diff --git a/autinerd/keys b/autinerd/keys deleted file mode 100644 index 48f9a7b..0000000 --- a/autinerd/keys +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDJIN3GrRR5suQHnWBL7b/W4gu2CoZZK+eXOsicnHct3 sidney diff --git a/autinerd/meta.toml b/autinerd/meta.toml deleted file mode 100644 index 5b46eed..0000000 --- a/autinerd/meta.toml +++ /dev/null @@ -1,2 +0,0 @@ -name = "autinerd" -email = "autinerd@noreply.localhost" diff --git a/autinerd/wireguard b/autinerd/wireguard deleted file mode 100644 index c42a696..0000000 --- a/autinerd/wireguard +++ /dev/null @@ -1 +0,0 @@ -fugelNyT7VVriZgB6gwebHH/JfsZGQ8G34xjb6uVY0k= \ No newline at end of file diff --git a/denny/keys b/denny/keys deleted file mode 100644 index 3d4fa32..0000000 --- a/denny/keys +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGo9RUJ7MiKAsWdBKaYqUFYZAFl6qsOlSv+GEN5Z5Bdu denny diff --git a/denny/meta.toml b/denny/meta.toml deleted file mode 100644 index 71feaa6..0000000 --- a/denny/meta.toml +++ /dev/null @@ -1,3 +0,0 @@ -name = "denny" -email = "denny@dennybertus.de" - diff --git a/denny/wireguard b/denny/wireguard deleted file mode 100644 index 06f9bab..0000000 --- a/denny/wireguard +++ /dev/null @@ -1 +0,0 @@ -oMTiAkSRrvqxLuy59YzjXPgy8R5CuGvwDW6/vorOHgk= diff --git a/lilian/keys b/lilian/keys deleted file mode 100644 index da1fe7b..0000000 --- a/lilian/keys +++ /dev/null @@ -1,2 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINTt9fIKrXhfUYCKdpkI8etdvNgn8jubA2YxvdFj4Rn5 lilian@metis -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFc/fKL52XHMx2oM9YE9o20zQ/Y+JAwx+YSUPdT+Y7Vf lilian@cordelia diff --git a/lilian/meta.toml b/lilian/meta.toml deleted file mode 100644 index 0bc0780..0000000 --- a/lilian/meta.toml +++ /dev/null @@ -1,2 +0,0 @@ -name = "lilian" -email = "lilian.no-reply@chaostreff-backnang.de" diff --git a/lilian/wireguard b/lilian/wireguard deleted file mode 100644 index 283ba50..0000000 --- a/lilian/wireguard +++ /dev/null @@ -1 +0,0 @@ -PSnR3Z+O9ChkFsQSsFzYk23fnyeCaqzF2cH+4MnK5xI= diff --git a/verify.py b/verify.py index a04a3ae..8d7330c 100755 --- a/verify.py +++ b/verify.py @@ -28,15 +28,14 @@ def collect_user_dirs(): def last_commit_for(dir: Path, ref: git.Reference): """Returns the Git commit signature for the last commit on this path.""" - last_commit_hash = str(ref.repo.git.rev_list("--max-count=1", ref, dir)) + last_commit_hash = str(ref.repo.git.rev_list("--max-count=1", action_ref, dir)) return ref.repo.commit(last_commit_hash) def keylist_to_principals(keyfile_text: str, email: str) -> str: - # trailing newline, otherwise git may get confused and reject the key return "\n".join( f"{email} {public_key}" for public_key in keyfile_text.splitlines() - ) + "\n" + ) def get_forgejo_keys(username: str) -> str: @@ -54,8 +53,7 @@ def verify_dir(dir: Path, ref: git.Reference): raise Exception("Missing keyfile") commit = last_commit_for(dir, ref) log.debug(f"Found last commit: {commit.name_rev}") - # ignore author casing - if commit.author.name.lower() != username.lower(): + if commit.author.name != username: raise Exception( f"Commit author {commit.author.name} is not the owner of this directory." ) @@ -82,10 +80,9 @@ def verify_dir(dir: Path, ref: git.Reference): config.set_value("gpg.ssh", "allowedSignersFile", temp_keyfile.name) temp_keyfile_contents = keylist_to_principals(remote_keys, email) + log.debug(f"temp keyfile:\n{temp_keyfile_contents}") temp_keyfile.write(temp_keyfile_contents) temp_keyfile.flush() - - log.debug(f"temp keyfile:\n{Path(temp_keyfile.name).read_text()}") # Check whether one of the user keys signed this commit. # throws an exception automatically if verification fails, nothing else to do ref.repo.git.verify_commit("--raw", commit.hexsha) @@ -101,18 +98,7 @@ def verify_dir(dir: Path, ref: git.Reference): def current_ref(repo: git.Repo) -> git.Reference: - log.debug(f"{repo.references}") - # some of this logic stolen from https://code.forgejo.org/actions/checkout/src/branch/main/src/ref-helper.ts - the ref names github provides are beyond fucked - global action_ref - if (action_ref.startswith('refs/heads/')): - branch = action_ref.removeprefix('refs/heads/') - action_ref = branch - # refs/pull/ - elif (action_ref.startswith('refs/pull/')): - branch = action_ref.removeprefix('refs/pull/') - action_ref = f'refs/remotes/pull/{branch}' - - for ref in repo.refs: + for ref in repo.references: if ref.name == action_ref or ref.path == action_ref: return ref raise Exception(f"No ref named {action_ref} found")