This is the default reprepro snaphost hook script. Let's add it until
OBS reprepro support is finally dropped.

Signed-off-by: Ariel D'Alessandro <ariel.dalessandro@collabora.com>

This function cleans up all contents from a repository.

In order to re-create snapshots from reprepro, we may wanna reset a
repository, then add all packages from an old reprepro snapshot and
create the aptly snapshot from there.

Signed-off-by: Ariel D'Alessandro <ariel.dalessandro@collabora.com>

Update the prefix used in the aptly test, to match the one used by
reprepro repositories in general.

Signed-off-by: Ariel D'Alessandro <ariel.dalessandro@collabora.com>

These functions will be used from other perl scripts as well. Let's make
it available from the aptly module.

Signed-off-by: Ariel D'Alessandro <ariel.dalessandro@collabora.com>

Andrej Shadura authored May 02, 2022 and Sjoerd Simons committed May 12, 2022

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Ariel D'Alessandro authored Mar 29, 2022 and Sjoerd Simons committed May 12, 2022

This commit adds tests for the OBS aptly integration.

See tests/aptly/README.md for instructions on how to run the test suite.

Signed-off-by: Ariel D'Alessandro <ariel.dalessandro@collabora.com>

Ariel D'Alessandro authored Feb 03, 2022 and Sjoerd Simons committed May 12, 2022

This commit integratates aptly backend. The following features are
supported:

* OBS repositories gets automatically created/removed on aptly.
* Each arch with the publish flag enabled in a repository, get published
  on aptly.
* Package binaries get added to the aptly repository right after they
  get built. Old versions are automatically removed.
* Every time a package is published, a snapshot is taken and published.

Related documentation is added to `README.aptly.md`:
* aptly configuration files.
* snapshot and db-cleanup scripts.

Signed-off-by: Ariel D'Alessandro <ariel.dalessandro@collabora.com>

Andrej Shadura authored May 12, 2022 and Sjoerd Simons committed May 12, 2022

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Andrej Shadura authored May 12, 2022 and Sjoerd Simons committed May 12, 2022

Secrets are owned by root and are not world-readable by default, so
the frontend cannot access them when it’s not running as root.
Not all versions of docker-compose support setting access rights for
secrets, so instead of wrangling with them, just copy secrets and
re-own them.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Andrej Shadura authored May 04, 2022 and Sjoerd Simons committed May 04, 2022

The can_register check is actually only suitable for preventing new
unverified registrations; in SSO mode, we normally trust the SSO
provider have performed the checks and only gives us users we’re
supposed to let in.

Ideally, this should be a separate set of settings to allow e.g.
optionally requiring confirmation on SSO logins or to configure
different levels of trust per SSO provider.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The auth hash can be quite large, and with session storage in cookies,
the cookie can easily reach the 4 KB limit. Work around this issue
by only storing the part of the hash we currently use.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Add a new "hash type" for invalid passwords, which is never equal to
normal passwords, but nevertheless can be changed without being known by
the user.

This "invalid" password can only be set by directly setting the password
hash type. When updating the password using update_password method, it will
always be upgrade it to the strongest hash type, sha256crypt.

To allow changing this "invalid" password to a normal one, stop
requiring a non-empty current password in the password change dialog
when changing a password from an "invalid" one. Don’t show the current
password box either, as it is not used anyway in this case, making
it better not to show it to avoid confusion.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The redirect should only happen to the referrer URL pointing at our
domain, never to the external ones.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Some providers set username or nickname to an email address.
For this reason, first collect the best possible user name we can find,
and only then fix it to match our requirements.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

See https://bugs.debian.org/697630



Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Service dispatch daemon depends on the source service, so it has to
start after it.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Andrej Shadura authored Apr 27, 2022 and Sjoerd Simons committed Apr 27, 2022

Backend services have internal dependencies, so it’s better to start
them in the correct order. Supervisord does not guarantee this order,
but it’s still better than starting them all at once.

See: https://openbuildservice.org/help/manuals/obs-admin-guide/obs.cha.installation_and_configuration.html#_backend_installation



Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Andrej Shadura authored Apr 26, 2022 and Sjoerd Simons committed Apr 27, 2022

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Sjoerd Simons authored Apr 26, 2022 and Andrej Shadura committed Apr 26, 2022

The backend better fits to a stateful set rather then a replicaset; As
obviously the backend has a lot of state and a 1:1 relationship with its
volumes

Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>

Sjoerd Simons authored Apr 26, 2022 and Andrej Shadura committed Apr 26, 2022

OBS doesn't talk to the kubernetes api so there is no reason to create
service accounts

Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>