Add SHA512 tree hash to merge commits

Author: sipa

contrib/devtools/github-merge.py

@@ -18,6 +18,7 @@
 import os
 from sys import stdin,stdout,stderr
 import argparse
+import hashlib
 import subprocess
 import json,codecs
 try:
@@ -69,6 +70,27 @@ def ask_prompt(text):
     print("",file=stderr)
     return reply
 
+def tree_sha512sum():
+    files = sorted(subprocess.check_output([GIT, 'ls-tree', '--full-tree', '-r', '--name-only', 'HEAD']).splitlines())
+    overall = hashlib.sha512()
+    for f in files:
+        intern = hashlib.sha512()
+        fi = open(f, 'rb')
+        while True:
+            piece = fi.read(65536)
+            if piece:
+                intern.update(piece)
+            else:
+                break
+        fi.close()
+        dig = intern.hexdigest()
+        overall.update(dig.encode("utf-8"))
+        overall.update("  ".encode("utf-8"))
+        overall.update(f)
+        overall.update("\n".encode("utf-8"))
+    return overall.hexdigest()
+
+
 def parse_arguments():
     epilog = '''
         In addition, you can set the following git configuration variables:
@@ -157,6 +179,9 @@ def main():
     subprocess.check_call([GIT,'checkout','-q','-b',local_merge_branch])
 
     try:
+        # Go up to the repository's root.
+        toplevel = subprocess.check_output([GIT,'rev-parse','--show-toplevel']).strip()
+        os.chdir(toplevel)
         # Create unsigned merge commit.
         if title:
             firstline = 'Merge #%s: %s' % (pull,title)
@@ -175,14 +200,29 @@ def main():
             print("ERROR: Creating merge failed (already merged?).",file=stderr)
             exit(4)
 
+        # Put tree SHA512 into the message
+        try:
+            first_sha512 = tree_sha512sum()
+            message += '\n\nTree-SHA512: ' + first_sha512
+        except subprocess.CalledProcessError as e:
+            printf("ERROR: Unable to compute tree hash")
+            exit(4)
+        try:
+            subprocess.check_call([GIT,'commit','--amend','-m',message.encode('utf-8')])
+        except subprocess.CalledProcessError as e:
+            printf("ERROR: Cannot update message.",file=stderr)
+            exit(4)
+        second_sha512 = tree_sha512sum()
+        if first_sha512 != second_sha512:
+            print("ERROR: Tree hash changed unexpectedly",file=stderr)
+            exit(4)
+
         print('%s#%s%s %s %sinto %s%s' % (ATTR_RESET+ATTR_PR,pull,ATTR_RESET,title,ATTR_RESET+ATTR_PR,branch,ATTR_RESET))
         subprocess.check_call([GIT,'log','--graph','--topo-order','--pretty=format:'+COMMIT_FORMAT,base_branch+'..'+head_branch])
         print()
+
         # Run test command if configured.
         if testcmd:
-            # Go up to the repository's root.
-            toplevel = subprocess.check_output([GIT,'rev-parse','--show-toplevel']).strip()
-            os.chdir(toplevel)
             if subprocess.call(testcmd,shell=True):
                 print("ERROR: Running %s failed." % testcmd,file=stderr)
                 exit(5)