Release version 0.13.0

Add support for storing PAT in OSX keychain

CHANGES.rst

@@ -1,6 +1,61 @@
 Changelog
 =========
 
+0.13.0 (2017-04-05)
+-------------------
+
+- Add OS check for OSX specific keychain args. [Martin O'Reilly]
+
+  Keychain arguments are only supported on Mac OSX.
+  Added check for operating system so we give a
+  "Keychain arguments are only supported on Mac OSX"
+  error message rather than a "No password item matching the
+  provided name and account could be found in the osx keychain"
+  error message
+
+
+- Add support for storing PAT in OSX keychain. [Martin O'Reilly]
+
+  Added additional optional arguments and README guidance for storing
+  and accessing a Github personal access token (PAT) in the OSX
+  keychain
+
+
+0.12.1 (2017-03-27)
+-------------------
+
+- Avoid remote branch name churn. [Chris Adams]
+
+  This avoids the backup output having lots of "[new branch]" messages
+  because removing the old remote name removed all of the existing branch
+  references.
+
+
+- Fix detection of bare git directories. [Andrzej Maczuga]
+
+0.12.0 (2016-11-22)
+-------------------
+
+Fix
+~~~
+
+- Properly import version from github_backup package. [Jose Diaz-
+  Gonzalez]
+
+- Support alternate git status output. [Jose Diaz-Gonzalez]
+
+Other
+~~~~~
+
+- Pep8: E501 line too long (83 > 79 characters) [Jose Diaz-Gonzalez]
+
+- Pep8: E128 continuation line under-indented for visual indent. [Jose
+  Diaz-Gonzalez]
+
+- Support archivization using bare git clones. [Andrzej Maczuga]
+
+- Fix typo, 3x. [Terrell Russell]
+
 0.11.0 (2016-10-26)
 -------------------
 

README.rst

@@ -29,10 +29,13 @@ CLI Usage is as follows::
                   [-o OUTPUT_DIRECTORY] [-i] [--starred] [--watched]
                   [--all] [--issues] [--issue-comments] [--issue-events]
                   [--pulls] [--pull-comments] [--pull-commits] [--labels]
-                  [--hooks] [--milestones] [--repositories] [--wikis]
+                  [--hooks] [--milestones] [--repositories] [--bare]
-                  [--skip-existing] [-L [LANGUAGES [LANGUAGES ...]]]
+                  [--wikis] [--skip-existing]
-                  [-N NAME_REGEX] [-H GITHUB_HOST] [-O] [-R REPOSITORY]
+                  [-L [LANGUAGES [LANGUAGES ...]]] [-N NAME_REGEX]
-                  [-P] [-F] [--prefer-ssh] [-v]
+                  [-H GITHUB_HOST] [-O] [-R REPOSITORY] [-P] [-F]
+                  [--prefer-ssh] [-v]
+                  [--keychain-name OSX_KEYCHAIN_ITEM_NAME]
+                  [--keychain-account OSX_KEYCHAIN_ITEM_ACCOUNT]
                   USER
 
     Backup a github account
@@ -66,6 +69,7 @@ CLI Usage is as follows::
                             authenticated)
       --milestones          include milestones in backup
       --repositories        include repository clone in backup
+      --bare                clone bare repositories
       --wikis               include wiki clone in backup
       --skip-existing       skip project if a backup directory exists
       -L [LANGUAGES [LANGUAGES ...]], --languages [LANGUAGES [LANGUAGES ...]]
@@ -81,6 +85,12 @@ CLI Usage is as follows::
       -F, --fork            include forked repositories
       --prefer-ssh          Clone repositories using SSH instead of HTTPS
       -v, --version         show program's version number and exit
+      --keychain-name OSX_KEYCHAIN_ITEM_NAME
+                            OSX ONLY: name field of password item in OSX keychain
+                            that holds the personal access or OAuth token
+      --keychain-account OSX_KEYCHAIN_ITEM_ACCOUNT
+                            OSX ONLY: account field of password item in OSX
+                            keychain that holds the personal access or OAuth token
 
 
 The package can be used to backup an *entire* organization or repository, including issues and wikis in the most appropriate format (clones for wikis, json files for issues).
@@ -89,3 +99,18 @@ Authentication
 ==============
 
 Note: Password-based authentication will fail if you have two-factor authentication enabled.
+
+Using the Keychain on Mac OSX
+=============================
+Note: On Mac OSX the token can be stored securely in the user's keychain. To do this:
+
+1. Open Keychain from "Applications -> Utilities -> Keychain Access"
+2. Add a new password item using "File -> New Password Item"
+3. Enter a name in the "Keychain Item Name" box. You must provide this name to github-backup using the --keychain-name argument.
+4. Enter an account name in the "Account Name" box, enter your Github username as set above. You must provide this name to github-backup using the --keychain-account argument.
+5. Enter your Github personal access token in the "Password" box
+
+Note:  When you run github-backup, you will be asked whether you want to allow "security" to use your confidential information stored in your keychain. You have two options:
+
+1. **Allow:** In this case you will need to click "Allow" each time you run `github-backup`
+2. **Always Allow:** In this case, you will not be asked for permission when you run `github-backup` in future. This is less secure, but is required if you want to schedule `github-backup` to run automatically

bin/github-backup

@@ -16,6 +16,7 @@ import select
 import subprocess
 import sys
 import time
+import platform
 try:
     # python 3
     from urllib.parse import urlparse
@@ -33,8 +34,7 @@ except ImportError:
     from urllib2 import urlopen
     from urllib2 import Request
 
-__version__='asdf'
+from github_backup import __version__
-# from github_backup import __version__
 
 FNULL = open(os.devnull, 'w')
 
@@ -141,7 +141,7 @@ def parse_args():
     parser.add_argument('-t',
                         '--token',
                         dest='token',
-                        help='personal access or OAuth token, or path to token (file://...)')
+                        help='personal access or OAuth token, or path to token (file://...)')  # noqa
     parser.add_argument('-o',
                         '--output-directory',
                         default='.',
@@ -195,7 +195,7 @@ def parse_args():
     parser.add_argument('--hooks',
                         action='store_true',
                         dest='include_hooks',
-                        help='include hooks in backup (works only when authenticated)')
+                        help='include hooks in backup (works only when authenticated)')  # noqa
     parser.add_argument('--milestones',
                         action='store_true',
                         dest='include_milestones',
@@ -204,6 +204,10 @@ def parse_args():
                         action='store_true',
                         dest='include_repository',
                         help='include repository clone in backup')
+    parser.add_argument('--bare',
+                        action='store_true',
+                        dest='bare_clone',
+                        help='clone bare repositories')
     parser.add_argument('--wikis',
                         action='store_true',
                         dest='include_wiki',
@@ -248,13 +252,37 @@ def parse_args():
     parser.add_argument('-v', '--version',
                         action='version',
                         version='%(prog)s ' + __version__)
+    parser.add_argument('--keychain-name',
+                        dest='osx_keychain_item_name',
+                        help='OSX ONLY: name field of password item in OSX keychain that holds the personal access or OAuth token')
+    parser.add_argument('--keychain-account',
+                        dest='osx_keychain_item_account',
+                        help='OSX ONLY: account field of password item in OSX keychain that holds the personal access or OAuth token')
     return parser.parse_args()
 
 
 def get_auth(args, encode=True):
     auth = None
 
-    if args.token:
+    if args.osx_keychain_item_name:
+        if not args.osx_keychain_item_account:
+            log_error('You must specify both name and account fields for osx keychain password items')
+        else:
+            if platform.system() != 'Darwin':
+                log_error("Keychain arguments are only supported on Mac OSX")
+            try:
+                with open(os.devnull,'w') as devnull:
+                    token = (subprocess.check_output([
+                        'security','find-generic-password',
+                        '-s',args.osx_keychain_item_name,
+                        '-a',args.osx_keychain_item_account,
+                        '-w' ], stderr=devnull).strip())
+                auth = token + ':' + 'x-oauth-basic'
+            except:
+                log_error('No password item matching the provided name and account could be found in the osx keychain.')
+    elif args.osx_keychain_item_account:
+        log_error('You must specify both name and account fields for osx keychain password items')
+    elif args.token:
         _path_specifier = 'file://'
         if args.token.startswith(_path_specifier):
             args.token = open(args.token[len(_path_specifier):],
@@ -459,10 +487,13 @@ def retrieve_repositories(args):
     return retrieve_data(args, template, single_request=single_request)
 
 
-def filter_repositories(args, repositories):
+def filter_repositories(args, unfiltered_repositories):
     log_info('Filtering repositories')
 
-    repositories = [r for r in repositories if r['owner']['login'] == args.user]
+    repositories = []
+    for r in unfiltered_repositories:
+        if r['owner']['login'] == args.user:
+            repositories.append(r)
 
     name_regex = None
     if args.name_regex:
@@ -489,7 +520,7 @@ def backup_repositories(args, output_directory, repositories):
     repos_template = 'https://{0}/repos'.format(get_github_api_host(args))
 
     if args.incremental:
-        last_update = max(repository['updated_at'] for repository in repositories)
+        last_update = max(repository['updated_at'] for repository in repositories)  # noqa
         last_update_path = os.path.join(output_directory, 'last_update')
         if os.path.exists(last_update_path):
             args.since = open(last_update_path).read().strip()
@@ -508,14 +539,16 @@ def backup_repositories(args, output_directory, repositories):
             fetch_repository(repository['name'],
                              repo_url,
                              repo_dir,
-                             skip_existing=args.skip_existing)
+                             skip_existing=args.skip_existing,
+                             bare_clone=args.bare_clone)
 
         download_wiki = (args.include_wiki or args.include_everything)
         if repository['has_wiki'] and download_wiki:
             fetch_repository(repository['name'],
                              repo_url.replace('.git', '.wiki.git'),
                              os.path.join(repo_cwd, 'wiki'),
-                             skip_existing=args.skip_existing)
+                             skip_existing=args.skip_existing,
+                             bare_clone=args.bare_clone)
 
         if args.include_issues or args.include_everything:
             backup_issues(args, repo_cwd, repository, repos_template)
@@ -551,6 +584,7 @@ def backup_issues(args, repo_cwd, repository, repos_template):
     _issue_template = '{0}/{1}/issues'.format(repos_template,
                                               repository['full_name'])
 
+    should_include_pulls = args.include_pulls or args.include_everything
     issue_states = ['open', 'closed']
     for issue_state in issue_states:
         query_args = {
@@ -566,15 +600,18 @@ def backup_issues(args, repo_cwd, repository, repos_template):
         for issue in _issues:
             # skip pull requests which are also returned as issues
             # if retrieving pull requests is requested as well
-            if 'pull_request' in issue and (args.include_pulls or args.include_everything):
+            if 'pull_request' in issue and should_include_pulls:
                 issues_skipped += 1
                 continue
 
             issues[issue['number']] = issue
 
     if issues_skipped:
-        issues_skipped_message = ' (skipped {0} pull requests)'.format(issues_skipped)
+        issues_skipped_message = ' (skipped {0} pull requests)'.format(
-    log_info('Saving {0} issues to disk{1}'.format(len(list(issues.keys())), issues_skipped_message))
+            issues_skipped)
+
+    log_info('Saving {0} issues to disk{1}'.format(
+        len(list(issues.keys())), issues_skipped_message))
     comments_template = _issue_template + '/{0}/comments'
     events_template = _issue_template + '/{0}/events'
     for number, issue in list(issues.items()):
@@ -620,7 +657,8 @@ def backup_pulls(args, repo_cwd, repository, repos_template):
             if not args.since or pull['updated_at'] >= args.since:
                 pulls[pull['number']] = pull
 
-    log_info('Saving {0} pull requests to disk'.format(len(list(pulls.keys()))))
+    log_info('Saving {0} pull requests to disk'.format(
+        len(list(pulls.keys()))))
     comments_template = _pulls_template + '/{0}/comments'
     commits_template = _pulls_template + '/{0}/commits'
     for number, pull in list(pulls.items()):
@@ -657,7 +695,8 @@ def backup_milestones(args, repo_cwd, repository, repos_template):
     for milestone in _milestones:
         milestones[milestone['number']] = milestone
 
-    log_info('Saving {0} milestones to disk'.format(len(list(milestones.keys()))))
+    log_info('Saving {0} milestones to disk'.format(
+        len(list(milestones.keys()))))
     for number, milestone in list(milestones.items()):
         milestone_file = '{0}/{1}.json'.format(milestone_cwd, number)
         with codecs.open(milestone_file, 'w', encoding='utf-8') as f:
@@ -695,35 +734,63 @@ def backup_hooks(args, repo_cwd, repository, repos_template):
         log_info("Unable to read hooks, skipping")
 
 
-def fetch_repository(name, remote_url, local_dir, skip_existing=False):
+def fetch_repository(name,
-    clone_exists = os.path.exists(os.path.join(local_dir, '.git'))
+                     remote_url,
+                     local_dir,
+                     skip_existing=False,
+                     bare_clone=False):
+    if bare_clone:
+        if os.path.exists(local_dir):
+            clone_exists = subprocess.check_output(['git',
+                                                    'rev-parse',
+                                                    '--is-bare-repository'],
+                                                   cwd=local_dir) == "true\n"
+        else:
+            clone_exists = False
+    else:
+        clone_exists = os.path.exists(os.path.join(local_dir, '.git'))
 
     if clone_exists and skip_existing:
         return
 
     masked_remote_url = mask_password(remote_url)
 
-    initalized = subprocess.call('git ls-remote ' + remote_url,
+    initialized = subprocess.call('git ls-remote ' + remote_url,
-                                 stdout=FNULL,
+                                  stdout=FNULL,
-                                 stderr=FNULL,
+                                  stderr=FNULL,
-                                 shell=True)
+                                  shell=True)
-    if initalized == 128:
+    if initialized == 128:
-        log_info("Skipping {0} ({1}) since it's not initalized".format(name, masked_remote_url))
+        log_info("Skipping {0} ({1}) since it's not initialized".format(
+            name, masked_remote_url))
         return
 
     if clone_exists:
         log_info('Updating {0} in {1}'.format(name, local_dir))
-        git_command = ['git', 'remote', 'rm', 'origin']
+
-        logging_subprocess(git_command, None, cwd=local_dir)
+        remotes = subprocess.check_output(['git', 'remote', 'show'],
-        git_command = ['git', 'remote', 'add', 'origin', remote_url]
+                                          cwd=local_dir)
-        logging_subprocess(git_command, None, cwd=local_dir)
+        remotes = [i.strip() for i in remotes.decode('utf-8')]
-        git_command = ['git', 'fetch', '--all', '--tags', '--prune']
+
+        if 'origin' not in remotes:
+            git_command = ['git', 'remote', 'rm', 'origin']
+            logging_subprocess(git_command, None, cwd=local_dir)
+            git_command = ['git', 'remote', 'add', 'origin', remote_url]
+            logging_subprocess(git_command, None, cwd=local_dir)
+        else:
+            git_command = ['git', 'remote', 'set-url', 'origin', remote_url]
+            logging_subprocess(git_command, None, cwd=local_dir)
+
+        git_command = ['git', 'fetch', '--all', '--force', '--tags', '--prune']
         logging_subprocess(git_command, None, cwd=local_dir)
     else:
-        log_info('Cloning {0} repository from {1} to {2}'.format(name,
+        log_info('Cloning {0} repository from {1} to {2}'.format(
-                                                                 masked_remote_url,
+            name,
-                                                                 local_dir))
+            masked_remote_url,
-        git_command = ['git', 'clone', remote_url, local_dir]
+            local_dir))
+        if bare_clone:
+            git_command = ['git', 'clone', '--mirror', remote_url, local_dir]
+        else:
+            git_command = ['git', 'clone', remote_url, local_dir]
         logging_subprocess(git_command, None)
 
 

github_backup/__init__.py

@@ -1 +1 @@
-__version__ = '0.11.0'
+__version__ = '0.13.0'

release

@@ -34,7 +34,7 @@ fi
 echo -e "\n${GREEN}STARTING RELEASE PROCESS${COLOR_OFF}\n"
 
 set +e;
-git status | grep "working directory clean" &> /dev/null
+git status | grep -Eo "working (directory|tree) clean" &> /dev/null
 if [ ! $? -eq 0 ]; then # working directory is NOT clean
     echo -e "${RED}WARNING: You have uncomitted changes, you may have forgotten something${COLOR_OFF}\n"
     exit 1