$? does not work in a boolean manner in Perl. Instead, it’s
the same sort of a value wait(2) would return, so we need to
convert it into a return code and check it’s non-zero to make
it a true boolean value.

Then, we need to systematically check that this is passed on
everywhere we expect to do some error handling.

Finally, die with an error message if anything goes wrong,
so that errors can be detected by whatever’s calling us.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Apparently, this needs **/* to actually match files in directories
we’re interested in.

See https://docs.gitlab.com/ci/yaml/#onlychanges--exceptchanges



Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

OBS API has an endpoint where the publishing state can be found,
/published/<project>/<repo>?view=status.
This state is not shown anywhere in the UI.

Show the latest publishing state on a page corresponding to the
repository, /project/repository_state/<project>/<repo>.

When publishing fails, the icon in the project status also turns
red and changes to "publishing failed", with the popup clearly
indicating that: "Publishing failed, will retry soon".

To avoid potentially breaking other bits of OBS or scripts using osc,
publishing_failed is not a real state, but it’s only created internally
in the UI when needed.

The new code in src/api/lib/backend/api/published intentionally doesn't
use the Rails cache so that the publisher status is always fresh.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

OBS ships its own snapshot of XML::Structured which is written
in pure Perl. This allows us to patch it more easily compared to
the XS-powered one Debian ships.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The qsystem function does not redirect and preserve the stdout and
stderr of the command. Both end up in the logs, but cannot be saved
for further processing.

Instead of hacking up yet another system() replacement, use
Capture::Tiny, a well-proven and easy to use solution to capture
output of the standard system() function.

More specifically, capture_merged captures both stdout and stderr,
interleaved (mostly) as it would appear normally. Usually, tee or
tee_merged would be more appropriate, but here the error handler
around line 3016 handles printing the error output, so capture{,_merged}
is more than enough: in case of error, die() and leave printing
up to the caller. In case of success, print the output normally.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

XML::Structured does not encode newlines when generating XML,
so any multi-line output gets forcefully line-wrapped.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Michael Schroeder authored 2 years ago and Andrej Shadura committed 1 month ago

(cherry picked from commit 413ce35c)

When using publisher hooks, the first line of the output is often
useless as it contains something like "foo failed" or "reading config".
Including the complete error output makes more sense for diagnosing
publishing issues.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

osc 1.* changed the human-readable output format, breaking our
scripts.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The %pre section might fail in OBS since 15.6 if
"systemctl disable obsapidelayed.service"
returns non-zero exit code.

This is caused by using "export SYSTEMD_OFFLINE=1" in build script.

SP6 apache seems to limit to 1GB, going back to unlimited in our config.

During the configuration format overhaul, this code was initially
rewritten in a suboptimal way which involved snapshotting projects over
and over multiple times with lots of error messages. Instead of
deduplicating it and making it snapshot projects only once, this code
was mistakenly dropped, which resulted in snapshot identifiers going out
of sync between the main repository and updates/security.

Instead of attempting to snapshot everything, just build a map of OBS
projects corresponding to different repositories of the same distribution:

    v2024: apertis:v2024:target
    v2024-updates: apertis:v2024:updates:sdk
    v2024-security: apertis:v2024:security:development

and then run the snapshotting project on the list of projects extracted
from this map.

The last component in the project name (target etc) is irrelevant here
since the snapshotting code will snapshot all projects in the group at
once anyway.

Fixes: 7b57c3f7 ("aptly: Port internal functions and the hook to the new calling format")

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Ryan Gonzalez authored 1 year ago and Andrej Shadura committed 1 year ago

Signed-off-by: Ryan Gonzalez <ryan.gonzalez@collabora.com>
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Trigger services for every push to the branch

This somehow got lost...

Release notes for 2.10.22

🚨 [security] [src/api - 2.10] Update rack 2.2.6.4 → 2.2.8.1 (patch)

This will allow the 2.10 branch to pull the updated 2.2.8.1 gem with the security patches.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

This package was never meant to be executed directly.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

This syntax’s been available since Perl 5.20 (released 2014).

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The new configuration format splits aptly repositories and OBS projects
into two separate hashmaps, while still allowing to override settings
on per-project level:

    my $apertis_aptly_server = {
      "url" => "https://...",
      "token" => "...",
    };

    our $aptly_targets = {
      "apertis" => {
        "server"  => $apertis_aptly_server
        "gpg-key" => $aptly_gpgkey,
        "prefix"  => "apertis",
      }
    };

    our $aptly_projects = {
      "apertis:v2025:target" => {
        "default" => {
          "target"       => "apertis",
          "distribution" => "v2025",
          "component"    => "target",
        }
      },
      "apertis:v2025:development" => {
        "default" => {
          "target"       => "apertis",
          "distribution" => "v2025",
          "component"    => "development",
        }
      },
      "apertis:v2025:sdk" => {
        "default" => {
          "target"       => "apertis",
          "distribution" => "v2025",
          "gpg-key"      => "...",
          "component"    => "sdk",
        },
        "rebuild" => {
          "distribution" => "v2025",
          "component"    => "sdk",
          "gpg-key"      => "...",
          "prefix"       => "apertis",
          "aptly-server" => {
            "url" => "https://rebuilds.apertis.org",
            "token" => "tokentoken",
          },
        },
      },
      "apertis:v2025:foo" => {
        "default" => {
          "distribution" => "v2025",
          "component"    => "sdk",
          "prefix"       => "foo",
          "gpg-key"      => "...",
          "aptly-server" => {
            "url" => "https://aptly.example.org/debian

",
            "token" => "toktok",
          },
        }
      },
    };

The old-style configuration is still accepted for the time being,
subject to be removed in future.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Checksum in annotations ensures that the pod restart when an object is
updated. Previosuly, checksums were not included when there were no other
annotations on the object, so they had no effect.
Instead, always include annotations with at least the checksums, so they
are be used regardless.

Signed-off-by: Pablo Vigo <pvigo@collabora.com>

Annotate objects with a hashsum of a part of the object. This ensures
the pod restarts automatically whenever the secret or the configuration
is updated.

Signed-off-by: Pablo Vigo <pvigo@collabora.com>

[backend] compat with OBS 2.11 patchinfo format

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Included in libsolv 0.7.25-1ccu1.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Ryan Gonzalez authored 1 year ago and Sjoerd Simons committed 1 year ago

Using dashes is more consistent with configuring the GPG key.

Signed-off-by: Ryan Gonzalez <ryan.gonzalez@collabora.com>