preferring https: to http: in commit messages for gnu.org

preferring https: to http: in commit messages for gnu.org

[Paul Eggert]

[-- Attachment #1: Type: text/plain, Size: 269 bytes --]

I installed the attached into the default Git commit hooks to help remind us 
(and particularly to remind me, since I write a fair number of these things) 
that https: should be preferred to http: in commit-message URLs that point to 
gnu.org or fsf.org web sites.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-Encourage-https-in-commit-messages.patch --]
[-- Type: text/x-patch; name="0001-Encourage-https-in-commit-messages.patch", Size: 1826 bytes --]

From 3c78960a4755d7bd583a0411d7089a0c13c0c64b Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@day>
Date: Sat, 14 Oct 2017 19:16:12 -0700
Subject: [PATCH] Encourage https: in commit messages

* CONTRIBUTE: Prefer https: when citing.
* build-aux/git-hooks/commit-msg:
Diagnose http: and ftp: URLs to FSF or GNU hosts.
---
 CONTRIBUTE                     |  3 +++
 build-aux/git-hooks/commit-msg | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/CONTRIBUTE b/CONTRIBUTE
index 8995bb3..c7f3330 100644
--- a/CONTRIBUTE
+++ b/CONTRIBUTE
@@ -175,6 +175,9 @@ them right the first time, so here are guidelines for formatting them:
   bug number NNNNN in the debbugs database.  This string is often
   parenthesized, as in "(Bug#19003)".
 
+- When citing URLs, prefer https: to http: when either will do.  In
+  particular, gnu.org and fsf.org URLs should start with "https:".
+
 - Commit messages should contain only printable UTF-8 characters.
 
 - Commit messages should not contain the "Signed-off-by:" lines that
diff --git a/build-aux/git-hooks/commit-msg b/build-aux/git-hooks/commit-msg
index 3945086..e21aaf0 100755
--- a/build-aux/git-hooks/commit-msg
+++ b/build-aux/git-hooks/commit-msg
@@ -66,6 +66,8 @@ at_sign=
         non_print = "[^[:print:]]"
       }
     }
+    c_lower = "abcdefghijklmnopqrstuvwxyz"
+    unsafe_gnu_url = "(http|ftp)://([" c_lower ".]*\\.)?(gnu|fsf)\\.org"
   }
 
   /^#/ {
@@ -125,6 +127,14 @@ at_sign=
     status = 1
   }
 
+  {
+    if (match($0, unsafe_gnu_url)) {
+      url = substr($0, RSTART, RLENGTH)
+      printf "Use https: URL instead of '\''%s'\'' in commit message\n", url
+      status = 1
+    }
+  }
+
   $0 ~ non_print {
     print "Unprintable character in commit message"
     status = 1
-- 
2.7.4

Re: preferring https: to http: in commit messages for gnu.org

[Eli Zaretskii]

> From: Paul Eggert <eggert@cs.ucla.edu>
> Date: Sun, 15 Oct 2017 00:14:04 -0700
> 
> I installed the attached into the default Git commit hooks to help remind us 
> (and particularly to remind me, since I write a fair number of these things) 
> that https: should be preferred to http: in commit-message URLs that point to 
> gnu.org or fsf.org web sites.
> 
> +  {
> +    if (match($0, unsafe_gnu_url)) {
> +      url = substr($0, RSTART, RLENGTH)
> +      printf "Use https: URL instead of '\''%s'\'' in commit message\n", url
> +      status = 1

"status = 1" means the commit will be rejected, am I right?  If so,
please don't fail commits because of that, it's too radical.  E.g., I
frequently cite URLs in commit messages, copying them from the
browser, and this hook change will now require me to look for
alternative URLs, if they exist, re-commit, perhaps find out that
someone already pushed to upstream, then pull, push again...  It's an
annoyance.  I cannot be responsible for every useful URL out there.

Thanks.

Re: preferring https: to http: in commit messages for gnu.org

[Paul Eggert]

Eli Zaretskii wrote:
> I cannot be responsible for every useful URL out there.

The newly-added change does not check for every useful URL, only for URLs to 
gnu.org or fsf.org. The goal is for developers to have reliable communications 
from the GNU project itself, even if other sources are less reliable.

Without this change, I need to manually fix the gnu.org and fsf.org URLs in 
ChangeLog.<N>, which is an annoyance. (Especially since many of these URLs are 
in my own commit messages. :-)

If you find it really aggravating to put https: before gnu.org URLs in commit 
messages I could revert the change. I was hoping, though, that this was merely a 
minor annoyance that simplified maintenance overall.

Re: preferring https: to http: in commit messages for gnu.org

[Eli Zaretskii]

> Cc: Emacs-devel@gnu.org
> From: Paul Eggert <eggert@cs.ucla.edu>
> Date: Mon, 16 Oct 2017 00:07:09 -0700
> 
> Eli Zaretskii wrote:
> > I cannot be responsible for every useful URL out there.
> 
> The newly-added change does not check for every useful URL, only for URLs to 
> gnu.org or fsf.org.

That includes URLs such as

  http://lists.gnu.org/archive/html/emacs-devel/2017-10/msg00592.html

doesn't it?  This is by far the most frequent use of URLs in the
commit log messages for me: to cite discussions on our lists, since it
is not uncommon to have an issue be raised on a list, rather than via
the bug tracker.  If you can amend the change to leave out URLs that
point to GNU mailing list messages, it's possible that what's left
will be insignificant noise for me.  But I rather suspect that
lists.gnu.org pointers are one of your main targets...

> The goal is for developers to have reliable communications 
> from the GNU project itself, even if other sources are less reliable.

Sorry, I cannot be responsible for the protocols supported by GNU list
servers.  It is unreasonable to ask me to correct such references, or
risk to have my commits rejected.

> Without this change, I need to manually fix the gnu.org and fsf.org URLs in 
> ChangeLog.<N>, which is an annoyance.

It is a similar annoyance to require me to do that when I need to cite
a mailing-list message.

> (Especially since many of these URLs are in my own commit
> messages. :-)

Well, you can always install such hooks locally, if that's the problem.

Thanks.

Re: preferring https: to http: in commit messages for gnu.org

[Yuri Khan]

On Mon, Oct 16, 2017 at 10:09 PM, Eli Zaretskii <eliz@gnu.org> wrote:

> That includes URLs such as
>
>   http://lists.gnu.org/archive/html/emacs-devel/2017-10/msg00592.html
>
>> The goal is for developers to have reliable communications
>> from the GNU project itself, even if other sources are less reliable.

A good first step towards that goal is to configure the server at
http://lists.gnu.org/* to serve a permanent redirect to
https://lists.gnu.org/*.

Re: preferring https: to http: in commit messages for gnu.org

[Robert Pluim]

Yuri Khan <yuri.v.khan@gmail.com> writes:

> On Mon, Oct 16, 2017 at 10:09 PM, Eli Zaretskii <eliz@gnu.org> wrote:
>
>> That includes URLs such as
>>
>>   http://lists.gnu.org/archive/html/emacs-devel/2017-10/msg00592.html
>>
>>> The goal is for developers to have reliable communications
>>> from the GNU project itself, even if other sources are less reliable.
>
> A good first step towards that goal is to configure the server at
> http://lists.gnu.org/* to serve a permanent redirect to
> https://lists.gnu.org/*.

No, a good first step is to upgrade https://lists.gnu.org to use TLS
1.2 instead of 1.0, then we can start thinking about redirects and/or
enforcing https spelling in commits. eg Mozilla in paranoid mode will
refuse to connect to TLS 1.0 sites, with no override available

Robert

Re: preferring https: to http: in commit messages for gnu.org

[Paul Eggert]

On 10/16/2017 09:20 AM, Robert Pluim wrote:
> a good first step is to upgradehttps://lists.gnu.org  to use TLS
> 1.2 instead of 1.0

I asked sysadmin@gnu.org to do this on Sept. 12. I didn't get any 
response, unfortunately. I'll ping them again now.

Re: preferring https: to http: in commit messages for gnu.org

[Eli Zaretskii]

> From: Paul Eggert <eggert@cs.ucla.edu>
> Date: Mon, 16 Oct 2017 11:47:32 -0700
> Cc: Eli Zaretskii <eliz@gnu.org>, Emacs developers <Emacs-devel@gnu.org>
> 
> On 10/16/2017 09:20 AM, Robert Pluim wrote:
> > a good first step is to upgradehttps://lists.gnu.org  to use TLS
> > 1.2 instead of 1.0
> 
> I asked sysadmin@gnu.org to do this on Sept. 12. I didn't get any 
> response, unfortunately. I'll ping them again now.

Thanks.

Re: preferring https: to http: in commit messages for gnu.org

[Paul Eggert]

On 10/16/2017 08:09 AM, Eli Zaretskii wrote:
> I rather suspect that lists.gnu.org pointers are one of your main 
> targets...

Yes, and that's in my most recent change along these lines:

https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-26&id=864734d112249bac120764f1564e008231ebb6e8

> It is a similar annoyance to require me to do that when I need to cite 
> a mailing-list message. 

OK, I changed it to remove this requirement. Instead of rejecting the 
commit message, the hook now changes the http: to https: in the commit 
message while committing it, for gnu.org and fsf.org URLs.