git-secure-fetch

#!/bin/bash


# Update this variable value with your GPG Key
GPG_KEY=`git config user.signingkey`
GPG_KEY_EXISTS=$(gpg2 --list-key $GPG_KEY)

if [[ $? -ne 0 ]]
then
  echo "GPG Key $GPG_KEY is unavailable in the current GPG keychain"
  exit 4
fi


#************** Functions ***********************************

function print_usage {
  echo "Usage: git secure-fetch [branch]"
  echo ""
  echo "Fetches the current state of a branch and validates the RSL leading"
  echo "up to that point."
  echo ""
  echo "NOTE: Only fetches from the 'origin' remote."
  echo "origin: `git remote get-url origin`"
}

#This function creates the rsl entries related to the fetch operation
function update_rsl_fetch {
  LAST_ENTRY=$(find_last_entry_number)
  RSL=$(($LAST_ENTRY+1))
  dd if=/dev/urandom bs=16 count=1 of=$RSL

  # Commit the new RSL
  git add $RSL
  echo "Committing the fetch entry to the RSL branch."
  echo "<---- GPG signature required."

  git commit -S -m "Adding the fetch entry at RSL for $CURRENT_BRANCH"
}

#This function pushes the rsl branch to server
function push_rsl {
  git push --set-upstream origin rsl 2>/dev/null
  #Checking the status of RSL Push
  status=$?
}


#This function initializes the rsl branch and creates rsl file initial entries
function rsl_init {

  #Set init variable
  init=1
  git checkout -q --orphan rsl
  git rm -qrf .
  dd if=/dev/urandom bs=16 count=1 of=1

  # Commit the new RSL
  git add 1
  echo "Committing inital entries to RSL branch."
  echo "<---- GPG signature required."
  git commit -S -qm "Commiting the changes at RSL"

}

function find_last_entry_number {
  # the number of files in the RSL branch
  echo $(find . -maxdepth 1 -type f | grep -v 'rsl.tmp' | wc -l)
}

# This function fetches the rsl and related branch
function rsl_fetch {

  git fetch -q origin rsl
  git checkout -q rsl

  RSL=$(find_last_entry_number)

  #finding the last verified push entry
  while [ -f $RSL ]
  do
    if grep -q HEAD $RSL
    then
      #Update Last RSL push entry
      LAST_VERIFIED_PUSH_ENTRY=$RSL
      break
    else
      RSL=$(($RSL-1))
    fi
  done
  git merge -q

  #Fetch the current branch from server
  git fetch -q --no-tags origin $CURRENT_BRANCH 2>/dev/null

  RSL=$(find_last_entry_number)

  #Finding out the last Push entry for the current branch
  while [ -f $RSL ]
  do
    if grep -q "^Branch:$CURRENT_BRANCH$" $RSL
    then
      echo "RSL entry $RSL contains the latest push entry for branch $CURRENT_BRANCH"
      #Get the branch head from the rsl
      RSL_BRANCH_HEAD=`cat $RSL |grep HEAD |tail -1|cut -d':' -f2`
      break
    else
      RSL=$(($RSL-1))
    fi
  done

  #Get the FETCH_HEAD
  FETCH_HEAD=`cat .git/FETCH_HEAD |grep $CURRENT_BRANCH |cut -f1`

  #Verify the branch head in RSL matches with the FETCH_HEAD
  if [ -z $RSL_BRANCH_HEAD ]
  then
    echo "No prior push entry in the rsl for branch $CURRENT_BRANCH"
    fetch_status=0
  elif  [ "$RSL_BRANCH_HEAD" != "$FETCH_HEAD" ]
  then
    echo "ERROR: We fetched a commit that doesn't match the latest push entry"
    echo ""
    echo "This is indicative of someone pushing instead of secure-pushing"
    echo ""
    echo "FETCH_HEAD: $FETCH_HEAD"
    echo "PUSH_ENTRY: $RSL_BRANCH_HEAD"
    echo ""
    git log --oneline origin/$CURRENT_BRANCH | head
    restore_original_state
    exit 99
    fetch_status=1
  else
    fetch_status=0
  fi
}

#This function verifies the rsl file
function rsl_verify {

    git checkout -q rsl
    if git diff $RSL_PREV_HEAD HEAD --stat|grep -q 'deletion'
    then
        echo "RSL file corrupted"
    fi

    #verify the signature on last enry
    LAST_ENTRY=$(ls -lrt|wc -l)


    #Computing Hash for previous entries
    RSL=$(find_last_entry_number)

    #Finding first push entry
    for i in $(seq 1 $RSL)
    do
        if grep -q HEAD $i
        then
          #Update Last RSL push entry
          FIRST_PUSH_ENTRY=$i
          break
        else
          RSL=$(($i+1))
        fi
      done

      RSL=$(find_last_entry_number)
    #finding the last push entry
    while [ -f $RSL ]
    do
      if grep -q HEAD $RSL
        then
          #Update Last RSL push entry
          LAST_PUSH_ENTRY=$RSL
          break
        else
          RSL=$(($RSL-1))
        fi
      done


      echo "******* Verifying the sign on last rsl entry *******"

      if [ -f $LAST_PUSH_ENTRY ]
      then
        gpg2 --default-key $GPG_KEY --verify $LAST_PUSH_ENTRY &> /dev/null
        local status=$?
      if [ $status -ne 0 ]
      then
        echo "Signature verification on last push entry is failed"
      else
        echo "Signature verification on last push entry is successful"
      fi
      else
        echo "There is no RSL push entry exist before. No need of signature verification"
      fi

      echo "****************************************************"

      echo "******* Verifying the hash on new rsl push entries *******"
      #Hash Verification

      VERIFY=1
      while [ $VERIFY -eq 1 ]
      do
      RSL=$(($LAST_PUSH_ENTRY-1))
      while [ -f $RSL ]
      do
        if grep -q HEAD $RSL
          then
            #Update Last RSL push entry
            LAST_PUSH_ENTRY2=$RSL
            break
          else
            RSL=$(($RSL-1))
          fi
        done

      if [ -f $LAST_PUSH_ENTRY2 ]
      then
          for i in $(seq $LAST_PUSH_ENTRY2 $(($LAST_PUSH_ENTRY-1)))
          do
            cat $i >>hash_file.tmp
          done
      else
          for i in $(seq 1 $(($LAST_PUSH_ENTRY-1)))
          do
            cat $i >>hash_file.tmp
          done
      fi

      HASH_1=`cat $LAST_PUSH_ENTRY|grep 'PREV_HASH:'|cut -d':' -f2`
      HASH_2=`cat hash_file.tmp|sha512sum|cut -d' ' -f1`

      if [[ "$HASH_2" != "$HASH_1" && ! -z "$HASH_1" ]]
      then
            echo "Hash verfication on the following entry failed"
            echo "HASH_1:"$HASH_1 "  HASH_2":$HASH_2
            echo `cat hash_file.tmp`
            exit 1
      else
            echo "Hash verification successful "
      fi
      rm hash_file.tmp

      if [[  $LAST_PUSH_ENTRY -eq $LAST_VERIFIED_PUSH_ENTRY || $LAST_PUSH_ENTRY -eq $FIRST_PUSH_ENTRY || -z $LAST_PUSH_ENTRY ]]
      then
          VERIFY=0
      fi
      LAST_PUSH_ENTRY=$LAST_PUSH_ENTRY2
      LAST_PUSH_ENTRY2=0
    done

}

function unstash_changes() {
  if [ "$STASH_OUTPUT" != "No local changes to save" ]; then
    POP_STASH="$(git stash pop)"
    if [ $? != 0 ]; then
      echo "ERROR:"
      echo "$POP_STASH"
      exit 9
    fi
  fi
  cd $WORKING_DIRECTORY
}


function restore_original_state() {
  CLEAR_INDEX="$(git reset --hard HEAD)"
  if [ $? != 0 ]; then
    echo "ERROR:"
    echo "$CLEAR_INDEX"
  fi
  CHECKOUT_ORIGINAL_OUTPUT="$(git checkout -q $PRIOR_BRANCH)"
  if [ $? != 0 ]; then
    echo "ERROR:"
    echo "$CHECKOUT_ORIGINAL_OUTPUT"
          exit 8
  fi
  unstash_changes
}

#************************************************************************************

# Get Current Branch
PRIOR_BRANCH=$(git symbolic-ref --short HEAD)
# Get current working directory
WORKING_DIRECTORY="$(pwd)"

while [ $# -ne 0 ]
do
  case "$1" in
    -h | -help )
      print_usage
      exit 0
      ;;
    -* )
      print_usage
      exit -1
      ;;
    * )
      CURRENT_BRANCH=$1
      shift
      ;;
  esac
done
if [[ -z $CURRENT_BRANCH ]]
then
  CURRENT_BRANCH=$PRIOR_BRANCH
fi

#check if we are pushing rsl branch
if [ "$CURRENT_BRANCH" == "rsl" ]
then
    exit 0
fi

echo "Stashing any local changes."
STASH_OUTPUT="$(git -c commit.gpgSign=false stash save -a)"
if [ $? != 0 ]; then
  echo "ERROR:"
  echo "$STASH_OUTPUT"
  exit 1
fi
cd $(git rev-parse --show-toplevel)


status=1
# Repeat the following steps until rsl push is successful
while [ $status -ne 0 ]
do
  #Fetch RSL
  if  [[ $(git branch -a |grep 'remotes/origin/rsl') ]]
  then

    fetch_status=1
    while [ $fetch_status -ne 0 ]
    do
      #fetch the RSL branch and current branch
      echo "Fetching the rsl ..."
      rsl_fetch
    done

    # Update the RSL file
    echo "Updating the rsl ..."
    update_rsl_fetch
  else
    # RSL branch Intialization
    echo "Intializing the rsl ..."
    rsl_init

  fi

  #Pushing the RSL
  echo "Pushing the rsl ... "
  push_rsl
  if [ $status -ne 0 ]
  then
    echo "rsl push failed !!"
    git reset --hard origin/rsl
  fi
done

RSL=$(find_last_entry_number)
#finding the last push entry
while [ -f $RSL ]
do
  if grep -q HEAD $RSL
    then
      #Update Last RSL push entry
      LAST_PUSH_ENTRY=$RSL
      break
  else
      RSL=$(($RSL-1))
  fi
done

if [[ $LAST_VERIFIED_PUSH_ENTRY -eq 1 || -z "$LAST_VERIFIED_PUSH_ENTRY" || $LAST_PUSH_ENTRY -eq $LAST_VERIFIED_PUSH_ENTRY ]]
then
  echo "No verification required"
else
  rsl_verify
fi

#Switch back to prior branch
restore_original_state