Watch
1
0
Fork
You've already forked RedFlag
0
RedFlag/scripts/check-public-history.sh
2026-08-20 12:02:35 -04:00

64 lines
2.3 KiB
Shell
Executable file

#!/usr/bin/env bash
set -euo pipefail
ref="${1:-HEAD}"
root="$(git rev-parse --show-toplevel)"
allowlist="$root/scripts/public-history-allowlist.txt"
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
cd "$root"
if [[ "$(git rev-parse --is-shallow-repository)" != "false" ]]; then
echo "[public-history] full history is required" >&2
exit 1
fi
git rev-parse --verify "${ref}^{commit}" >/dev/null
# RedFlag legitimately manages private networks. This gate is deliberately
# Casey-specific: it catches known home infrastructure and author metadata,
# not every RFC1918 address a fleet-management tool needs in examples/tests.
git log "$ref" -p --no-ext-diff --no-color --format='@@COMMIT@@%H' |
awk '
/^@@COMMIT@@/ { sha=substr($0,11); next }
/10\.10\.20\.[0-9]{1,3}|172\.16\.42\.[0-9]{1,3}|wiuf-docker|gitea\.wiuf\.net|\/home\/casey/ { print sha }
' >"$tmpdir/content"
git log "$ref" --format='%H%x09%an%x09%ae%x09%cn%x09%ce' |
awk -F '\t' '
tolower($0) ~ /@wiuf\.net|@wifu\.net|10\.10\.20\.|172\.16\.42\.|\/home\/casey/ { print $1 }
' >"$tmpdir/metadata"
sed -E '/^[[:space:]]*(#|$)/d' "$allowlist" | sort -u >"$tmpdir/allowed"
cat "$tmpdir/content" "$tmpdir/metadata" | sort -u >"$tmpdir/found"
while IFS= read -r sha; do
if ! git merge-base --is-ancestor "$sha" "$ref"; then
echo "[public-history] stale or unreachable allowlist commit: $sha" >&2
exit 1
fi
done <"$tmpdir/allowed"
comm -23 "$tmpdir/found" "$tmpdir/allowed" >"$tmpdir/unreviewed"
if [[ -s "$tmpdir/unreviewed" ]]; then
echo "[public-history] unreviewed private infrastructure or author metadata:" >&2
while IFS= read -r sha; do
printf ' %s %s\n' "$sha" "$(git show -s --format='%s' "$sha")" >&2
done <"$tmpdir/unreviewed"
exit 1
fi
large_blobs="$tmpdir/large-blobs"
git rev-list --objects "$ref" |
git cat-file --batch-check='%(objecttype) %(objectname) %(objectsize) %(rest)' |
awk '$1 == "blob" && $3 > 52428800 { print $2, $3, $4 }' >"$large_blobs"
if [[ -s "$large_blobs" ]]; then
echo "[public-history] blobs over 50 MiB require LFS or removal:" >&2
cat "$large_blobs" >&2
exit 1
fi
test -s LICENSE
test -s README.md
grep -qiE '^#{1,3}[[:space:]]+(quick start|install|installation)|install' README.md
echo "[public-history] complete reachable history, metadata, license, install path, and blob size passed"