linux-kernel - Re: [PATCH] scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Nov 2018 12:43:33 -0800
From:   Guenter Roeck <linux@...ck-us.net>
To:     Brian Norris <briannorris@...omium.org>
Cc:     Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Douglas Anderson <dianders@...omium.org>,
        Genki Sky <sky@...ki.is>,
        Christian Kujau <lists@...dbynature.de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] scripts/setlocalversion: Improve -dirty check with
 git-status --no-optional-locks

On Fri, Nov 09, 2018 at 10:34:37AM -0800, Brian Norris wrote:
> git-diff-index does not refresh the index for you, so using it for a
> "-dirty" check can give misleading results. Commit 6147b1cf19651
> ("scripts/setlocalversion: git: Make -dirty check more robust") tried to
> fix this by switching to git-status, but it overlooked the fact that
> git-status also writes to the .git directory of the source tree, which
> is definitely not kosher for an out-of-tree (O=) build. That is getting
> reverted.
> 
> Fortunately, git-status now supports avoiding writing to the index via
> the --no-optional-locks flag, as of git 2.14. It still calculates an
> up-to-date index, but it avoids writing it out to the .git directory.
> 
> So, let's retry the solution from commit 6147b1cf19651 using this new
> flag first, and if it fails, we assume this is an older version of git
> and just use the old git-diff-index method.
> 
> Cc: Genki Sky <sky@...ki.is>
> Cc: Christian Kujau <lists@...dbynature.de>
> Cc: Guenter Roeck <linux@...ck-us.net>
> Signed-off-by: Brian Norris <briannorris@...omium.org>

Working for me with git v2.7.4.

Tested-by: Guenter Roeck <linux@...ck-us.net>

> ---
> On Fri, Nov 09, 2018 at 11:55:26AM +0900, Masahiro Yamada wrote:
> > > On Wed, Nov 7, 2018 at 1:18 PM Doug Anderson <dianders@...omium.org> wrote:
> > > > On Wed, Nov 7, 2018 at 1:07 PM Genki Sky <sky@...ki.is> wrote:
> > > > > On Wed, 7 Nov 2018 12:55:14 -0800, Guenter Roeck <linux@...ck-us.net> wrote:
> > > > > > Ubuntu 16.04 ships with git version 2.7.4.
> > > > >
> > > > > Okay. I guess --no-optional-locks is a no-go then.
> > > >
> > > > In theory you could wrap it.  If passing git with
> > > > "--no-optional-locks" doesn't work you could fall back to the old
> > > > code?  That would mean only people with newer git would get your new
> > > > feature and everyone else would stick with the pre-existing behavior.
> > >
> > > +1, that's what I was going to suggest. Presumably older git would
> > > give non-zero exit status for unknown flags, and we take that as
> > > signal to try to the old way?
> > 
> > I also like this idea!
> > 
> > I will pick-up this revert patch soon.
> > 
> > 
> > Brian,
> > Could you please send a patch on top of that?
> 
> Done.
> 
> It's not supremely beautiful, but I believe it works. I tested with new
> git, and with a faked git wrapper that rejects --no-optional-locks,
> dumps an error to stderr, and returns a non-zero exit code. I don't
> happen to have an older copy of git lying around at the moment...
> 
>  scripts/setlocalversion | 15 +++++++++++++--
>  1 file changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/scripts/setlocalversion b/scripts/setlocalversion
> index 71f39410691b..eab1f90de50d 100755
> --- a/scripts/setlocalversion
> +++ b/scripts/setlocalversion
> @@ -73,8 +73,19 @@ scm_version()
>  			printf -- '-svn%s' "`git svn find-rev $head`"
>  		fi
>  
> -		# Check for uncommitted changes
> -		if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
> +		# Check for uncommitted changes.
> +		# First, with git-status, but --no-optional-locks is only
> +		# supported in git >= 2.14, so fall back to git-diff-index if
> +		# it fails. Note that git-diff-index does not refresh the
> +		# index, so it may give misleading results. See
> +		# git-update-index(1), git-diff-index(1), and git-status(1).
> +		local git_status
> +		git_status="$(git --no-optional-locks status -uno --porcelain 2>/dev/null)"
> +		if [ $? -eq 0 ]; then
> +			if echo "$git_status" | grep -qv '^.. scripts/package'; then
> +				printf '%s' -dirty
> +			fi
> +		elif git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
>  			printf '%s' -dirty
>  		fi
>  
> -- 
> 2.19.1.930.g4563a0d9d0-goog