BigW Consortium Gitlab

security-harness 1.23 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
#!/usr/bin/env ruby

require 'digest'
require 'fileutils'

harness_path = File.expand_path('../.git/security_harness', __dir__)
hook_path    = File.expand_path("../.git/hooks/pre-push", __dir__)

if File.exist?(hook_path)
  # Deal with a pre-existing hook
  source_sum = Digest::SHA256.hexdigest(DATA.read)
  dest_sum   = Digest::SHA256.file(hook_path).hexdigest

  if source_sum != dest_sum
    puts "#{hook_path} exists and is different from our hook!"
    puts "Remove it and re-run this script to continue."

    exit 1
  end
else
  File.open(hook_path, 'w') do |file|
    IO.copy_stream(DATA, file)
  end
24 25

  File.chmod(0755, hook_path)
26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
end

# Toggle the harness on or off
if File.exist?(harness_path)
  FileUtils.rm(harness_path)

  puts "Security harness removed -- you can now push to all remotes."
else
  FileUtils.touch(harness_path)

  puts "Security harness installed -- you will only be able to push to dev.gitlab.org!"
end

__END__
#!/bin/sh

set -e

url="$2"
harness=`dirname "$0"`/../security_harness

if [ -e "$harness" ]
then
  if [[ "$url" != *"dev.gitlab.org"* ]]
  then
    echo "Pushing to remotes other than dev.gitlab.org has been disabled!"
    echo "Run scripts/security-harness to disable this check."
    echo

    exit 1
  fi
fi