A check that keeps the real coat of arms out of a commit - #47
Open
nordfisch wants to merge 1 commit into
Open
Conversation
frontend/public/logo.png is a placeholder. A machine that sets a device up replaces it with the municipal arms, and from then on it is a modified tracked file that rides along with the next `git add -A`. That is a legal problem: the arms are free of copyright as an official work, but the municipality governs their use, and permission for one museum is not permission for everybody who clones a public repository. It happened twice. 6d47d36 is titled "Wappen aus der Historie entfernt", and on 8 September 2026 it happened again -- swept into a commit that was pushed, then taken back out and force-pushed. The warning in adaption.md prevented neither. tools/check_logo.py reads the **index**, not the working tree, and that is the whole design: on the machine setting a device up, the tree should hold the real crest, because `make release` bakes it into the image from there. A check on the tree would refuse every commit there and be switched off within the day. The way past it needs no exception: a staged change is allowed when tools/build_logo.py is staged with it, which is the one legitimate reason for the placeholder to change. No hash to keep in step, and no byte comparison against a regenerated PNG, which would break on the next Pillow release. Hook only -- it needs an index, so it is not in `make check`. Proven both ways against the actual accident: red with the crest staged alone, green with the generator staged beside it. Closes #46. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #46.
frontend/public/logo.pngis a placeholder. A machine that sets a device up replaces it with themunicipal arms, and from then on it is a modified tracked file that rides along with the next
git add -A.It happened twice.
6d47d36is titled "Wappen aus der Historie entfernt". On 8 September 2026it happened again: the real crest was swept into a commit and pushed to this public repository, then
taken back out and force-pushed. The warning in
adaption.mdprevented neither occasion.The design, in one sentence
tools/check_logo.pyreads the index, not the working tree.On the machine setting a device up, the tree should hold the real crest —
make releasebakes itinto the frontend image from there, and the manual now says so. A check on the working tree would
refuse every commit on that machine and be switched off within the day. So the check asks
git diff --cachedwhat the commit carries.The way past it needs no exception: a staged change to the file is allowed when
tools/build_logo.pyis staged with it, which is the one legitimate reason for the placeholder tochange. Two alternatives were rejected — a recorded hash is a value to keep in step, and
regenerating the PNG in the hook to compare bytes would break on the next Pillow release, since
nothing promises byte-identical output across versions.
It guards against the accident, not against intent.
--no-verifywas always there. The failurebeing prevented is a sweep of
git add -A, twice now.Proven both ways, against the actual accident
git restore --stagedline in the messagebuild_logo.pyThe hook ran on this commit itself.
Where it sits
In
.githooks/pre-commitand not inmake check. The other seven checks answer whether thetree is right; this one answers what a commit carries, so it needs an index.
development.mdanddecisions point 78 say so, and point 78 records why a rule that only a document stated was not
enough.