update

#!/bin/sh

# Config
# ------
# hooks.verify.keydir
#   This string specifies the directory inside the repository that contains
#   all keys that are allowed to sign commits.
# gpg.program
#   See git-config(1) man page.

set -e

msg () {
	echo $msg_prefix$@ >&2
}

# Detach the GPG signature from git commit object.
# Outputs the payload to fd 3 and the signature to fd 4.
# If no signature was found a non-zero code is returned.
detach_signature() {
	in_signature=false
	saw_signature=false
	while IFS= read -r line; do
		case "$line" in
			'gpgsig '*)
				printf '%s\n' "${line#gpgsig }" >&4
				in_signature=true
				saw_signature=true
				;;
			' '*)
				if [ "$in_signature" = true ]; then
					printf '%s\n' "${line# }" >&4
				else
					printf '%s\n' "$line" >&3
				fi
				;;
			*)
				if [ "$in_signature" = true ]; then
					in_signature=false
			 fi
			  printf '%s\n' "$line" >&3
			 ;;
		esac
	done
	# Trailing content from read after last newline
	printf '%s' "$line" >&3
	[ "$saw_signature" = true ] || return 1
}

# Parse the GPG status output.
# Returns a non-zero code, if GPG reports any signature errors occur or no
# good signature is found.
check_gpg_status() {
	rc=1
	while read -r prefix type keyid f2 f3 f4 f5 f6; do
		[ "$prefix" = '[GNUPG:]' ] || continue
		case "$type" in
			'GOODSIG')
				rc=0;;
			'EXPSIG')
				msg "Expired signature from \"$f2\" keyid $keyid"
				return 1;;
			'EXPKEYSIG')
				msg "Expired key signature from \"$f2\" keyid $keyid"
				return 1;;
			'REVKEYSIG')
				msg "Revoked key signature from \"$f2\" keyid $keyid"
				return 1;;
			'BADSIG')
				msg "Bad signature from \"$f2\" keyid $keyid"
				return 1;;
			'ERRSIG')
				msg 'Signature verification error'
				if [ "$f6" = 9 ]; then
					msg "No public key with keyid $keyid"
				fi
				return 1;;
		esac
	done
	return $rc
}

# Get all parent commits of a commit
get_parent_commits () {
	commit=$1
	git rev-list -n 1 --parents "$commit" | ( read -r child parents; echo "$parents" )
}

# Verify a commit with the keys found in its parent.
# Return a non-zero code if the commit could successfully be verified.
#
# The commit verification is implemented in the shell, because
# git-verify-commit(1) was only introduced in git 2.1.0
verify_commit () {
	commit=$1
	parent=$2
	msg "Trying parent commit $(git show -s --oneline $parent)"

	if [ "$(git cat-file -t ${parent}:${keydir} 2>/dev/null)" != "tree" ]; then
		msg 'warn: no key directory found.'
		msg 'A key directory can be specified in the hooks.verify.keydir'
		msg 'git configuration variable, the default is "keys"'
		return 1
	fi

	# Clear the keyring
	true > $keyring
	# Import all keys from $keydir into the keyring
	for key in $(git ls-tree --full-tree --name-only -r $parent $keydir); do
		if ! git cat-file blob $parent:$key | $gpg --import; then
			msg "Warning: Could not import $key. Is it a valid PGP key?"
		fi
	done

	$gpg --status-fd=1 --verify "$signature" - < "$payload" 2>/dev/null | check_gpg_status || {
		msg 'Verification failed.'
		return 1
	}
	msg 'Verification successful.'
	return 0
}

main () {
	if [ "$#" -lt 3 ]; then
		msg "usage: $0 <ref> <oldrev> <newrev>"
		exit 1
	fi

	# --- Safety check
	if [ -z "$GIT_DIR" ]; then
		msg "Don't run this script from the command line."
		msg " (if you want, you could supply GIT_DIR then run"
		msg "  $0 <ref> <oldrev> <newrev>)"
		exit 1
	fi

	refname="$1"
	oldrev="$2"
	newrev="$3"

	zero="0000000000000000000000000000000000000000"
	if [ "$newrev" = "$zero" ]; then
		msg "info: Deletion of ${refname}. No verification is performed."
		exit 0
	fi

	tempdir=$(mktemp -d) || {
		msg "Could not create temporary directory"
		exit 1
	}
	trap 'rm -rf "$tempdir"' EXIT INT TERM HUP

	if ! keydir=$(git config --get hooks.verify.keydir); then
		keydir=keys
	fi

	keyring="$tempdir/trusted.gpg"
	payload="$tempdir/payload"
	signature="$tempdir/signature"
	gpgopts="--quiet --no-options --no-default-keyring --homedir $tempdir \
		--no-auto-check-trustdb --trust-model always --keyring $keyring \
		--primary-keyring $keyring"
	if ! gpg=$(git config --get gpg.program); then
		gpg=gpg
	fi
	gpg="$gpg $gpgopts"

	# Exclude all already present refs if this is a new ref
	if [ "$oldrev" = "$zero" ]; then
		excludes="$(git for-each-ref --format '^%(refname)' refs/heads/ refs/tags/ | tr '\n' ' ')"
	# Exclude $oldrev if this isn't a new ref
	else
		excludes="^${oldrev}"
	fi

	commits=$(git rev-list $newrev $excludes 2>/dev/null)
	for commit in $commits; do
		msg "Verifying commit $(git show -s --oneline $commit )"
		git cat-file commit "$commit" | detach_signature 3>$payload 4>$signature || {
			msg 'error: commit is not signed'
			exit 1
		}
		parents=$(get_parent_commits $commit)
		# Find parent commits
		if [ -z "$parents" ]; then
			msg 'error: commit has no parents'
			msg 'You must initialize the git repository with a trusted first'
			msg 'commit containing a key directory before enabling this hook.'
			exit 1
		fi
		success=0
		msg_prefix='-> '
		for parent in $parents; do
			if verify_commit $commit $parent; then
				success=1
				break
			fi
		done
		msg_prefix=

		if [ "$success" -eq 0 ]; then
			msg "error: No parent commit could verify $(git show -s --oneline $commit)"
			exit 1
		fi
	done

	exit 0
}

main $@