signed push: fortify against replay attacks

In order to prevent a valid push certificate for pushing into an
repository from getting replayed in a different push operation, send
a nonce string from the receive-pack process and have the signer
include it in the push certificate.  The receiving end uses an HMAC
hash of the path to the repository it serves and the current time
stamp, hashed with a secret seed (the secret seed does not have to
be per-repository but can be defined in /etc/gitconfig) to generate
the nonce, in order to ensure that a random third party cannot forge
a nonce that looks like it originated from it.

The original nonce is exported as GIT_PUSH_CERT_NONCE for the hooks
to examine and match against the value on the "nonce" header in the
certificate to notice a replay, but returned "nonce" header in the
push certificate is examined by receive-pack and the result is
exported as GIT_PUSH_CERT_NONCE_STATUS, whose value would be "OK"
if the nonce recorded in the certificate matches what we expect, so
that the hooks can more easily check.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
signed push: teach smart-HTTP to pass "git push --signed" around

The "--signed" option received by "git push" is first passed to the
transport layer, which the native transport directly uses to notice
that a push certificate needs to be sent.  When the transport-helper
is involved, however, the option needs to be told to the helper with
set_helper_option(), and the helper needs to take necessary action.
For the smart-HTTP helper, the "necessary action" involves spawning
the "git send-pack" subprocess with the "--signed" option.

Once the above all gets wired in, the smart-HTTP transport now can
use the push certificate mechanism to authenticate its pushes.

Add a test that is modeled after tests for the native transport in
t5534-push-signed.sh to t5541-http-push-smart.sh.  Update the test
Apache configuration to pass GNUPGHOME environment variable through.
As PassEnv would trigger warnings for an environment variable that
is not set, export it from test-lib.sh set to a harmless value when
GnuPG is not being used in the tests.

Note that the added test is deliberately loose and does not check
the nonce in this step.  This is because the stateless RPC mode is
inevitably flaky and a nonce that comes back in the actual push
processing is one issued by a different process; if the two
interactions with the server crossed a second boundary, the nonces
will not match and such a check will fail.  A later patch in the
series will work around this shortcoming.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
signed push: allow stale nonce in stateless mode

When operating with the stateless RPC mode, we will receive a nonce
issued by another instance of us that advertised our capability and
refs some time ago.  Update the logic to check received nonce to
detect this case, compute how much time has passed since the nonce
was issued and report the status with a new environment variable
GIT_PUSH_CERT_NONCE_SLOP to the hooks.

GIT_PUSH_CERT_NONCE_STATUS will report "SLOP" in such a case.  The
hooks are free to decide how large a slop it is willing to accept.

Strictly speaking, the "nonce" is not really a "nonce" anymore in
the stateless RPC mode, as it will happily take any "nonce" issued
by it (which is protected by HMAC and its secret key) as long as it
is fresh enough.  The degree of this security degradation, relative
to the native protocol, is about the same as the "we make sure that
the 'git push' decided to update our refs with new objects based on
the freshest observation of our refs by making sure the values they
claim the original value of the refs they ask us to update exactly
match the current state" security is loosened to accomodate the
stateless RPC mode in the existing code without this series, so
there is no need for those who are already using smart HTTP to push
to their repositories to be alarmed any more than they already are.

In addition, the server operator can set receive.certnonceslop
configuration variable to specify how stale a nonce can be (in
seconds).  When this variable is set, and if the nonce received in
the certificate that passes the HMAC check was less than that many
seconds old, hooks are given "OK" in GIT_PUSH_CERT_NONCE_STATUS
(instead of "SLOP") and the received nonce value is given in
GIT_PUSH_CERT_NONCE, which makes it easier for a simple-minded
hook to check if the certificate we received is recent enough.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
Merge branch 'jc/push-cert' into jch

Allow "git push" request to be signed, so that it can be verified
audited, using the GPG signature of the person who pushed, that the
tips of branches at a public repository really point the commits
the pusher wanted to, without having to "trust" the server.

Will start merging early bits to 'next'.

* jc/push-cert: (23 commits)
  signed push: allow stale nonce in stateless mode
  signed push: teach smart-HTTP to pass "git push --signed" around
  signed push: fortify against replay attacks
  signed push: add "pushee" header to push certificate
  signed push: remove duplicated protocol info
  send-pack: send feature request on push-cert packet
  receive-pack: GPG-validate push certificates
  push: the beginning of "git push --signed"
  pack-protocol doc: typofix for PKT-LINE
  gpg-interface: move parse_signature() to where it should be
  gpg-interface: move parse_gpg_output() to where it should be
  send-pack: clarify that cmds_sent is a boolean
  send-pack: refactor inspecting and resetting status and sending commands
  send-pack: rename "new_refs" to "need_pack_data"
  receive-pack: factor out capability string generation
  send-pack: factor out capability string generation
  send-pack: always send capabilities
  send-pack: refactor decision to send update per ref
  send-pack: move REF_STATUS_REJECT_NODELETE logic a bit higher
  receive-pack: factor out queueing of command
  ...
Merge branch 'pr/use-default-sigpipe-setting' into jch

* pr/use-default-sigpipe-setting:
  SQUASH???
  unblock and unignore SIGPIPE
Merge branch 'jc/ignore-sigpipe-while-running-hooks' into jch

* jc/ignore-sigpipe-while-running-hooks:
  receive-pack: allow hooks to ignore its standard input stream

Conflicts:
	builtin/receive-pack.c
Merge branch 'cc/interpret-trailers' into pu

A new filter to programatically edit the tail end of the commit log
messages.

Comments & reviews?

* cc/interpret-trailers:
  Documentation: add documentation for 'git interpret-trailers'
  trailer: add tests for commands in config file
  trailer: execute command from 'trailer.<name>.command'
  trailer: add tests for "git interpret-trailers"
  trailer: add interpret-trailers command
  trailer: put all the processing together and print
  trailer: parse trailers from file or stdin
  trailer: process command line trailer arguments
  trailer: read and process config information
  trailer: process trailers from input message and arguments
  trailer: add data structures and basic functions
Merge branch 'mh/lockfile' into pu

Rerolled and reviews starting.

* mh/lockfile: (35 commits)
  get_locked_file_path(): new function
  lockfile.c: rename static functions
  lockfile: rename LOCK_NODEREF to LOCK_NO_DEREF
  commit_locked_index(): extract a function commit_lock_file_to()
  trim_last_path_component(): replace last_path_elm()
  resolve_symlink(): take a strbuf parameter
  resolve_symlink(): use a strbuf for internal scratch space
  struct lock_file: change the filename member into a strbuf
  commit_lock_file(): use a strbuf to manage temporary space
  try_merge_strategy(): use a statically-allocated lock_file object
  try_merge_strategy(): remove redundant lock_file allocation
  struct lock_file: declare some fields volatile
  lockfile: avoid transitory invalid states
  git_config_set_multivar_in_file(): avoid call to rollback_lock_file()
  dump_marks(): remove a redundant call to rollback_lock_file()
  api-lockfile: document edge cases
  commit_lock_file(): rollback lock file on failure to rename
  commit_lock_file(): if close fails, roll back
  commit_lock_file(): die() if called for unlocked lockfile object
  commit_lock_file(): inline temporary variable
  ...

# Conflicts:
# 	lockfile.c
# 	refs.c
Merge branch 'nd/multiple-work-trees' into pu

A replacement for contrib/workdir/git-new-workdir that does not
rely on symbolic links and make sharing of objects and refs safer
by making the borrowee and borrowers aware of each other.

Re-reroll posted, and already received a few comments.

* nd/multiple-work-trees: (32 commits)
  t2025: add a test to make sure grafts is working from a linked checkout
  checkout: don't require a work tree when checking out into a new one
  git_path(): keep "info/sparse-checkout" per work-tree
  count-objects: report unused files in $GIT_DIR/worktrees/...
  gc: support prune --worktrees
  gc: factor out gc.pruneexpire parsing code
  gc: style change -- no SP before closing parenthesis
  checkout: clean up half-prepared directories in --to mode
  checkout: reject if the branch is already checked out elsewhere
  prune: strategies for linked checkouts
  checkout: support checking out into a new working directory
  use new wrapper write_file() for simple file writing
  wrapper.c: wrapper to open a file, fprintf then close
  setup.c: support multi-checkout repo setup
  setup.c: detect $GIT_COMMON_DIR check_repository_format_gently()
  setup.c: convert check_repository_format_gently to use strbuf
  setup.c: detect $GIT_COMMON_DIR in is_git_directory()
  setup.c: convert is_git_directory() to use strbuf
  git-stash: avoid hardcoding $GIT_DIR/logs/....
  *.sh: avoid hardcoding $GIT_DIR/hooks/...
  ...

# Conflicts:
# 	builtin/gc.c
# 	builtin/receive-pack.c
# 	refs.c
# 	refs.h
# 	trace.c
# 	wrapper.c
Merge branch 'hv/submodule-config' into pu

Kicked back to 'pu' per request ($gmane/255610).

* hv/submodule-config:
  do not die on error of parsing fetchrecursesubmodules option
  use new config API for worktree configurations of submodules
  extract functions for submodule config set and lookup
  implement submodule config cache for lookup of submodule names
Merge branch 'jt/timer-settime' into pu

Reviewed, discussed and wanting for a reroll.

* jt/timer-settime:
  use timer_settime() for new platforms
  autoconf: check for timer_settime()
  autoconf: check for struct itimerspec
  autoconf: check for struct sigevent
  autoconf: check for struct timespec
  autoconf: check for timer_t
  autoconf: check for setitimer()
  autoconf: check for struct itimerval
  git-compat-util.h: add missing semicolon after struct itimerval
Merge branch 'jc/test-lazy-prereq' into pu

Test-script clean-up.

Comments & reviews?
Otherwise will merge to 'next'.

* jc/test-lazy-prereq:
  tests: drop GIT_*_TIMING_TESTS environment variable support
Merge branch 'mt/patch-id-stable' into pu

Teaches "git patch-id" to compute the patch ID that does not change
when the files in a single patch is reordered. As this new algorithm
is backward incompatible, the last bit to flip it to be the default
is left out of 'master' for now.

Nobody seems to be jumping up & down requesting this last step,
which makes the result somewhat backward incompatible.

* mt/patch-id-stable:
  patch-id: change default to stable
Merge branch 'cb/mergetool-difftool' into pu

Update the way the "difftool --help" shows the help message that is
shared with the "mergetool" to reduce one shell dependency.

* cb/mergetool-difftool:
  difftool: don't assume that default sh is sane
  mergetool: don't require a work tree for --tool-help
Merge branch 'po/everyday-doc' into pu

This may make the said command to emit something, but the source is
not meant to be formatted into a manual pages to begin with, and
also its contents are a bit stale.  It may be a good first step in
the right direction, but needs more work to at least get the
mark-up right before public consumption.

* po/everyday-doc:
  Make 'git help everyday' work

# Conflicts:
# 	Documentation/Makefile
Merge branch 'jk/pack-bitmap' into pu

Hold, waiting for Karsten's replacement.

* jk/pack-bitmap:
  pack-bitmap: do not use gcc packed attribute
Merge branch 'rr/mergetool-temporary-filename-tweak' into pu

* rr/mergetool-temporary-filename-tweak:
  Allow the user to change the temporary file name for mergetool
Merge branch 'rh/prompt-tests' into pu

to be broken with older zsh that are still in the field ($gmane/251231).

* rh/prompt-tests:
  t9904: new __git_ps1 tests for Zsh
  test-lib: make it possible to override how test code is eval'd
  lib-prompt-tests.sh: add variable for string that encodes percent in PS1
  lib-prompt-tests.sh: put all tests inside a function
  t9903: move prompt tests to a new lib-prompt-tests.sh file
  t9903: move PS1 color code variable definitions to lib-bash.sh
  t9903: include "Bash" in test names via new $shellname var
  t9903: run pc mode tests again with PS1 expansion disabled
  t9903: move test name prefix to a separate variable
  t9903: put the Bash pc mode prompt test cases in a function
  t9903: remove Zsh test from the suite of Bash prompt tests
Merge branch 'bg/rebase-off-of-previous-branch' into pu

Teach "git rebase -" to report the concrete name of the branch
(i.e. the previous one).

But it stops short and does not do the same for "git rebase @{-1}".

* bg/rebase-off-of-previous-branch:
  git-rebase: print name of rev when using shorthand
Merge branch 'rb/merge-prepare-commit-msg-hook' into pu

Expose more merge states (e.g. $GIT_DIR/MERGE_MODE) to hooks that
run during "git merge".  The log message stresses too much on one
hook, prepare-commit-msg, but it would equally apply to other hooks
like post-merge, I think.

* rb/merge-prepare-commit-msg-hook:
  merge: drop unused arg from abort_commit method signature
  merge: make prepare_to_commit responsible for write_merge_state
  t7505: ensure cleanup after hook blocks merge
  t7505: add missing &&

# Conflicts:
# 	builtin/merge.c
# 	t/t7505-prepare-commit-msg-hook.sh