July 2017 - Aur-dev - lists.archlinux.org

[aur-dev] [PATCH v4] Require TUs to explicitly request to overwrite a pkgbase
by Eli Schwartz 25 Jul '17

25 Jul '17

AUR_PRIVILEGED allows people with privileged AUR accounts to evade the block on non-fast-forward commits. While valid in this case, we should not do so by default, since in at least one case a TU did this without realizing there was an existing package. ( https://aur.archlinux.org/packages/rtmidi/ ) Switch to using allow_overwrite to check for destructive actions. Use .ssh/config "SendEnv" on the TU's side and and sshd_config "AcceptEnv" in the AUR server to specifically request overwrite access. TUs should use: `AUR_OVERWRITE=1 git push --force` Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- INSTALL | 1 + aurweb/git/auth.py | 2 ++ aurweb/git/update.py | 3 ++- doc/git-interface.txt | 6 ++++++ 4 files changed, 11 insertions(+), 1 deletion(-) diff --git a/INSTALL b/INSTALL index 8c9c4dd..369e1e3 100644 --- a/INSTALL +++ b/INSTALL @@ -76,6 +76,7 @@ read the instructions below. PasswordAuthentication no AuthorizedKeysCommand /usr/local/bin/aurweb-git-auth "%t" "%k" AuthorizedKeysCommandUser aur + AcceptEnv AUR_OVERWRITE 9) If you want to enable smart HTTP support with nginx and fcgiwrap, you can use the following directives: diff --git a/aurweb/git/auth.py b/aurweb/git/auth.py index 022b0ff..d02390d 100755 --- a/aurweb/git/auth.py +++ b/aurweb/git/auth.py @@ -1,5 +1,6 @@ #!/usr/bin/python3 +import os import shlex import re import sys @@ -52,6 +53,7 @@ def main(): env_vars = { 'AUR_USER': user, 'AUR_PRIVILEGED': '1' if account_type > 1 else '0', + 'AUR_OVERWRITE' : os.environ.get('AUR_OVERWRITE', '0') if account_type > 1 else '0', } key = keytype + ' ' + keytext diff --git a/aurweb/git/update.py b/aurweb/git/update.py index c9a98d0..16fa2b0 100755 --- a/aurweb/git/update.py +++ b/aurweb/git/update.py @@ -238,6 +238,7 @@ def main(): user = os.environ.get("AUR_USER") pkgbase = os.environ.get("AUR_PKGBASE") privileged = (os.environ.get("AUR_PRIVILEGED", '0') == '1') + allow_overwrite = (os.environ.get("AUR_OVERWRITE", '0') == '1') warn_or_die = warn if privileged else die if len(sys.argv) == 2 and sys.argv[1] == "restore": @@ -258,7 +259,7 @@ def main(): conn = aurweb.db.Connection() # Detect and deny non-fast-forwards. - if sha1_old != "0" * 40 and not privileged: + if sha1_old != "0" * 40 and not allow_overwrite: walker = repo.walk(sha1_old, pygit2.GIT_SORT_TOPOLOGICAL) walker.hide(sha1_new) if next(walker, None) is not None: diff --git a/doc/git-interface.txt b/doc/git-interface.txt index 7758512..f940961 100644 --- a/doc/git-interface.txt +++ b/doc/git-interface.txt @@ -33,6 +33,11 @@ users cannot access anything on the server except for the aurweb SSH interface. The forced command can be configured in the aurweb configuration file and it usually points to the git-serve program. +If SSH has been configured to pass on the AUR_OVERWRITE environment variable +(via SendEnv, see ssh_config(5) for details) and the user's account is a +registered Trusted User or Developer, this will be passed on to the git-update +program in order to enable a non-fast-forward push. + The INSTALL file in the top-level directory contains detailed instructions on how to configure sshd(8) to use git-auth for authentication. @@ -67,6 +72,7 @@ The Git update hook, called git-update, performs several subtasks: * Prevent from creating branches or tags other than master. * Deny non-fast-forwards, except for Trusted Users and Developers. +* Deny blacklisted packages, except for Trusted Users and Developers. * Verify each new commit (validate meta data, impose file size limits, ...) * Update package base information and package information in the database. * Update the named branch and the namespaced HEAD ref of the package. -- 2.13.3

2 1

[aur-dev] [PATCH] Document new git-serve commands
by Lukas Fleischer 22 Jul '17

22 Jul '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- doc/git-interface.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/git-interface.txt b/doc/git-interface.txt index 475fda6..7758512 100644 --- a/doc/git-interface.txt +++ b/doc/git-interface.txt @@ -41,11 +41,15 @@ The Shell: git-serve The git-serve command, the "aurweb shell", provides different subcommands: +* The adopt/disown commands can be used to change ownership of a package base. +* The flag/unflag commands can be used to flag/unflag a package. * The help command shows a list of available commands. * The list-repos command lists all repositories of the authenticated user. +* The restore command can be used to restore a deleted package base. +* The set-comaintainers command modifies the co-maintainers of a package base. * The set-keywords command modifies the keywords assigned to a package base. * The setup-repo command can be used to create a new repository. -* The restore command can be used to restore a deleted package base. +* The vote/unvote command can be used to vote/unvote for a package base. * The git-{receive,upload}-pack commands are redirected to git-shell(1). The command is extracted from the SSH_ORIGINAL_COMMAND environment variable -- 2.13.3

1 0

[aur-dev] [PATCH v2 2/2] Require TUs to explicitly request to overwrite a pkgbase
by Eli Schwartz 21 Jul '17

21 Jul '17

AUR_PRIVILEGED allows people with privileged AUR accounts to evade the block on non-fast-forward commits. While valid in this case, we should not do so by default, since in at least one case a TU did this without realizing there was an existing package. ( https://aur.archlinux.org/packages/rtmidi/ ) Switch to using allow_overwrite to check for destructive actions. Use .ssh/config "SendEnv" on the TU's side and and sshd_config "AcceptEnv" in the AUR server to specifically request overwrite access. TUs should use: `export AUR_OVERWRITE=1; git push` Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- v2: only require confirmation for force-pushing history. If you want to restrict who can use this feature, it should be as simple as adding a new account_type and modifying the env_vars passthrough, which can be implemented separately. INSTALL | 1 + aurweb/git/auth.py | 1 + aurweb/git/update.py | 3 ++- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/INSTALL b/INSTALL index 8c9c4dd..369e1e3 100644 --- a/INSTALL +++ b/INSTALL @@ -76,6 +76,7 @@ read the instructions below. PasswordAuthentication no AuthorizedKeysCommand /usr/local/bin/aurweb-git-auth "%t" "%k" AuthorizedKeysCommandUser aur + AcceptEnv AUR_OVERWRITE 9) If you want to enable smart HTTP support with nginx and fcgiwrap, you can use the following directives: diff --git a/aurweb/git/auth.py b/aurweb/git/auth.py index 022b0ff..fe018cb 100755 --- a/aurweb/git/auth.py +++ b/aurweb/git/auth.py @@ -52,6 +52,7 @@ def main(): env_vars = { 'AUR_USER': user, 'AUR_PRIVILEGED': '1' if account_type > 1 else '0', + 'AUR_OVERWRITE' : os.environ.get('AUR_OVERWRITE', '0') if account_type > 1 else '0', } key = keytype + ' ' + keytext diff --git a/aurweb/git/update.py b/aurweb/git/update.py index 3b9ff97..5419338 100755 --- a/aurweb/git/update.py +++ b/aurweb/git/update.py @@ -238,6 +238,7 @@ def main(): user = os.environ.get("AUR_USER") pkgbase = os.environ.get("AUR_PKGBASE") privileged = (os.environ.get("AUR_PRIVILEGED", '0') == '1') + allow_overwrite = (os.environ.get("AUR_OVERWRITE", '0') == '1') warn_or_die = warn if privileged else die if len(sys.argv) == 2 and sys.argv[1] == "restore": @@ -262,7 +263,7 @@ def main(): walker = repo.walk(sha1_old, pygit2.GIT_SORT_TOPOLOGICAL) walker.hide(sha1_new) if next(walker, None) is not None: - if privileged: + if allow_overwrite: warn("non-fast-forward push (are you absolutely sure you mean this?)") else: die("denying non-fast-forward (you should pull first)") -- 2.13.3

2 3

[aur-dev] [PATCH] Fix setting keywords in the SSH interface.
by Eli Schwartz 21 Jul '17

21 Jul '17

This was broken in commit 8914a41db938194efc021f842c89d47ff6b522c9 which refactored the argument parsing. Instead of checking for at least the set-keywords command and a pkgbase name, we were checking for *exactly* the command and pkgbase name, leaving no room for keywords... As a result, while we could clear the keywords, we could not set them. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- aurweb/git/serve.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aurweb/git/serve.py b/aurweb/git/serve.py index 3eef26a..eea0c9c 100755 --- a/aurweb/git/serve.py +++ b/aurweb/git/serve.py @@ -502,7 +502,7 @@ def serve(action, cmdargv, user, privileged, remote_addr): cmd = action + " '" + repo_path + "'" os.execl(git_shell_cmd, git_shell_cmd, '-c', cmd) elif action == 'set-keywords': - checkarg(cmdargv, 'repository name') + checkarg_atleast(cmdargv, 'repository name') pkgbase_set_keywords(cmdargv[1], cmdargv[2:]) elif action == 'list-repos': checkarg(cmdargv) -- 2.13.3

2 1

[aur-dev] [PATCH 1/2] Emit warning when TUs use their supowerpowers to overwrite a pkgbase
by Eli Schwartz 21 Jul '17

21 Jul '17

AUR_PRIVILEGED allows people with privileged AUR accounts to evade the block on non-fast-forward commits. While valid in this case, we should still provide a message saying that this happened, since in at least one case ( https://aur.archlinux.org/packages/rtmidi/ ) a TU did this without realizing there was an existing package. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Similar to the warn_or_die function, except that doesn't take alternative messages and there is no nice universal message here. I think I prefer something that allows the TU to set whether they really mean to perform a privileged TU action, since accidentally overwriting something is kind of bad either way. The follow-up patch implements this -- instead? alongside? Either patch stands on its own, though I think I'd like to see both. aurweb/git/update.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/aurweb/git/update.py b/aurweb/git/update.py index c9a98d0..3b9ff97 100755 --- a/aurweb/git/update.py +++ b/aurweb/git/update.py @@ -258,11 +258,14 @@ def main(): conn = aurweb.db.Connection() # Detect and deny non-fast-forwards. - if sha1_old != "0" * 40 and not privileged: + if sha1_old != "0" * 40: walker = repo.walk(sha1_old, pygit2.GIT_SORT_TOPOLOGICAL) walker.hide(sha1_new) if next(walker, None) is not None: - die("denying non-fast-forward (you should pull first)") + if privileged: + warn("non-fast-forward push (are you absolutely sure you mean this?)") + else: + die("denying non-fast-forward (you should pull first)") # Prepare the walker that validates new commits. walker = repo.walk(sha1_new, pygit2.GIT_SORT_TOPOLOGICAL) -- 2.13.3

2 2