Initial Vexta Core v0.1.0 release
This commit is contained in:
commit
25c454329d
2481 changed files with 689289 additions and 0 deletions
57
contrib/verify-commits/README.md
Normal file
57
contrib/verify-commits/README.md
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
Tooling for verification of PGP signed commits
|
||||
----------------------------------------------
|
||||
|
||||
This is an incomplete work in progress, but currently includes a pre-push hook
|
||||
script (`pre-push-hook.sh`) for maintainers to ensure that their own commits
|
||||
are PGP signed (nearly always merge commits), as well as a Python 3 script to verify
|
||||
commits against a trusted keys list.
|
||||
|
||||
|
||||
Using verify-commits.py safely
|
||||
------------------------------
|
||||
|
||||
Remember that you can't use an untrusted script to verify itself. This means
|
||||
that checking out code, then running `verify-commits.py` against `HEAD` is
|
||||
_not_ safe, because the version of `verify-commits.py` that you just ran could
|
||||
be backdoored. Instead, you need to use a trusted version of verify-commits
|
||||
prior to checkout to make sure you're checking out only code signed by trusted
|
||||
keys:
|
||||
|
||||
```sh
|
||||
git fetch origin && \
|
||||
./contrib/verify-commits/verify-commits.py origin/master && \
|
||||
git checkout origin/master
|
||||
```
|
||||
|
||||
Note that the above isn't a good UI/UX yet, and needs significant improvements
|
||||
to make it more convenient and reduce the chance of errors; pull-reqs
|
||||
improving this process would be much appreciated.
|
||||
|
||||
Configuration files
|
||||
-------------------
|
||||
|
||||
* `trusted-git-root`: This file should contain a single git commit hash which is the first unsigned git commit (hence it is the "root of trust").
|
||||
* `trusted-sha512-root-commit`: This file should contain a single git commit hash which is the first commit without a SHA512 root commitment.
|
||||
* `trusted-keys`: This file should contain a \n-delimited list of all PGP fingerprints of authorized commit signers (primary, not subkeys).
|
||||
* `allow-revsig-commits`: This file should contain a \n-delimited list of git commit hashes. See next section for more info.
|
||||
|
||||
Import trusted keys
|
||||
-------------------
|
||||
In order to check the commit signatures, you must add the trusted PGP keys to your machine. [GnuPG](https://gnupg.org/) may be used to import the trusted keys by running the following command:
|
||||
|
||||
```sh
|
||||
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys $(<contrib/verify-commits/trusted-keys)
|
||||
```
|
||||
|
||||
Key expiry/revocation
|
||||
---------------------
|
||||
|
||||
When a key (or subkey) which has signed old commits expires or is revoked,
|
||||
verify-commits will start failing to verify all commits which were signed by
|
||||
said key. In order to avoid bumping the root-of-trust `trusted-git-root`
|
||||
file, individual commits which were signed by such a key can be added to the
|
||||
`allow-revsig-commits` file. That way, the PGP signatures are still verified
|
||||
but no new commits can be signed by any expired/revoked key. To easily build a
|
||||
list of commits which need to be added, verify-commits.py can be edited to test
|
||||
each commit with DIGIBYTE_VERIFY_COMMITS_ALLOW_REVSIG set to both 1 and 0, and
|
||||
those which need it set to 1 printed.
|
||||
2
contrib/verify-commits/allow-incorrect-sha512-commits
Normal file
2
contrib/verify-commits/allow-incorrect-sha512-commits
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
f8feaa4636260b599294c7285bcf1c8b7737f74e
|
||||
8040ae6fc576e9504186f2ae3ff2c8125de1095c
|
||||
504
contrib/verify-commits/allow-revsig-commits
Normal file
504
contrib/verify-commits/allow-revsig-commits
Normal file
|
|
@ -0,0 +1,504 @@
|
|||
a06ede9a138d0fb86b0de17c42b936d9fe6e2158
|
||||
923dc447eaa8e017985b2afbbb12dd1283fbea0e
|
||||
71148b8947fe8b4d756822420a7f31c380159425
|
||||
6696b4635ceb9b47aaa63244bff9032fa7b08354
|
||||
812714fd80e96e28cd288c553c83838cecbfc2d9
|
||||
8a445c5651edb9a1f51497055b7ddf4402be9188
|
||||
e126d0c12ca66278d9e7b12187c5ff4fc02a7e6c
|
||||
3908fc4728059719bed0e1c7b1c8b388c2d4a8da
|
||||
8b66bf74e2a349e71eaa183af81fa63eaee76ad2
|
||||
05950427d310654774031764a7141a1a4fd9c6e4
|
||||
07fd147b9f12e9205afd66a624edce357977d615
|
||||
12e31127948fa4bb01c3bddc1b8c85b432f7465b
|
||||
8c87f175d335e9d9e93f987d871ae9f05f6a10a7
|
||||
46b249e578e8a3dfbe85bc7253a12e82ef4b658b
|
||||
a55716abe5662ec74c2f8af93023f1e7cca901fc
|
||||
f646275b90b1de93bc62b4c4d045d75ac0b96eee
|
||||
c252685aa5867631e9a5ef07ccae7c7c25cae8ff
|
||||
a7d55c93385359952d85decd5037843ac70ba3d4
|
||||
7dac1e5e9e887f5f6ff146e812a05bd3bf281eae
|
||||
2a524b8e8fe69ef487fd8ea1b4f7a03f473ed201
|
||||
ce5c1f4acae43477989cdf9a82ed33703919cda2
|
||||
2db4cbcc437f51f5dac82cc4de46f383b92e6f11
|
||||
7aa700424cbda387536373d8dfec88aee43f950e
|
||||
b99a093afed880f23fb279c443cc6ae5e379cc43
|
||||
b83264d9c7a8ddb79f64bd9540caddc8632ef31f
|
||||
57e337d40e94ba33d8cd265c134d6ef857b32b59
|
||||
a1dcf2e1087beaf3981739fd2bb74f35ecad630a
|
||||
d38b0d7a6b6056cba26999b702815775e2437d87
|
||||
815640ec6af9a38d6a2da4a4400056e2f4105080
|
||||
09c4fd157c5b88df2d97fad4826c79b094db90c9
|
||||
2efcfa5acfacb958973d9e8125e1d81f102e2dfd
|
||||
dc6dee41f7cf2ba93fcd0fea7c157e4b2775d439
|
||||
ad826b3df9f763b49f1e3e3d50c4efdd438c7547
|
||||
c1a52276848d8caa9a9789dff176408c1aa6b1ed
|
||||
3bf06e9bac57b5b5a746677b75e297a7b154bdbd
|
||||
72ae6f8cf0224370e8121d6769b21e612ca15d6f
|
||||
a143b88dbd4971ecfdd1d39a494489c8f2db0344
|
||||
76fec09d878d6dbf214bdb6228d480bd9195db4c
|
||||
93566e0c37c5ae104095474fea89f00dcb40f551
|
||||
407d9232ef5cb1ebf6cff21f3d13e07ea4158eeb
|
||||
9346f8429957e356d21c665bab59fe45bcf1f74e
|
||||
6eeac6e30d65f9a972067c1ea8c49978c8e631ac
|
||||
dc6b9406bdfab2af8c86cb080cb3e6cf8f2385d8
|
||||
9f554e03ebe5701c1b75ff03b3d6152095c0cad3
|
||||
05009935f9ac070197113954d680bc2c9150b9b3
|
||||
508404de98a8a5435f52916cef8f328e82651961
|
||||
ed0cc50afed146c27f6d8129c683c225fb940093
|
||||
6429cfa8a70308241c576aeb92ffe3db5203b2ef
|
||||
6898213409811b140843c3d89af43328c3b22fad
|
||||
5b2ea29cf4fd298346437bb16a54407f8c1f9dca
|
||||
e2a1a1ee895149c544d4ae295466611f0cec3094
|
||||
e82fb872ff5cc8fd22d43327c1ee3e755f61c562
|
||||
19b0f33de0efd9da788e8e4f3fdc2a9e159abdb1
|
||||
89de1538ce1f8c00f80e8d11f43e1b77e24d7dea
|
||||
de07fdcf77e97b8613091285e4d0a734f5de7492
|
||||
01680195f8aa586c55c44767397380def3a23b54
|
||||
05e1c85fb687c82ae477c72d4a7e2d6b0c692167
|
||||
c072b8fd95cd4fa84f08189a0cd8b173ea2dbb8e
|
||||
9a0ed08b40b15ae2b791aa8549b53e69934b4ea7
|
||||
53f8f226bd1d627c4a6dec5862a1d4ea5a933e45
|
||||
9d0f43b7ca7241d8a018fd35dd3bc01555235ec6
|
||||
f12d2b5a8ac397e4bcaefcc19898f8ff5705dea5
|
||||
8250de13587ed05ca45df3e12c5dc9bcb1500e2c
|
||||
d727f77e390426e9e463336bda08d50c451c7086
|
||||
484312bda2d43e3ea60047be076332299463adf8
|
||||
c7e05b35ab0a791c7a8e2d863e716fdec6f3f671
|
||||
b9c1cd81848da9de1baf9c2f29c19c50e549de13
|
||||
8ea7d31e384975019733b5778feabbd9955c79d8
|
||||
f798b891bcecea9548eedacae70eeb9906c1ddbf
|
||||
ebefe7a00b46579cdd1e033a8c7fd8ce9aa578e4
|
||||
ad087638ee4864d6244ec9381ff764bfa6ee5086
|
||||
66db2d62d59817320c9182fc18e75a93b76828ea
|
||||
7ce9ac5c83b1844a518ef2e12e87aae3cacdfe58
|
||||
4286f43025149cf44207c3ad98e4a1f068520ada
|
||||
cd0c5135ab2291aaa5410ac919bad3fc87249a4a
|
||||
66ed450d771a8fc01c159a8402648ebd1c35eb4c
|
||||
a82f03393a32842d49236e8666ee57805ca701f8
|
||||
f972b04d63eb8af79ff3cec1dc561ed13dfa6053
|
||||
ec45cc5e27668171b55271b0c735194c70e7da41
|
||||
715e9fd7454f7a48d7adba7d42f662c20a3e3367
|
||||
2e0a99037dcc35bc63ba0d54371bc678af737c8e
|
||||
7fa8d758598407f3bf0beb0118dc122ea5340736
|
||||
6a22373771edbc3c7513cacb9355f880c73c2cbf
|
||||
b89ef131147f71a96152a7b5c4374266cdf539b2
|
||||
01d8359983e2f77b5118fede3ffa947072c666c8
|
||||
58f0c929a3d70a4bff79cc200f1c186f71ef1675
|
||||
950be19727a581970591d8f8138dfe4725750382
|
||||
425278d17bd0edf8a3a7cc81e55016f7fd8e7726
|
||||
c028c7b7557da2baff7af8840108e8be4db8e0c6
|
||||
47a7cfb0aa2498f6801026d258a59f9de48f60b0
|
||||
f6b7df3155ddb4cedfbcf5d3eb3383d4614b3a85
|
||||
d72098038f3b55a714ed8adb34fab547b15eb0d5
|
||||
c49c825bd9f4764536b45df5a684d97173673fc7
|
||||
33799afe83eec4200ff140e9bf5eae83701a4d7f
|
||||
5c3f8ddcaa1164079105c452429fccf8127b01b6
|
||||
1f01443567b03ac75a91c810f1733f5c21b5699d
|
||||
b3e42b6d02e8d19658a9135e427ebceab5367779
|
||||
69b3a6dd9d9a0adf5506c8b9fde42187356bd4a8
|
||||
bafd075c5e6a1088ef0f1aa0b0b224e026a3d3e0
|
||||
7daa3adb242d9c8728fdb15c6af6596aaad5502f
|
||||
514993554c370f4cf30a109ac28d5d64893dbf0a
|
||||
c8d2473e6cb042e7275a10c49d3f6a4a91bf0166
|
||||
386f4385ab04b0b2c3d47bddc0dc0f2de7354964
|
||||
9f33dba05c01ecc5c56eb1284ab7d64d42f55171
|
||||
7466a26cab5d66665991433947964a638f5b957e
|
||||
b43aba89e356ff95b706e80d4802f60fc46a569a
|
||||
02b7e8319aef2a870264ad4fa2e3bb18664dcc36
|
||||
f686002a8eba820a40ac2f34a6e8f57b2b5cc54c
|
||||
2b1c50b9352ab1dc40b0f877db23c1fa4048fae3
|
||||
2405ce1df043f778b8efb9205009500cbc17313a
|
||||
4ad3b3c72c73d61e0a0cab541dca20acf651320d
|
||||
4ba3d4f4393d81148422d24d222fe7ed00130194
|
||||
8ee5c7b747171e335793c74cd9d2f7491da58164
|
||||
872c921c0a208b04bd0713758e52fcab5b7c1684
|
||||
00d1680498c5550e7db1f359202d3433a092fafd
|
||||
585db41e9ab7a6fb262c8bad7f427cdbdc497188
|
||||
18462960c0f13bd07d8f52b61e7d7bc17e991eea
|
||||
0630974647dacaf25e7fcb7f9cbb785bb078ede6
|
||||
0f58d7f3d62f012f2584f5e781fc73de4763dd9e
|
||||
3d16f581538b0974853e820508e8b3093269d2fd
|
||||
66e91420ab233cf1dac64504e0dc129019bf8c0d
|
||||
d8d9162f5bad39b2720dd2b2da237c6159e4755f
|
||||
29fad97c320c892ab6a480c81e2078ec22ab354b
|
||||
791c3ea61b4e49fd46a1a71b84ca99ddf69d2ff7
|
||||
a312e201ba56742499a5480b5f2115f01505c217
|
||||
ce56fdd2e8cdf94fd0ab76d71adbfa755e23ce7d
|
||||
480f42630cbd598c04fa59ee0e406f56904ecffb
|
||||
6012f1caf744ac9b53383d7d10a8f1b70ca2c0e1
|
||||
ded6a2afa549f693dcabb430ce0862f8631360c8
|
||||
07090c5339436f856e79a8036d1c85deeb453803
|
||||
0e265916d1c6a63e4a3821dab9db597b5ec64b46
|
||||
e4ffcacc2187d3419c8ea12b82fb06d82d8751d2
|
||||
e117cfe45eee9169409e74a44ef4a866be25bc35
|
||||
dcfe218626b05204e9fbc95ba5d95ca0eb72ec9b
|
||||
23481fa50301201ef5a60675ef899aa6ce94ca03
|
||||
27c59dc502f29cf1d76290556c21e366145e3b2e
|
||||
4a62ddd01873d18dbca96c81d756be1020249b45
|
||||
a233fb4f1d037e68ff70eef3a9f5b7bf1d631918
|
||||
b2089c51cc4af2f7e1c0ec75be9449ee222b1d69
|
||||
c997f8808256521397f1c003bb1e9896fee6eaa0
|
||||
5dc00f68c49c46a380a98d06233f90528b8e2557
|
||||
fe53d5f3636aed064823bc220d828c7ff08d1d52
|
||||
935eb8de039dec65669a96a1c3b86f4b03a1b86c
|
||||
0277173b1defb63216d40a8d8805ae6d5d563c26
|
||||
2a30e67d20f76bbcd9a7d445f616f005316e0a1a
|
||||
d32528e733f2711b34dbc41fbb2bb0f153bf7e9a
|
||||
4cad91663df381d0dff8526f3b4aa74569dfb626
|
||||
1b06ed136f17b526360617a70026aed5ded5746c
|
||||
895fbd768f0c89cea3f78acac58b233d4e3a145e
|
||||
f0295becbf3ef1fb78095306408789253fe0c114
|
||||
8d573198638e52e2dbd9abc609861430f9d2bcc3
|
||||
9d9c4185fadaf243bb97c226e2fef16b65299699
|
||||
eebe4580bc8d6484d79ecb24dd87412221cf2ea7
|
||||
9cf6393a4f82b9c81d3b4b468a17a89db10531a2
|
||||
598a9c4e4dcd03c6d80fba005de729a6a3aeba7e
|
||||
6970b30c6f1d2be7947295fe18f2390649b17a4b
|
||||
f359afcc410432ed5d30001acda0c66741ee8935
|
||||
126000ba9e7ff16271be2f4eef3df99ade8d624f
|
||||
b5e4b9b5100ec15217d43edb5f4149439f4b20a5
|
||||
b987ca4ee495a7fff82f0ac14ef0753bfb7586e2
|
||||
b03013396cb2f4bf25746388b3982a2c3616e16b
|
||||
9a97f39afaa890caa7987c6bc001b9a66e3e74e8
|
||||
cad504bf4c302f7a72e0a0e191f3fdbafda7340f
|
||||
45cf8a03cb57b8639a8d47323bde46ba22d9eeaf
|
||||
b7450cdbd89a1c862f4d4d8bf093f8a0b5448f9c
|
||||
0910cbe4ef31eb95fd76c7c2f820419fe64a3150
|
||||
92a810d04b906722c9efe60e3997243c71ff3d4c
|
||||
45173fa6fca9537abb0a0554f731d14b9f89c456
|
||||
fd4ca17360e6fc0c9bb76bf6b5b07c9102c12728
|
||||
ddff3447f29b62d79a33f728791f42fa9436216e
|
||||
36a5a4404836da323c755523fbd27563a8e84f94
|
||||
c991b304dee368f506cfee27ddaa333f1f82c518
|
||||
d38d1a3e75aa97ffa8755ddd431754a6d0942964
|
||||
a332a7d5a15214015f9553fdb2bcf80a1a4b8dc0
|
||||
604e08c83cf58ca7e7cda2ab284c1ace7bb12977
|
||||
18a1bbad98bd4321f15e7921d9aec91661499d90
|
||||
8049241e226c16bd07b029c0cb4b62ac40f0c923
|
||||
797441ee995aac59f55d59a93ecb55e8ecbe7dbc
|
||||
62fdf9b07087b80d2142799bdd2324f61483359d
|
||||
f60b4ad57912b78a96af08046a503f7905610a8c
|
||||
13e31dd6548d64a5992f439e74bb424bf88aca04
|
||||
fbce66a982679b5409a295be5c99a2eef429cabf
|
||||
9f2c2dba21855b8cb9b193b1819be73fa4a23a99
|
||||
a89221873a3ee2451c73b41bbe2d99d36f439d31
|
||||
3d6ad407770e13958e157bf026cae0bfb9254899
|
||||
901ba3e3819405306414628306746552b0aa1d28
|
||||
7a43fbb959c38e025e558e472ad57de357539894
|
||||
0d89fa0877930c6c8a539a656c1009ad8ab6755b
|
||||
54aedc013744c86b11157423fa3cffc9a51eef02
|
||||
f0c1f8abb0182da557d07372b938f3a0a4bb906f
|
||||
4ed818060ecf4a38a02c8cb48f6cbc78d2ee7708
|
||||
3bdf242fc68a8d767932c6214455d4d413effbc9
|
||||
5e468994fbb349e8eefc996954a31a67a34aaa15
|
||||
41aa9c4a801a01eca1fad22a7095372d23dace60
|
||||
2adbddb03840ad71e843c6c4a207a13e871cd1d4
|
||||
13e352dc53dec0127c5f94a60055d0ca829420dc
|
||||
95e14dc81dd30ee0d396ad08dca9a6980d16eee1
|
||||
61fb80660f73e5aa5b69302ecc7ac33da206ba5a
|
||||
05a761932edd05cf94ffe938908baf058f38632a
|
||||
ee92243e66f2df03b3a759a8ffb75dc06f0cea0d
|
||||
22cdf93c062eeaa0f8f9d6220f01b67240073dfb
|
||||
76b33491596736ca804e3a29bd8398d7a1516ab7
|
||||
6e4e98ee8ce2da3cca2e2fd210e9e8dbc9b1c936
|
||||
c838283ecdfb9490425bb071b7c22e542de46c7c
|
||||
5e3f5e4f25b65b583d3bfefac9e1148035781089
|
||||
f7388e93d3dd91a90239aedac4ec58404f103a2e
|
||||
0a2f46b0158b6fc7244a585913b0925c0acf707f
|
||||
dd561667cb7ccbbfed3134b05a565971ef6f5873
|
||||
6f01dcf63873a5e42798635ab4026c9a5f9fa213
|
||||
70fec9e36bcd1a3d93df019be084aaf89cecd7d7
|
||||
f9b74ef3fc74fd7d2aa94560820341f03cda8e12
|
||||
998c3046fab2b52bc9f141cfb588a18c05506a86
|
||||
89cc4f905e30b913ca20e4192d538cc5cbe2c38d
|
||||
87d90efd69b64f769116956a5db89e536e9e3714
|
||||
5aeaa9ccd1568a77e075dbe2bd2435bd60c87c91
|
||||
bfb270acfa30713dc8c968bb9ee40cf5a2360359
|
||||
1b8c88451b0554502435d3883c528ad0aad1b09b
|
||||
57ee73990f1ce29916adfd99f93eae1ccea1a43b
|
||||
808c84f89d0edcef9ddaab0b849a382719f6ec9e
|
||||
14b860bf64020451ced823b859da8cb912278ab9
|
||||
c63364610f4a041df1c1bd81d01b1f6856160749
|
||||
92eadc395071876d77f3babddc056b4325bdbabc
|
||||
e93fff1463ae906fc986bf98c3b118c82f171546
|
||||
9ccafb1d7bdd172a9b963444072a844da379c4f7
|
||||
b4a509a3f817121c3df98ddfd96b2769e18a3e5a
|
||||
dbc4ae03963014ab4b7957d62ba59dbd8f938c33
|
||||
8ddf60db7ad636b6a31b590251c671ded635fa1d
|
||||
f199b8a33d9443a258a1f49a1a29674cd9ee9a20
|
||||
e542728cde676f218c552d841d0af29b92f9800b
|
||||
763231051596b8e3455b839911ad6a3a1f1c3c74
|
||||
ff4cd6075b12fb32b9a906deea3ed033e3f9560a
|
||||
9c3c9cdae3e20b5bdea91a0631edac5116bbc89f
|
||||
93d20a734d2ee873832bed8ca5c05cf8e539c53c
|
||||
ef8340d25f7c5dd5682bdecea97ce84cfce1493c
|
||||
69c7ecef405d168f658a9cc7996da84c17f61e66
|
||||
4ce2f3d0d33346e9f0e96851689ee6550b2a72e3
|
||||
44e1fd926cfb0df0fbd8c41de8cd65ed8d5d6e18
|
||||
d6d2c8503c4039b682196d83a67dc28359c10c5c
|
||||
ae233c4ec3d14a97c6195059f52873cdba2b4755
|
||||
0f399a9ff227896265cafab9b2e9fab6cdb9b5b9
|
||||
f4ed44ab4a8f9a87ba678d5fd1449fbf636103dc
|
||||
7fcd61b2613c211bb042a82a889655178be6a212
|
||||
42973f834445d7735738bdba8847812ba3c34d95
|
||||
8df48b36ed3201d938b9974ecbee455d7dc2fb84
|
||||
96ac26e56627f0c24213fcd3a1cce9fc95f1f661
|
||||
cce94c518a46b7b0006f984bbe4d69e8749182d2
|
||||
801dd40666d1e6009920ad3ff755c7bb993b2a62
|
||||
ce829855cfca103dde55661fa1524e66b139d063
|
||||
b148803b181e30213e8a7f3bd89c8239e9dcb866
|
||||
c377feaad87f8109f85da6caf62602b30c20effc
|
||||
b37cab65c63e051ebc5b491da9bd687581df94df
|
||||
16e41844e7d6c5876d2caaeef6010656950c6ec5
|
||||
ee50c9e48786dea0d9df2e45805c25565c100fe3
|
||||
11dacc6154c42bc6fe3ba94c1823f8a46e4fe81a
|
||||
791a0e6ddade27d1b69f4861a6640de60b9553cf
|
||||
638e6c59da4fad987c437592174b188510193b2e
|
||||
52f8877525d5238f3440e73710507be889d14127
|
||||
2a56baf395bf11835d784c4f8634f4525deed6a1
|
||||
bc561b4b7d6a3f71649d37d5eb9047c29efa2b13
|
||||
31809d6f8514c4a8d5677e947e3f1ebb0db210b9
|
||||
a31e9ad4f027955d43c04a05517244647e250161
|
||||
777519bd96f68c18150a0f5942f8f97a91937f5e
|
||||
4eb1f39d421024d9666cec61deaf96715ffae4c6
|
||||
50fae68d416b4b8ec4ca192923dfd5ae9ea42773
|
||||
ce665863b137ac4a7470cf006a92aa7694faca71
|
||||
81f8c0378b2ab5ea0d7b65635cb529bd3c69127c
|
||||
108222b9c323a05cc9339368f10ddd0859f62b43
|
||||
28f788e47e58f2b462351d6989348a4e1a241b2b
|
||||
d81dccf191a48a6b59c3747d7b4ccbe3535dde40
|
||||
a90e6d2bffc422ddcdb771c53aac0bceb970a2c4
|
||||
91e49c51f1aecc9e1d75457f4920d52a4b0a133c
|
||||
60dd9cc470584960431de425e2a9ffbed0e8034a
|
||||
ede386c2193fc31351e193b3a8cf30030d6be62c
|
||||
a084767b40c0d3ba8fa8f8d60f1e8d99a9dc3457
|
||||
3f726c99f819f97f2ab21b94d34c6b3129cd883a
|
||||
77fc469fc78cdd87c29f398d46ac58dbb9ef62c0
|
||||
4ae6d0fbef60ccbecf8f23bb482e201b3678f7a3
|
||||
8858b6ddd3bce9daa08da6e05de3ca863a399c15
|
||||
22e301a3d56dc9e6878380ee92c7d19ca43119d2
|
||||
c484ec6c9b85ca4e331e395c564ae232fd0681dd
|
||||
a46a671e253528e450bd57645c400bf761da07ab
|
||||
655970d9c60ae6850daf452457e14e21047c0e1b
|
||||
b6a48914c50631914192aa11b19205436a9c664d
|
||||
7db65c363a0cc6ca7cdb04de9a973ab70013baad
|
||||
6366941275344dac7e2130b0c972e90117d37ed0
|
||||
4fb2586661471a1572c2df2a5a091011d45eb7c4
|
||||
d7be7b39fa1021ec4518186afe145ee948e12a94
|
||||
85aec87b11ec41295558175c63f1f5a849460fdf
|
||||
aeb31756276034dd506fdf97c8aaade0e7e584f5
|
||||
ac016e17d20253129a0287cee7e1d06b7ef15966
|
||||
bf74d377fb8e20140da6eac1407414928384bcea
|
||||
2c811e08db651a4aed6ea0f7c1972d60de6de8ab
|
||||
e5d26e47c7a482c072a7fe47bb84c56854734184
|
||||
96a63a3e0cefe920819bd42add0041837b1214a1
|
||||
e526ca6284b9e13be1b912b80dd73a34e739b539
|
||||
ecd21357f16106e541e9c2854ead2a906659b938
|
||||
4b5a7ce0c301ad971f383eb60f61bf9b4026efda
|
||||
929fd7276c0f0c30b9416f61a6f5f35d763d81e4
|
||||
fa8a0639f7b0ce04030b72b4d5be4f0aa36fc5cb
|
||||
f1f1605c22a6283bbfd757055fcf2b584a857709
|
||||
0c173a15ca1bf20999f74987988985508c9de463
|
||||
df0793f324e33066cc746c0cb1d053d35733d626
|
||||
2b0179d8a9b75397937126b36114df0dddeab40c
|
||||
bf0a08be281dc42241e7f264c2a20515eb4781bb
|
||||
3895e25a77363ae8b49358fb793f50fa8b271e2d
|
||||
1fc783fc08bc078239537535f174ab8a489772c0
|
||||
1d4805ce04645f3203b0cfd3d66ea710e7433eb4
|
||||
d3b58704d1d325875fc605580c1c02b825c1bbcc
|
||||
ed88e3194c4bc43aeafef929da7b419d03dea1ad
|
||||
dd07f47b79628668e29cc0143b21e790100ee445
|
||||
65cc7aacfbfc7b747926375280a1d839e88d576b
|
||||
080ec5209172ac9605f1434559dbb3c1e012b10a
|
||||
416af3edf5b5ab265acf95568f2bc9eabd3d96de
|
||||
e0a7801223fd573863939e76cb633f1dcc2d22c4
|
||||
4bc853b50fd9127687eb9e4f3b679dd261a4fa96
|
||||
c68a9a69278aa194fed96bd9733d32af3690a11e
|
||||
c38f540298f0e188df5ed68fd56c623b9ac8331b
|
||||
643fa0b22d70e459d7f7ec3d728ae4811dc5158f
|
||||
e053e05c130549f43953f1d70e724dc9ce3e1b85
|
||||
75e898c094eea533d1dfaf141c6afccc3072c49f
|
||||
2805d606bc46bf5589093a1b92d3542c13ce50c2
|
||||
32751807c9c06011eb689cba56b401a6302699c0
|
||||
30853e16d332816752dafcfca92147c7ffef5b54
|
||||
bea5b00cfe95cd37832305c0f93c339a22a7d79d
|
||||
c871f323b418fac27bf834843ca26985010df53f
|
||||
329fc1dce7a1c372c8b10c2f2f8732b2c60daff0
|
||||
1aefc94dd78d6e0c9209cb09fc16f53dedf42108
|
||||
8e5725666b519b61fcdc3141da5c6a57c1959909
|
||||
a4ca0b042365061020627a8c045cddacea3312ec
|
||||
8bd16ee12fc8ef6723e0572c29b979c15b92b4f4
|
||||
87abe20fc118721cc5efdbd94a8462468cd1da2b
|
||||
4b766fcdd4ca16399075d1e081a321b3b05ce516
|
||||
f6241b3e420e19f3f0507cbbc872fe9218916a02
|
||||
7ee523604851af62c0a47c07ee023a8710ef32f7
|
||||
776ba233e939fe41a74c6b2632b93a0679a32c71
|
||||
6a796b2b53fe542e0f340f250f4f20d69efed8d0
|
||||
23d78c4dd01bc74ba35db3e3df95280f6f1b2e22
|
||||
f4b15e2de97c4f8cdbb40bef4c9d0ab2807974d9
|
||||
fff72de5bf8ac7b70208e655f237b80e70e18851
|
||||
170bc2c381f86a523de2fc8b71d62ade66303c0d
|
||||
314ebdfcb38d4b4c977579f787d5e1a20d068c94
|
||||
e9274839bf316b1972d80d28e45759f898edbf86
|
||||
75171f099e82e3527d7c3469b15891bd92227ec2
|
||||
3c5e6c94caf40395e031fbde44a0cca46fdd76ec
|
||||
dc8fc0c73bebbc1c48ac5540026030c9cc00ec23
|
||||
492d22f92919d8d9d59568318c26c1e2ac4890cc
|
||||
80c3a734298e824f9321c4efdd446086a3baad89
|
||||
47535d7c3ec79c5978cdcc03a5351ddbbb22538d
|
||||
1b25b6df0f08f7474228c5b6ed13b58682e1e440
|
||||
c530c15180631cea95e9c292cf7fabde9dca9db3
|
||||
2723bcdce3248417e98e6c43207bef74d34076c1
|
||||
ed22eb4a62bd8d5369aaec87d4cbdc03c9f16368
|
||||
9111df9673beb6d6616d491a5478f09b5f14d040
|
||||
d86bb075bf6d1e78c1e4f3dd38b0ea828ef5ecfe
|
||||
50a1cc0f0aef1514b917a5a3f4476967170b429d
|
||||
6ce733747e160ca699711f2c47e686284ca9aa07
|
||||
b44adf92342ad4f9c343ba29c081a91687932936
|
||||
88799ea1b1c08f4bc1a487c9e3c2effd5e1650ae
|
||||
080d7c700fc3291560d79fc590e05b8e2bad984f
|
||||
12af74b289f8cdc6caf850dc6c802f9936b1e8b3
|
||||
8e4f7e72410df3ba430082c7cf385f26fd75b033
|
||||
8ac80412867118172dc4172494304e19969e9489
|
||||
f2734c2828f69d9cfd535e5eab0592a7674b2b61
|
||||
0b9fb682890b8fe10cec54072b809a5efe57d33d
|
||||
5b029aaedb5fcf7cadd249607dd28eb3f233ab8c
|
||||
79af9fbd8c3c0e54702a9c92b171f134bd4466c8
|
||||
c412fd805ddf3282dc2e1f28e30f51ffcb1f1da2
|
||||
111849345bb5140f86b48e730ceab4bff45fa2e9
|
||||
a0b1e57b20a17177ed5a9a54e4a8aab597a546b4
|
||||
ca209230c8e73745cf8cfc79f500c9c46e103306
|
||||
a230b0588788dbe1ac84622aea169c577b381241
|
||||
dfef6b6af08097f0676a2323085558fbbd3c48c6
|
||||
3192e5278abca7c1f3b4a2a7f77a0ce941c73985
|
||||
7c7ddd9ead99a8b5033a1a5d4698032c9e2b3a92
|
||||
10b930dde8f14e9cb661810e97a33bbf144fc55c
|
||||
9225de2cf652fe2bf6e50636824cdb641546f57d
|
||||
598ef9c44b3ea2cc142c175f077b493f39f5ba22
|
||||
c49355c7170a64bdd7864cc3ba9a64916b67fe7c
|
||||
857d1e171e051b254a617f27b39f6a551054cee2
|
||||
21833f9456f6ad5bc06321ad6d9590f42ce0195c
|
||||
8910b4717e5bb946ee6988f7fe9fd461f53a5935
|
||||
5703dff0939f05c7457cebd6fc61d88ab13afe41
|
||||
8bfa13b15b84cb372950fb7b25a1080173060b6a
|
||||
ac23a7c1f19b3d8c326ffe75c8e13edf285f90fe
|
||||
19be26afe3d04783a92d032b55bf3fb1e2ae63cc
|
||||
f7ec7cfd38b543ba81ac7bed5b77f9a19739460b
|
||||
36afd4db4442c45d4078b1a7ad16a1872b5bee0d
|
||||
88c2ae3ed2bb5d367dd408c9255cd8f1e7a36c7d
|
||||
a13a417cdcfdfd1f1b3bf997bb6ffe6e69b096b9
|
||||
d6064a89ac97dc0d2ce9da3982e1a4e25afaeda8
|
||||
7146d96de3e15a80cafbab2af48ff6f65d8e41bb
|
||||
5628c70f2a44567695e5331fe2293c5b7f35b629
|
||||
7ff4a538a8682cdf02a4bcd6f15499c841001b73
|
||||
aa5fa642b0e7ce2ea55e2298886f212f11a8894e
|
||||
8efd1c820b9a782d8608d54d924658536178295c
|
||||
50a226563cd8d7c0a5e8448e87fede0eb72a8354
|
||||
b860915f8b0dae98e57a254d11575ea41f5c5a79
|
||||
d304fef3746039183f51b3ac8f4774dcf3a64f59
|
||||
53ab12d9318d5d195ccc77028b0e3ae66dc6e1fd
|
||||
668de70be039a4f1ffcf20aeae2a22ee71fc55a8
|
||||
0fea960ca917b73aff853fe88476174c8a313863
|
||||
f89502306dcf6393a2c7b0efbb0fa728fc582137
|
||||
ff58b1c3bdff5e5f687f10f9e40ce495ca49674e
|
||||
0b96abc35f1a9d46a27eeddd7df418d107c29c57
|
||||
b0b57a17306a7e963a4fe463f84e2b150a00a859
|
||||
4105cb6fd964ad13099ca83b1fdf3d35f3961f74
|
||||
23281a4dc3afc42a001346caec4dbb8193f0bb53
|
||||
8daf103fa138f9a184448ebf1c2e03b9dbd96f21
|
||||
02e5308c1b9f3771bbe49bc5036215fa2bd66aa9
|
||||
a65ced1a66575c652baf5084644b8647f531be8c
|
||||
2456a835f0bc7796d9ff71f64837fa6790e2b7cc
|
||||
9ec1330b455c1ab2eb6b89f8a2ab885677d4ae8a
|
||||
0b738075bd43fbd4410e30a51e0498cbfd2b7513
|
||||
98c80e374b84e5a9c2d5c36889a0b1ebed5b814b
|
||||
25720fc394e27a951bcad26095fb5a711bfacb8f
|
||||
4cfd57d2e38207d78722ce8c9274ba8dd700d1cc
|
||||
0fc1c31a878e93d938c67db3f958e82e3c39659f
|
||||
df1ab5b4d67b46b5e9e840b1fbe0ff02520831f9
|
||||
5bc3b6cede8dabdf3f4f27ddb03723cbb7cde51a
|
||||
c2ea1e6561caba3abffce361abc800822b9e0efe
|
||||
caa2f106d704ec3ade63498031dd58d34510bc76
|
||||
dce853ef76ef90c46d84294225088d595467d08c
|
||||
dbc8a8c86ae50059fddb2d6834fa5f0c9bbf9b71
|
||||
0f921e6a0492c4e9f037a9ed91f474885032d68c
|
||||
041331e1da23e4136fd046ed870cdcc177464176
|
||||
e6ba5068f107ac234576e77cedbd748b665369c2
|
||||
76fcd9d5034143a5b041766552670d19f926097d
|
||||
72bf1b3d0962304850a3ef5fe375db4bff1d0a39
|
||||
919db037f1f5cc73cdcaef92dd9cb0e7f5c8dec3
|
||||
c36229b0b2e9d4554053f5c9fc451ac29a493b1f
|
||||
9e4bb312e6958d2baa309ba670e5eed1523c6f47
|
||||
d7ba4a233bd5a6f8fadee681c68a995e23fe36d7
|
||||
98514988a3d3e8b7dbf0463884a5c38f5ed5562d
|
||||
5412c08c3cf13577566064edd04da021c37b7cbe
|
||||
31bcc667863f368157efa1143a78623a5db8f0d1
|
||||
7bd1aa566fb4a4fe194f209085649f2c722b0cff
|
||||
c4522e71c7e1d8ecfd70112e9375b9d00d6733a8
|
||||
e22f409f18881b63a8e747036584a71217f40e6e
|
||||
97ec6e5c9098a1240655cfcab05b6cd5eedb6cd1
|
||||
bc121b0eb19713ec72002b5be03ba5ac35903a17
|
||||
c98f6b3d93a2cc1b49a6db425ea2b661089d0f9e
|
||||
0de7fd36de57a68e543b4c1f184fba192c398c73
|
||||
e662d281b837c25b2b70525aa8fe8af894339823
|
||||
44adf683ad232db8ce0cb89b3e236a1f5944cfb0
|
||||
cb2ed300a89ebf9f0654da869ced665ed8b2abe7
|
||||
0a6d48d9ed60b0b02177059ab116f8f46d2cbed3
|
||||
b42291334651fff46dbfe5947a726f65cb9d7dfe
|
||||
e5364991daecb73aca3bb5ac37f2619d7a89211b
|
||||
4a2b170c075ce703cbdc82519a48016a9ee3f99c
|
||||
924de0bd75a7f75df65d7d15f9d1587a2e794abf
|
||||
1253f8692fc3a11be9430685cd405236a68df6c3
|
||||
2b799ae9e1e0a540f9a5971ddf27d83254668279
|
||||
c9bdf9a75f9fde8cd011e4aa94be4ed4347078a3
|
||||
3d69ecb4edeb80003a1a41442e320898a30dbd9c
|
||||
f08222e882b18c1f279308636e03beceece2dbf1
|
||||
23e03f8d26d7bd03273a5dcbdcfe3905dfb49ffb
|
||||
03dd707dc027fbf6f24120213f8eb66571600374
|
||||
d0754799698de2c032abcb8198ee5d5401063213
|
||||
072116fceb2294b97d1c40f79305f2e3ff71812b
|
||||
e66cc1d58e16bf1650dd6479fed64ecaca8c6098
|
||||
f137753a2dcd8229f89d1d1ac28039364e5850b4
|
||||
61d191fbf953700ba8aeadc9c8cf4c195efbd10c
|
||||
76f3c02fb01a6df98fbd8c16ac21d159d4649d37
|
||||
6013c73b3312e11b447ed387426749014716f820
|
||||
6faffb8a83db3f209a303a4464dbdd597faad5a4
|
||||
cc9e8aca5f950c78dcfeff63c441ba993c1fe12f
|
||||
8ca69a2a88a77eb06149fa049ab1a7e6de38b321
|
||||
2f71490d21796594ca6f55e375558944de9db5a0
|
||||
08cc5fd666456cb476467473ed1880c90c92dedb
|
||||
e31a43c725ebe641d7c219c3886eee18eebf0bb8
|
||||
52b5a8785de760a204b2b0aab19dfaf79c2c3ff0
|
||||
483e8e4f4875a1a621ec9e9df2880d3037d95ed7
|
||||
1e5799c52535a3fc20e885916f1e7ed33ecc7f46
|
||||
a82e5d8220bbc8b5d786bed99b0876f530b9b7cc
|
||||
7fe6c5c993706e8395cdaf7977bee793c06f48f3
|
||||
2a0836f6d5e7c1d7e97bedb0e0ea33dcaf981f77
|
||||
ddc308068d69c6c9aa629ee3c4ce75e1d1cf08b5
|
||||
ec139a5621a9c9f03e1988391a3c7c6c5d849776
|
||||
c01a6c48b982d625fd9f4f69005878781d3d56fa
|
||||
95a983d56dbda457e3bf8766d59bac74c7aa5699
|
||||
760741a00833876976389ed7a6b73f36ee5b4c13
|
||||
6e5e5abba6f8bbbe61c22795df440dfafcfdc378
|
||||
cf2cecb18779ce83de9adebf382dff1c19b12840
|
||||
af9b7a9f2f73b1a2f9728106774dd13e8d1cdd8d
|
||||
115735d547fdeade822f547eb3e8c8f9961a9b07
|
||||
c2c69edf37b5c02aafa01d0407dadbf5ef8751b5
|
||||
a072d1a83787e786d074a4b5871b0b961781f7c6
|
||||
ed2cd59e258f756b2eaed7909a60956ade6ef7ee
|
||||
ae5575ba41c8a782805afb1c08730343cfc22397
|
||||
6ff2c8d29f6b5a5c2ce63f0a16f3bb0dbd049451
|
||||
a80de15113166354cdf208e3d8b6e25f4511a591
|
||||
06bd4f637f15e769f088d9051a5af94bbb0217a3
|
||||
6700cc993cc07fb0f5b8b577ff8c4afcf0b18274
|
||||
37f9a1f627c0995d89b62923e75cd092600894f9
|
||||
8844ef15ded02d5ed86fb95aaf251235fcef2396
|
||||
1b87e5b5b184a0a6c683eda23b36393822b57f03
|
||||
e2bf830bb6c1bfa038c943dd6f5d92a406bd723f
|
||||
423ca302a3ee87000530da3c105f269b8fabece7
|
||||
4e14afe42fdd468d5de11df8cc13defdcb8e83f8
|
||||
3e90fe6534206412ea22beaa445cf20d28fbe718
|
||||
88b77c7da0a672c89e24df37ea6e9085b4e2a05c
|
||||
0ad104190465d8d65c2344bbe10dcf3df025d86c
|
||||
5c7df7022bcd360e6af00b9458b1a3fd54e1cc9a
|
||||
59ad56851a342d2c62f6b38bf15002b23ab439e1
|
||||
4
contrib/verify-commits/allow-unclean-merge-commits
Normal file
4
contrib/verify-commits/allow-unclean-merge-commits
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
6052d509105790a26b3ad5df43dd61e7f1b24a12
|
||||
3798e5de334c3deb5f71302b782f6b8fbd5087f1
|
||||
326ffed09bfcc209a2efd6a2ebc69edf6bd200b5
|
||||
97d83739db0631be5d4ba86af3616014652c00ec
|
||||
66
contrib/verify-commits/gpg.sh
Executable file
66
contrib/verify-commits/gpg.sh
Executable file
|
|
@ -0,0 +1,66 @@
|
|||
#!/bin/sh
|
||||
# Copyright (c) 2014-2016 The Bitcoin Core developers
|
||||
# Copyright (c) 2014-2019 The DigiByte Core developers
|
||||
# Distributed under the MIT software license, see the accompanying
|
||||
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
||||
|
||||
export LC_ALL=C
|
||||
INPUT=$(cat /dev/stdin)
|
||||
VALID=false
|
||||
REVSIG=false
|
||||
IFS='
|
||||
'
|
||||
if [ "$DIGIBYTE_VERIFY_COMMITS_ALLOW_SHA1" = 1 ]; then
|
||||
GPG_RES="$(printf '%s\n' "$INPUT" | gpg --trust-model always "$@" 2>/dev/null)"
|
||||
else
|
||||
# Note how we've disabled SHA1 with the --weak-digest option, disabling
|
||||
# signatures - including selfsigs - that use SHA1. While you might think that
|
||||
# collision attacks shouldn't be an issue as they'd be an attack on yourself,
|
||||
# in fact because what's being signed is a commit object that's
|
||||
# semi-deterministically generated by untrusted input (the pull-req) in theory
|
||||
# an attacker could construct a pull-req that results in a commit object that
|
||||
# they've created a collision for. Not the most likely attack, but preventing
|
||||
# it is pretty easy so we do so as a "belt-and-suspenders" measure.
|
||||
GPG_RES=""
|
||||
for LINE in $(gpg --version); do
|
||||
case "$LINE" in
|
||||
"gpg (GnuPG) 1.4.1"*|"gpg (GnuPG) 2.0."*)
|
||||
echo "Please upgrade to at least gpg 2.1.10 to check for weak signatures" > /dev/stderr
|
||||
GPG_RES="$(printf '%s\n' "$INPUT" | gpg --trust-model always "$@" 2>/dev/null)"
|
||||
;;
|
||||
# We assume if you're running 2.1+, you're probably running 2.1.10+
|
||||
# gpg will fail otherwise
|
||||
# We assume if you're running 1.X, it is either 1.4.1X or 1.4.20+
|
||||
# gpg will fail otherwise
|
||||
esac
|
||||
done
|
||||
[ "$GPG_RES" = "" ] && GPG_RES="$(printf '%s\n' "$INPUT" | gpg --trust-model always --weak-digest sha1 "$@" 2>/dev/null)"
|
||||
fi
|
||||
for LINE in $GPG_RES; do
|
||||
case "$LINE" in
|
||||
"[GNUPG:] VALIDSIG "*)
|
||||
while read KEY; do
|
||||
[ "${LINE#?GNUPG:? VALIDSIG * * * * * * * * * }" = "$KEY" ] && VALID=true
|
||||
done < ./contrib/verify-commits/trusted-keys
|
||||
;;
|
||||
"[GNUPG:] REVKEYSIG "*)
|
||||
[ "$DIGIBYTE_VERIFY_COMMITS_ALLOW_REVSIG" != 1 ] && exit 1
|
||||
REVSIG=true
|
||||
GOODREVSIG="[GNUPG:] GOODSIG ${LINE#* * *}"
|
||||
;;
|
||||
"[GNUPG:] EXPKEYSIG "*)
|
||||
[ "$DIGIBYTE_VERIFY_COMMITS_ALLOW_REVSIG" != 1 ] && exit 1
|
||||
REVSIG=true
|
||||
GOODREVSIG="[GNUPG:] GOODSIG ${LINE#* * *}"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
if ! $VALID; then
|
||||
exit 1
|
||||
fi
|
||||
if $VALID && $REVSIG; then
|
||||
printf '%s\n' "$INPUT" | gpg --trust-model always "$@" 2>/dev/null | grep "^\[GNUPG:\] \(NEWSIG\|SIG_ID\|VALIDSIG\)"
|
||||
echo "$GOODREVSIG"
|
||||
else
|
||||
printf '%s\n' "$INPUT" | gpg --trust-model always "$@" 2>/dev/null
|
||||
fi
|
||||
22
contrib/verify-commits/pre-push-hook.sh
Executable file
22
contrib/verify-commits/pre-push-hook.sh
Executable file
|
|
@ -0,0 +1,22 @@
|
|||
#!/usr/bin/env bash
|
||||
# Copyright (c) 2014-2015 The Bitcoin Core developers
|
||||
# Copyright (c) 2014-2020 The DigiByte Core developers
|
||||
# Distributed under the MIT software license, see the accompanying
|
||||
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
||||
|
||||
export LC_ALL=C
|
||||
if ! [[ "$2" =~ ^(git@)?(www.)?github.com(:|/)digibyte/digibyte(.git)?$ ]]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
while read LINE; do
|
||||
set -- A $LINE
|
||||
if [ "$4" != "refs/heads/master" ]; then
|
||||
continue
|
||||
fi
|
||||
if ! ./contrib/verify-commits/verify-commits.py $3 > /dev/null 2>&1; then
|
||||
echo "ERROR: A commit is not signed, can't push"
|
||||
./contrib/verify-commits/verify-commits.py
|
||||
exit 1
|
||||
fi
|
||||
done < /dev/stdin
|
||||
1
contrib/verify-commits/trusted-git-root
Normal file
1
contrib/verify-commits/trusted-git-root
Normal file
|
|
@ -0,0 +1 @@
|
|||
82bcf405f6db1d55b684a1f63a4aabad376cdad7
|
||||
7
contrib/verify-commits/trusted-keys
Normal file
7
contrib/verify-commits/trusted-keys
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
71A3B16735405025D447E8F274810B012346C9A6
|
||||
133EAC179436F14A5CF1B794860FEB804E669320
|
||||
32EE5C4C3FA15CCADB46ABE529D4BCB6416F53EC
|
||||
B8B3F1C0E58C15DB6A81D30C3648A882F4316B9B
|
||||
CA03882CB1FC067B5D3ACFE4D300116E1C875A3D
|
||||
E777299FC265DD04793070EB944D35F9AC3DB76A
|
||||
D1DBF2C4B96F2DEBF4C16654410108112E7EA81F
|
||||
1
contrib/verify-commits/trusted-sha512-root-commit
Normal file
1
contrib/verify-commits/trusted-sha512-root-commit
Normal file
|
|
@ -0,0 +1 @@
|
|||
309bf16257b2395ce502017be627186b749ee749
|
||||
166
contrib/verify-commits/verify-commits.py
Executable file
166
contrib/verify-commits/verify-commits.py
Executable file
|
|
@ -0,0 +1,166 @@
|
|||
#!/usr/bin/env python3
|
||||
# Copyright (c) 2018 The Bitcoin Core developers
|
||||
# Copyright (c) 2018-2019 The DigiByte Core developers
|
||||
# Distributed under the MIT software license, see the accompanying
|
||||
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
||||
"""Verify commits against a trusted keys list."""
|
||||
import argparse
|
||||
import hashlib
|
||||
import logging
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
|
||||
GIT = os.getenv('GIT', 'git')
|
||||
|
||||
def tree_sha512sum(commit='HEAD'):
|
||||
"""Calculate the Tree-sha512 for the commit.
|
||||
|
||||
This is copied from github-merge.py. See https://github.com/digibyte-core/digibyte-maintainer-tools."""
|
||||
|
||||
# request metadata for entire tree, recursively
|
||||
files = []
|
||||
blob_by_name = {}
|
||||
for line in subprocess.check_output([GIT, 'ls-tree', '--full-tree', '-r', commit]).splitlines():
|
||||
name_sep = line.index(b'\t')
|
||||
metadata = line[:name_sep].split() # perms, 'blob', blobid
|
||||
assert metadata[1] == b'blob'
|
||||
name = line[name_sep + 1:]
|
||||
files.append(name)
|
||||
blob_by_name[name] = metadata[2]
|
||||
|
||||
files.sort()
|
||||
# open connection to git-cat-file in batch mode to request data for all blobs
|
||||
# this is much faster than launching it per file
|
||||
p = subprocess.Popen([GIT, 'cat-file', '--batch'], stdout=subprocess.PIPE, stdin=subprocess.PIPE)
|
||||
overall = hashlib.sha512()
|
||||
for f in files:
|
||||
blob = blob_by_name[f]
|
||||
# request blob
|
||||
p.stdin.write(blob + b'\n')
|
||||
p.stdin.flush()
|
||||
# read header: blob, "blob", size
|
||||
reply = p.stdout.readline().split()
|
||||
assert reply[0] == blob and reply[1] == b'blob'
|
||||
size = int(reply[2])
|
||||
# hash the blob data
|
||||
intern = hashlib.sha512()
|
||||
ptr = 0
|
||||
while ptr < size:
|
||||
bs = min(65536, size - ptr)
|
||||
piece = p.stdout.read(bs)
|
||||
if len(piece) == bs:
|
||||
intern.update(piece)
|
||||
else:
|
||||
raise IOError('Premature EOF reading git cat-file output')
|
||||
ptr += bs
|
||||
dig = intern.hexdigest()
|
||||
assert p.stdout.read(1) == b'\n' # ignore LF that follows blob data
|
||||
# update overall hash with file hash
|
||||
overall.update(dig.encode("utf-8"))
|
||||
overall.update(" ".encode("utf-8"))
|
||||
overall.update(f)
|
||||
overall.update("\n".encode("utf-8"))
|
||||
p.stdin.close()
|
||||
if p.wait():
|
||||
raise IOError('Non-zero return value executing git cat-file')
|
||||
return overall.hexdigest()
|
||||
|
||||
def main():
|
||||
|
||||
# Enable debug logging if running in CI
|
||||
if 'CI' in os.environ and os.environ['CI'].lower() == "true":
|
||||
logging.getLogger().setLevel(logging.DEBUG)
|
||||
|
||||
# Parse arguments
|
||||
parser = argparse.ArgumentParser(usage='%(prog)s [options] [commit id]')
|
||||
parser.add_argument('--disable-tree-check', action='store_false', dest='verify_tree', help='disable SHA-512 tree check')
|
||||
parser.add_argument('--clean-merge', type=float, dest='clean_merge', default=float('inf'), help='Only check clean merge after <NUMBER> days ago (default: %(default)s)', metavar='NUMBER')
|
||||
parser.add_argument('commit', nargs='?', default='HEAD', help='Check clean merge up to commit <commit>')
|
||||
args = parser.parse_args()
|
||||
|
||||
# get directory of this program and read data files
|
||||
dirname = os.path.dirname(os.path.abspath(__file__))
|
||||
print("Using verify-commits data from " + dirname)
|
||||
verified_root = open(dirname + "/trusted-git-root", "r", encoding="utf8").read().splitlines()[0]
|
||||
verified_sha512_root = open(dirname + "/trusted-sha512-root-commit", "r", encoding="utf8").read().splitlines()[0]
|
||||
revsig_allowed = open(dirname + "/allow-revsig-commits", "r", encoding="utf-8").read().splitlines()
|
||||
unclean_merge_allowed = open(dirname + "/allow-unclean-merge-commits", "r", encoding="utf-8").read().splitlines()
|
||||
incorrect_sha512_allowed = open(dirname + "/allow-incorrect-sha512-commits", "r", encoding="utf-8").read().splitlines()
|
||||
|
||||
# Set commit and branch and set variables
|
||||
current_commit = args.commit
|
||||
if ' ' in current_commit:
|
||||
print("Commit must not contain spaces", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
verify_tree = args.verify_tree
|
||||
no_sha1 = True
|
||||
prev_commit = ""
|
||||
initial_commit = current_commit
|
||||
branch = subprocess.check_output([GIT, 'show', '-s', '--format=%H', initial_commit]).decode('utf8').splitlines()[0]
|
||||
|
||||
# Iterate through commits
|
||||
while True:
|
||||
|
||||
# Log a message to prevent Travis from timing out
|
||||
logging.debug("verify-commits: [in-progress] processing commit {}".format(current_commit[:8]))
|
||||
|
||||
if current_commit == verified_root:
|
||||
print('There is a valid path from "{}" to {} where all commits are signed!'.format(initial_commit, verified_root))
|
||||
sys.exit(0)
|
||||
if current_commit == verified_sha512_root:
|
||||
if verify_tree:
|
||||
print("All Tree-SHA512s matched up to {}".format(verified_sha512_root), file=sys.stderr)
|
||||
verify_tree = False
|
||||
no_sha1 = False
|
||||
|
||||
os.environ['DIGIBYTE_VERIFY_COMMITS_ALLOW_SHA1'] = "0" if no_sha1 else "1"
|
||||
os.environ['DIGIBYTE_VERIFY_COMMITS_ALLOW_REVSIG'] = "1" if current_commit in revsig_allowed else "0"
|
||||
|
||||
# Check that the commit (and parents) was signed with a trusted key
|
||||
if subprocess.call([GIT, '-c', 'gpg.program={}/gpg.sh'.format(dirname), 'verify-commit', current_commit], stdout=subprocess.DEVNULL):
|
||||
if prev_commit != "":
|
||||
print("No parent of {} was signed with a trusted key!".format(prev_commit), file=sys.stderr)
|
||||
print("Parents are:", file=sys.stderr)
|
||||
parents = subprocess.check_output([GIT, 'show', '-s', '--format=format:%P', prev_commit]).decode('utf8').splitlines()[0].split(' ')
|
||||
for parent in parents:
|
||||
subprocess.call([GIT, 'show', '-s', parent], stdout=sys.stderr)
|
||||
else:
|
||||
print("{} was not signed with a trusted key!".format(current_commit), file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
# Check the Tree-SHA512
|
||||
if (verify_tree or prev_commit == "") and current_commit not in incorrect_sha512_allowed:
|
||||
tree_hash = tree_sha512sum(current_commit)
|
||||
if ("Tree-SHA512: {}".format(tree_hash)) not in subprocess.check_output([GIT, 'show', '-s', '--format=format:%B', current_commit]).decode('utf8').splitlines():
|
||||
print("Tree-SHA512 did not match for commit " + current_commit, file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
# Merge commits should only have two parents
|
||||
parents = subprocess.check_output([GIT, 'show', '-s', '--format=format:%P', current_commit]).decode('utf8').splitlines()[0].split(' ')
|
||||
if len(parents) > 2:
|
||||
print("Commit {} is an octopus merge".format(current_commit), file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
# Check that the merge commit is clean
|
||||
commit_time = int(subprocess.check_output([GIT, 'show', '-s', '--format=format:%ct', current_commit]).decode('utf8').splitlines()[0])
|
||||
check_merge = commit_time > time.time() - args.clean_merge * 24 * 60 * 60 # Only check commits in clean_merge days
|
||||
allow_unclean = current_commit in unclean_merge_allowed
|
||||
if len(parents) == 2 and check_merge and not allow_unclean:
|
||||
current_tree = subprocess.check_output([GIT, 'show', '--format=%T', current_commit]).decode('utf8').splitlines()[0]
|
||||
subprocess.call([GIT, 'checkout', '--force', '--quiet', parents[0]])
|
||||
subprocess.call([GIT, 'merge', '--no-ff', '--quiet', '--no-gpg-sign', parents[1]], stdout=subprocess.DEVNULL)
|
||||
recreated_tree = subprocess.check_output([GIT, 'show', '--format=format:%T', 'HEAD']).decode('utf8').splitlines()[0]
|
||||
if current_tree != recreated_tree:
|
||||
print("Merge commit {} is not clean".format(current_commit), file=sys.stderr)
|
||||
subprocess.call([GIT, 'diff', current_commit])
|
||||
subprocess.call([GIT, 'checkout', '--force', '--quiet', branch])
|
||||
sys.exit(1)
|
||||
subprocess.call([GIT, 'checkout', '--force', '--quiet', branch])
|
||||
|
||||
prev_commit = current_commit
|
||||
current_commit = parents[0]
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
131
contrib/verify-commits/verify-commits.sh
Executable file
131
contrib/verify-commits/verify-commits.sh
Executable file
|
|
@ -0,0 +1,131 @@
|
|||
#!/bin/sh
|
||||
# Copyright (c) 2014-2017 The DigiByte Core developers
|
||||
# Distributed under the MIT software license, see the accompanying
|
||||
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
||||
|
||||
DIR=$(dirname "$0")
|
||||
[ "/${DIR#/}" != "$DIR" ] && DIR=$(dirname "$(pwd)/$0")
|
||||
|
||||
echo "Using verify-commits data from ${DIR}"
|
||||
|
||||
VERIFIED_ROOT=$(cat "${DIR}/trusted-git-root")
|
||||
VERIFIED_SHA512_ROOT=$(cat "${DIR}/trusted-sha512-root-commit")
|
||||
REVSIG_ALLOWED=$(cat "${DIR}/allow-revsig-commits")
|
||||
|
||||
HAVE_GNU_SHA512=1
|
||||
[ ! -x "$(which sha512sum)" ] && HAVE_GNU_SHA512=0
|
||||
|
||||
if [ x"$1" = "x" ]; then
|
||||
CURRENT_COMMIT="HEAD"
|
||||
else
|
||||
CURRENT_COMMIT="$1"
|
||||
fi
|
||||
|
||||
if [ "${CURRENT_COMMIT#* }" != "$CURRENT_COMMIT" ]; then
|
||||
echo "Commit must not contain spaces?" > /dev/stderr
|
||||
exit 1
|
||||
fi
|
||||
|
||||
VERIFY_TREE=0
|
||||
if [ x"$2" = "x--tree-checks" ]; then
|
||||
VERIFY_TREE=1
|
||||
fi
|
||||
|
||||
NO_SHA1=1
|
||||
PREV_COMMIT=""
|
||||
INITIAL_COMMIT="${CURRENT_COMMIT}"
|
||||
|
||||
while true; do
|
||||
if [ "$CURRENT_COMMIT" = $VERIFIED_ROOT ]; then
|
||||
echo "There is a valid path from \"$INITIAL_COMMIT\" to $VERIFIED_ROOT where all commits are signed!"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "$CURRENT_COMMIT" = $VERIFIED_SHA512_ROOT ]; then
|
||||
if [ "$VERIFY_TREE" = "1" ]; then
|
||||
echo "All Tree-SHA512s matched up to $VERIFIED_SHA512_ROOT" > /dev/stderr
|
||||
fi
|
||||
VERIFY_TREE=0
|
||||
NO_SHA1=0
|
||||
fi
|
||||
|
||||
if [ "$NO_SHA1" = "1" ]; then
|
||||
export DIGIBYTE_VERIFY_COMMITS_ALLOW_SHA1=0
|
||||
else
|
||||
export DIGIBYTE_VERIFY_COMMITS_ALLOW_SHA1=1
|
||||
fi
|
||||
|
||||
if [ "${REVSIG_ALLOWED#*$CURRENT_COMMIT}" != "$REVSIG_ALLOWED" ]; then
|
||||
export DIGIBYTE_VERIFY_COMMITS_ALLOW_REVSIG=1
|
||||
else
|
||||
export DIGIBYTE_VERIFY_COMMITS_ALLOW_REVSIG=0
|
||||
fi
|
||||
|
||||
if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit "$CURRENT_COMMIT" > /dev/null; then
|
||||
if [ "$PREV_COMMIT" != "" ]; then
|
||||
echo "No parent of $PREV_COMMIT was signed with a trusted key!" > /dev/stderr
|
||||
echo "Parents are:" > /dev/stderr
|
||||
PARENTS=$(git show -s --format=format:%P $PREV_COMMIT)
|
||||
for PARENT in $PARENTS; do
|
||||
git show -s $PARENT > /dev/stderr
|
||||
done
|
||||
else
|
||||
echo "$CURRENT_COMMIT was not signed with a trusted key!" > /dev/stderr
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# We always verify the top of the tree
|
||||
if [ "$VERIFY_TREE" = 1 -o "$PREV_COMMIT" = "" ]; then
|
||||
IFS_CACHE="$IFS"
|
||||
IFS='
|
||||
'
|
||||
for LINE in $(git ls-tree --full-tree -r "$CURRENT_COMMIT"); do
|
||||
case "$LINE" in
|
||||
"12"*)
|
||||
echo "Repo contains symlinks" > /dev/stderr
|
||||
IFS="$IFS_CACHE"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
IFS="$IFS_CACHE"
|
||||
|
||||
FILE_HASHES=""
|
||||
for FILE in $(git ls-tree --full-tree -r --name-only "$CURRENT_COMMIT" | LC_ALL=C sort); do
|
||||
if [ "$HAVE_GNU_SHA512" = 1 ]; then
|
||||
HASH=$(git cat-file blob "$CURRENT_COMMIT":"$FILE" | sha512sum | { read FIRST _; echo $FIRST; } )
|
||||
else
|
||||
HASH=$(git cat-file blob "$CURRENT_COMMIT":"$FILE" | shasum -a 512 | { read FIRST _; echo $FIRST; } )
|
||||
fi
|
||||
[ "$FILE_HASHES" != "" ] && FILE_HASHES="$FILE_HASHES"'
|
||||
'
|
||||
FILE_HASHES="$FILE_HASHES$HASH $FILE"
|
||||
done
|
||||
|
||||
if [ "$HAVE_GNU_SHA512" = 1 ]; then
|
||||
TREE_HASH="$(echo "$FILE_HASHES" | sha512sum)"
|
||||
else
|
||||
TREE_HASH="$(echo "$FILE_HASHES" | shasum -a 512)"
|
||||
fi
|
||||
HASH_MATCHES=0
|
||||
MSG="$(git show -s --format=format:%B "$CURRENT_COMMIT" | tail -n1)"
|
||||
|
||||
case "$MSG -" in
|
||||
"Tree-SHA512: $TREE_HASH")
|
||||
HASH_MATCHES=1;;
|
||||
esac
|
||||
|
||||
if [ "$HASH_MATCHES" = "0" ]; then
|
||||
echo "Tree-SHA512 did not match for commit $CURRENT_COMMIT" > /dev/stderr
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
PARENTS=$(git show -s --format=format:%P "$CURRENT_COMMIT")
|
||||
for PARENT in $PARENTS; do
|
||||
PREV_COMMIT="$CURRENT_COMMIT"
|
||||
CURRENT_COMMIT="$PARENT"
|
||||
break
|
||||
done
|
||||
done
|
||||
Loading…
Reference in a new issue