7 files changed, 350 insertions, 0 deletions
diff --git a/util/git-hooks/applypatch-msg b/util/git-hooks/applypatch-msg
new file mode 100755
index 000000000..32ff6c700
--- /dev/null
+++ b/util/git-hooks/applypatch-msg
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# A hook script to check the commit log message taken by
+# applypatch from an e-mail message (via git-am).
+# We simply do the same as for other commit messages
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.  The hook is
+# allowed to edit the commit message file.
+#
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/commit-msg" &&
+	exec "$GIT_DIR/hooks/commit-msg" ${1+"$@"}
+:
diff --git a/util/git-hooks/commit-msg b/util/git-hooks/commit-msg
new file mode 100755
index 000000000..b9217e081
--- /dev/null
+++ b/util/git-hooks/commit-msg
@@ -0,0 +1,209 @@
+#!/bin/sh
+#
+# Change-ID amending from Gerrit Code Review 2.14.2
+#
+# Part of Gerrit Code Review (https://www.gerritcodereview.com/)
+#
+# Copyright (C) 2009 The Android Open Source Project
+#
+# Any other changes including test_duplicate_signoffs_acks
+#
+# Copyright (C) 2017 Stefan Tauner
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+unset GREP_OPTIONS
+
+CHANGE_ID_AFTER="Bug|Depends-On|Issue|Test|Feature|Fixes|Fixed|Staging-ID"
+MSG="$1"
+
+# Check for, and add if missing, a unique Change-Id
+#
+add_ChangeId() {
+	clean_message=`sed -e '
+		/^diff --git .*/{
+			s///
+			q
+		}
+		/^Signed-off-by:/d
+		/^#/d
+	' "$MSG" | git stripspace`
+	if test -z "$clean_message"
+	then
+		return
+	fi
+
+	# *Do* add Change-Id to temp commits (original code bails out here)
+	# if echo "$clean_message" | head -1 | grep -q '^\(fixup\|squash\)!'
+	# then
+	# 	return
+	# fi
+
+	if test "false" = "`git config --bool --get gerrit.createChangeId`"
+	then
+		return
+	fi
+
+	# Does Change-Id: already exist? if so, exit (no change).
+	if grep -i '^Change-Id:' "$MSG" >/dev/null
+	then
+		return
+	fi
+
+	id=`_gen_ChangeId`
+	T="$MSG.tmp.$$"
+	AWK=awk
+	if [ -x /usr/xpg4/bin/awk ]; then
+		# Solaris AWK is just too broken
+		AWK=/usr/xpg4/bin/awk
+	fi
+
+	# Get core.commentChar from git config or use default symbol
+	commentChar=`git config --get core.commentChar`
+	commentChar=${commentChar:-#}
+
+	# How this works:
+	# - parse the commit message as (textLine+ blankLine*)*
+	# - assume textLine+ to be a footer until proven otherwise
+	# - exception: the first block is not footer (as it is the title)
+	# - read textLine+ into a variable
+	# - then count blankLines
+	# - once the next textLine appears, print textLine+ blankLine* as these
+	#   aren't footer
+	# - in END, the last textLine+ block is available for footer parsing
+	$AWK '
+	BEGIN {
+		# while we start with the assumption that textLine+
+		# is a footer, the first block is not.
+		isFooter = 0
+		footerComment = 0
+		blankLines = 0
+	}
+
+	# Skip lines starting with commentChar without any spaces before it.
+	/^'"$commentChar"'/ { next }
+
+	# Skip the line starting with the diff command and everything after it,
+	# up to the end of the file, assuming it is only patch data.
+	# If more than one line before the diff was empty, strip all but one.
+	/^diff --git / {
+		blankLines = 0
+		while (getline) { }
+		next
+	}
+
+	# Count blank lines outside footer comments
+	/^$/ && (footerComment == 0) {
+		blankLines++
+		next
+	}
+
+	# Catch footer comment
+	/^\[[a-zA-Z0-9-]+:/ && (isFooter == 1) {
+		footerComment = 1
+	}
+
+	/]$/ && (footerComment == 1) {
+		footerComment = 2
+	}
+
+	# We have a non-blank line after blank lines. Handle this.
+	(blankLines > 0) {
+		print lines
+		for (i = 0; i < blankLines; i++) {
+			print ""
+		}
+
+		lines = ""
+		blankLines = 0
+		isFooter = 1
+		footerComment = 0
+	}
+
+	# Detect that the current block is not the footer
+	(footerComment == 0) && (!/^\[?[a-zA-Z0-9-]+:/ || /^[a-zA-Z0-9-]+:\/\//) {
+		isFooter = 0
+	}
+
+	{
+		# We need this information about the current last comment line
+		if (footerComment == 2) {
+			footerComment = 0
+		}
+		if (lines != "") {
+			lines = lines "\n";
+		}
+		lines = lines $0
+	}
+
+	# Footer handling:
+	# If the last block is considered a footer, splice in the Change-Id at the
+	# right place.
+	# Look for the right place to inject Change-Id by considering
+	# CHANGE_ID_AFTER. Keys listed in it (case insensitive) come first,
+	# then Change-Id, then everything else (eg. Signed-off-by:).
+	#
+	# Otherwise just print the last block, a new line and the Change-Id as a
+	# block of its own.
+	END {
+		unprinted = 1
+		if (isFooter == 0) {
+			print lines "\n"
+			lines = ""
+		}
+		changeIdAfter = "^(" tolower("'"$CHANGE_ID_AFTER"'") "):"
+		numlines = split(lines, footer, "\n")
+		for (line = 1; line <= numlines; line++) {
+			if (unprinted && match(tolower(footer[line]), changeIdAfter) != 1) {
+				unprinted = 0
+				print "Change-Id: I'"$id"'"
+			}
+			print footer[line]
+		}
+		if (unprinted) {
+			print "Change-Id: I'"$id"'"
+		}
+	}' "$MSG" > "$T" && mv "$T" "$MSG" || rm -f "$T"
+}
+_gen_ChangeIdInput() {
+	echo "tree `git write-tree`"
+	if parent=`git rev-parse "HEAD^0" 2>/dev/null`
+	then
+		echo "parent $parent"
+	fi
+	echo "author `git var GIT_AUTHOR_IDENT`"
+	echo "committer `git var GIT_COMMITTER_IDENT`"
+	echo
+	printf '%s' "$clean_message"
+}
+_gen_ChangeId() {
+	_gen_ChangeIdInput |
+	git hash-object -t commit --stdin
+}
+
+# Test for duplicate signoffs/acks
+test_duplicate_signoffs_acks() {
+	test "" = "$(grep -i '^(Signed-off-by|Acked-by): ' "$MSG" |
+		 sort | uniq -c | sed -e '/^[[:space:]]*1[[:space:]]/d')" || {
+		echo "Duplicate Signed-off-by or Acked-by lines." >&2
+		exit 1
+	}
+}
+
+main() {
+	test_duplicate_signoffs_acks
+	add_ChangeId
+}
+
+main
diff --git a/util/git-hooks/install.sh b/util/git-hooks/install.sh
new file mode 100755
index 000000000..d557c2f8a
--- /dev/null
+++ b/util/git-hooks/install.sh
@@ -0,0 +1,20 @@
+#!/bin/sh -e
+
+root=$(git rev-parse --show-cdup 2>/dev/null) || \
+     { echo "Not under git control. Cannot install git hooks." >&2 ; exit 0 ; }
+
+dst="${root}"$(git rev-parse --git-path hooks/)
+src=util/git-hooks/ # relative to root
+hooks=$(cd "${root}${src}" && git ls-files -c | grep -Ev 'install.sh|wrapper.sh')
+
+for h in $hooks; do
+	# Test if hook is not already installed, i.e. doesn't point at the wrapper
+	if [ ! "${dst}$h" -ef "${root}${src}wrapper.sh" ]; then
+		# preserve custom hooks if any
+		if [ -e "${dst}$h" ]; then
+			mv "${dst}$h" "${dst}$h.local"
+		fi
+		ln -s "$(git rev-parse --prefix $(git rev-parse --git-path hooks/) --show-cdup)${src}wrapper.sh" \
+		      "${dst}$h"
+	fi
+done
diff --git a/util/git-hooks/pre-applypatch b/util/git-hooks/pre-applypatch
new file mode 100755
index 000000000..2ed28f71f
--- /dev/null
+++ b/util/git-hooks/pre-applypatch
@@ -0,0 +1,12 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed
+# by applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/pre-commit" &&
+	exec "$GIT_DIR/hooks/pre-commit" ${1+"$@"}
+:
diff --git a/util/git-hooks/pre-commit b/util/git-hooks/pre-commit
new file mode 100755
index 000000000..dbccb9e27
--- /dev/null
+++ b/util/git-hooks/pre-commit
@@ -0,0 +1,9 @@
+#!/bin/sh
+#
+# A hook script to verify what is about to be committed.
+# Called by "git commit" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+
+# Check for whitespace errors
+git diff-index --check --cached HEAD -- || exit 1
diff --git a/util/git-hooks/pre-push b/util/git-hooks/pre-push
new file mode 100755
index 000000000..b5f4620ea
--- /dev/null
+++ b/util/git-hooks/pre-push
@@ -0,0 +1,75 @@
+#!/bin/sh
+
+# A hook script to verify what is about to be pushed.  Called by "git
+# push" after it has checked the remote status, but before anything has been
+# pushed.  If this script exits with a non-zero status nothing will be pushed.
+#
+# This hook is called with the following parameters:
+#
+# $1 -- Name of the remote to which the push is being done
+# $2 -- URL to which the push is being done
+#
+# If pushing without using a named remote those arguments will be equal.
+#
+# Information about the commits which are being pushed is supplied as lines to
+# the standard input in the form:
+#
+#   <local ref> <local sha1> <remote ref> <remote sha1>
+
+remote="$1"
+url="$2"
+
+zero=0000000000000000000000000000000000000000
+
+upstream_pattern="github\.com.flashrom/flashrom(\.git)?|flashrom\.org.git/flashrom(\.git)?"
+
+# Only care about the upstream repositories
+if echo "$url" | grep -q -v -E "$upstream_pattern" ; then
+	exit 0
+fi
+
+while read local_ref local_sha remote_ref remote_sha ; do
+
+	# Only allow the stable and staging branches as well as versioned stable branches (e.g., 0.0.x).
+	# The matching expression's RE is always anchored to the first character (^ is undefined).
+	# The outer parentheses are needed to print out the whole matched string.
+	version=$(expr ${remote_ref#*refs/heads/} : '\(\([0-9]\+\.\)\{2,\}x\)$')
+	if [ "$remote_ref" != "refs/heads/staging" ] && \
+	   [ "$remote_ref" != "refs/heads/stable" ] && \
+	   [ -z "$version" ]; then
+		echo "Feature branches not allowed ($remote_ref)." >&2
+		exit 1
+	fi
+
+	if [ "$local_sha" = $zero ]; then
+		echo "Deletion of branches is prohibited." >&2
+		exit 1
+	fi
+
+	# Check for Signed-off-by and Acked-by
+	commit=$(git rev-list -n 1 --all-match --invert-grep -E \
+		--grep '^Signed-off-by: .+ <.+@.+\..+>$' \
+		--grep '^Acked-by: .+ <.+@.+\..+>$' \
+		"$remote_sha..$local_sha")
+	if [ -n "$commit" ]; then
+		echo "Commit $local_sha in $local_ref is missing either \"Signed-off-by\"" \
+			" or \"Acked-by\" lines, not pushing." >&2
+		exit 1
+	fi
+
+	# Make _really_ sure we do not rewrite history of any head/branch
+	if [ "${remote_ref#*refs/heads/}" != "$remote_ref" ]; then
+		nonreachable=$(git rev-list $remote_sha ^$local_sha | head -1)
+		if [ -n "$nonreachable" ]; then
+			echo "Only fast-forward pushes are allowed on branches." >&2
+			echo "At least $nonreachable is not included in $remote_sha while pushing to " \
+			     "$remote_ref" >&2
+			exit 1
+		fi
+	fi
+
+	# FIXME: check commit log format (subject without full stop at the end etc).
+	# FIXME: do buildbot checks if authorized?
+done
+
+exit 0
diff --git a/util/git-hooks/wrapper.sh b/util/git-hooks/wrapper.sh
new file mode 100755
index 000000000..3fc3e05c6
--- /dev/null
+++ b/util/git-hooks/wrapper.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+if [ -x $0.local ]; then
+	$0.local "$@" || exit $?
+fi
+
+hook=$(git rev-parse --show-toplevel)"/util/git-hooks/"$(basename $0)
+if [ -x $hook ]; then
+	$hook "$@" || exit $?
+fi