tools/dist/collect_sigs.py - subversion - Git at Google

 #!/usr/bin/env python
 #
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
 # regarding copyright ownership.  The ASF licenses this file
 # to you under the Apache License, Version 2.0 (the
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
 #
 #   http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing,
 # software distributed under the License is distributed on an
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
 #
 #
 # A script intended to be useful in helping to collect signatures for a
 # release.  This is a pretty rough, and patches are welcome to improve it.
 #
 # Some thoughts about future improvement:
 #  * Display of per-file and per-release statistics
 #  * Make use of the python-gpg package (http://code.google.com/p/python-gnupg/)
 #  * Post to IRC when a new signature is collected
 #    - Since we don't want to have a long running bot, perhaps we could
 #      also patch wayita to accept and then echo a privmsg?
 #  * Mail dev@ when somebody submits a successful signature, and include a
 #    comments field which could be included in the mail.
 #  * Use a subversion repository instead of sqlite backend
 #    - no need to re-invent storage and retrieval
 #    - perhaps we could re-use existing CIA/mailer hooks?
 #

 import sys, os
 import sqlite3

 def make_config():
   'Output a blank config file'

   if os.path.exists('config.py'):
     print "'config.py' already exists!'"
     sys.exit(1)

   conf = open('config.py', 'w')
   conf.write("version = ''\n")
   conf.write("sigdir = ''\n")
   conf.write("filesdir = ''\n")
   conf.close()

   print "'config.py' generated"

 def make_db():
   'Initialize a blank database'

   db = sqlite3.connect('sigs.db')
   db.execute('''
     CREATE TABLE signatures (
       keyid TEXT, filename TEXT, signature BLOB,
       UNIQUE(keyid,filename)
     );
 ''');

 # This function is web-facing
 def generate_asc_files(target_dir='.'):
   fds = {}
   def _open(filename):
     if not fds.has_key(filename):
       fd = open(os.path.join(target_dir, filename + '.asc'), 'w')
       fds[filename] = fd
     return fds[filename]

   db = sqlite3.connect(os.path.join(target_dir, 'sigs.db'))
   curs = db.cursor()
   curs.execute('SELECT filename, signature FROM signatures;')
   for filename, signature in curs:
     fd = _open(filename)
     fd.write(signature + "\n")

   for fd in fds.values():
     fd.flush()
     fd.close()

 actions = {
     'make_config' : make_config,
     'make_db' : make_db,
     'make_asc' : generate_asc_files,
 }


 if __name__ == '__main__':
   if len(sys.argv) > 1:
     if sys.argv[1] in actions:
       actions[sys.argv[1]]()
       sys.exit(0)


 # Stuff below this line is the web-facing side
 # ======================================================================


 import cgi
 import cgitb
 cgitb.enable()

 import string, subprocess, re

 try:
   sys.path.append(os.path.dirname(sys.argv[0]))
   import config
 except:
   print 'Content-type: text/plain'
   print
   print 'Cannot find config file'
   sys.exit(1)

 r = re.compile('^\[GNUPG\:\] GOODSIG (\w*) (.*)')

 def files():
   for f in os.listdir(config.filesdir):
     if config.version in f and (f.endswith('.tar.gz') or f.endswith('.zip') or f.endswith('.tar.bz2')):
       yield f

 def ordinal(N):
   try:
     return [None, 'first', 'second', 'third', 'fourth', 'fifth', 'sixth'][N]
   except:
     # Huh?  We only have six files to sign.
     return "%dth" % N

 shell_content = '''
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html>
 <head>
 <title>Signature collection for Subversion $version</title>
 </head>
 <body style="font-size: 14pt; text-align: justify;
   background-color: #f0f0f0; padding: 0 5%%">
 <p>This page is used to collect <a href="%s/list">signatures</a> for the
 proposed release of Apache Subversion $version.</p>
 $content
 </body>
 </html>
 ''' % os.getenv('SCRIPT_NAME')

 signature_area = '''
 <hr/>
 <form method="post" action="%s">
 <p>Paste one or more signatures in the area below:<br/>
 <textarea name="signatures" rows="20" cols="80"></textarea>
 </p>
 <input type="submit" value="Submit" />
 <p>Any text not between the <tt>BEGIN PGP SIGNATURE</tt>
 and <tt>END PGP SIGNATURE</tt> lines will be ignored.</p>
 </form>
 <hr/>
 ''' % os.getenv('SCRIPT_NAME')


 def split(sigs):
   lines = []
   for line in sigs.split('\n'):
     if lines or '--BEGIN' in line:
       lines.append(line)
     if '--END' in line:
       yield "\n".join(lines) + "\n"
       lines = []

 def list_signatures():
   db = sqlite3.connect(os.path.join(config.sigdir, 'sigs.db'))
   template = '''
 <hr/>
 <p>The following signature files are available:</p>
 <p>%s</p>
 '''

   lines = ""
   curs = db.cursor()
   curs.execute('''SELECT filename, COUNT(*) FROM signatures
                   GROUP BY filename ORDER BY filename''')
   for filename, count in curs:
     lines += '<a href="%s/%s.asc">%s.asc</a>: %d signature%s<br/>\n' \
              % (os.getenv('SCRIPT_NAME'), filename, filename,
                 count, ['s', ''][count == 1])
   return (template % lines) + signature_area

 def save_valid_sig(db, filename, keyid, signature):
   db.execute('INSERT OR REPLACE INTO signatures VALUES (?,?,?);',
              (keyid, filename, buffer(signature)))
   db.commit()

   generate_asc_files(config.sigdir)

 def verify_sig_for_file(signature, filename):
   args = ['gpg', '--logger-fd', '1', '--no-tty',
           '--status-fd', '2', '--verify', '-',
           os.path.join(config.filesdir, filename)]

   gpg = subprocess.Popen(args,
                          stdin=subprocess.PIPE,
                          stdout=subprocess.PIPE,
                          stderr=subprocess.PIPE)

   gpg.stdin.write(signature)
   gpg.stdin.close()

   rc = gpg.wait()
   output = gpg.stdout.read()
   status = gpg.stderr.read()

   if rc:
     return (False, status + output)

   lines = status.split('\n')
   for line in lines:
     match = r.search(line)
     if match:
       keyid = match.group(1)
       user = match.group(2)

   return (True, (filename, keyid, user))

 def verify_sig(signature):
   all_failures = ""
   for filename in files():
     (verified, result) = verify_sig_for_file(signature, filename)
     if verified:
       return (verified, result)
     else:
       all_failures += "%s:\n[[[\n%s]]]\n\n" % (filename, result)
   return (False, all_failures)

 def process_sigs(signatures):
   success = '''
   <p style="color: green;">All %d signatures verified!</p>
 '''
   failure = '''
   <p style="color: red;">%d of %d signatures failed to verify; details below.</p>
 '''
   c_verified = '''
   <p style="color: green;">The signature is verified!</p>
   <p>Filename: <code>%s</code></p>
   <p>Key ID: <code>%s</code></p>
   <p>User: <code>%s</code></p>
   <p>This signature has been saved, and will be included as part of the
     release signatures.</p>
 '''
   c_unverified = '''
   <p style="color: red;">The signature was not able to be verified!</p>
   <p>Signature: <pre>%s</pre></p>
   <p>Reason:</p><pre>%s</pre>
   <p>Please talk to the release manager if this is in error.</p>
 '''

   outcomes = []
   N_sigs = 0
   N_verified = 0
   retval = ''

   # Verify
   db = sqlite3.connect(os.path.join(config.sigdir, 'sigs.db'))
   for signature in split(signatures):
     N_sigs += 1
     (verified, result) = verify_sig(signature)
     outcomes.append((verified, result))

     if verified:
       (filename, keyid, user) = result
       save_valid_sig(db, filename, keyid, signature)
       N_verified += 1

   # Output header
   if N_verified == N_sigs:
     retval += success % N_sigs
   else:
     retval += failure % (N_sigs-N_verified, N_sigs)

   # Output details
   N = 0
   for outcome in outcomes:
     N += 1
     (verified, result) = outcome
     retval += "<h1>Results for the %s signature</h1>" % ordinal(N)
     if verified:
       (filename, keyid, user) = result
       retval += c_verified % (filename, keyid[-8:], user)
     else:
       retval += c_unverified % (signature, result)

   return retval + signature_area


 def cat_signatures(basename):
   # strip '.asc' extension
   assert basename[:-4] in files()

   # cat
   ascfile = os.path.join(config.sigdir, basename)
   if os.path.exists(ascfile):
     return (open(ascfile, 'r').read())

 def print_content_type(mimetype):
   print "Content-Type: " + mimetype
   print

 def main():
   form = cgi.FieldStorage()
   pathinfo = os.getenv('PATH_INFO')

   # default value, to be changed below
   content = signature_area

   if 'signatures' in form:
     content = process_sigs(form['signatures'].value)

   elif pathinfo and pathinfo[1:]:
     basename = pathinfo.split('/')[-1]

     if basename == 'list':
       content = list_signatures()

     elif basename[:-4] in files():
       # early exit; bypass 'content' entirely
       print_content_type('text/plain')
       print cat_signatures(basename)
       return

   # These are "global" values, not specific to our action.
   mapping = {
       'version' : config.version,
       'content' : content,
     }

   print_content_type('text/html')

   template = string.Template(shell_content)
   print template.safe_substitute(mapping)


 if __name__ == '__main__':
   main()
	#!/usr/bin/env python
	#
	#
	# Licensed to the Apache Software Foundation (ASF) under one
	# or more contributor license agreements. See the NOTICE file
	# distributed with this work for additional information
	# regarding copyright ownership. The ASF licenses this file
	# to you under the Apache License, Version 2.0 (the
	# "License"); you may not use this file except in compliance
	# with the License. You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing,
	# software distributed under the License is distributed on an
	# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	# KIND, either express or implied. See the License for the
	# specific language governing permissions and limitations
	# under the License.
	#
	#
	# A script intended to be useful in helping to collect signatures for a
	# release. This is a pretty rough, and patches are welcome to improve it.
	#
	# Some thoughts about future improvement:
	# * Display of per-file and per-release statistics
	# * Make use of the python-gpg package (http://code.google.com/p/python-gnupg/)
	# * Post to IRC when a new signature is collected
	# - Since we don't want to have a long running bot, perhaps we could
	# also patch wayita to accept and then echo a privmsg?
	# * Mail dev@ when somebody submits a successful signature, and include a
	# comments field which could be included in the mail.
	# * Use a subversion repository instead of sqlite backend
	# - no need to re-invent storage and retrieval
	# - perhaps we could re-use existing CIA/mailer hooks?
	#

	import sys, os
	import sqlite3

	def make_config():
	'Output a blank config file'

	if os.path.exists('config.py'):
	print "'config.py' already exists!'"
	sys.exit(1)

	conf = open('config.py', 'w')
	conf.write("version = ''\n")
	conf.write("sigdir = ''\n")
	conf.write("filesdir = ''\n")
	conf.close()

	print "'config.py' generated"

	def make_db():
	'Initialize a blank database'

	db = sqlite3.connect('sigs.db')
	db.execute('''
	CREATE TABLE signatures (
	keyid TEXT, filename TEXT, signature BLOB,
	UNIQUE(keyid,filename)
	);
	''');

	# This function is web-facing
	def generate_asc_files(target_dir='.'):
	fds = {}
	def _open(filename):
	if not fds.has_key(filename):
	fd = open(os.path.join(target_dir, filename + '.asc'), 'w')
	fds[filename] = fd
	return fds[filename]

	db = sqlite3.connect(os.path.join(target_dir, 'sigs.db'))
	curs = db.cursor()
	curs.execute('SELECT filename, signature FROM signatures;')
	for filename, signature in curs:
	fd = _open(filename)
	fd.write(signature + "\n")

	for fd in fds.values():
	fd.flush()
	fd.close()

	actions = {
	'make_config' : make_config,
	'make_db' : make_db,
	'make_asc' : generate_asc_files,
	}


	if __name__ == '__main__':
	if len(sys.argv) > 1:
	if sys.argv[1] in actions:
	actions[sys.argv[1]]()
	sys.exit(0)


	# Stuff below this line is the web-facing side
	# ======================================================================


	import cgi
	import cgitb
	cgitb.enable()

	import string, subprocess, re

	try:
	sys.path.append(os.path.dirname(sys.argv[0]))
	import config
	except:
	print 'Content-type: text/plain'
	print
	print 'Cannot find config file'
	sys.exit(1)

	r = re.compile('^\[GNUPG\:\] GOODSIG (\w) (.)')

	def files():
	for f in os.listdir(config.filesdir):
	if config.version in f and (f.endswith('.tar.gz') or f.endswith('.zip') or f.endswith('.tar.bz2')):
	yield f

	def ordinal(N):
	try:
	return [None, 'first', 'second', 'third', 'fourth', 'fifth', 'sixth'][N]
	except:
	# Huh? We only have six files to sign.
	return "%dth" % N

	shell_content = '''
	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
	"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
	<html>
	<head>
	<title>Signature collection for Subversion $version</title>
	</head>
	<body style="font-size: 14pt; text-align: justify;
	background-color: #f0f0f0; padding: 0 5%%">
	<p>This page is used to collect <a href="%s/list">signatures</a> for the
	proposed release of Apache Subversion $version.</p>
	$content
	</body>
	</html>
	''' % os.getenv('SCRIPT_NAME')

	signature_area = '''
	<hr/>
	<form method="post" action="%s">
	<p>Paste one or more signatures in the area below:<br/>
	<textarea name="signatures" rows="20" cols="80"></textarea>
	</p>
	<input type="submit" value="Submit" />
	<p>Any text not between the <tt>BEGIN PGP SIGNATURE</tt>
	and <tt>END PGP SIGNATURE</tt> lines will be ignored.</p>
	</form>
	<hr/>
	''' % os.getenv('SCRIPT_NAME')



	def split(sigs):
	lines = []
	for line in sigs.split('\n'):
	if lines or '--BEGIN' in line:
	lines.append(line)
	if '--END' in line:
	yield "\n".join(lines) + "\n"
	lines = []

	def list_signatures():
	db = sqlite3.connect(os.path.join(config.sigdir, 'sigs.db'))
	template = '''
	<hr/>
	<p>The following signature files are available:</p>
	<p>%s</p>
	'''

	lines = ""
	curs = db.cursor()
	curs.execute('''SELECT filename, COUNT(*) FROM signatures
	GROUP BY filename ORDER BY filename''')
	for filename, count in curs:
	lines += '<a href="%s/%s.asc">%s.asc</a>: %d signature%s<br/>\n' \
	% (os.getenv('SCRIPT_NAME'), filename, filename,
	count, ['s', ''][count == 1])
	return (template % lines) + signature_area

	def save_valid_sig(db, filename, keyid, signature):
	db.execute('INSERT OR REPLACE INTO signatures VALUES (?,?,?);',
	(keyid, filename, buffer(signature)))
	db.commit()

	generate_asc_files(config.sigdir)

	def verify_sig_for_file(signature, filename):
	args = ['gpg', '--logger-fd', '1', '--no-tty',
	'--status-fd', '2', '--verify', '-',
	os.path.join(config.filesdir, filename)]

	gpg = subprocess.Popen(args,
	stdin=subprocess.PIPE,
	stdout=subprocess.PIPE,
	stderr=subprocess.PIPE)

	gpg.stdin.write(signature)
	gpg.stdin.close()

	rc = gpg.wait()
	output = gpg.stdout.read()
	status = gpg.stderr.read()

	if rc:
	return (False, status + output)

	lines = status.split('\n')
	for line in lines:
	match = r.search(line)
	if match:
	keyid = match.group(1)
	user = match.group(2)

	return (True, (filename, keyid, user))

	def verify_sig(signature):
	all_failures = ""
	for filename in files():
	(verified, result) = verify_sig_for_file(signature, filename)
	if verified:
	return (verified, result)
	else:
	all_failures += "%s:\n[[[\n%s]]]\n\n" % (filename, result)
	return (False, all_failures)

	def process_sigs(signatures):
	success = '''
	<p style="color: green;">All %d signatures verified!</p>
	'''
	failure = '''
	<p style="color: red;">%d of %d signatures failed to verify; details below.</p>
	'''
	c_verified = '''
	<p style="color: green;">The signature is verified!</p>
	<p>Filename: <code>%s</code></p>
	<p>Key ID: <code>%s</code></p>
	<p>User: <code>%s</code></p>
	<p>This signature has been saved, and will be included as part of the
	release signatures.</p>
	'''
	c_unverified = '''
	<p style="color: red;">The signature was not able to be verified!</p>
	<p>Signature: <pre>%s</pre></p>
	<p>Reason:</p><pre>%s</pre>
	<p>Please talk to the release manager if this is in error.</p>
	'''

	outcomes = []
	N_sigs = 0
	N_verified = 0
	retval = ''

	# Verify
	db = sqlite3.connect(os.path.join(config.sigdir, 'sigs.db'))
	for signature in split(signatures):
	N_sigs += 1
	(verified, result) = verify_sig(signature)
	outcomes.append((verified, result))

	if verified:
	(filename, keyid, user) = result
	save_valid_sig(db, filename, keyid, signature)
	N_verified += 1

	# Output header
	if N_verified == N_sigs:
	retval += success % N_sigs
	else:
	retval += failure % (N_sigs-N_verified, N_sigs)

	# Output details
	N = 0
	for outcome in outcomes:
	N += 1
	(verified, result) = outcome
	retval += "<h1>Results for the %s signature</h1>" % ordinal(N)
	if verified:
	(filename, keyid, user) = result
	retval += c_verified % (filename, keyid[-8:], user)
	else:
	retval += c_unverified % (signature, result)

	return retval + signature_area


	def cat_signatures(basename):
	# strip '.asc' extension
	assert basename[:-4] in files()

	# cat
	ascfile = os.path.join(config.sigdir, basename)
	if os.path.exists(ascfile):
	return (open(ascfile, 'r').read())

	def print_content_type(mimetype):
	print "Content-Type: " + mimetype
	print

	def main():
	form = cgi.FieldStorage()
	pathinfo = os.getenv('PATH_INFO')

	# default value, to be changed below
	content = signature_area

	if 'signatures' in form:
	content = process_sigs(form['signatures'].value)

	elif pathinfo and pathinfo[1:]:
	basename = pathinfo.split('/')[-1]

	if basename == 'list':
	content = list_signatures()

	elif basename[:-4] in files():
	# early exit; bypass 'content' entirely
	print_content_type('text/plain')
	print cat_signatures(basename)
	return

	# These are "global" values, not specific to our action.
	mapping = {
	'version' : config.version,
	'content' : content,
	}

	print_content_type('text/html')

	template = string.Template(shell_content)
	print template.safe_substitute(mapping)


	if __name__ == '__main__':
	main()