August 2016 - Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Change default SSH options to "restrict"
by Lukas Fleischer 05 Aug '16

05 Aug '16

>From the sshd(8) man page: Enable all restrictions, i.e. disable port, agent and X11 forwarding, as well as disabling PTY allocation and execution of ~/.ssh/rc. If any future restriction capabilities are added to authorized_keys files they will be included in this set. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- conf/config.proto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/conf/config.proto b/conf/config.proto index 64af774..d5778a0 100644 --- a/conf/config.proto +++ b/conf/config.proto @@ -47,7 +47,7 @@ RSA = SHA256:Ju+yWiMb/2O+gKQ9RJCDqvRg7l+Q95KFAeqM5sr6l2s valid-keytypes = ssh-rsa ssh-dss ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 username-regex = [a-zA-Z0-9]+[.\-_]?[a-zA-Z0-9]+$ git-serve-cmd = /srv/http/aurweb/git-interface/git-serve.py -ssh-options = no-port-forwarding,no-X11-forwarding,no-pty +ssh-options = restrict [serve] repo-path = /srv/http/aurweb/aur.git/ -- 2.9.2

1 0

[aur-dev] [PATCH] git-serve: Deprecate setup-repo
by Lukas Fleischer 05 Aug '16

05 Aug '16

Since 02dd9c5 (git-serve.py: Automatically create repositories, 2015-01-06), one can create new package bases by running `git push`. It is no longer necessary to run setup-repo manually. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- git-interface/git-serve.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/git-interface/git-serve.py b/git-interface/git-serve.py index aa5f1c9..81b7e93 100755 --- a/git-interface/git-serve.py +++ b/git-interface/git-serve.py @@ -133,6 +133,10 @@ def die_with_help(msg): die(msg + "\nTry `{:s} help` for a list of commands.".format(ssh_cmdline)) +def warn(msg): + sys.stderr.write("warning: {:s}\n".format(msg)) + + user = os.environ.get('AUR_USER') privileged = (os.environ.get('AUR_PRIVILEGED', '0') == '1') ssh_cmd = os.environ.get('SSH_ORIGINAL_COMMAND') @@ -186,6 +190,7 @@ elif action == 'setup-repo': die_with_help("{:s}: missing repository name".format(action)) if len(cmdargv) > 2: die_with_help("{:s}: too many arguments".format(action)) + warn('{:s} is deprecated. Use `git push` to create new repositories.') create_pkgbase(cmdargv[1], user) elif action == 'restore': if len(cmdargv) < 2: -- 2.9.2

1 1

[aur-dev] [PATCH] git-update: Notify privileged users of forced uploads
by Lukas Fleischer 01 Aug '16

01 Aug '16

Show a warning when a Trusted User or a developer creates a package that is blacklisted or already provided by an official package. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- git-interface/git-update.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index 2c24e72..41b38a6 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -202,6 +202,7 @@ repo = pygit2.Repository(repo_path) user = os.environ.get("AUR_USER") pkgbase = os.environ.get("AUR_PKGBASE") privileged = (os.environ.get("AUR_PRIVILEGED", '0') == '1') +warn_or_die = warn if privileged else die if len(sys.argv) == 2 and sys.argv[1] == "restore": if 'refs/heads/' + pkgbase not in repo.listall_references(): @@ -338,11 +339,11 @@ for pkgname in srcinfo.utils.get_package_names(metadata): pkginfo = srcinfo.utils.get_merged_package(pkgname, metadata) pkgname = pkginfo['pkgname'] - if pkgname in blacklist and not privileged: - die('package is blacklisted: {:s}'.format(pkgname)) - if pkgname in providers and not privileged: + if pkgname in blacklist: + warn_or_die('package is blacklisted: {:s}'.format(pkgname)) + if pkgname in providers: repo = providers[pkgname] - die('package already provided by [{:s}]: {:s}'.format(repo, pkgname)) + warn_or_die('package already provided by [{:s}]: {:s}'.format(repo, pkgname)) cur.execute("SELECT COUNT(*) FROM Packages WHERE Name = %s AND " + "PackageBaseID <> %s", [pkgname, pkgbase_id]) -- 2.9.0

1 0

[aur-dev] [PATCH] git-serve: Refactor environment variable access
by Lukas Fleischer 01 Aug '16

01 Aug '16

Read all environment variables at the beginning of the script and immediately pre-process their values. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- git-interface/git-serve.py | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/git-interface/git-serve.py b/git-interface/git-serve.py index 35c6b3a..aa5f1c9 100755 --- a/git-interface/git-serve.py +++ b/git-interface/git-serve.py @@ -108,15 +108,12 @@ def pkgbase_set_keywords(pkgbase, keywords): db.close() -def check_permissions(pkgbase, user): +def pkgbase_has_write_access(pkgbase, user): db = mysql.connector.connect(host=aur_db_host, user=aur_db_user, passwd=aur_db_pass, db=aur_db_name, unix_socket=aur_db_socket, buffered=True) cur = db.cursor() - if os.environ.get('AUR_PRIVILEGED', '0') == '1': - return True - cur.execute("SELECT COUNT(*) FROM PackageBases " + "LEFT JOIN PackageComaintainers " + "ON PackageComaintainers.PackageBaseID = PackageBases.ID " + @@ -136,15 +133,18 @@ def die_with_help(msg): die(msg + "\nTry `{:s} help` for a list of commands.".format(ssh_cmdline)) -user = os.environ.get("AUR_USER") -cmd = os.environ.get("SSH_ORIGINAL_COMMAND") -if not cmd: +user = os.environ.get('AUR_USER') +privileged = (os.environ.get('AUR_PRIVILEGED', '0') == '1') +ssh_cmd = os.environ.get('SSH_ORIGINAL_COMMAND') +ssh_client = os.environ.get('SSH_CLIENT') + +if not ssh_cmd: die_with_help("Interactive shell is disabled.") -cmdargv = shlex.split(cmd) +cmdargv = shlex.split(ssh_cmd) action = cmdargv[0] +remote_addr = ssh_client.split(' ')[0] if ssh_client else None if enable_maintenance: - remote_addr = os.environ["SSH_CLIENT"].split(" ")[0] if remote_addr not in maintenance_exc: die("The AUR is down due to maintenance. We will be back soon.") @@ -165,7 +165,7 @@ if action == 'git-upload-pack' or action == 'git-receive-pack': create_pkgbase(pkgbase, user) if action == 'git-receive-pack': - if not check_permissions(pkgbase, user): + if not privileged and not pkgbase_has_write_access(pkgbase, user): die('{:s}: permission denied: {:s}'.format(action, user)) os.environ["AUR_USER"] = user -- 2.9.0

1 0