GitLab

Signed-off-by: Andrew Lee (李健秋) <andrew.lee@collabora.co.uk>

Sync debian master

See merge request !3

Handle links properly when doing backend build operations

See merge request ruby-team/open-build-service!6

# Conflicts:
#   debian/patches/series

fix-kiwitree-symlink.patch: cherry-pick bad code fix from upstream.

See merge request ruby-team/open-build-service!5

Make passenger rubyapp runs as obsapi user.

See merge request ruby-team/open-build-service!8

The rb_sysopen runs as www-data that needs to access to production.log,
backend_access.log and database.yml.

Revert the group owner to www-data to avoid following errors:

 Rails Error: Unable to access log file. Please ensure that
 /usr/share/obs/api/log/production.log exists and is writable (ie, make
 it writable for user and group: chmod 0664
 /usr/share/obs/api/log/production.log). The log level has been raised
 to WARN and the output directed to STDERR until the problem is fixed.
 rake aborted!
 Errno::EACCES: Cannot load `Rails.application.database_configuration`:
 Permission denied @ rb_sysopen - /usr/share/obs/api/config/database.yml
 /usr/share/obs/api/config/environment.rb:30:in `<top (required)>'
 Errno::EACCES: Permission denied @ rb_sysopen -
 /usr/share/obs/api/config/database.yml
 /usr/share/obs/api/config/environment.rb:30:in `<top (required)>'
 Tasks: TOP => environment
 (See full trace by running task with --trace)
 Errno::EACCES: Permission denied @ rb_sysopen -
 /usr/share/obs/api/log/backend_access.log
 /usr/share/obs/api/lib/opensuse/backend.rb:14:in `new'
 /usr/share/obs/api/lib/opensuse/backend.rb:14:in `<class:Backend>'
 /usr/share/obs/api/lib/opensuse/backend.rb:6:in `<module:Suse>'
 /usr/share/obs/api/lib/opensuse/backend.rb:5:in `<top (required)>'
 /usr/share/obs/api/app/models/project.rb:1:in `<top (required)>'
 /usr/share/obs/api/app/indices/project_index.rb:2:in `block in <top
 (required)>'
 Tasks: TOP => ts:index
 (See full trace by running task with --trace)
Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

Passenger's default user is nobody:
 https://www.phusionpassenger.com/library/config/nginx/reference/#passenger_default_user

So that we got Passenger and the RubyApp runs as nobody. However,
according to Debian's SystemGroup usage:
  https://wiki.debian.org/SystemGroups

nogroup (user: nobody): Daemons that need not own any files run as user
nobody and group nogroup. Thus, no files on a system should be owned by
this user or group.

So that we should create a new user call 'obapi' and force passenger app
to run as obs-api instead.

And config files should be readable by that obsapi user but usually not
writable.
Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

These are fixed from upstream 2.7 branch. Originally from pull
request#3284 in upstream:
  https://github.com/openSUSE/open-build-service/pull/3284/commitsSigned-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

obs-api: embed sanitize-4.0.0 to fix runtime issue

See merge request ruby-team/open-build-service!4

  When adding comments and other cases, obs-api calls unexistent
  function in sanitize 2.1.0, causing error 500 in webui.
Signed-off-by: Héctor Orón Martínez <hector.oron@collabora.co.uk>
Signed-off-by: Héctor Orón Martínez <zumbi@debian.org>

Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

  When adding comments and other cases, obs-api calls unexistent
  function in sanitize 2.1.0, causing error 500 in webui.
Signed-off-by: Héctor Orón Martínez <hector.oron@collabora.co.uk>
Signed-off-by: Héctor Orón Martínez <zumbi@debian.org>

CVE-2017-5188.patch: Apply upstream fixes for CVE-2017-5188.(Closes:#900133)

See merge request ruby-team/open-build-service!3

obs-worker: depends on fdisk | util-linux (<< 2.29.2-3~). (Closes: #872093)

See merge request ruby-team/open-build-service!2

These are two upstream commits that fixes CVE-2017-5188:
  https://github.com/openSUSE/open-build-service/commit/00ec3c6f4132422f00d5c15e854755c331ef1661
  https://github.com/openSUSE/open-build-service/commit/ba27c91351878bc297ec4baba0bd488a2f3b568dSigned-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

* Remove stray debug print from
  backend-Handle-ERROR_WANT_-READ-WRITE-from-ssl-reads.patch
* Add patches against BSConfig.pm to all release pools ortogonal and
  to read a BSConfig.local.pm file by default if exists.

Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>

Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>

Signed-off-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>

Differential Revision: https://phabricator.collabora.co.uk/D1111

Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

Signed-off-by: Héctor Orón Martínez <zumbi@debian.org>

  Running worker code in /run does not work as it is usually noexec.
Signed-off-by: Héctor Orón Martínez <zumbi@debian.org>

Signed-off-by: Héctor Orón Martínez <zumbi@debian.org>

Fix logrotate, refine postrm, prerm script to ensure config and log files removed after purged. (Closes:#851356)