maint.mk: add pre-release check to ensure submodule commits are public

* top/maint.mk (public-submodule-commit): New rule.
(submodule-checks): New variable.
(alpha beta stable): Depend on the variable.

diff --git a/ChangeLog b/ChangeLog
index 6b99e92..5e319f9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2011-01-06  Eric Blake  <eblake@redhat.com>
+
+       maint.mk: add pre-release check to ensure submodule commits are public
+       * top/maint.mk (public-submodule-commit): New rule.
+       (submodule-checks): New variable.
+       (alpha beta stable): Depend on the variable.
+
 2011-01-05  Pádraig Brady <P@draigBrady.com>
        and Jim Meyering  <meyering@redhat.com>
 

diff --git a/top/maint.mk b/top/maint.mk
index 5545e69..f892304 100644 (file)
--- a/top/maint.mk
+++ b/top/maint.mk
@@ -1118,9 +1118,25 @@ no-submodule-changes:
          : ;                                                           \
        fi
 
+submodule-checks ?= no-submodule-changes public-submodule-commit
+
+# Ensure that each sub-module commit we're using is public.
+# Without this, it is too easy to tag and release code that
+# cannot be built from a fresh clone.
+.PHONY: public-submodule-commit
+public-submodule-commit:
+       if test -d $(srcdir)/.git; then                                 \
+         git submodule foreach 'test $$(git rev-parse origin)'         \
+             = '"$$(git merge-base --independent origin $$sha1)"'      \
+           || { echo '$(ME): found non-public submodule commit' >&2;   \
+                exit 1; };                                             \
+       else                                                            \
+         : ;                                                           \
+       fi
+
 .PHONY: alpha beta stable
 ALL_RECURSIVE_TARGETS += alpha beta stable
-alpha beta stable: $(local-check) writable-files no-submodule-changes
+alpha beta stable: $(local-check) writable-files $(submodule-checks)
        test $@ = stable                                                \
          && { echo $(VERSION) | grep -E '^[0-9]+(\.[0-9]+)+$$'         \
               || { echo "invalid version string: $(VERSION)" 1>&2; exit 1;};}\