7 files changed, 154 insertions, 0 deletions
diff --git a/util/git-hooks/applypatch-msg b/util/git-hooks/applypatch-msg
new file mode 100755
index 0000000..32ff6c7
--- /dev/null
+++ b/util/git-hooks/applypatch-msg
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# A hook script to check the commit log message taken by
+# applypatch from an e-mail message (via git-am).
+# We simply do the same as for other commit messages
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.  The hook is
+# allowed to edit the commit message file.
+#
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/commit-msg" &&
+	exec "$GIT_DIR/hooks/commit-msg" ${1+"$@"}
+:
diff --git a/util/git-hooks/commit-msg b/util/git-hooks/commit-msg
new file mode 100755
index 0000000..710fe78
--- /dev/null
+++ b/util/git-hooks/commit-msg
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# A hook script to check the commit log message.
+# Called by "git commit" with one argument, the name of the file
+# that has the commit message.  The hook should exit with non-zero
+# status after issuing an appropriate message if it wants to stop the
+# commit.  The hook is allowed to edit the commit message file.
+#
+
+# Catches duplicate Signed-off-by lines.
+test "" = "$(grep '^Signed-off-by: ' "$1" |
+	 sort | uniq -c | sed -e '/^[ 	]*1[ 	]/d')" || {
+	echo "Duplicate Signed-off-by lines." >&2
+	exit 1
+}
diff --git a/util/git-hooks/install.sh b/util/git-hooks/install.sh
new file mode 100755
index 0000000..e216af4
--- /dev/null
+++ b/util/git-hooks/install.sh
@@ -0,0 +1,19 @@
+#!/bin/sh -e
+
+root=$(git rev-parse --show-cdup 2>/dev/null) || \
+     { echo "Not under git control. Cannot install git hooks." >&2 ; exit 0 ; }
+
+dst="${root}"$(git rev-parse --git-path hooks/)
+src=util/git-hooks/ # relative to root
+hooks=$(cd "${root}${src}" && git ls-files -c | grep -Ev 'install.sh|wrapper.sh')
+
+for h in $hooks; do
+	# Test if hook is not already installed, i.e. doesn't point at the wrapper
+	if [ ! "${dst}$h" -ef "${root}${src}wrapper.sh" ]; then
+		# preserve custom hooks if any
+		if [ -e "${dst}$h" ]; then
+			mv "${dst}$h" "${dst}$h.local"
+		fi
+		ln -s "../../${src}wrapper.sh" "${dst}$h"
+	fi
+done
diff --git a/util/git-hooks/pre-applypatch b/util/git-hooks/pre-applypatch
new file mode 100755
index 0000000..2ed28f7
--- /dev/null
+++ b/util/git-hooks/pre-applypatch
@@ -0,0 +1,12 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed
+# by applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/pre-commit" &&
+	exec "$GIT_DIR/hooks/pre-commit" ${1+"$@"}
+:
diff --git a/util/git-hooks/pre-commit b/util/git-hooks/pre-commit
new file mode 100755
index 0000000..dbccb9e
--- /dev/null
+++ b/util/git-hooks/pre-commit
@@ -0,0 +1,9 @@
+#!/bin/sh
+#
+# A hook script to verify what is about to be committed.
+# Called by "git commit" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+
+# Check for whitespace errors
+git diff-index --check --cached HEAD -- || exit 1
diff --git a/util/git-hooks/pre-push b/util/git-hooks/pre-push
new file mode 100755
index 0000000..b7e34ee
--- /dev/null
+++ b/util/git-hooks/pre-push
@@ -0,0 +1,74 @@
+#!/bin/sh
+
+# A hook script to verify what is about to be pushed.  Called by "git
+# push" after it has checked the remote status, but before anything has been
+# pushed.  If this script exits with a non-zero status nothing will be pushed.
+#
+# This hook is called with the following parameters:
+#
+# $1 -- Name of the remote to which the push is being done
+# $2 -- URL to which the push is being done
+#
+# If pushing without using a named remote those arguments will be equal.
+#
+# Information about the commits which are being pushed is supplied as lines to
+# the standard input in the form:
+#
+#   <local ref> <local sha1> <remote ref> <remote sha1>
+
+remote="$1"
+url="$2"
+
+zero=0000000000000000000000000000000000000000
+
+upstream_pattern="github\.com.flashrom/flashrom(\.git)?|flashrom\.org.git/flashrom(\.git)?"
+precious_branches=( stable staging )
+
+# Only care about the upstream repository
+if echo "$url" | grep -q -v -E "$upstream_pattern" ; then
+	exit 0
+fi
+
+while read local_ref local_sha remote_ref remote_sha ; do
+	if [ "$remote_ref" != "refs/heads/staging" -a "$remote_ref" != "refs/heads/stable" ]; then
+		echo "Feature branches not allowed ($remote_ref)." >&2
+		exit 1
+	fi
+
+	if [ "$local_sha" = $zero ]; then
+		echo "Deletion of branches is prohibited." >&2
+		exit 1
+	else
+		if [ "$remote_sha" = "$zero" ]; then
+			echo "No new branches allowed." >&2
+			exit 1
+		else
+			range="$remote_sha..$local_sha"
+		fi
+
+		# Check for Signed-off-by and Acked-by
+		commit=$(git rev-list -n 1 --all-match --invert-grep -E \
+			--grep '^Signed-off-by: .+ <.+@.+\..+>$' --grep '^Acked-by: .+ <.+@.+\..+>$' "$range")
+		if [ -n "$commit" ]; then
+			echo "No Signoff or Ack found in commit $local_sha in $local_ref, not pushing." >&2
+			exit 1
+		fi
+
+		# Make _really_ sure we do not rewrite precious history
+		for lbranch in "${precious_branches[@]}"; do
+			if [ "$remote_ref" = "refs/heads/$lbranch" ]; then
+				nonreachable=$(git rev-list $remote_sha ^$local_sha)
+				if [ -n "$nonreachable" ]; then
+					echo "Only fast-forward pushes are allowed on $lbranch." >&2
+					echo "$nonreachable is not included in $remote_sha while pusing to $remote_ref" >&2
+					exit 1
+				fi
+			fi
+		done
+
+		# FIXME: check commit log format (subject without full stop at the end etc).
+		# FIXME: do buildbot checks if authorized?
+	fi
+done
+
+exit 0
diff --git a/util/git-hooks/wrapper.sh b/util/git-hooks/wrapper.sh
new file mode 100755
index 0000000..3fc3e05
--- /dev/null
+++ b/util/git-hooks/wrapper.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+if [ -x $0.local ]; then
+	$0.local "$@" || exit $?
+fi
+
+hook=$(git rev-parse --show-toplevel)"/util/git-hooks/"$(basename $0)
+if [ -x $hook ]; then
+	$hook "$@" || exit $?
+fi