linux-kernel - Re: linux-next: Signed-off-by missing for commits in Linus' tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202102241324.E784B6A0@keescook>
Date:   Wed, 24 Feb 2021 13:30:01 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Stephen Rothwell <sfr@...b.auug.org.au>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Next Mailing List <linux-next@...r.kernel.org>,
        Linus Walleij <linus.walleij@...aro.org>,
        Jonathan Corbet <corbet@....net>,
        Greg KH <gregkh@...uxfoundation.org>
Subject: Re: linux-next: Signed-off-by missing for commits in Linus' tree

On Wed, Feb 24, 2021 at 11:49:42AM +1100, Stephen Rothwell wrote:
> Hi Linus,
> 
> On Tue, 23 Feb 2021 16:33:47 -0800 Linus Torvalds <torvalds@...ux-foundation.org> wrote:
> >
> > On Tue, Feb 23, 2021 at 4:31 PM Stephen Rothwell <sfr@...b.auug.org.au> wrote:
> > >
> > > are missing a Signed-off-by from their committer.  
> > 
> > Gaah. Maybe I should do some pre-pull hook or something to notice this
> > automatically (like you clearly do).
> 
> I have attached the scripts I run over things after fetching them, but
> before merging them (so not a hook, sorry).  check_commits runs
> check_fixes - but just for my convenience.
> 
> -- 
> Cheers,
> Stephen Rothwell

Based on the pre-push.sample file, here is what I've added to my
.git/hooks/pre-push hook:


z40=0000000000000000000000000000000000000000

while read local_ref local_sha remote_ref remote_sha
do
        if [ "$local_sha" = $z40 ]
        then
                # Handle delete
                :
        else
                if [ "$remote_sha" = $z40 ]
                then
                        # New branch, examine all commits
                        range="$local_sha"
                else
                        # Update to existing branch, examine new commits
                        range="$remote_sha..$local_sha"
                fi

                if ! $HOME/bin/check_commits "$range"; then
                        exit 1
                fi
        fi
done

(and I modified check_fixes and check_commits to exit non-zero on failure)


I wonder if we need this in Documentation/maintainer/configure-git.rst
and to put check_commits and check_fixes into tools/ somewhere?

(Though goodness, please never aim your hook at your tree's tools/
directory.)

-- 
Kees Cook