internal/hookd/hookd.go
400 lines · 13075 bytes
1// Package hookd is the unix-socket bridge between git hooks and the daemon.
2// The hook process (gitbayd in hook mode) computes git facts — it inherits
3// git's quarantine environment, which the daemon does not see — and sends
4// them here; the daemon answers with a policy decision.
5//
6// pre-receive is two-phase when the repo requires signed commits: the first
7// response sets NeedCommits, and the hook answers with the raw commit
8// objects (only the hook can read them out of quarantine) for verification.
9package hookd
10
11import (
12 "crypto/sha256"
13 "encoding/json"
14 "fmt"
15 "log/slog"
16 "net"
17 "os"
18 "path"
19 "path/filepath"
20 "strings"
21 "time"
22
23 "gitbay.org/gitbay/internal/ci"
24 "gitbay.org/gitbay/internal/config"
25 "gitbay.org/gitbay/internal/control"
26 "gitbay.org/gitbay/internal/gitutil"
27 "gitbay.org/gitbay/internal/policy"
28 "gitbay.org/gitbay/internal/sig"
29 "gitbay.org/gitbay/internal/store"
30)
31
32// Env variable names passed to git transport subprocesses and inherited by
33// hooks.
34const (
35 EnvSocket = "GITBAY_HOOK_SOCKET"
36 EnvRepoID = "GITBAY_REPO_ID"
37 EnvUserID = "GITBAY_USER_ID"
38)
39
40type Request struct {
41 Hook string `json:"hook"` // pre-receive | post-receive
42 RepoID int64 `json:"repo_id"`
43 UserID int64 `json:"user_id"`
44 Updates []policy.RefUpdate `json:"updates"`
45}
46
47// RawCommit is one incoming commit object. When NeedCommits is set the
48// hook streams these one per JSON value and ends with a zero one, rather
49// than sending a single message holding every commit in the push: an
50// initial push of a large history is tens of thousands of them (#100).
51type RawCommit struct {
52 SHA string `json:"sha"`
53 Raw []byte `json:"raw"`
54}
55
56// Done marks the end of the commit stream.
57func (c RawCommit) Done() bool { return c.SHA == "" }
58
59type Response struct {
60 Allow bool `json:"allow"`
61 Message string `json:"message,omitempty"`
62 NeedCommits bool `json:"need_commits,omitempty"`
63}
64
65// SocketPath returns the hook socket location. It prefers the server root,
66// but unix socket paths are capped (~104 bytes on macOS, 108 on Linux), so
67// deep roots fall back to a hashed name under the system temp directory.
68// Hooks receive the chosen path via GITBAY_HOOK_SOCKET, so both sides always
69// agree.
70func SocketPath(root string) string {
71 p := filepath.Join(root, "hook.sock")
72 if len(p) <= 100 {
73 return p
74 }
75 sum := sha256.Sum256([]byte(root))
76 return filepath.Join(os.TempDir(), fmt.Sprintf("gitbay-%x.sock", sum[:8]))
77}
78
79type Server struct {
80 cfg config.Config
81 st *store.Store
82}
83
84// Serve listens on the unix socket until the listener is closed.
85func Serve(cfg config.Config, st *store.Store) (func() error, error) {
86 path := SocketPath(cfg.Server.Root)
87 os.Remove(path)
88 ln, err := net.Listen("unix", path)
89 if err != nil {
90 return nil, err
91 }
92 s := &Server{cfg: cfg, st: st}
93 go func() {
94 for {
95 conn, err := ln.Accept()
96 if err != nil {
97 return
98 }
99 go s.handle(conn)
100 }
101 }()
102 return ln.Close, nil
103}
104
105func (s *Server) handle(conn net.Conn) {
106 defer conn.Close()
107 dec := json.NewDecoder(conn)
108 enc := json.NewEncoder(conn)
109 var req Request
110 if err := dec.Decode(&req); err != nil {
111 enc.Encode(Response{Allow: false, Message: "bad hook request"})
112 return
113 }
114 switch req.Hook {
115 case "pre-receive":
116 s.preReceive(req, dec, enc)
117 case "post-receive":
118 s.postReceive(req)
119 enc.Encode(Response{Allow: true})
120 default:
121 enc.Encode(Response{Allow: false, Message: fmt.Sprintf("unknown hook %q", req.Hook)})
122 }
123}
124
125func (s *Server) preReceive(req Request, dec *json.Decoder, enc *json.Encoder) {
126 repo, err := s.st.RepoByID(req.RepoID)
127 if err != nil {
128 enc.Encode(Response{Allow: false, Message: "unknown repository"})
129 return
130 }
131 if msg := policy.CheckPush(repo, req.Updates); msg != "" {
132 enc.Encode(Response{Allow: false, Message: msg})
133 return
134 }
135 if !repo.Settings.RequireSignedCommits {
136 enc.Encode(Response{Allow: true})
137 return
138 }
139
140 // Phase two: ask the hook for the incoming commit objects.
141 if err := enc.Encode(Response{Allow: true, NeedCommits: true}); err != nil {
142 return
143 }
144 // Each commit is verified as it arrives, so nothing holds the push in
145 // memory. The first refusal decides the answer, but the stream is
146 // still drained to its end before replying: the hook is writing, and
147 // answering early would leave it writing into a socket nobody reads.
148 // Draining costs a decode per commit and no verification.
149 db := store.SigDB{Store: s.st}
150 refusal := ""
151 for {
152 var rc RawCommit
153 if err := dec.Decode(&rc); err != nil {
154 enc.Encode(Response{Allow: false, Message: "bad commits payload"})
155 return
156 }
157 if rc.Done() {
158 break
159 }
160 if refusal != "" {
161 continue
162 }
163 parsed, err := sig.ParseCommit(rc.Raw)
164 if err != nil {
165 refusal = fmt.Sprintf("unparseable commit %s", rc.SHA)
166 continue
167 }
168 res, err := sig.VerifyCommit(db, parsed)
169 if err != nil || res.State != sig.Verified {
170 state := "error"
171 if err == nil {
172 state = string(res.State)
173 }
174 refusal = fmt.Sprintf("this repository requires signed commits: %.10s is %s", rc.SHA, state)
175 }
176 }
177 if refusal != "" {
178 enc.Encode(Response{Allow: false, Message: refusal})
179 return
180 }
181 enc.Encode(Response{Allow: true})
182}
183
184// postReceive applies the cross-repo MR effect: a push to a source branch
185// refreshes refs/merge-requests/N/head in every target repo, by fetching —
186// the target owns the objects, so the MR outlives the fork. This is the only
187// place a hook writes outside its own repository.
188func (s *Server) postReceive(req Request) {
189 pushedRepo, pushedRepoErr := s.st.RepoByID(req.RepoID)
190 if pushedRepoErr == nil {
191 s.adoptDefaultBranch(&pushedRepo, req.Updates)
192 }
193 for _, u := range req.Updates {
194 // Every ref update is an event webhooks can subscribe to.
195 s.st.RecordEvent(req.RepoID, req.UserID, "push", fmt.Sprintf(
196 `{"ref":%q,"old":%q,"new":%q,"forced":%v,"deleted":%v}`,
197 u.Ref, u.Old, u.New, u.IsForce, u.IsDelete))
198
199 // Any ref update — branch or tag — schedules the push mirrors.
200 s.st.MarkMirrorsDirty(req.RepoID, "push")
201
202 // Tag pushes run the tag-triggered CI jobs.
203 if tag, ok := strings.CutPrefix(u.Ref, "refs/tags/"); ok && !u.IsDelete && pushedRepoErr == nil {
204 s.queueTagBuilds(pushedRepo, req.UserID, tag, u.New)
205 }
206
207 branch, ok := cutHeads(u.Ref)
208 if !ok {
209 continue
210 }
211 // Commits landing on the default branch act on issue references
212 // in their messages (closes #N, plain #N).
213 if pushedRepoErr == nil && branch == pushedRepo.DefaultBranch && !u.IsDelete {
214 dir := control.RepoDir(s.cfg.Server.Root, pushedRepo.OwnerName, pushedRepo.Name)
215 control.ProcessCommitMessages(s.st, dir, pushedRepo, req.UserID, u.Old, u.New)
216 control.RecordLandedCommits(s.st, dir, pushedRepo, u.Old, u.New)
217 }
218 // A branch push with a .gitbay/ci.yml queues one build per job.
219 if pushedRepoErr == nil && !u.IsDelete {
220 s.queueBuilds(pushedRepo, req.UserID, branch, u.Old, u.New)
221 }
222 if u.IsForce {
223 s.st.Audit(req.UserID, "push.forced", map[string]any{
224 "repo": req.RepoID, "ref": u.Ref, "old": u.Old, "new": u.New})
225 }
226 mrs, err := s.st.OpenMRsBySource(req.RepoID, branch)
227 if err != nil {
228 slog.Error("post-receive: listing MRs", "err", err)
229 continue
230 }
231 srcRepo, err := s.st.RepoByID(req.RepoID)
232 if err != nil {
233 continue
234 }
235 srcDir := control.RepoDir(s.cfg.Server.Root, srcRepo.OwnerName, srcRepo.Name)
236 for _, mr := range mrs {
237 target, err := s.st.RepoByID(mr.RepoID)
238 if err != nil {
239 continue
240 }
241 if u.IsDelete {
242 if mr.State == "open" {
243 s.st.SetMRState(mr.ID, "source_gone")
244 }
245 continue // head ref retained: the diff stays viewable
246 }
247 dstDir := control.RepoDir(s.cfg.Server.Root, target.OwnerName, target.Name)
248 headRef := fmt.Sprintf("refs/merge-requests/%d/head", mr.Number)
249 if err := gitutil.FetchInto(dstDir, srcDir, u.New, headRef); err != nil {
250 slog.Error("post-receive: refreshing MR head", "mr", mr.Number, "err", err)
251 continue
252 }
253 // The merge base as it stands now, so a later range-diff
254 // compares each revision against the target it was written
255 // on rather than against today's. Best-effort: a base that
256 // cannot be worked out costs precision, not the record.
257 base, err := gitutil.MergeBase(dstDir, "refs/heads/"+mr.TargetRef, headRef)
258 if err != nil {
259 base = ""
260 }
261 if err := s.st.UpdateMRHead(mr.ID, u.New, base); err != nil {
262 slog.Error("post-receive: recording MR head", "mr", mr.Number, "err", err)
263 }
264 if srcRepo.ID != target.ID {
265 control.QueueMRBuilds(s.st, s.cfg.Server.Root, s.cfg.Server.SiteURL,
266 target, req.UserID, mr.Number, u.New)
267 }
268 if mr.State == "source_gone" {
269 s.st.SetMRState(mr.ID, "open") // branch came back
270 }
271 }
272 }
273}
274
275// adoptDefaultBranch moves an unborn HEAD to the first branch a push
276// creates. A repository is initialised with HEAD at the stored default,
277// and a first push of master or trunk left HEAD naming a branch that did
278// not exist: clones checked out nothing and every surface asked git for
279// a branch that was not there (#189). A push that includes the default
280// branch itself needs nothing.
281func (s *Server) adoptDefaultBranch(repo *store.Repo, updates []policy.RefUpdate) {
282 dir := control.RepoDir(s.cfg.Server.Root, repo.OwnerName, repo.Name)
283 if _, err := gitutil.ResolveRef(dir, "refs/heads/"+repo.DefaultBranch); err == nil {
284 return
285 }
286 for _, u := range updates {
287 branch, ok := cutHeads(u.Ref)
288 if !ok || u.IsDelete || !gitutil.ZeroSHA(u.Old) {
289 continue
290 }
291 if err := gitutil.SetHead(dir, branch); err != nil {
292 slog.Error("post-receive: moving HEAD", "repo", repo.Path(), "err", err)
293 return
294 }
295 if err := s.st.UpdateDefaultBranch(repo.ID, branch); err != nil {
296 slog.Error("post-receive: recording default branch", "repo", repo.Path(), "err", err)
297 return
298 }
299 repo.DefaultBranch = branch
300 return
301 }
302}
303
304// queueBuilds queues the push jobs for a branch update. The work is
305// shared with the merge path, which moves a ref without reaching a hook.
306func (s *Server) queueBuilds(repo store.Repo, userID int64, branch, old, sha string) {
307 control.QueueBranchBuilds(
308 s.st, s.cfg.Server.Root, s.cfg.Server.SiteURL,
309 repo, userID, branch, old, sha, time.Now())
310}
311
312// queueTagBuilds runs the jobs whose tag pattern matches a pushed tag.
313// The build records the tag as its ref and the peeled commit as its sha,
314// so statuses land on the commit, not an annotated tag object.
315func (s *Server) queueTagBuilds(repo store.Repo, userID int64, tag, pushed string) {
316 dir := control.RepoDir(s.cfg.Server.Root, repo.OwnerName, repo.Name)
317 sha, err := gitutil.PeelToCommit(dir, pushed)
318 if err != nil {
319 return
320 }
321 raw, err := gitutil.ReadBlob(dir, sha, ci.ConfigPath, 1<<16)
322 if err != nil {
323 return
324 }
325 jobs, err := ci.Parse(raw)
326 if err != nil {
327 return // the branch push already reported ci/config
328 }
329 for _, j := range jobs {
330 if j.Tags == "" {
331 continue
332 }
333 if ok, _ := path.Match(j.Tags, tag); !ok {
334 continue
335 }
336 steps, _ := json.Marshal(j.Steps)
337 n, err := s.st.CreateBuild(repo.ID, j.Name, sha, tag, string(steps), j.Image, "", true)
338 if err != nil {
339 slog.Error("queueing tag build", "repo", repo.Path(), "job", j.Name, "err", err)
340 continue
341 }
342 url := fmt.Sprintf("%s/%s/builds/%d", s.cfg.Server.SiteURL, repo.Path(), n)
343 s.st.SetCommitStatus(repo.ID, sha, "ci/"+j.Name, "pending", "tag "+tag, url, userID)
344 }
345}
346
347func cutHeads(ref string) (string, bool) {
348 const p = "refs/heads/"
349 if len(ref) > len(p) && ref[:len(p)] == p {
350 return ref[len(p):], true
351 }
352 return "", false
353}
354
355// Ask sends one request from the hook process to the daemon. stream is
356// called if the daemon asks for the incoming commit objects; it hands each
357// commit to the callback, which writes it on the wire.
358func Ask(socketPath string, req Request, stream func(emit func(RawCommit) error) error) (Response, error) {
359 conn, err := net.Dial("unix", socketPath)
360 if err != nil {
361 return Response{}, err
362 }
363 defer conn.Close()
364 enc := json.NewEncoder(conn)
365 dec := json.NewDecoder(conn)
366 if err := enc.Encode(req); err != nil {
367 return Response{}, err
368 }
369 var resp Response
370 if err := dec.Decode(&resp); err != nil {
371 return Response{}, err
372 }
373 if !resp.NeedCommits {
374 return resp, nil
375 }
376 if err := stream(func(rc RawCommit) error { return enc.Encode(rc) }); err != nil {
377 return Response{}, err
378 }
379 if err := enc.Encode(RawCommit{}); err != nil { // end of stream
380 return Response{}, err
381 }
382 err = dec.Decode(&resp)
383 return resp, err
384}
385
386// WriteHookScripts (re)generates the shared hooks directory. Called at
387// daemon startup so a moved binary self-heals; every repo points here via
388// core.hooksPath.
389func WriteHookScripts(hooksDir, gitbaydPath string) error {
390 if err := os.MkdirAll(hooksDir, 0o755); err != nil {
391 return err
392 }
393 for _, hook := range []string{"pre-receive", "post-receive"} {
394 script := fmt.Sprintf("#!/bin/sh\nexec %q hook %s\n", gitbaydPath, hook)
395 if err := os.WriteFile(filepath.Join(hooksDir, hook), []byte(script), 0o755); err != nil {
396 return err
397 }
398 }
399 return nil
400}