Convert flashrom to git

 - Drop support for Subversion in the getrevision script and Makefile.
 - Refinement of getrevision to have a single function determining the
   new flashrom version string (based on git describe).
 - Add .gitignore and .gitattributes file (the latter to limit exports).
 - Restore modification dates of the exported files from the VCS.
 - Stop exporting VCS log dumps to CHANGELOG. This makes no sense.
 - Export VCS metadata needed by the Makefile to versioninfo.inc
 - Do not export the pre-"compiled" manpage. It can be generated like
   anything else from the code dump with versioninfo.inc
 - Add some initial client-side git hooks that get installed automatically
   on make runs:
   * pre-commit:
     - test for whitespace errors via git diff-index --check
   * commit-msg:
     - Use the up to date hook from gerrit to add Change-Id tags.
       Unlike the upstream hook, add them to fixup/squash changes too
       to allow for our staging process.
     - Test for duplicate sign-offs/acks.
   * When pushing to one of the upstream repositories check mandatory rules:
      - existing signoffs and acks in all new commits
      - no deletions of branches
      - no new branches other than versioned branches (e.g., 0.0.x)
      - no history rewriting of branches
 - Various other small refinements, bikesheddings and cosmetic changes to
   slow down progress of flashrom and humanity as a whole.

Original-Change-Id: I64eef21982cac0a0a7419bcd2c8a936672ae9cb2
Original-Reviewed-on: https://review.coreboot.org/19206
Original-Reviewed-by: Nico Huber <nico.h@gmx.de>
Original-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Change-Id: I325edb7d9890c412a44ecacb5161268d3dbccc57
Signed-off-by: Stefan Tauner <stefan.tauner@gmx.at>
Signed-off-by: David Hendricks <dhendricks@fb.com>
Signed-off-by: Nico Huber <nico.h@gmx.de>
Reviewed-on: https://review.coreboot.org/21923
Acked-by: Stefan Tauner <stefan.tauner@gmx.at>

12 files changed, 441 insertions, 133 deletions

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 000000000..10f89626d
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,5 @@
+.gitattributes export-ignore
+.gitignore export-ignore
+/util/getrevision.sh export-ignore
+/util/git-hooks export-ignore
+/util/git-hooks/** export-ignore
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..19a4365ee
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,15 @@
+*.d
+*.o
+/.features
+/.dependencies
+/.libdeps
+/build_details.txt
+/flashrom
+/flashrom-*
+/flashrom.exe
+/flashrom.8
+
+/util/ich_descriptors_tool/ich_descriptors_tool
+/util/ich_descriptors_tool/ich_descriptors_tool.exe
+/util/ich_descriptors_tool/.dep
+/util/ich_descriptors_tool/.obj
diff --git a/Makefile b/Makefile
index 4ebde1efb..984c60c18 100644
--- a/Makefile
+++ b/Makefile
@@ -526,23 +526,23 @@ LIB_OBJS = layout.o flashrom.o udelay.o programmer.o helpers.o
 
 CLI_OBJS = cli_classic.o cli_output.o cli_common.o print.o
 
-# Set the flashrom version string from the highest revision number of the checked out flashrom files.
-# Note to packagers: Any tree exported with "make export" or "make tarball"
-# will not require subversion. The downloadable snapshots are already exported.
-SVNVERSION := $(shell ./util/getrevision.sh -u 2>/dev/null )
+# versioninfo.inc stores metadata required to build a packaged flashrom. It is generated by the export rule and
+# imported below. If versioninfo.inc is not found and the variables are not defined by the user, the info will
+# be obtained using util/getrevision.sh, which is the common case during development.
+-include versioninfo.inc
+VERSION ?= $(shell ./util/getrevision.sh --revision)
+MAN_DATE ?= $(shell ./util/getrevision.sh --date $(PROGRAM).8.tmpl 2>/dev/null)
 
-RELEASE := 0.9.9
-VERSION := $(RELEASE)-$(SVNVERSION)
-RELEASENAME ?= $(VERSION)
+SCMDEF := -D'FLASHROM_VERSION="$(VERSION)"'
 
-SVNDEF := -D'FLASHROM_VERSION="$(VERSION)"'
+# No spaces in release names unless set explicitly
+RELEASENAME ?= $(shell echo "$(VERSION)" | sed -e 's/ /_/')
 
-# Inform user if there is no meaningful version string. If there is version information from a VCS print
-# something anyway because $(info...) will print a line break in any case which would look suspicious.
-# The && between the echos is a workaround for old versions of GNU make that issue the error "unterminated
-# variable reference" if a semicolon is used instead.
-$(info $(shell ./util/getrevision.sh -c 2>/dev/null || echo "Files don't seem to be under version control." && \
-	echo "Replacing all version templates with $(VERSION)." ))
+# Inform user of the version string
+$(info Replacing all version templates with $(VERSION).)
+
+# If a VCS is found then try to install hooks.
+$(shell ./util/getrevision.sh -c 2>/dev/null && ./util/git-hooks/install.sh)
 
 ###############################################################################
 # Default settings of CONFIG_* variables.
@@ -1024,7 +1024,7 @@ libflashrom.a: $(LIBFLASHROM_OBJS)
 TAROPTIONS = $(shell LC_ALL=C tar --version|grep -q GNU && echo "--owner=root --group=root")
 
 %.o: %.c .features
-	$(CC) -MMD $(CFLAGS) $(CPPFLAGS) $(FLASHROM_CFLAGS) $(FEATURE_CFLAGS) $(SVNDEF) -o $@ -c $<
+	$(CC) -MMD $(CFLAGS) $(CPPFLAGS) $(FLASHROM_CFLAGS) $(FEATURE_CFLAGS) $(SCMDEF) -o $@ -c $<
 
 # Make sure to add all names of generated binaries here.
 # This includes all frontends and libflashrom.
@@ -1349,7 +1349,7 @@ $(PROGRAM).8.html: $(PROGRAM).8
 
 $(PROGRAM).8: $(PROGRAM).8.tmpl
 	@# Add the man page change date and version to the man page
-	@sed -e 's#.TH FLASHROM 8 ".*".*#.TH FLASHROM 8 "$(shell ./util/getrevision.sh -d $(PROGRAM).8.tmpl 2>/dev/null)" "$(VERSION)"#' <$< >$@
+	@sed -e 's#.TH FLASHROM 8 ".*".*#.TH FLASHROM 8 "$(MAN_DATE)" "$(VERSION)"#' <$< >$@
 
 install: $(PROGRAM)$(EXEC_SUFFIX) $(PROGRAM).8
 	mkdir -p $(DESTDIR)$(PREFIX)/sbin
@@ -1357,25 +1357,42 @@ install: $(PROGRAM)$(EXEC_SUFFIX) $(PROGRAM).8
 	$(INSTALL) -m 0755 $(PROGRAM)$(EXEC_SUFFIX) $(DESTDIR)$(PREFIX)/sbin
 	$(INSTALL) -m 0644 $(PROGRAM).8 $(DESTDIR)$(MANDIR)/man8
 
-export: $(PROGRAM).8
-	@rm -rf $(EXPORTDIR)/flashrom-$(RELEASENAME)
-	@svn export -r BASE . $(EXPORTDIR)/flashrom-$(RELEASENAME)
-	@sed "s/^SVNVERSION.*/SVNVERSION := $(SVNVERSION)/" Makefile >$(EXPORTDIR)/flashrom-$(RELEASENAME)/Makefile
-	@cp $(PROGRAM).8 "$(EXPORTDIR)/flashrom-$(RELEASENAME)/$(PROGRAM).8"
-	@svn log >$(EXPORTDIR)/flashrom-$(RELEASENAME)/ChangeLog
-	@echo Exported $(EXPORTDIR)/flashrom-$(RELEASENAME)/
-
-tarball: export
-	@tar cjf $(EXPORTDIR)/flashrom-$(RELEASENAME).tar.bz2 -C $(EXPORTDIR)/ $(TAROPTIONS) flashrom-$(RELEASENAME)/
-	@rm -rf $(EXPORTDIR)/flashrom-$(RELEASENAME)
-	@echo Created $(EXPORTDIR)/flashrom-$(RELEASENAME).tar.bz2
+_export: $(PROGRAM).8
+	@rm -rf "$(EXPORTDIR)/flashrom-$(RELEASENAME)"
+	@mkdir -p "$(EXPORTDIR)/flashrom-$(RELEASENAME)"
+	@git archive HEAD | tar -x -C "$(EXPORTDIR)/flashrom-$(RELEASENAME)"
+#	Generate versioninfo.inc containing metadata that would not be available in exported sources otherwise.
+	@echo "VERSION = $(VERSION)" > "$(EXPORTDIR)/flashrom-$(RELEASENAME)/versioninfo.inc"
+	@echo "MAN_DATE = $(MAN_DATE)" >> "$(EXPORTDIR)/flashrom-$(RELEASENAME)/versioninfo.inc"
+#	Restore modification date of all tracked files not marked 'export-ignore' in .gitattributes.
+#	sed is required to filter out file names having the attribute set.
+#	The sed program saves the file name in the hold buffer and then checks if the respective value is 'set'.
+#	If so it ignores the rest of the program, which otherwise restores the file name and prints it.
+	@git ls-tree -r -z -t --full-name --name-only HEAD | \
+		git check-attr -z --stdin export-ignore | \
+		sed -zne 'x;n;n;{/^set$$/b;};x;p;' | \
+		xargs -0 sh -c 'for f; do \
+			touch -d $$(git log --pretty=format:%cI -1 HEAD -- "$$f") \
+				"$(EXPORTDIR)/flashrom-$(RELEASENAME)/$$f"; \
+		done' dummy_arg0
+
+export: _export
+	@echo "Exported $(EXPORTDIR)/flashrom-$(RELEASENAME)/"
+
+tarball: _export
+	@tar -cz --format=ustar -f "$(EXPORTDIR)/flashrom-$(RELEASENAME).tar.gz" -C $(EXPORTDIR)/ \
+		$(TAROPTIONS) "flashrom-$(RELEASENAME)/"
+#	Delete the exported directory again because it is most likely what's expected by the user.
+	@rm -rf "$(EXPORTDIR)/flashrom-$(RELEASENAME)"
+	@echo Created "$(EXPORTDIR)/flashrom-$(RELEASENAME).tar.gz"
 
 djgpp-dos: clean
 	make CC=i586-pc-msdosdjgpp-gcc STRIP=i586-pc-msdosdjgpp-strip
+
 libpayload: clean
 	make CC="CC=i386-elf-gcc lpgcc" AR=i386-elf-ar RANLIB=i386-elf-ranlib
 
-.PHONY: all install clean distclean compiler hwlibs features export tarball djgpp-dos featuresavailable libpayload
+.PHONY: all install clean distclean compiler hwlibs features _export export tarball featuresavailable libpayload
 
 # Disable implicit suffixes and built-in rules (for performance and profit)
 .SUFFIXES:
diff --git a/flashrom.c b/flashrom.c
index 25e53f20c..1a433036c 100644
--- a/flashrom.c
+++ b/flashrom.c
@@ -1801,7 +1801,7 @@ void print_buildinfo(void)
 
 void print_version(void)
 {
-	msg_ginfo("flashrom v%s", flashrom_version);
+	msg_ginfo("flashrom %s", flashrom_version);
 	print_sysinfo();
 	msg_ginfo("\n");
 }
diff --git a/util/getrevision.sh b/util/getrevision.sh
index 101205860..80812b457 100755
--- a/util/getrevision.sh
+++ b/util/getrevision.sh
@@ -1,11 +1,12 @@
 #!/bin/sh
+# NB: Supposed to be POSIX compatible but at least the usage of 'local' is not.
 #
 # This file is part of the flashrom project.
 #
 # Copyright (C) 2005 coresystems GmbH <stepan@coresystems.de>
 # Copyright (C) 2009,2010 Carl-Daniel Hailfinger
 # Copyright (C) 2010 Chromium OS Authors
-# Copyright (C) 2013 Stefan Tauner
+# Copyright (C) 2013-2016 Stefan Tauner
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -31,30 +32,24 @@ export LC_ALL=C
 export TZ=UTC0
 
 # Helper functions
-# First argument is the path to inspect (usually optional; w/o it the whole repository will be considered)
-svn_has_local_changes() {
-	svn status "$1" | egrep '^ *[ADMR] *' >/dev/null
-}
-
+# First argument is the path to inspect (usually optional; without
+# it the whole repository will be considered)
 git_has_local_changes() {
 	git update-index -q --refresh >/dev/null
 	! git diff-index --quiet HEAD -- "$1"
 }
 
 git_last_commit() {
+	# git rev-parse --short HEAD would suffice if repository as a whole is of interest (no $1)
 	git log --pretty=format:"%h" -1 -- "$1"
 }
 
-svn_is_file_tracked() {
-	svn info "$1" >/dev/null 2>&1
-}
-
 git_is_file_tracked() {
 	git ls-files --error-unmatch -- "$1" >/dev/null 2>&1
 }
 
 is_file_tracked() {
-	svn_is_file_tracked "$1" || git_is_file_tracked "$1"
+	git_is_file_tracked "$1"
 }
 
 # Tries to find a remote source for the changes committed locally.
@@ -62,7 +57,7 @@ is_file_tracked() {
 # Takes one optional argument: the path to inspect
 git_url() {
 	last_commit=$(git_last_commit "$1")
-	# get all remote branches containing the last commit (excluding origin/HEAD and git-svn branches/tags)
+	# get all remote branches containing the last commit (excluding origin/HEAD)
 	branches=$(git branch -r --contains $last_commit | sed '/\//!d;/.*->.*/d;s/[\t ]*//')
 	if [ -z "$branches" ] ; then
 		echo "No remote branch contains a suitable commit">&2
@@ -84,18 +79,12 @@ git_url() {
 	echo "$(git ls-remote --exit-code --get-url ${target%/*}) ${target#*/}"
 }
 
-# Returns a string indicating where others can get the current source code (excluding uncommitted changes)
+# Returns a string indicating where others can get the current source code (excluding uncommitted changes).
 # Takes one optional argument: the path to inspect
 scm_url() {
 	local url=
 
-	# for a primitive VCS like subversion finding the URL is easy: there is only one upstream host
-	if svn_is_file_tracked "$1" ; then
-		url="$(svn info "$1" 2>/dev/null |
-		       grep URL: |
-		       sed 's/.*URL:[[:blank:]]*//;s/:\/\/.*@/:\/\//' |
-		       grep ^.)"
-	elif git_is_file_tracked "$1" ; then
+	if git_is_file_tracked "$1" ; then
 		url="$(git_url "$1")"
 	else
 		return ${EXIT_FAILURE}
@@ -116,29 +105,7 @@ timestamp() {
 	# freebsd	date [-jnu]  [-d dst] [-r seconds] [-f fmt date | [[[[[cc]yy]mm]dd]HH]MM[.ss]] [+format] [...]
 	# dragonflybsd	date [-jnu]  [-d dst] [-r seconds] [-f fmt date | [[[[[cc]yy]mm]dd]HH]MM[.ss]] [+format] [...]
 	# openbsd	date [-aju]  [-d dst] [-r seconds] [+format] [[[[[[cc]yy]mm]dd]HH]MM[.SS]] [...]
-	if svn_is_file_tracked "$2" ; then
-		if svn_has_local_changes "$2"; then
-			t=$(date -u "$1")
-		else
-			# No local changes, get date of the last log record. Subversion provides that in
-			# ISO 8601 format when using the --xml switch. The sed call extracts that ignoring any
-			# fractional parts started by a comma or a dot.
-			local last_commit_date="$(svn info --xml "$2"| \
-						  sed -n -e 's/<date>\([^,\.]*\)\([\.,].*\)*Z<\/date>/\1Z/p')"
-
-			case $(uname) in
-			# Most BSD dates do not support parsing date values from user input with -d but all of
-			# them support parsing the syntax with [[[[[[cc]yy]mm]dd]HH]MM[.ss]]. We have to
-			# transform the ISO8601 date first though.
-			NetBSD|OpenBSD|DragonFly|FreeBSD)
-				last_commit_date="$(echo ${last_commit_date} | \
-				   sed -n -e 's/\(....\)-\(..\)-\(..\)T\(..\):\(..\):\(..\)Z/\1\2\3\4\5\.\6/p')"
-				t=$(date -u -j "${last_commit_date}" "$1" 2>/dev/null);;
-			*)
-				t=$(date -u -d "${last_commit_date}" "$1" 2>/dev/null);;
-			esac
-		fi
-	elif git_is_file_tracked "$2" ; then
+	if git_is_file_tracked "$2" ; then
 		# are there local changes?
 		if git_has_local_changes "$2" ; then
 			t=$(date -u "${1}")
@@ -163,55 +130,17 @@ timestamp() {
 	echo "${t}"
 }
 
-# Retrieve local SCM revision info. This is useful if we're working in a different SCM than upstream and/or
-# have local changes.
-local_revision() {
-	local r=
-
-	if svn_is_file_tracked "$1" ; then
-		r=$(svn_has_local_changes "$1" && echo "dirty")
-	elif git_is_file_tracked "$1" ; then
-		r=$(git_last_commit "$1")
-
-		local svn_base=$(git log --grep=git-svn-id -1 --format='%h')
-		if [ "$svn_base" != "" ] ; then
-			local diff_to_svn=$(git rev-list --count ${svn_base}..${r})
-			if [ "$diff_to_svn" -gt 0 ] ; then
-				r="$r-$diff_to_svn"
-			fi
-		fi
-
+revision() {
+	local r
+	if git_is_file_tracked "$1" ; then
+		r=$(git describe $(git_last_commit "$1"))
 		if git_has_local_changes "$1" ; then
 			r="$r-dirty"
 		fi
 	else
-		return ${EXIT_FAILURE}
-	fi
-
-	echo "${r}"
-}
-
-# Get the upstream flashrom revision stored in SVN metadata.
-upstream_revision() {
-	local r=
-
-	if svn_is_file_tracked "$1" ; then
-		r=$(svn info "$1" 2>/dev/null | \
-		    grep "Last Changed Rev:" | \
-		    sed -e "s/^Last Changed Rev: *//" -e "s/\([0-9]*\).*/r\1/" | \
-		    grep "r[0-9]")
-	elif git_is_file_tracked "$1" ; then
-		# If this is a "native" git-svn clone we could use git svn log:
-		# git svn log --oneline -1 | sed 's/^r//;s/[[:blank:]].*//' or even git svn find-rev
-		# but it is easier to just grep for the git-svn-id unconditionally
-		r=$(git log --grep=git-svn-id -1 -- "$1" | \
-		    grep git-svn-id | \
-		    sed 's/.*@/r/;s/[[:blank:]].*//')
+		r="unknown"
 	fi
 
-	if [ -z "$r" ]; then
-		r="unknown" # default to unknown
-	fi
 	echo "${r}"
 }
 
@@ -228,10 +157,9 @@ Commands
         this message
     -c or --check
         test if path is under version control at all
-    -l or --local
-        local revision information including an indicator for uncommitted changes
-    -u or --upstream
-        upstream revision
+    -r or --revision
+        return unique revision information including an indicator for
+        uncommitted changes
     -U or --url
         URL associated with the latest commit
     -d or --date
@@ -260,14 +188,6 @@ main() {
 		-h|--help)
 			action=show_help;
 			shift;;
-		-l|--local)
-			check_action $1
-			action=local_revision
-			shift;;
-		-u|--upstream)
-			check_action $1
-			action=upstream_revision
-			shift;;
 		-U|--url)
 			check_action $1
 			action=scm_url
@@ -276,13 +196,17 @@ main() {
 			check_action $1
 			action="timestamp +%Y-%m-%d" # refrain from suffixing 'Z' to indicate it's UTC
 			shift;;
+		-r|--revision)
+			check_action $1
+			action=revision
+			shift;;
 		-t|--timestamp)
 			check_action $1
 			action="timestamp +%Y-%m-%dT%H:%M:%SZ" # There is only one valid time format! ISO 8601
 			shift;;
 		-c|--check)
-			check_action=$1
-			action="is_tracked"
+			check_action $1
+			action=is_tracked
 			shift;;
 		-*)
 			show_help;
@@ -306,9 +230,6 @@ main() {
 	if [ -z "$query_path" ] ; then
 		query_path=.
 	fi
-	if ! is_file_tracked "$query_path" ; then
-		echo "Warning: Path \"${query_path}\" is not under version control.">&2
-	fi
 	if [ -z "$action" ] ; then
 		show_help
 		echo "Error: No actions specified"
diff --git a/util/git-hooks/applypatch-msg b/util/git-hooks/applypatch-msg
new file mode 100755
index 000000000..32ff6c700
--- /dev/null
+++ b/util/git-hooks/applypatch-msg
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# A hook script to check the commit log message taken by
+# applypatch from an e-mail message (via git-am).
+# We simply do the same as for other commit messages
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.  The hook is
+# allowed to edit the commit message file.
+#
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/commit-msg" &&
+	exec "$GIT_DIR/hooks/commit-msg" ${1+"$@"}
+:
diff --git a/util/git-hooks/commit-msg b/util/git-hooks/commit-msg
new file mode 100755
index 000000000..b9217e081
--- /dev/null
+++ b/util/git-hooks/commit-msg
@@ -0,0 +1,209 @@
+#!/bin/sh
+#
+# Change-ID amending from Gerrit Code Review 2.14.2
+#
+# Part of Gerrit Code Review (https://www.gerritcodereview.com/)
+#
+# Copyright (C) 2009 The Android Open Source Project
+#
+# Any other changes including test_duplicate_signoffs_acks
+#
+# Copyright (C) 2017 Stefan Tauner
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unset GREP_OPTIONS
+
+CHANGE_ID_AFTER="Bug|Depends-On|Issue|Test|Feature|Fixes|Fixed|Staging-ID"
+MSG="$1"
+
+# Check for, and add if missing, a unique Change-Id
+#
+add_ChangeId() {
+	clean_message=`sed -e '
+		/^diff --git .*/{
+			s///
+			q
+		}
+		/^Signed-off-by:/d
+		/^#/d
+	' "$MSG" | git stripspace`
+	if test -z "$clean_message"
+	then
+		return
+	fi
+
+	# *Do* add Change-Id to temp commits (original code bails out here)
+	# if echo "$clean_message" | head -1 | grep -q '^\(fixup\|squash\)!'
+	# then
+	# 	return
+	# fi
+
+	if test "false" = "`git config --bool --get gerrit.createChangeId`"
+	then
+		return
+	fi
+
+	# Does Change-Id: already exist? if so, exit (no change).
+	if grep -i '^Change-Id:' "$MSG" >/dev/null
+	then
+		return
+	fi
+
+	id=`_gen_ChangeId`
+	T="$MSG.tmp.$$"
+	AWK=awk
+	if [ -x /usr/xpg4/bin/awk ]; then
+		# Solaris AWK is just too broken
+		AWK=/usr/xpg4/bin/awk
+	fi
+
+	# Get core.commentChar from git config or use default symbol
+	commentChar=`git config --get core.commentChar`
+	commentChar=${commentChar:-#}
+
+	# How this works:
+	# - parse the commit message as (textLine+ blankLine*)*
+	# - assume textLine+ to be a footer until proven otherwise
+	# - exception: the first block is not footer (as it is the title)
+	# - read textLine+ into a variable
+	# - then count blankLines
+	# - once the next textLine appears, print textLine+ blankLine* as these
+	#   aren't footer
+	# - in END, the last textLine+ block is available for footer parsing
+	$AWK '
+	BEGIN {
+		# while we start with the assumption that textLine+
+		# is a footer, the first block is not.
+		isFooter = 0
+		footerComment = 0
+		blankLines = 0
+	}
+
+	# Skip lines starting with commentChar without any spaces before it.
+	/^'"$commentChar"'/ { next }
+
+	# Skip the line starting with the diff command and everything after it,
+	# up to the end of the file, assuming it is only patch data.
+	# If more than one line before the diff was empty, strip all but one.
+	/^diff --git / {
+		blankLines = 0
+		while (getline) { }
+		next
+	}
+
+	# Count blank lines outside footer comments
+	/^$/ && (footerComment == 0) {
+		blankLines++
+		next
+	}
+
+	# Catch footer comment
+	/^\[[a-zA-Z0-9-]+:/ && (isFooter == 1) {
+		footerComment = 1
+	}
+
+	/]$/ && (footerComment == 1) {
+		footerComment = 2
+	}
+
+	# We have a non-blank line after blank lines. Handle this.
+	(blankLines > 0) {
+		print lines
+		for (i = 0; i < blankLines; i++) {
+			print ""
+		}
+
+		lines = ""
+		blankLines = 0
+		isFooter = 1
+		footerComment = 0
+	}
+
+	# Detect that the current block is not the footer
+	(footerComment == 0) && (!/^\[?[a-zA-Z0-9-]+:/ || /^[a-zA-Z0-9-]+:\/\//) {
+		isFooter = 0
+	}
+
+	{
+		# We need this information about the current last comment line
+		if (footerComment == 2) {
+			footerComment = 0
+		}
+		if (lines != "") {
+			lines = lines "\n";
+		}
+		lines = lines $0
+	}
+
+	# Footer handling:
+	# If the last block is considered a footer, splice in the Change-Id at the
+	# right place.
+	# Look for the right place to inject Change-Id by considering
+	# CHANGE_ID_AFTER. Keys listed in it (case insensitive) come first,
+	# then Change-Id, then everything else (eg. Signed-off-by:).
+	#
+	# Otherwise just print the last block, a new line and the Change-Id as a
+	# block of its own.
+	END {
+		unprinted = 1
+		if (isFooter == 0) {
+			print lines "\n"
+			lines = ""
+		}
+		changeIdAfter = "^(" tolower("'"$CHANGE_ID_AFTER"'") "):"
+		numlines = split(lines, footer, "\n")
+		for (line = 1; line <= numlines; line++) {
+			if (unprinted && match(tolower(footer[line]), changeIdAfter) != 1) {
+				unprinted = 0
+				print "Change-Id: I'"$id"'"
+			}
+			print footer[line]
+		}
+		if (unprinted) {
+			print "Change-Id: I'"$id"'"
+		}
+	}' "$MSG" > "$T" && mv "$T" "$MSG" || rm -f "$T"
+}
+_gen_ChangeIdInput() {
+	echo "tree `git write-tree`"
+	if parent=`git rev-parse "HEAD^0" 2>/dev/null`
+	then
+		echo "parent $parent"
+	fi
+	echo "author `git var GIT_AUTHOR_IDENT`"
+	echo "committer `git var GIT_COMMITTER_IDENT`"
+	echo
+	printf '%s' "$clean_message"
+}
+_gen_ChangeId() {
+	_gen_ChangeIdInput |
+	git hash-object -t commit --stdin
+}
+
+# Test for duplicate signoffs/acks
+test_duplicate_signoffs_acks() {
+	test "" = "$(grep -i '^(Signed-off-by|Acked-by): ' "$MSG" |
+		 sort | uniq -c | sed -e '/^[[:space:]]*1[[:space:]]/d')" || {
+		echo "Duplicate Signed-off-by or Acked-by lines." >&2
+		exit 1
+	}
+}
+
+main() {
+	test_duplicate_signoffs_acks
+	add_ChangeId
+}
+
+main
diff --git a/util/git-hooks/install.sh b/util/git-hooks/install.sh
new file mode 100755
index 000000000..d557c2f8a
--- /dev/null
+++ b/util/git-hooks/install.sh
@@ -0,0 +1,20 @@
+#!/bin/sh -e
+
+root=$(git rev-parse --show-cdup 2>/dev/null) || \
+     { echo "Not under git control. Cannot install git hooks." >&2 ; exit 0 ; }
+
+dst="${root}"$(git rev-parse --git-path hooks/)
+src=util/git-hooks/ # relative to root
+hooks=$(cd "${root}${src}" && git ls-files -c | grep -Ev 'install.sh|wrapper.sh')
+
+for h in $hooks; do
+	# Test if hook is not already installed, i.e. doesn't point at the wrapper
+	if [ ! "${dst}$h" -ef "${root}${src}wrapper.sh" ]; then
+		# preserve custom hooks if any
+		if [ -e "${dst}$h" ]; then
+			mv "${dst}$h" "${dst}$h.local"
+		fi
+		ln -s "$(git rev-parse --prefix $(git rev-parse --git-path hooks/) --show-cdup)${src}wrapper.sh" \
+		      "${dst}$h"
+	fi
+done
diff --git a/util/git-hooks/pre-applypatch b/util/git-hooks/pre-applypatch
new file mode 100755
index 000000000..2ed28f71f
--- /dev/null
+++ b/util/git-hooks/pre-applypatch
@@ -0,0 +1,12 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed
+# by applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/pre-commit" &&
+	exec "$GIT_DIR/hooks/pre-commit" ${1+"$@"}
+:
diff --git a/util/git-hooks/pre-commit b/util/git-hooks/pre-commit
new file mode 100755
index 000000000..dbccb9e27
--- /dev/null
+++ b/util/git-hooks/pre-commit
@@ -0,0 +1,9 @@
+#!/bin/sh
+#
+# A hook script to verify what is about to be committed.
+# Called by "git commit" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+
+# Check for whitespace errors
+git diff-index --check --cached HEAD -- || exit 1
diff --git a/util/git-hooks/pre-push b/util/git-hooks/pre-push
new file mode 100755
index 000000000..b5f4620ea
--- /dev/null
+++ b/util/git-hooks/pre-push
@@ -0,0 +1,75 @@
+#!/bin/sh
+
+# A hook script to verify what is about to be pushed.  Called by "git
+# push" after it has checked the remote status, but before anything has been
+# pushed.  If this script exits with a non-zero status nothing will be pushed.
+#
+# This hook is called with the following parameters:
+#
+# $1 -- Name of the remote to which the push is being done
+# $2 -- URL to which the push is being done
+#
+# If pushing without using a named remote those arguments will be equal.
+#
+# Information about the commits which are being pushed is supplied as lines to
+# the standard input in the form:
+#
+#   <local ref> <local sha1> <remote ref> <remote sha1>
+
+remote="$1"
+url="$2"
+
+zero=0000000000000000000000000000000000000000
+
+upstream_pattern="github\.com.flashrom/flashrom(\.git)?|flashrom\.org.git/flashrom(\.git)?"
+
+# Only care about the upstream repositories
+if echo "$url" | grep -q -v -E "$upstream_pattern" ; then
+	exit 0
+fi
+
+while read local_ref local_sha remote_ref remote_sha ; do
+
+	# Only allow the stable and staging branches as well as versioned stable branches (e.g., 0.0.x).
+	# The matching expression's RE is always anchored to the first character (^ is undefined).
+	# The outer parentheses are needed to print out the whole matched string.
+	version=$(expr ${remote_ref#*refs/heads/} : '\(\([0-9]\+\.\)\{2,\}x\)$')
+	if [ "$remote_ref" != "refs/heads/staging" ] && \
+	   [ "$remote_ref" != "refs/heads/stable" ] && \
+	   [ -z "$version" ]; then
+		echo "Feature branches not allowed ($remote_ref)." >&2
+		exit 1
+	fi
+
+	if [ "$local_sha" = $zero ]; then
+		echo "Deletion of branches is prohibited." >&2
+		exit 1
+	fi
+
+	# Check for Signed-off-by and Acked-by
+	commit=$(git rev-list -n 1 --all-match --invert-grep -E \
+		--grep '^Signed-off-by: .+ <.+@.+\..+>$' \
+		--grep '^Acked-by: .+ <.+@.+\..+>$' \
+		"$remote_sha..$local_sha")
+	if [ -n "$commit" ]; then
+		echo "Commit $local_sha in $local_ref is missing either \"Signed-off-by\"" \
+			" or \"Acked-by\" lines, not pushing." >&2
+		exit 1
+	fi
+
+	# Make _really_ sure we do not rewrite history of any head/branch
+	if [ "${remote_ref#*refs/heads/}" != "$remote_ref" ]; then
+		nonreachable=$(git rev-list $remote_sha ^$local_sha | head -1)
+		if [ -n "$nonreachable" ]; then
+			echo "Only fast-forward pushes are allowed on branches." >&2
+			echo "At least $nonreachable is not included in $remote_sha while pushing to " \
+			     "$remote_ref" >&2
+			exit 1
+		fi
+	fi
+
+	# FIXME: check commit log format (subject without full stop at the end etc).
+	# FIXME: do buildbot checks if authorized?
+done
+
+exit 0
diff --git a/util/git-hooks/wrapper.sh b/util/git-hooks/wrapper.sh
new file mode 100755
index 000000000..3fc3e05c6
--- /dev/null
+++ b/util/git-hooks/wrapper.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+if [ -x $0.local ]; then
+	$0.local "$@" || exit $?
+fi
+
+hook=$(git rev-parse --show-toplevel)"/util/git-hooks/"$(basename $0)
+if [ -x $hook ]; then
+	$hook "$@" || exit $?
+fi