Commit Graph

29 Commits

Author SHA1 Message Date
Wladimir J. van der Laan
c0db4fddf0
Merge #13448: Add linter: Make sure we explicitly open all text files using UTF-8 encoding in Python
c8176b3cc7556d7bcec39a55ae4d6ba16453baaa Add linter: Make sure we explicitly open all text files using UTF-8 or ASCII encoding in Python (practicalswift)
634bd970013eca90f4b4c1f9044eec8c97ba62c2 Explicitly specify encoding when opening text files in Python code (practicalswift)

Pull request description:

  Add linter: Make sure we explicitly open all text files using UTF-8 encoding in Python.

  As requested by @laanwj in #13440.

Tree-SHA512: 1651c00fe220ceb273324abd6703aee504029b96c7ef0e3029145901762c733c9b9d24927da281394fd4681a5bff774336c04eed01fafea997bb32192c334c06
2021-05-06 12:06:09 +03:00
Wladimir J. van der Laan
9dac547275
Merge #13066: Migrate verify-commits script to python, run in travis
e5b2cd8e7564b9fc2ed4f63fe49efb0af60b4460 Use python instead of slow shell script on verify-commits (Chun Kuan Lee)

Pull request description:

  The cron job that runs every day would fail because of git checkout a single commit, not a branch.

  #12708 introduce a method to check whether merges are clean.
  However, there are four merges are not clean.
  So, I add a list of merges that are dirty and ignore them.

  Also, I modify the current shell script to python, it makes the script speed up a lot.
  The python code `tree_sha512sum` was copied from `github-merge.py`

  I've re-designed this. Now we verify all the things by default.
  - Add `--disable-tree-check` option, not to check SHA-512 tree
  - Add `--clean-merge NUMBER` option, only verify commits after <NUMBER> days ago

  Travis running time:

  |option|time|
  |-|-|
  |verify-commits.py|[25m47.02s(1547.02s)](https://travis-ci.org/ken2812221/bitcoin/jobs/373321423)|
  |verify-commits.py --disable-tree-check|[19m10.08s(1150.08s)](https://travis-ci.org/ken2812221/bitcoin/jobs/373321423)|
  |verify-commits.py --clean-merge 30|[9m18.18s(558.18s)](https://travis-ci.org/ken2812221/bitcoin/jobs/373321423)|
  |verify-commits.py --disable-tree-check --clean-merge 30|[1m16.51s(76.51s)](https://travis-ci.org/ken2812221/bitcoin/jobs/373321423)|

  Since the cron job always fail, I've created a respository to verify this daily.
   [![Build Status](https://travis-ci.org/ken2812221/bitcoin-verify-commits.svg?branch=master)](https://travis-ci.org/ken2812221/bitcoin-verify-commits)

Tree-SHA512: 476bcf707d92ed3d431ca5642e013036df1506120d3dd2aa718f74240063ce856abd78f4c948336c2a6230dfe5c60c6f2d52d19bdb52d647a1c5f838eaa02e3b
2021-05-06 12:06:09 +03:00
Wladimir J. van der Laan
be4345ce12
Merge #13510: Scripts and tools: Obsolete #!/bin/bash shebang
000000035b20402dea3e8168165cd4eefdc97539 Obsolete #!/bin/bash shebang (DesWurstes)

Pull request description:

  > `#!/bin/bash` assumes it is always installed to `/bin/` which can cause issues
  > `#!/usr/bin/env bash` searches the user's `PATH` to find the `bash` binary

  Details: https://github.com/dylanaraps/pure-bash-bible#obsolete-syntax

  I'm open to comments: Should I also fix `#!/bin/sh`?

Tree-SHA512: b47bb4828116aa119f1899c68fee081270d51a898535490b9c616bf0f3660ad953f29c361eafc759bc64cdd54ee6eeecb2d79e9fdb5291a996a515c719805476
2020-12-18 12:55:45 -06:00
Wladimir J. van der Laan
568b7e1c0c
Merge #12822: Revert 7deba93bdc and fix expired-key-sigs properly
9471576 [verify-commits] Add some additional useful documentation. (Matt Corallo)
de7e931 Add Marco-expired-key-signed-commits to allow-revsig-commits (Matt Corallo)
99f6d48 Revert "test: Update trust git root". (Matt Corallo)

Pull request description:

  7deba93bdc was took the wrong approach to updating verify-commits for a key expiration. Namely, adding each commit to allow-revsig-commits should have been done instead, allowing them to still be validated, but with the expired key.

Tree-SHA512: 9fdc67eda8f6daa95082f6c1a2af81beb730a9ff3f8cf930bb2311fe29b5f05e1f89259aba5f112153ca2e9c62577cf60d31b4c8e9ac1bf3f5506e78f8401378
Signed-off-by: pasta <pasta@dashboost.org>

# Conflicts:
#	contrib/verify-commits/allow-revsig-commits
2020-10-22 11:36:39 -04:00
UdjinM6
f7218d1899 Make shellcheck happy 2020-07-29 11:20:12 -05:00
UdjinM6
35fbb5992f More of "export LC_ALL=C" 2020-07-29 11:04:30 -05:00
Wladimir J. van der Laan
cb5d0d8b99 Merge #13454: Make sure LC_ALL=C is set in all shell scripts
47776a958b08382d76d69b5df7beed807af168b3 Add linter: Make sure all shell scripts opt out of locale dependence using "export LC_ALL=C" (practicalswift)
3352da8da1243c03fc83ba678d2f5d193bd5a0c2 Add "export LC_ALL=C" to all shell scripts (practicalswift)

Pull request description:

  ~~Make sure `LC_ALL=C` is set when using `grep` range expressions.~~

  Make sure `LC_ALL=C` is set in all shell scripts.

  From the `grep(1)` documentation:

  > Within a bracket expression, a range expression consists of two characters separated by a hyphen. It matches any single character that sorts between the two characters, inclusive, using the locale's collating sequence and character set. For example, in the default C locale, `[a-d]` is equivalent to `[abcd]`. Many  locales sort characters in dictionary order, and in these locales `[a-d]` is typically not equivalent to `[abcd]`; it might be equivalent to `[aBbCcDd]`, for example. To obtain the traditional interpretation of bracket expressions, you can use the C locale by setting the `LC_ALL` environment variable to the value C.

  Context: [Locale issue found when reviewing #13450](https://github.com/bitcoin/bitcoin/pull/13450/files#r194877736)

Tree-SHA512: fd74d2612998f9b49ef9be24410e505d8c842716f84d085157fc7f9799d40e8a7b4969de783afcf99b7fae4f91bbb4559651f7dd6578a6a081a50bdea29f0909
2020-07-28 21:35:31 -05:00
Wladimir J. van der Laan
3979f24d3f Merge #13479: contrib: Fix CVE-2018-12356 by hardening the regex
9e2e5626dabb7208dafedcc9904940b666be1c3b Fix CVE-2018-12356 by hardening the regex. (Loganaden Velvindron)

Pull request description:

  Detailed write-up here:
  https://neopg.io/blog/pass-signature-spoof/

Tree-SHA512: 2020474ff4c7b5e7f1bea932c63da62aca48d3dc6dcd04507afefad6c40f2977ed2d2916defe2e8e7936a2d498125c578077870147954a7af9b29b823cbb0b10
2020-07-07 11:48:28 -05:00
UdjinM6
7d75dbda22 More of 10773 2020-04-01 12:43:18 -05:00
Pieter Wuille
a7a3ecc354 Merge #10773: Shell script cleanups
13a81b19d Add quotes to variable assignment (as requested by @TheBlueMatt) (practicalswift)
683b9d280 Fix valid path output (practicalswift)
193c2fb4c Use bash instead of POSIX sh. POSIX sh does not support arrays. (practicalswift)
80f5f28d3 Fix incorrect quoting of quotes (the previous quotes had no effect beyond unquoting) (practicalswift)
564a172df Add required space to [[ -n "$1" ]] (previously [[ -n"$1" ]]) (practicalswift)
1e44ae0e1 Add error handling: exit if cd fails (practicalswift)
b9e79ab41 Remove "\n" from echo argument. echo does not support escape sequences. (practicalswift)
f6b3382fa Remove unused variables (practicalswift)

Pull request description:

  Shell script cleanups:
  * Add required space to `[ -n ]`.
  * Avoid quote within quote.
  * Exit if `cd` fails.
  * Remove `\n` which is not handled by `echo`.
  * ~~Remove redundant `$` in arithmetic variable expression.~~
  * ~~Use `$(command)` instead of legacy form `` `command` ``.~~
  * Arrays are not supported in POSIX `sh`. Use `bash` when arrays are used.
  * ~~`[ foo -a bar ]` is not well defined, use `[ foo ] && [ bar ]` instead.~~
  * ~~`[ foo -o bar ]` is not well defined, use `[ foo ] || [ bar ]` instead.~~

Tree-SHA512: 80f6ded58bce625b15b4da30d69d2714c633e184e62b21ed67d2c58e2ebaa08b4147593324012694d02bf4f1f252844cdff2fd1cf5e817ddb07e2777db7a6390
2020-04-01 12:43:18 -05:00
Pieter Wuille
f32949fa91
Merge #11834: [verify-commits] Fix gpg.sh's echoing for commits with '\n'
a38686cea [verify-commits] Fix gpg.sh's echoing for commits with '\n' (Matt Corallo)

Pull request description:

  Should fix master travis failures

Tree-SHA512: 1e96476e4db0474f1dc2c6973cdb1154316b7cec13d3fe46f3383cfe4f1ed30c2eee08a0d047931f20b2fa83baaacb4687f39e1cab6f264009cd0292134facdd
2020-01-30 07:32:32 -06:00
Wladimir J. van der Laan
e357bda75b
Merge #11467: Fix typos. Use nullptr instead of NULL.
0aacfa4 Remove accidental stray semicolon (practicalswift)
68feb49 Use nullptr instead of NULL (practicalswift)
c6b07fd Fix a vs. an typo (practicalswift)

Pull request description:

  Minor cleanups:
  * Typo: Fix a vs. an typo
  * Typo: Remove accidental stray semicolon (only remaining instance in repo)
  * Correctness/consistency: Use `nullptr` instead of `NULL` (only remaining instance in repo)

Tree-SHA512: 47142e557da9d3fa0b532c46edeb7f356a1f6dc5973e60b0e496badff3581ff696eade542d49da777ac7f2e895129cc8487ccdb1984ff828434fa86f9a56dad0
2020-01-16 09:22:46 -06:00
Wladimir J. van der Laan
7919c96818 Merge #11539: [verify-commits] Allow revoked keys to expire
d23be30 [verify-commits] Allow revoked keys to expire (Matt Corallo)

Pull request description:

  This should fix verify-commits on master.

Tree-SHA512: 9bfca41fdfcdb11f6d07fcbc80a7b2de37706051e963292e0fbb4c608f146c87b65ab1e8395792197b4a7099e89fa045f278a60276672f6540b68d5e15b5a4a7
2019-09-30 08:33:16 +02:00
Pasta
c3eb0c7887 reset file perms 2019-02-26 16:50:25 -06:00
Wladimir J. van der Laan
c55e019bf7 Merge #9940: Fix verify-commits on OSX, update for new bad Tree-SHA512, point travis to different keyservers
df5bae2 Update trusted-sha512-root-commit for new bad tree hash (Matt Corallo)
efc06c2 If GNU sha512sum is missing, try perl shasum in verify-commits (Matt Corallo)
8ed849f Fix travis failing to fetch keys from the sks keyserver pool (Matt Corallo)
fd5e905 Make verify-commits.sh non-recursive (Matt Corallo)

Tree-SHA512: 457cc81d6e0a77ab32d030ecd058c59857f22cb998a1394593e115639081f3fdc74a6376035b77be0712ad5cb9143bc3f498b77e99eb66034492dbbb38c39bc6
2019-02-26 16:41:05 -06:00
UdjinM6
0b552be20b
Fix file permissions broken in 2682 (#2717) 2019-02-20 12:03:48 +03:00
Wladimir J. van der Laan
8a436ec36a Merge #9932: Fix verify-commits on travis and always check top commit's tree
b3ec305 Fix bashisms in verify-commits and always check top commit's tree (Matt Corallo)
f20e664 Check gpg version before setting --weak-digest (Matt Corallo)

Tree-SHA512: f87247008ae6a265e3fd371f00aec0e84f1feb713bf5859eab139a88a4e205e1f26de7b510bcc2c3ab538d5443978a48ec920d25b52b9601e625d198fa2d725f
2019-02-04 19:58:15 -06:00
Wladimir J. van der Laan
6addbe0747 Merge #9880: Verify Tree-SHA512s in merge commits, enforce sigs are not SHA1
bbd7579 Fix regsig checking for subkey sigs in verify-commits (Matt Corallo)
d025bc7 Allow any subkey in verify-commits (Matt Corallo)
eddc77a Add comment re: why SHA1 is disabled (Peter Todd)
d9c450f Verify Tree-SHA512s in merge commits, enforce sigs are not SHA1 (Matt Corallo)
be908a6 Fail merge if there are any symlinks (Matt Corallo)

Tree-SHA512: bb66c59cc1c6b1c86d7d8be7adb0769c6598c0e28ad927409941f30af87d390521e82fc13700ee22e92db1bd571db3e19a152ec7b2c0349c6e06f5de62c0b65f
2019-02-04 19:58:07 -06:00
UdjinM6
1c9917e227
Fix CVE-2018-12356 by hardening the regex (#2126) 2018-06-18 19:08:27 +03:00
Wladimir J. van der Laan
a5a9e46042 Merge #8700: [copyright] add MIT license headers to .sh scripts where missing
0766d1c [copyright] add MIT license headers to .sh scripts where missing (isle2983)
2018-01-11 13:20:57 +01:00
Wladimir J. van der Laan
573d9314e8 Merge #7713: Fixes for verify-commits script
1e9aab0 Remove sipa's old revoked key from verify-commits (Peter Todd)
966151e Add README for verify-commits (Peter Todd)
11164ec Remove keys that are no longer used for merging (Peter Todd)
22421fa Remove pointless warning (Peter Todd)
9523e8a Make verify-commits path-independent (Matt Corallo)
f7d4a25 Make verify-commits POSIX-compliant (Matt Corallo)
2017-12-28 11:44:59 +01:00
UdjinM6
b3d1140800 more bitcoin->dash 2016-03-04 12:09:03 +03:00
Jonas Schnelli
a5bc8de1ba
add jonasschnellis key to git-verify-commits trusted-keys 2015-11-13 14:52:17 +01:00
Matt Corallo
9ea7762e2c Use Pieter's signing subkey instead of his primary key
This commit is signed.
2015-11-06 15:19:31 -08:00
Matt Corallo
6e800c2b41
Add Pieter's new PGP key to verify-commits/trusted-keys 2015-10-27 17:06:13 -07:00
Matt Corallo
1d94b72019 Whitelist commits signed with Pieter's now-revoked key 2015-10-23 02:05:42 -07:00
Matt Corallo
27252b7389 Fix pre-push-hook regexes 2015-10-22 19:50:01 -07:00
Matt Corallo
0186228d61 Update trusted-git-root to the most recent unsigned commit 2015-09-14 12:54:25 -04:00
Matt Corallo
adaa568722 Add script to verify all merge commits are signed 2014-12-20 00:39:42 -05:00