Commit 4b0d2bf5d945de34edd37485b4c156c9d8409ad4
Merge pull request #31 into master
TheCharlatan committed on 11/19/2019, 11:55:59 PMParent: b53b89087262d29dec6eb41cf0d562715fd9c5d6
Parent: 8ac63f4f313a1e94636964cb047c9e999e91ba3b
Files changed
| verify-merge.py | changed |
| verify-merge.py | ||
|---|---|---|
| @@ -11,10 +11,10 @@ | ||
| 11 | 11 | def verify(): |
| 12 | 12 | global args, workdir |
| 13 | 13 | if args.import_keys: |
| 14 | 14 | os.chdir('gitian-pubkeys') |
| 15 | - print('Importing pubkeys...') | |
| 16 | - keys = [f for f in glob.glob("*.asc", recursive=True)] | |
| 15 | + print('Importing gpg pubkeys...') | |
| 16 | + keys = [f for f in glob.glob('*.asc', recursive=False)] | |
| 17 | 17 | for key in keys: |
| 18 | 18 | subprocess.check_call([GPG, '--import', key]) |
| 19 | 19 | os.chdir('../') |
| 20 | 20 | if args.refresh_keys: |
| @@ -37,67 +37,67 @@ | ||
| 37 | 37 | exit(1) |
| 38 | 38 | |
| 39 | 39 | print('All signatures verified correctly.\n') |
| 40 | 40 | print('Beginning checksum comparison...\n') |
| 41 | - # Check that the contents between the assertion signers match. This is meant for quick verification, not for validation of their contents | |
| 41 | + # Check that the contents between the assertion signers match. | |
| 42 | + # This is meant for quick verification, not for validation of their contents. | |
| 42 | 43 | # TODO: prevent false positives related to filenames / whitespace / formatting. |
| 43 | 44 | builds = glob.glob(ver_pattern + '*') |
| 44 | 45 | for build in builds: |
| 45 | 46 | first_file = glob.glob(build + '/*/*.assert', recursive=False)[0] |
| 46 | - f = open(first_file, "r") | |
| 47 | + f = open(first_file, 'r') | |
| 47 | 48 | first_file_contents = f.readlines() |
| 48 | 49 | f.close() |
| 49 | 50 | for assert_file in glob.glob(build + '/*/*.assert', recursive=False): |
| 50 | - f = open(assert_file, "r") | |
| 51 | + f = open(assert_file, 'r') | |
| 51 | 52 | assert_file_contents = f.readlines() |
| 52 | 53 | f.close() |
| 53 | 54 | for i in range(len(assert_file_contents)): |
| 54 | - # compare everything in the assertions until the base image manifests | |
| 55 | - if assert_file_contents[i] == "- base_manifests: !!omap\n": | |
| 55 | + # Compare each line in the assertion file until base_manifests: | |
| 56 | + if assert_file_contents[i] == '- base_manifests: !!omap\n': | |
| 56 | 57 | break |
| 57 | - # the OSX SDK may change from time to time | |
| 58 | - if "sdk" in assert_file_contents[i]: | |
| 58 | + # The OSX SDK may change from time to time: | |
| 59 | + if 'sdk' in assert_file_contents[i]: | |
| 59 | 60 | continue |
| 60 | 61 | if assert_file_contents[i] != first_file_contents[i]: |
| 61 | - print("ERROR: Found conflicting contents on line:", i) | |
| 62 | - print(assert_file, ":\n", assert_file_contents[i]) | |
| 63 | - print(first_file, ":\n", first_file_contents[i]) | |
| 62 | + sys.stderr.write('ERROR: Found conflicting contents on line:', i) | |
| 63 | + sys.stderr.write(assert_file + ':\n' + assert_file_contents[i]) | |
| 64 | + sys.stderr.write(first_file + ':\n' + first_file_contents[i]) | |
| 64 | 65 | exit(1) |
| 65 | 66 | |
| 66 | 67 | print('No discrepancies found in assertion files.') |
| 67 | 68 | print('All checks passed.') |
| 68 | 69 | os.chdir(workdir) |
| 69 | 70 | |
| 70 | 71 | def main(): |
| 71 | - host_repo = "git@github.com/monero-project/gitian.sigs" | |
| 72 | + host_repo = 'git@github.com/monero-project/gitian.sigs' | |
| 72 | 73 | global args, workdir |
| 73 | 74 | parser = argparse.ArgumentParser(usage='%(prog)s [options]', description='Use this script to verify the signatures of existing gitian assert files and / or assert files in a specific pull request.') |
| 74 | - parser.add_argument('-p', '--pull_id', dest='pull_id', help='Github Pull request id to check') | |
| 75 | - parser.add_argument('-r', '--remote', dest='remote', default='upstream', help='git remote repository') | |
| 75 | + parser.add_argument('-p', '--pull_id', dest='pull_id', help='GitHub Pull request id to check') | |
| 76 | + parser.add_argument('-r', '--remote', dest='remote', default='upstream', help='The git remote repository') | |
| 76 | 77 | parser.add_argument('-t', '--target-branch', dest='target_branch', default='master', help='Remote repository merge into branch') |
| 77 | 78 | parser.add_argument('-m', '--merge', action='store_true', dest='merge', help='Merge the given pull request id') |
| 78 | - parser.add_argument('-k', '--refresh-keys', action='store_true', dest='refresh_keys', help='refresh all pgp public keys that are currently in the gpg keyring.') | |
| 79 | - parser.add_argument('-i', '--import-keys', action='store_true', dest='import_keys', help='import all public keys in the gitian-pubkeys directory to the gpg keyring.') | |
| 79 | + parser.add_argument('-k', '--refresh-keys', action='store_true', dest='refresh_keys', help='Refresh all public keys that are currently in the gpg keyring.') | |
| 80 | + parser.add_argument('-i', '--import-keys', action='store_true', dest='import_keys', help='Import all public keys in the gitian-pubkeys directory to the gpg keyring.') | |
| 80 | 81 | parser.add_argument('-o', '--no-verify', action='store_true', dest='no_verify', help='Do not run any signature verification') |
| 81 | 82 | parser.add_argument('-v', '--version', dest='version', help='Version number of sigs to be verified (defaults to all versions if not specified).') |
| 82 | 83 | |
| 83 | 84 | args = parser.parse_args() |
| 84 | 85 | |
| 85 | 86 | workdir = os.getcwd() |
| 86 | 87 | if args.pull_id != None: |
| 87 | 88 | # Get branch from remote pull request and compare |
| 88 | - head_branch = args.pull_id+'_head' | |
| 89 | - | |
| 89 | + head_branch = args.pull_id + '_head' | |
| 90 | 90 | subprocess.check_call([GIT, 'fetch', args.remote]) |
| 91 | - subprocess.check_call([GIT, 'checkout', args.remote+'/'+args.target_branch]) | |
| 92 | - subprocess.check_call([GIT, 'fetch','-q', args.remote, 'pull/'+args.pull_id+'/head:'+head_branch]) | |
| 91 | + subprocess.check_call([GIT, 'checkout', args.remote + '/' + args.target_branch]) | |
| 92 | + subprocess.check_call([GIT, 'fetch', '-q', args.remote, 'pull/' + args.pull_id + '/head:' + head_branch]) | |
| 93 | 93 | subprocess.check_call([GIT, 'checkout', '-f', head_branch]) |
| 94 | 94 | if args.merge: |
| 95 | 95 | # Hard reset the target branch to the remote's state and merge the pull request's head branch into it |
| 96 | 96 | subprocess.check_call([GIT, 'checkout', args.target_branch]) |
| 97 | 97 | subprocess.check_call([GIT, 'reset', '--hard', args.remote + '/' + args.target_branch]) |
| 98 | 98 | print('Merging and signing pull request #' + args.pull_id + ' , if you are using a smartcard, confirm the signature now.') |
| 99 | - subprocess.check_call([GIT, 'merge','-q', '--commit', '--no-edit', '-m', 'Merge pull request #'+args.pull_id+' into '+args.target_branch, '--no-ff', '--gpg-sign', head_branch]) | |
| 99 | + subprocess.check_call([GIT, 'merge', '-q', '--commit', '--no-edit', '-m', 'Merge pull request #' + args.pull_id + ' into ' + args.target_branch, '--no-ff', '--gpg-sign', head_branch]) | |
| 100 | 100 | if not args.no_verify: |
| 101 | 101 | verify() |
| 102 | 102 | subprocess.check_call([GIT, 'checkout', 'master']) |
| 103 | 103 | subprocess.check_call([GIT, 'branch', '-D', head_branch]) |
Built with git-ssb-web