Merge branch 'merge-debian-master' into 'collabora/master'

Merge debian master

See merge request obs/open-build-service-debian!4

debian/patches/dist-Use-2.7-packages-for-testing.patch

+From be9fc5f2f7c564392948f127faff6486225ba8e6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B6rn=20Geuken?= <bgeuken@suse.de>
+Date: Mon, 26 Jun 2017 15:06:51 +0200
+Subject: [PATCH] [dist] Use 2.7 packages for testing 2.7 branch in travis
+
+---
+ dist/ci/obs_testsuite_travis_install.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Origin: upstream, https://github.com/openSUSE/open-build-service/pull/3284/commits
+diff --git a/dist/ci/obs_testsuite_travis_install.sh b/dist/ci/obs_testsuite_travis_install.sh
+index 85238dbd1..f9ecadaeb 100755
+--- a/dist/ci/obs_testsuite_travis_install.sh
++++ b/dist/ci/obs_testsuite_travis_install.sh
+@@ -8,7 +8,7 @@ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C5C219E7
+ 
+ # Install updates from our own repository
+ sudo chmod a+w /etc/apt/sources.list.d
+-echo 'deb http://download.opensuse.org/repositories/OBS:/Server:/Unstable/xUbuntu_12.04 /' > /etc/apt/sources.list.d/opensuse.list
++echo 'deb http://download.opensuse.org/repositories/OBS:/Server:/2.7/xUbuntu_12.04 /' > /etc/apt/sources.list.d/opensuse.list
+ 
+ # We could use this to only update the package list from the OBS,
+ # but apprently this is not possible anymore. So we update all package lists.
+-- 
+2.11.0
+

debian/patches/fix-kiwitree-symlink.patch

+commit 3b73dab1a9e676e28334df10fac7c054418228a8
+Author: Michael Schroeder <mls@suse.de>
+Date:   Fri Mar 17 10:49:14 2017 +0100
+
+    [backend] fix kiwitree symlink check
+
+    Bad code copied from the build package. Sigh.
+
+Origin: upstream, https://github.com/openSUSE/open-build-service/commit/3b73dab1a9e676e28334df10fac7c054418228a8
+--- a/src/backend/bs_repserver
++++ b/src/backend/bs_repserver
+@@ -1743,7 +1743,7 @@ sub receivekiwitree {
+     } elsif ($type eq 'l') {
+       $extra =~ s/%([a-fA-F0-9]{2})/chr(hex($1))/ge;
+       die("bad symlink\n") if "/$extra/" =~ /\/\.?\//;
+-      if ("/$extra/" =~ /^(\/\.\.)+\/(.*?)$/s) {
++      if ("/$extra/" =~ /^((?:\/\.\.)+)\/(.*?)$/s) {
+         my ($head, $tail) = ($1, $2);
+ 	die("bad upref in symlink\n") if "/$tail/" =~ /\/\.\.\//;
+ 	die("bad upref in symlink\n") if ($head =~ y!/!!) > ($file =~ y!/!!);

debian/patches/handle-links-properly.patch

+commit d4bddd6df495cc436185961fb497dacedc046008
+Author: Adrian Schröter <adrian@suse.de>
+Date:   Thu Jun 22 12:12:01 2017 +0200
+
+    [webui] Handle links properly when doing backend build operations
+
+    OBS wasn't properly handling linked projects when triggering rebuilds,
+    wipe binaries and abort build. This resulted in packages of linked
+    projects being aborted, wiped, rebuilt.
+
+    This fixes the falsey code.
+
+    Pair-programmed with @eduardoj and @bgeuken
+
+Origin: upstream, https://github.com/openSUSE/open-build-service/pull/3284/commits
+--- a/src/api/app/models/package.rb
++++ b/src/api/app/models/package.rb
+@@ -1344,22 +1344,23 @@ class Package < ActiveRecord::Base
+     self
+   end
+ 
++  #### WARNING: these operations run in build object, not this package object
+   def rebuild(params)
+-    backend_build_command(:rebuild, params.slice(:package, :arch, :repository))
++    backend_build_command(:rebuild, params[:project], params.slice(:package, :arch, :repository))
+   end
+ 
+   def wipe_binaries(params)
+-    backend_build_command(:wipe, params.slice(:package, :arch, :repository))
++    backend_build_command(:wipe, params[:project], params.slice(:package, :arch, :repository))
+   end
+ 
+   def abort_build(params)
+-    backend_build_command(:abortbuild, params.slice(:package, :arch, :repository))
++    backend_build_command(:abortbuild, params[:project], params.slice(:package, :arch, :repository))
+   end
+ 
+-  def backend_build_command(command, params)
++  def backend_build_command(command, build_project, params)
+     begin
+-      Suse::Backend.post("/build/#{URI.escape(project.name)}?cmd=#{command}&#{params.to_query}", '')
+-    rescue ActiveXML::Transport::Error, Timeout::Error => e
++      Suse::Backend.post("/build/#{URI.escape(build_project)}?cmd=#{command}&#{params.to_query}", '')
++    rescue ActiveXML::Transport::Error, Timeout::Error, Project::WritePermissionError => e
+       errors.add(:base, e.message)
+       return false
+     end

debian/patches/series

@@ -15,18 +15,22 @@ missing-codemirror-js.patch
 Do-not-ship-database.yml.patch
 localgem.patch
 disable-slp.patch
-Add_global_configuration_for_a_shared_reprepro.patch
-Add_--ignore=unusedarch_to_reprepro_params.patch
-publish_Also_accept_udebs_into_reprepro_repository.patch
-Seperately_include_debs_and_udebs_into_reprepro.patch
-BSConfig.pm.template_include_a_skeleton_reprepro.patch
-Include_ddebs_in_reprepro_too_and_fix_inclusion_of_udebs.patch
-bs_publish_improve-logging_for_reprepro_invocations.patch
-publisher_reprepro_set_surprising_binary.patch
-Add-support-for-md5-and-sha256-cypted-passwords.patch
-Put-binary-uploads-in-architecture-dependent-subdirectori.patch
-Correct-reprepro-argument-to-match-current-version.patch
-backend-Handle-ERROR_WANT_-READ-WRITE-from-ssl-reads.patch
-backend-Support-https-urls-for-package-downloads.patch
-BSConfig-Make-every-architecture-its-own-relsync-pool.patch
-BSConfig-Read-a-BSConfig.local.pm-if-it-exists.patch
+CVE-2017-5188.patch
+fix-kiwitree-symlink.patch
+handle-links-properly.patch
+dist-Use-2.7-packages-for-testing.patch
+collabora/Add_global_configuration_for_a_shared_reprepro.patch
+collabora/Add_--ignore=unusedarch_to_reprepro_params.patch
+collabora/publish_Also_accept_udebs_into_reprepro_repository.patch
+collabora/Seperately_include_debs_and_udebs_into_reprepro.patch
+collabora/BSConfig.pm.template_include_a_skeleton_reprepro.patch
+collabora/Include_ddebs_in_reprepro_too_and_fix_inclusion_of_udebs.patch
+collabora/bs_publish_improve-logging_for_reprepro_invocations.patch
+collabora/publisher_reprepro_set_surprising_binary.patch
+collabora/Add-support-for-md5-and-sha256-cypted-passwords.patch
+collabora/Put-binary-uploads-in-architecture-dependent-subdirectori.patch
+collabora/Correct-reprepro-argument-to-match-current-version.patch
+collabora/backend-Handle-ERROR_WANT_-READ-WRITE-from-ssl-reads.patch
+collabora/backend-Support-https-urls-for-package-downloads.patch
+collabora/BSConfig-Make-every-architecture-its-own-relsync-pool.patch
+collabora/BSConfig-Read-a-BSConfig.local.pm-if-it-exists.patch

debian/rake-tasks.sh

@@ -26,10 +26,10 @@ case "$1" in
 	chown -R www-data:www-data /usr/share/obs/api/public
 	chown www-data:www-data /etc/obs/api/config/production.sphinx.conf
 	chmod 664 /var/log/obs/*.log
-	chown nobody:www-data /etc/obs/api/config/database.yml
-	chmod 660 /etc/obs/api/config/database.yml
-	chown nobody:www-data /var/log/obs/backend_access.log
-	chown nobody:www-data /var/log/obs/production.log
+	chown obsapi:www-data /etc/obs/api/config/database.yml
+	chmod 440 /etc/obs/api/config/database.yml
+	chown obsapi:www-data /var/log/obs/backend_access.log
+	chown obsapi:www-data /var/log/obs/production.log
 
 	# Generate Gemfile.lock file.
 	cd /usr/share/obs/api

debian/rules

@@ -69,6 +69,9 @@ override_dh_install:
 	# Fix Mark scripts as executable until upstream fixes
 	chmod a+x debian/obs-server/usr/lib/obs/tests/appliance/*t*
 
+	# Remove useless Gemfile.lock
+	rm -f debian/obs-api/usr/share/obs/api/Gemfile.lock
+
 override_dh_systemd_enable:
 	dh_systemd_enable -p obs-server \
 		obsrepserver.service \