1+ #! /bin/sh
2+
3+ if git rev-parse --verify HEAD > /dev/null 2>&1
4+ then
5+ against=HEAD
6+ else
7+ # Initial commit: diff against an empty tree object
8+ EMPTY_TREE=$( git hash-object -t tree /dev/null)
9+ against=$EMPTY_TREE
10+ fi
11+
12+ # Redirect output to stderr.
13+ exec 1>&2
14+
15+ echo " ======================================================="
16+ echo " Running Verification for tokens, secret keys, etc..."
17+ echo " ======================================================="
18+ echo " "
19+
20+ PROJECT_ROOT=$( git rev-parse --show-toplevel)
21+ PATTERNS_FILE=" .secret-key-patterns"
22+ PATTERNS_PATH=" $PROJECT_ROOT /$PATTERNS_FILE "
23+
24+ if [ ! -f " $PATTERNS_PATH " ; then
25+ echo " ========================= ERROR ========================="
26+ echo " Secret key patterns file not found at: $PATTERNS_PATH "
27+ echo " Please create this file in your project root to define the secret patterns."
28+ echo " Commit aborted."
29+ echo " ======================================================="
30+ exit 1
31+ fi
32+
33+
34+ source " $PATTERNS_PATH "
35+
36+ # FILES_MODIFIED=$(git diff --cached --name-only -z $against)
37+ FILES_MODIFIED=$( git diff --cached --name-only)
38+
39+ NUM_FILES_CHECKED=0
40+ NUM_FILES_OFFENCES=0
41+
42+ exec < /dev/tty
43+
44+ for F in $FILES_MODIFIED
45+ do
46+
47+ for i in " ${! git_verification_patterns[@]} " ; do
48+
49+ MATCH=$( cat $F | egrep -i --line-number " ${git_verification_patterns[$i]} " )
50+
51+ if [ ! -z " $MATCH " ; then
52+ echo " \t FILE: $F "
53+ echo " \tPATTERN: ${git_verification_patterns[$i]} "
54+ echo " \t DESC: ${git_verification_patterns_desc[$i]} "
55+ echo " \tLINE(S):"
56+ for L in $MATCH ; do
57+ echo " \t\t$L "
58+ done
59+
60+ while true ; do
61+ read -p " Commit file anyway? (y/N): "
62+ case $yn in
63+ [Yy] ) break ;;
64+ [Nn] ) NUM_FILES_OFFENCES=$(( NUM_FILES_OFFENCES+ 1 )) ; break ;;
65+ * ) echo " Answer y or n." ; continue ;;
66+ esac
67+ done
68+
69+ echo " \t---------------------------"
70+ fi
71+
72+ done
73+
74+ # Now also do a verification pattern for an SSH private key file
75+ MATCH=$( cat $F | egrep -i --line-number " ${git_verification_patterns_ssh_key} " )
76+ NUM_SSH_PK_LINES_FOUND=$( cat $F | egrep -i --line-number ${git_verification_patterns_ssh_key} | wc -l | awk ' {print $1}' )
77+
78+ if (( $NUM_SSH_PK_LINES_FOUND >= 3 )) ; then
79+ echo " \t FILE: $F "
80+ echo " \tPATTERN: ${git_verification_patterns_ssh_key} "
81+ echo " \t DESC: ${git_verification_patterns_desc[$i]} "
82+ echo " \tLINE(S):"
83+ for L in $MATCH ; do
84+ echo " \t\t$L "
85+ done
86+
87+ while true ; do
88+ read -p " Commit file anyway? (y/N): "
89+ case $yn in
90+ [Yy] ) break ;;
91+ [Nn] ) NUM_FILES_OFFENCES=$(( NUM_FILES_OFFENCES+ 1 )) ; break ;;
92+ * ) echo " Answer y or n." ; continue ;;
93+ esac
94+ done
95+
96+ echo " \t---------------------------"
97+ fi
98+
99+ NUM_FILES_CHECKED=$(( NUM_FILES_CHECKED+ 1 ))
100+
101+ done
102+
103+ exec < & - # Release input
104+
105+ echo " ======================= SUMMARY ======================="
106+ echo " Files Checked: $NUM_FILES_CHECKED "
107+ echo " Num File Offences: $NUM_FILES_OFFENCES "
108+ if [ $NUM_FILES_OFFENCES -gt 0 ]; then
109+ echo " Status: FAIL"
110+ else
111+ echo " Status: OK"
112+ fi
113+ echo " -------------------------------------------------------"
114+ echo " "
115+
116+
117+ # Exit code based on if > 0 offences found
118+ if [ $NUM_FILES_OFFENCES -gt 0 ]; then
119+ exit 1
120+ else
121+ exit 0
122+ fi
0 commit comments