diff --git a/contrib/source-control-tools/land-patch.sh b/contrib/source-control-tools/land-patch.sh --- a/contrib/source-control-tools/land-patch.sh +++ b/contrib/source-control-tools/land-patch.sh @@ -65,6 +65,32 @@ fi set -x +if [ -n "${REVISION}" ]; then + # Temporarily stop verbose logging to prevent leaking CONDUIT_TOKEN + set +x + # Fetch the revision and check Bitcoin ABC group's reviewer status + BITCOIN_ABC_REVIEWER_GROUP=PHID-PROJ-z2wrchs62yicqvwlgc5r + ABC_GROUP_REVIEW_STATUS=$(curl "https://reviews.bitcoinabc.org/api/differential.revision.search" \ + -d "api.token=${CONDUIT_TOKEN}" \ + -d "constraints[ids][0]=${REVISION:1}" \ + -d "attachments[reviewers]=1" |\ + jq '.result.data[].attachments.reviewers.reviewers[] | select(.reviewerPHID == "'"${BITCOIN_ABC_REVIEWER_GROUP}"'") | .status') || { + echo "Error: Failed to fetch review status of Bitcoin ABC group for revision '${REVISION}'" + echo "The 'reviewers' fields may be missing or malformed." + exit 30 + } + set -x + + # We only trust code that has been accepted by the Bitcoin ABC reviewers + if [ "${ABC_GROUP_REVIEW_STATUS}" != "\"accepted\"" ]; then + echo "Error: Bitcoin ABC reviewer group not accepted this change." + exit 31 + fi +fi + +# IMPORTANT NOTE: The patch is trusted past this point. It was either reviewed +# and accepted by Bitcoin ABC reviewers or it was auto-generated. + TOPLEVEL=$(git rev-parse --show-toplevel) DEVTOOLS_DIR="${TOPLEVEL}"/contrib/devtools BUILD_DIR="${TOPLEVEL}"/build