *macaron.Context, opts private.HookOptions) {
|
|||
return
|
||||
}
|
||||
if protectBranch != nil && protectBranch.IsProtected() {
|
||||
// check and deletion
|
||||
// detect and prevent deletion
|
||||
if newCommitID == git.EmptySHA {
|
||||
log.Warn("Forbidden: Branch: %s in %-v is protected from deletion", branchName, repo)
|
||||
ctx.JSON(http.StatusForbidden, map[string]interface{}{
|
||||
|
@ -62,20 +180,6 @@ func HookPreReceive(ctx *macaron.Context, opts private.HookOptions) {
|
|||
|
||||
// detect force push
|
||||
if git.EmptySHA != oldCommitID {
|
||||
env := os.Environ()
|
||||
if opts.GitAlternativeObjectDirectories != "" {
|
||||
env = append(env,
|
||||
private.GitAlternativeObjectDirectories+"="+opts.GitAlternativeObjectDirectories)
|
||||
}
|
||||
if opts.GitObjectDirectory != "" {
|
||||
env = append(env,
|
||||
private.GitObjectDirectory+"="+opts.GitObjectDirectory)
|
||||
}
|
||||
if opts.GitQuarantinePath != "" {
|
||||
env = append(env,
|
||||
private.GitQuarantinePath+"="+opts.GitQuarantinePath)
|
||||
}
|
||||
|
||||
output, err := git.NewCommand("rev-list", "--max-count=1", oldCommitID, "^"+newCommitID).RunInDirWithEnv(repo.RepoPath(), env)
|
||||
if err != nil {
|
||||
log.Error("Unable to detect force push between: %s and %s in %-v Error: %v", oldCommitID, newCommitID, repo, err)
|
||||
|
@ -92,6 +196,27 @@ func HookPreReceive(ctx *macaron.Context, opts private.HookOptions) {
|
|||
|
||||
}
|
||||
}
|
||||
|
||||
// Require signed commits
|
||||
if protectBranch.RequireSignedCommits {
|
||||
err := verifyCommits(oldCommitID, newCommitID, gitRepo, env)
|
||||
if err != nil {
|
||||
if !isErrUnverifiedCommit(err) {
|
||||
log.Error("Unable to check commits from %s to %s in %-v: %v", oldCommitID, newCommitID, repo, err)
|
||||
ctx.JSON(http.StatusInternalServerError, map[string]interface{}{
|
||||
"err": fmt.Sprintf("Unable to check commits from %s to %s: %v", oldCommitID, newCommitID, err),
|
||||
})
|
||||
return
|
||||
}
|
||||
unverifiedCommit := err.(*errUnverifiedCommit).sha
|
||||
log.Warn("Forbidden: Branch: %s in %-v is protected from unverified commit %s", branchName, repo, unverifiedCommit)
|
||||
ctx.JSON(http.StatusForbidden, map[string]interface{}{
|
||||
"err": fmt.Sprintf("branch %s is protected from unverified commit %s", branchName, unverifiedCommit),
|
||||
})
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
canPush := false
|
||||
if opts.IsDeployKey {
|
||||
canPush = protectBranch.CanPush && (!protectBranch.EnableWhitelist || protectBranch.WhitelistDeployKeys)
|
||||
|
|
|
@ -36,12 +36,13 @@ const (
|
|||
)
|
||||
|
||||
func renderCommitRights(ctx *context.Context) bool {
|
||||
canCommit, err := ctx.Repo.CanCommitToBranch(ctx.User)
|
||||
canCommitToBranch, err := ctx.Repo.CanCommitToBranch(ctx.User)
|
||||
if err != nil {
|
||||
log.Error("CanCommitToBranch: %v", err)
|
||||
}
|
||||
ctx.Data["CanCommitToBranch"] = canCommit
|
||||
return canCommit
|
||||
ctx.Data["CanCommitToBranch"] = canCommitToBranch
|
||||
|
||||
return canCommitToBranch.CanCommitToBranch
|
||||
}
|
||||
|
||||
// getParentTreeFields returns list of parent tree names and corresponding tree paths
|
||||
|
|
|
@ -971,6 +971,21 @@ func ViewIssue(ctx *context.Context) {
|
|||
ctx.Data["IsBlockedByApprovals"] = !pull.ProtectedBranch.HasEnoughApprovals(pull)
|
||||
ctx.Data["IsBlockedByRejection"] = pull.ProtectedBranch.MergeBlockedByRejectedReview(pull)
|
||||
ctx.Data["GrantedApprovals"] = cnt
|
||||
ctx.Data["RequireSigned"] = pull.ProtectedBranch.RequireSignedCommits
|
||||
}
|
||||
ctx.Data["WillSign"] = false
|
||||
if ctx.User != nil {
|
||||
sign, key, err := pull.SignMerge(ctx.User, pull.BaseRepo.RepoPath(), pull.BaseBranch, pull.GetGitRefName())
|
||||
ctx.Data["WillSign"] = sign
|
||||
ctx.Data["SigningKey"] = key
|
||||
if err != nil {
|
||||
if models.IsErrWontSign(err) {
|
||||
ctx.Data["WontSignReason"] = err.(*models.ErrWontSign).Reason
|
||||
} else {
|
||||
ctx.Data["WontSignReason"] = "error"
|
||||
log.Error("Error whilst checking if could sign pr %d in repo %s. Error: %v", pull.ID, pull.BaseRepo.FullName(), err)
|
||||
}
|
||||
}
|
||||
}
|
||||
ctx.Data["IsPullBranchDeletable"] = canDelete &&
|
||||
pull.HeadRepo != nil &&
|
||||
|
|
|
@ -246,6 +246,7 @@ func SettingsProtectedBranchPost(ctx *context.Context, f auth.ProtectBranchForm)
|
|||
}
|
||||
protectBranch.BlockOnRejectedReviews = f.BlockOnRejectedReviews
|
||||
protectBranch.DismissStaleApprovals = f.DismissStaleApprovals
|
||||
protectBranch.RequireSignedCommits = f.RequireSignedCommits
|
||||
|
||||
err = models.UpdateProtectBranch(ctx.Repo.Repository, protectBranch, models.WhitelistOptions{
|
||||
UserIDs: whitelistUsers,
|
||||
|
|
|
@ -158,7 +158,7 @@ func Merge(pr *models.PullRequest, doer *models.User, baseGitRepo *git.Repositor
|
|||
// Determine if we should sign
|
||||
signArg := ""
|
||||
if version.Compare(binVersion, "1.7.9", ">=") {
|
||||
sign, keyID := pr.SignMerge(doer, tmpBasePath, "HEAD", trackingBranch)
|
||||
sign, keyID, _ := pr.SignMerge(doer, tmpBasePath, "HEAD", trackingBranch)
|
||||
if sign {
|
||||
signArg = "-S" + keyID
|
||||
} else if version.Compare(binVersion, "2.0.0", ">=") {
|
||||
|
@ -470,6 +470,21 @@ func getDiffTree(repoPath, baseBranch, headBranch string) (string, error) {
|
|||
return out.String(), nil
|
||||
}
|
||||
|
||||
// IsSignedIfRequired check if merge will be signed if required
|
||||
func IsSignedIfRequired(pr *models.PullRequest, doer *models.User) (bool, error) {
|
||||
if err := pr.LoadProtectedBranch(); err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
if pr.ProtectedBranch == nil || !pr.ProtectedBranch.RequireSignedCommits {
|
||||
return true, nil
|
||||
}
|
||||
|
||||
sign, _, err := pr.SignMerge(doer, pr.BaseRepo.RepoPath(), pr.BaseBranch, pr.GetGitRefName())
|
||||
|
||||
return sign, err
|
||||
}
|
||||
|
||||
// IsUserAllowedToMerge check if user is allowed to merge PR with given permissions and branch protections
|
||||
func IsUserAllowedToMerge(pr *models.PullRequest, p models.Permission, user *models.User) (bool, error) {
|
||||
if p.IsAdmin() {
|
||||
|
|
|
@ -162,7 +162,7 @@ func TestPatch(pr *models.PullRequest) error {
|
|||
RunInDirTimeoutEnvFullPipelineFunc(
|
||||
nil, -1, tmpBasePath,
|
||||
nil, stderrWriter, nil,
|
||||
func(ctx context.Context, cancel context.CancelFunc) {
|
||||
func(ctx context.Context, cancel context.CancelFunc) error {
|
||||
_ = stderrWriter.Close()
|
||||
const prefix = "error: patch failed:"
|
||||
const errorPrefix = "error: "
|
||||
|
@ -199,6 +199,7 @@ func TestPatch(pr *models.PullRequest) error {
|
|||
}
|
||||
}
|
||||
_ = stderrReader.Close()
|
||||
return nil
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
|
|
|
@ -184,7 +184,7 @@ func updateWikiPage(doer *models.User, repo *models.Repository, oldWikiName, new
|
|||
Message: message,
|
||||
}
|
||||
|
||||
sign, signingKey := repo.SignWikiCommit(doer)
|
||||
sign, signingKey, _ := repo.SignWikiCommit(doer)
|
||||
if sign {
|
||||
commitTreeOpts.KeyID = signingKey
|
||||
} else {
|
||||
|
@ -298,7 +298,7 @@ func DeleteWikiPage(doer *models.User, repo *models.Repository, wikiName string)
|
|||
Parents: []string{"HEAD"},
|
||||
}
|
||||
|
||||
sign, signingKey := repo.SignWikiCommit(doer)
|
||||
sign, signingKey, _ := repo.SignWikiCommit(doer)
|
||||
if sign {
|
||||
commitTreeOpts.KeyID = signingKey
|
||||
} else {
|
||||
|
|
|
@ -1,7 +1,11 @@
|
|||
<div class="commit-form-wrapper">
|
||||
<img width="48" height="48" class="ui image commit-avatar" src="{{.SignedUser.RelAvatarLink}}">
|
||||
<div class="commit-form">
|
||||
<h3>{{.i18n.Tr "repo.editor.commit_changes"}}</h3>
|
||||
<h3>{{- if .CanCommitToBranch.WillSign}}
|
||||
<i title="{{.i18n.Tr "repo.signing.will_sign" .CanCommitToBranch.SigningKey}}" class="lock green icon"></i>{{.i18n.Tr "repo.editor.commit_signed_changes"}}
|
||||
{{- else}}
|
||||
<i title="{{.i18n.Tr (printf "repo.signing.wont_sign.%s" .CanCommitToBranch.WontSignReason)}}" class="unlock grey icon"></i>{{.i18n.Tr "repo.editor.commit_changes"}}
|
||||
{{- end}}</h3>
|
||||
<div class="field">
|
||||
<input name="commit_summary" placeholder="{{if .PageIsDelete}}{{.i18n.Tr "repo.editor.delete" .TreePath}}{{else if .PageIsUpload}}{{.i18n.Tr "repo.editor.upload_files_to_dir" .TreePath}}{{else if .IsNewFile}}{{.i18n.Tr "repo.editor.add_tmpl"}}{{else}}{{.i18n.Tr "repo.editor.update" .TreePath}}{{end}}" value="{{.commit_summary}}" autofocus>
|
||||
</div>
|
||||
|
@ -10,11 +14,20 @@
|
|||
</div>
|
||||
<div class="quick-pull-choice js-quick-pull-choice">
|
||||
<div class="field">
|
||||
<div class="ui radio checkbox {{if not .CanCommitToBranch}}disabled{{end}}">
|
||||
<div class="ui radio checkbox {{if not .CanCommitToBranch.CanCommitToBranch}}disabled{{end}}">
|
||||
<input type="radio" class="js-quick-pull-choice-option" name="commit_choice" value="direct" button_text="{{.i18n.Tr "repo.editor.commit_changes"}}" {{if eq .commit_choice "direct"}}checked{{end}}>
|
||||
<label>
|
||||
<i class="octicon octicon-git-commit" height="16" width="14"></i>
|
||||
{{.i18n.Tr "repo.editor.commit_directly_to_this_branch" (.BranchName|Escape) | Safe}}
|
||||
{{if not .CanCommitToBranch.CanCommitToBranch}}
|
||||
<div class="ui visible small warning message">
|
||||
{{.i18n.Tr "repo.editor.no_commit_to_branch"}}
|
||||
<ul>
|
||||
{{if not .CanCommitToBranch.UserCanPush}}<li>{{.i18n.Tr "repo.editor.user_no_push_to_branch"}}</li>{{end}}
|
||||
{{if and .CanCommitToBranch.RequireSigned (not .CanCommitToBranch.WillSign)}}<li>{{.i18n.Tr "repo.editor.require_signed_commit"}}</li>{{end}}
|
||||
</ul>
|
||||
</div>
|
||||
{{end}}
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
@ -48,6 +48,7 @@
|
|||
{{else if .IsBlockedByApprovals}}red
|
||||
{{else if .IsBlockedByRejection}}red
|
||||
{{else if and .EnableStatusCheck (not .IsRequiredStatusCheckSuccess)}}red
|
||||
{{else if and .RequireSigned (not .WillSign)}}}red
|
||||
{{else if .Issue.PullRequest.IsChecking}}yellow
|
||||
{{else if .Issue.PullRequest.CanAutoMerge}}green
|
||||
{{else}}red{{end}}"><span class="mega-octicon octicon-git-merge"></span></a>
|
||||
|
@ -93,49 +94,69 @@
|
|||
</div>
|
||||
{{else if .IsPullRequestBroken}}
|
||||
<div class="item text red">
|
||||
<span class="octicon octicon-x"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-x"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.data_broken"}}
|
||||
</div>
|
||||
{{else if .IsPullWorkInProgress}}
|
||||
<div class="item text grey">
|
||||
<span class="octicon octicon-x"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-x"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.cannot_merge_work_in_progress" .WorkInProgressPrefix | Str2html}}
|
||||
</div>
|
||||
{{else if .Issue.PullRequest.IsChecking}}
|
||||
<div class="item text yellow">
|
||||
<span class="octicon octicon-sync"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-sync"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.is_checking"}}
|
||||
</div>
|
||||
{{else if .Issue.PullRequest.CanAutoMerge}}
|
||||
{{if .IsBlockedByApprovals}}
|
||||
<div class="item text red">
|
||||
<span class="octicon octicon-x"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-x"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.blocked_by_approvals" .GrantedApprovals .Issue.PullRequest.ProtectedBranch.RequiredApprovals}}
|
||||
</div>
|
||||
{{else if .IsBlockedByRejection}}
|
||||
<div class="item text red">
|
||||
<span class="octicon octicon-x"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-x"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.blocked_by_rejection"}}
|
||||
</div>
|
||||
{{else if and .EnableStatusCheck (not .IsRequiredStatusCheckSuccess)}}
|
||||
<div class="item text red">
|
||||
<span class="octicon octicon-x"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-x"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.required_status_check_failed"}}
|
||||
</div>
|
||||
{{else if and .RequireSigned (not .WillSign)}}
|
||||
<div class="item text red">
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-x"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.require_signed_wont_sign"}}
|
||||
</div>
|
||||
<div class="item text yellow">
|
||||
<i class="icon unlock grey"></i>
|
||||
{{$.i18n.Tr (printf "repo.signing.wont_sign.%s" .WontSignReason) }}
|
||||
</div>
|
||||
{{end}}
|
||||
{{$notAllOk := or .IsBlockedByApprovals .IsBlockedByRejection (and .EnableStatusCheck (not .IsRequiredStatusCheckSuccess))}}
|
||||
{{if or $.IsRepoAdmin (not $notAllOk)}}
|
||||
{{$notAllOk := or .IsBlockedByApprovals .IsBlockedByRejection (and .RequireSigned (not .WillSign)) (and .EnableStatusCheck (not .IsRequiredStatusCheckSuccess))}}
|
||||
{{if and (or $.IsRepoAdmin (not $notAllOk)) (or (not .RequireSigned) .WillSign)}}
|
||||
{{if $notAllOk}}
|
||||
<div class="item text yellow">
|
||||
<span class="octicon octicon-primitive-dot"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-primitive-dot"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.required_status_check_administrator"}}
|
||||
</div>
|
||||
{{else}}
|
||||
<div class="item text green">
|
||||
<span class="octicon octicon-check"></span>
|
||||
<i class="icon icon-octicon"><span class="octicon octicon-check"></span></i>
|
||||
{{$.i18n.Tr "repo.pulls.can_auto_merge_desc"}}
|
||||
</div>
|
||||
{{end}}
|
||||
{{if .WillSign}}
|
||||
<div class="item text green">
|
||||
<i class="icon lock green"></i>
|
||||
{{$.i18n.Tr "repo.signing.will_sign" .SigningKey}}
|
||||
</div>
|
||||
{{else}}
|
||||
<div class="item text yellow">
|
||||
<i class="icon unlock grey"></i>
|
||||
{{$.i18n.Tr (printf "repo.signing.wont_sign.%s" .WontSignReason) }}
|
||||
</div>
|
||||
{{end}}
|
||||
{{if .AllowMerge}}
|
||||
{{$prUnit := .Repository.MustGetUnit $.UnitTypePullRequests}}
|
||||
{{$approvers := .Issue.PullRequest.GetApprovers}}
|
||||
|
@ -282,6 +303,11 @@
|
|||
<span class="octicon octicon-x"></span>
|
||||
{{$.i18n.Tr "repo.pulls.required_status_check_failed"}}
|
||||
</div>
|
||||
{{else if and .RequireSigned (not .WillSign)}}
|
||||
<div class="item text red">
|
||||
<span class="octicon octicon-x"></span>
|
||||
{{$.i18n.Tr "repo.pulls.require_signed_wont_sign"}}
|
||||
</div>
|
||||
{{else}}
|
||||
<div class="item text red">
|
||||
<span class="octicon octicon-x"></span>
|
||||
|
|
|
@ -210,7 +210,7 @@
|
|||
<label for="block_on_rejected_reviews">{{.i18n.Tr "repo.settings.block_rejected_reviews"}}</label>
|
||||
<p class="help">{{.i18n.Tr "repo.settings.block_rejected_reviews_desc"}}</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input name="dismiss_stale_approvals" type="checkbox" {{if .Branch.DismissStaleApprovals}}checked{{end}}>
|
||||
|
@ -218,6 +218,13 @@
|
|||
<p class="help">{{.i18n.Tr "repo.settings.dismiss_stale_approvals_desc"}}</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<div class="ui checkbox">
|
||||
<input name="require_signed_commits" type="checkbox" {{if .Branch.RequireSignedCommits}}checked{{end}}>
|
||||
<label for="require_signed_commits">{{.i18n.Tr "repo.settings.require_signed_commits"}}</label>
|
||||
<p class="help">{{.i18n.Tr "repo.settings.require_signed_commits_desc"}}</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
|
|
@ -652,6 +652,9 @@
|
|||
margin-left: 10px;
|
||||
margin-top: 10px;
|
||||
}
|
||||
.icon-octicon {
|
||||
padding-left: 2px;
|
||||
}
|
||||
}
|
||||
|
||||
.review-item {
|
||||
|
|
Reference in a new issue