Andrej Shadura authored May 12, 2022 and Sjoerd Simons committed May 12, 2022

Secrets are owned by root and are not world-readable by default, so
the frontend cannot access them when it’s not running as root.
Not all versions of docker-compose support setting access rights for
secrets, so instead of wrangling with them, just copy secrets and
re-own them.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Andrej Shadura authored May 04, 2022 and Sjoerd Simons committed May 04, 2022

The can_register check is actually only suitable for preventing new
unverified registrations; in SSO mode, we normally trust the SSO
provider have performed the checks and only gives us users we’re
supposed to let in.

Ideally, this should be a separate set of settings to allow e.g.
optionally requiring confirmation on SSO logins or to configure
different levels of trust per SSO provider.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The auth hash can be quite large, and with session storage in cookies,
the cookie can easily reach the 4 KB limit. Work around this issue
by only storing the part of the hash we currently use.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Add a new "hash type" for invalid passwords, which is never equal to
normal passwords, but nevertheless can be changed without being known by
the user.

This "invalid" password can only be set by directly setting the password
hash type. When updating the password using update_password method, it will
always be upgrade it to the strongest hash type, sha256crypt.

To allow changing this "invalid" password to a normal one, stop
requiring a non-empty current password in the password change dialog
when changing a password from an "invalid" one. Don’t show the current
password box either, as it is not used anyway in this case, making
it better not to show it to avoid confusion.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The redirect should only happen to the referrer URL pointing at our
domain, never to the external ones.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Some providers set username or nickname to an email address.
For this reason, first collect the best possible user name we can find,
and only then fix it to match our requirements.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

See https://bugs.debian.org/697630



Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Service dispatch daemon depends on the source service, so it has to
start after it.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Andrej Shadura authored Apr 27, 2022 and Sjoerd Simons committed Apr 27, 2022

Backend services have internal dependencies, so it’s better to start
them in the correct order. Supervisord does not guarantee this order,
but it’s still better than starting them all at once.

See: https://openbuildservice.org/help/manuals/obs-admin-guide/obs.cha.installation_and_configuration.html#_backend_installation



Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Andrej Shadura authored Apr 26, 2022 and Sjoerd Simons committed Apr 27, 2022

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Sjoerd Simons authored Apr 26, 2022 and Andrej Shadura committed Apr 26, 2022

The backend better fits to a stateful set rather then a replicaset; As
obviously the backend has a lot of state and a 1:1 relationship with its
volumes

Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>

Sjoerd Simons authored Apr 26, 2022 and Andrej Shadura committed Apr 26, 2022

OBS doesn't talk to the kubernetes api so there is no reason to create
service accounts

Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Add a charts with two subcharts, for the frontend and the backend.
Workers are not covered since we want to run them externally and connect
them using a proxy.

Settings for the backend and frontend themselves are specified through
the "global" section, while settings for MariaDB and memcached should go
into "frontend".

The extraConfig setting allows adding configuration code to BSConfig.local.pm.

The permanent backend storage stores both data and the configuration in
subdirectories.

All hosts have r/w+worker access to the backend by default.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

The default is "unexpected" which means exit codes 0 or 2 are considered
success, however search can crash and exit with 0.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Eduardo Navarro authored Feb 14, 2022 and Andrej Shadura committed Apr 20, 2022

CVE-2022-23633: Possible exposure of information vulnerability in Action
Pack.

Update Rails to 5.2.6.2 with `bundle update rails --strict --patch`.

Cherry-picked from 65292f48a504918aac61d35934e35c8b3d5c5bb1

Henne Vogelsang authored Apr 06, 2022 and Andrej Shadura committed Apr 20, 2022

Missing from #10951

Cherry-picked from 531160be9f3be444bf8ff63f0bebe3643b65788b

Sasi Olin authored Jan 04, 2022 and Andrej Shadura committed Apr 20, 2022

Fixes #10951:

    When I visit the Task page to look up my open tasks in our
    private instance, I get the followowing errors…

See https://github.com/openSUSE/open-build-service/issues/10951
Cherry-picked from d0b9bb6f524e73ed0b657b294d5c3ba0a61d0da2

Use preload_app! to boot the application and load its code before forking.
This takes advantage of copy-on-write, leading to better memory usage.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

If the GNUPGHOME existed but was empty, mkdir would fail without -p.

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>