- Aur-dev - lists.archlinux.org

Re: Tech stack for Python aurweb
by Sven-Hendrik Haase 24 May '20

24 May '20

Hi guys, This is just a drive-by suggestion but as I've had my fair share of contact with Python web development, both professional and as a hobby, I thought I'd write something. I've worked with Flask for a long time and it really got my career started so it'll always live in a special place for me but I wouldn't use it for modern projects anymore. Some of the patterns used by Flask and the technologies surrounding it are pretty dated by modern standards (magical globals anyone?). Let me instead suggest you consider FastAPI [0]. I've created a few projects using it and I love it. It has the feel of Flask while being entirely modern and yet doesn't feel bloated at all. Here's my feature top list: - Great documentation (even for outside-of-happy-path cases) - Very fast thanks to async (but you can mix sync and async routes if you want to) - Fully typed (with type-based input validation and marshaling using Pydantic by the same author) which makes it possible to run mypy to good effect - Automatic OpenAPI-based API documentation generation based on the aforementioned types - Testing is very nice - Dependency injection is nicer than using Flask's globals (but don't overuse it!) It doesn't ship with templating but you can easily add it. [1] I'm unlikely to be the one implementing this so it's always your call and I'll try to be helpful whichever framework you go with. Cheers, Sven [0] https://fastapi.tiangolo.com/ [1] https://fastapi.tiangolo.com/advanced/templates/

1 0

[PATCH] First HTTP functional test of the RPC interface
by Frédéric Mangano-Tarumi 23 May '20

23 May '20

Though barely useful in its current state, it shows how to integrate pytest with SQLAlchemy and Werkzeug, providing a test framework for the potential future Flask port, while actually testing the current PHP implementation. --- aurweb/test/__init__.py | 0 aurweb/test/conftest.py | 51 +++++++++++++++++++++++++++++++++++++++++ aurweb/test/test_rpc.py | 21 +++++++++++++++++ aurweb/test/wsgihttp.py | 38 ++++++++++++++++++++++++++++++ test/README.md | 3 +++ test/rpc.t | 2 ++ 6 files changed, 115 insertions(+) create mode 100644 aurweb/test/__init__.py create mode 100644 aurweb/test/conftest.py create mode 100644 aurweb/test/test_rpc.py create mode 100644 aurweb/test/wsgihttp.py create mode 100755 test/rpc.t diff --git a/aurweb/test/__init__.py b/aurweb/test/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/aurweb/test/conftest.py b/aurweb/test/conftest.py new file mode 100644 index 00000000..49cc2f6e --- /dev/null +++ b/aurweb/test/conftest.py @@ -0,0 +1,51 @@ +""" +Fixtures for pytest. + +This module is automatically loaded by pytest. +""" + +import pytest +import sqlalchemy +import werkzeug.test +import werkzeug.wrappers +import werkzeug.wrappers.json + +import aurweb.config +import aurweb.db +from aurweb.test.wsgihttp import WsgiHttpProxy + + +class Response(werkzeug.wrappers.CommonResponseDescriptorsMixin, + werkzeug.wrappers.json.JSONMixin, + werkzeug.wrappers.BaseResponse): + """ + Custom response object to be returned by the test client. More mixins could + be added if need be. + + See https://werkzeug.palletsprojects.com/en/1.0.x/wrappers/#mixin-classes + """ + pass + + +(a)pytest.fixture +def client(): + """ + Build a Werkzeug test client for making HTTP requests to AUR. It requires + that the AUR test website is already running at `[options] aur_location`, + specified in the configuration file. + + When aurweb becomes a pure Flask application, this should return Flask’s + test_client(), which is a Werkzeug test client too. + https://flask.palletsprojects.com/en/1.1.x/testing/#the-testing-skeleton + """ + base_uri = aurweb.config.get("options", "aur_location") + proxy = WsgiHttpProxy(base_uri) + return werkzeug.test.Client(proxy, Response) + + +(a)pytest.fixture(scope="session") +def db_engine(): + """ + Return an SQLAlchemy engine to the configured database. + """ + return sqlalchemy.create_engine(aurweb.db.get_sqlalchemy_url()) diff --git a/aurweb/test/test_rpc.py b/aurweb/test/test_rpc.py new file mode 100644 index 00000000..7079145c --- /dev/null +++ b/aurweb/test/test_rpc.py @@ -0,0 +1,21 @@ +""" +Test suite for the RPC interface. + +See also `doc/rpc.txt` for the RPC interface documentation. +""" + +import pytest +from sqlalchemy.sql import select + +from aurweb.schema import Packages + + +def test_search_by_name(client, db_engine): + """Take a package from the database, and find it through the RPC interface.""" + with db_engine.connect() as conn: + pkg = conn.execute(select([Packages]).limit(1)).fetchone() + if pkg is None: + pytest.skip("needs at least one package in the database") + resp = client.get("/rpc/", query_string={"v": "5", "type": "search", "arg": pkg["Name"]}) + result = resp.json + assert result["resultcount"] >= 1 diff --git a/aurweb/test/wsgihttp.py b/aurweb/test/wsgihttp.py new file mode 100644 index 00000000..5b9d8040 --- /dev/null +++ b/aurweb/test/wsgihttp.py @@ -0,0 +1,38 @@ +import http.client +import urllib.parse + + +class WsgiHttpProxy: + """ + WSGI-to-HTTP proxy, that is to say a WSGI application that forwards every + WSGI request to an HTTP server, then the HTTP response back to WSGI. + + The base URL the constructor takes is something like + `http://localhost:8080`. It must not contain a path, a query string or a + fragment, as the proxy wouldn’t now what to do with it. + + Only the HTTP scheme is supported, but HTTPS could probably be easily added. + """ + + def __init__(self, base_url): + parts = urllib.parse.urlsplit(base_url) + self.netloc = parts.netloc + # Limitations of this dumb proxy + assert parts.scheme == "http" + assert parts.path in ("", "/") + assert parts.query == "" + assert parts.fragment == "" + + def __call__(self, environ, start_response): + conn = http.client.HTTPConnection(self.netloc) + conn.request( + method=environ["REQUEST_METHOD"], + url=urllib.parse.urlunsplit(( + "http", self.netloc, + urllib.parse.quote(environ["PATH_INFO"]), + environ["QUERY_STRING"], "")), + body=environ["wsgi.input"].read(int(environ.get("CONTENT_LENGTH", 0))), + ) + resp = conn.getresponse() + start_response(f"{resp.status} {resp.reason}", resp.getheaders()) + return resp diff --git a/test/README.md b/test/README.md index de7eff18..cc8baf33 100644 --- a/test/README.md +++ b/test/README.md @@ -20,8 +20,11 @@ For all the test to run, the following Arch packages should be installed: - python-bleach - python-markdown - python-pygit2 +- python-pytest +- python-pytest-tap - python-sqlalchemy - python-srcinfo +- python-werkzeug Writing tests ------------- diff --git a/test/rpc.t b/test/rpc.t new file mode 100755 index 00000000..f950f7df --- /dev/null +++ b/test/rpc.t @@ -0,0 +1,2 @@ +#!/bin/sh +pytest --tap-stream "$(dirname "$0")/../aurweb/test/test_rpc.py" -- 2.26.0

3 15

[PATCH] ci: remove Travis CI
by Filipe Laíns 23 May '20

23 May '20

We are are moving to Gitlab CI. Signed-off-by: Filipe Laíns <lains(a)archlinux.org> --- .travis.yml | 23 ----------------------- 1 file changed, 23 deletions(-) delete mode 100644 .travis.yml diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 5bbfda1f..00000000 --- a/.travis.yml +++ /dev/null @@ -1,23 +0,0 @@ -language: python - -python: 3.6 - -addons: - apt: - packages: - - bsdtar - - libarchive-dev - - libgpgme11-dev - - libprotobuf-dev - -install: - - curl https://codeload.github.com/libgit2/libgit2/tar.gz/v0.26.0 | tar -xz - - curl https://sources.archlinux.org/other/pacman/pacman-5.0.2.tar.gz | tar -xz - - curl https://git.archlinux.org/pyalpm.git/snapshot/pyalpm-0.8.1.tar.gz | tar -xz - - ( cd libgit2-0.26.0 && cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr && make && sudo make install ) - - ( cd pacman-5.0.2 && ./configure --prefix=/usr && make && sudo make install ) - - ( cd pyalpm-0.8.1 && python setup.py build && python setup.py install ) - - pip install mysql-connector-python-rf pygit2==0.26 srcinfo - - pip install bleach Markdown - -script: make -C test -- 2.26.2

2 1

aurweb testing environment using Docker
by Lukas Fleischer 18 May '20

18 May '20

We are currently working on a testing environment using Docker. The idea is to have something that is super easy to set up and still mirrors our production environment as closely as possible. It should ideally allow future contributors to test their patch submissions without having to go through the hassle of manually setting up a full development environment. Shout-out to Yaron (Cc) for sending me an initial draft. One of the big design decisions is whether everything should be in a single Docker container vs. several smaller atomic containers (i.e. separate containers for the HTTP server, the database, the SSH/Git interface, ...), as often done in production environments. The first approach has the benefit of simplicity from a user's perspective and being able to easily set up the environment using just Docker. The second approach has the benefit of atomicity (simplicity from a developer's perspective) and is closer to what we would do if we would actually use Docker for our production environment. It would probably require docker-compose (or another tool) in addition to Docker to provide the same level of convenience we can achieve with the other approach using just Docker, though. Since Yaron and me have conflicting opinions, I would like to hear some more arguments and views. Thanks! Lukas

4 7

[PATCH] Create aurweb.spawn for spawing the test server
by Frédéric Mangano-Tarumi 04 May '20

04 May '20

This program makes it easier for developers to spawn the PHP server since it fetches automatically what it needs from the configuration file, rather than having the user explicitly pass arguments to the php executable. When the setup gets more complicated as we introduce Python, aurweb.spawn will keep providing the same interface, while under the hood it is planned to support running multiple sub-processes. Its Python interface provides an way for the test suite to spawn the test server when it needs to perform HTTP requests to the test server. The current implementation is somewhat weak as it doesn’t detect when a child process dies, but this is not supposed to happen often, and it is only meant for aurweb developers. In the long term, aurweb.spawn will eventually become obsolete, and replaced by Docker or Flask’s tools. --- TESTING | 7 +-- aurweb/spawn.py | 107 +++++++++++++++++++++++++++++++++++++++++++ conf/config.defaults | 3 ++ 3 files changed, 114 insertions(+), 3 deletions(-) create mode 100644 aurweb/spawn.py diff --git a/TESTING b/TESTING index 4a1e6f4c..a5e08cb8 100644 --- a/TESTING +++ b/TESTING @@ -17,7 +17,8 @@ INSTALL. Ensure to enable the pdo_sqlite extension in php.ini. 3) Copy conf/config.defaults to conf/config and adjust the configuration - (pay attention to disable_http_login, enable_maintenance and aur_location). + Pay attention to disable_http_login, enable_maintenance, aur_location and + htmldir. Be sure to change backend to sqlite and name to the file location of your created test database. @@ -31,6 +32,6 @@ INSTALL. $ ./gendummydata.py out.sql $ sqlite3 path/to/aurweb.sqlite3 < out.sql -5) Run the PHP built-in web server: +5) Run the test server: - $ AUR_CONFIG='/path/to/aurweb/conf/config' php -S localhost:8080 -t /path/to/aurweb/web/html + $ AUR_CONFIG='/path/to/aurweb/conf/config' python -m aurweb.spawn diff --git a/aurweb/spawn.py b/aurweb/spawn.py new file mode 100644 index 00000000..5fa646b5 --- /dev/null +++ b/aurweb/spawn.py @@ -0,0 +1,107 @@ +""" +Provide an automatic way of spawing an HTTP test server running aurweb. + +It can be called from the command-line or from another Python module. + +This module uses a global state, since you can’t open two servers with the same +configuration anyway. +""" + + +import atexit +import argparse +import subprocess +import sys +import time +import urllib + +import aurweb.config +import aurweb.schema + + +children = [] +verbosity = 0 + + +class ProcessExceptions(Exception): + """ + Compound exception used by stop() to list all the errors that happened when + terminating child processes. + """ + def __init__(self, message, exceptions): + self.message = message + self.exceptions = exceptions + messages = [message] + [str(e) for e in exceptions] + super().__init__("\n- ".join(messages)) + + +def spawn_child(args): + """Open a subprocess and add it to the global state.""" + if verbosity >= 1: + print(f"Spawning {args}", file=sys.stderr) + children.append(subprocess.Popen(args)) + + +def start(): + """ + Spawn the test server. If it is already running, do nothing. + + The server can be stopped with stop(), or is automatically stopped when the + Python process ends using atexit. + """ + if children: + return + atexit.register(stop) + aur_location = aurweb.config.get("options", "aur_location") + aur_location_parts = urllib.parse.urlsplit(aur_location) + htmldir = aurweb.config.get("options", "htmldir") + spawn_child(["php", "-S", aur_location_parts.netloc, "-t", htmldir]) + + +def stop(): + """ + Stop all the child processes. + + If an exception occurs during the process, the process continues anyway + because we don’t want to leave runaway processes around, and all the + exceptions are finally raised as a single ProcessExceptions. + """ + global children + atexit.unregister(stop) + exceptions = [] + for p in children: + try: + p.terminate() + if verbosity >= 1: + print(f"Sent SIGTERM to {p.args}", file=sys.stderr) + except Exception as e: + exceptions.append(e) + for p in children: + try: + rc = p.wait() + if rc != 0 and rc != -15: + # rc = -15 indicates the process was terminated with SIGTERM, + # which is to be expected since we called terminate on them. + raise Exception(f"Process {p.args} exited with {rc}") + except Exception as e: + exceptions.append(e) + children = [] + if exceptions: + raise ProcessExceptions("Errors terminating the child processes:", + exceptions) + + +if __name__ == '__main__': + parser = argparse.ArgumentParser( + prog='python -m aurweb.spawn', + description='Start aurweb\'s test server.') + parser.add_argument('-v', '--verbose', action='count', default=0, + help='increase verbosity') + args = parser.parse_args() + verbosity = args.verbose + start() + try: + while True: + time.sleep(60) + except KeyboardInterrupt: + stop() diff --git a/conf/config.defaults b/conf/config.defaults index 447dacac..86fe765c 100644 --- a/conf/config.defaults +++ b/conf/config.defaults @@ -41,6 +41,9 @@ cache = none cache_pkginfo_ttl = 86400 memcache_servers = 127.0.0.1:11211 +; Directory containing aurweb's PHP code, required by aurweb.spawn. +;htmldir = /path/to/web/html + [ratelimit] request_limit = 4000 window_length = 86400 -- 2.26.0

2 1

Append latest commit link to package update notification
by Amin Vakil 01 May '20

01 May '20

I have emailed this 10 days ago in aur-general and as there hasn't been a response to it, I wondered maybe aur-general mailing list is the wrong place to open this issue, therefore: Arch Linux Wiki has said explicitly that they don't have any responsibilities about what a package in AUR does and they also say that it's mandatory to read and understand PKGBUILD (or any other file or patch that a installation requires) before installing any package. But when a package gets updated and those who have enabled notifications want to update the package, they should (I would say everyone must) click on package page, view changes, and click on latest commit to see what has changed. So appending latest commit link "helps" and "encourages" people to check latest update and I don't think in any possible way has a downside except for a little more text to email which I assume it's OK. Best Regards, Amin Vakil

3 2

[PATCH 1/2] Fix invalid session ID check
by Lukas Fleischer 05 Apr '20

05 Apr '20

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aur.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index dbcc23a..f4ad6b4 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -50,7 +50,7 @@ function check_sid() { $result = $dbh->query($q); $row = $result->fetch(PDO::FETCH_NUM); - if (!$row[0]) { + if (!$row) { # Invalid SessionID - hacker alert! # $failed = 1; -- 2.26.0

1 1

aurweb 5.0.0 released
by Lukas Fleischer 27 Mar '20

27 Mar '20

Dear aurweb contributors and users, aurweb 5.0.0 has just been released! You can now add a secondary email address that can be used to recover your account in case access to the primary email address is lost. Reset keys for an account are always sent to both the primary and the backup email address. Most other changes were internal. Shout-out to Frédéric Mangano-Tarumi for doing some amazing work on the backend! For a comprehensive list of changes, please consult the Git log [2]. As usual, bugs should be reported to the aurweb bug tracker [3]. [1] https://aur.archlinux.org/ [2] https://projects.archlinux.org/aurweb.git/log/?id=v5.0.0 [3] https://bugs.archlinux.org/index.php?project=2

1 0

[PATCH] Add new upgrade instructions
by Lukas Fleischer 27 Mar '20

27 Mar '20

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- upgrading/5.x.x.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 upgrading/5.x.x.txt diff --git a/upgrading/5.x.x.txt b/upgrading/5.x.x.txt new file mode 100644 index 0000000..ba74e28 --- /dev/null +++ b/upgrading/5.x.x.txt @@ -0,0 +1,4 @@ +Starting from release 5.0.0, Alembic is used for managing database migrations. + +Run `alembic upgrade head` from the aurweb root directory to upgrade your +database after upgrading the source code to a new release. -- 2.26.0

1 1

TAP testing in Python
by Frédéric Mangano-Tarumi 23 Mar '20

23 Mar '20

In order to write tests in Python, we first need to make one important choice: the test framework. Our main constraint is the output format, which should be TAP to run along with the existing scripts. My favorite candidate is pycotap, which holds in a 157-line no-dependency module that we could put in our tests directory, pretty much like we did for `test/sharness.sh`. It is implemented as a producer for Python’s standard unittest module. https://el-tramo.be/pycotap/ Its main opponent is tappy, a set of tools for working with TAP. It integrates with unittest, pytest and nose. From the documentation, my impression is that it expects to be invoked with nose or pytest’s harness, which would be inconsistent with usual TAP test invocation consisting of calling scripts directly and relying on the shebang. https://tappy.readthedocs.io/en/latest/producers.html More alternatives at https://tappy.readthedocs.io/en/latest/alternatives.html Unless we plan to use pytest or nose over unittest, I suggest we use use pycotap. Except for a couple of lines, tests written with pycotap are standard unittest tests, which nose and pytest can collect results from too. If our needs evolve, we could easily upgrade to another framework.

3 4