- Aur-dev - lists.archlinux.org

Re: [PATCH] Display warning when flagging VCS packages
by Bruno Pagani 26 May '19

26 May '19

Le 26/05/2019 à 00:04, Lukas Fleischer a écrit : > On Sat, 25 May 2019 at 13:46:45, Bruno Pagani wrote: >> Le 25/05/2019 à 19:07, Lukas Fleischer a écrit : >>> + This is a VCS package. Please do not flag this package out-of-date when the package version in the AUR does not match the most recent commit. >> Maybe we should also hint when it is appropriated to do so? E.g. missing >> new dependency or old one to be removed, moved upstream… > There already is a message stating that package flagging should not be > used to report such bugs. Is it not obvious/precise enough? Well I think it should instead be used for such bugs in the case of VCS packages, because those are the only cases where they can be OOD, and in contrary to normal packages those are valid OOD reasons. And that is the case for the linked package in the FS ticket. But I acknowledge this is not what we say currently, though I would use the opportunity of that addition to change the guidelines regarding this. And then I’m in favour of saying so in the message: “This is a VCS package. Please do not flag it out-of-date if the package version in the AUR does not match the most recent commit. Flagging this package should only be done if the sources moved or changes in the PKGBUILD are required because of recent upstream changes.” >>> +/** >>> + * Determine whether a package base is (or contains a) VCS package >>> + * >>> + * @param int $base_id The ID of the package base >>> + * >>> + * @return bool True if the package base is/contains a VCS package >>> + */ >>> +function pkgbase_is_vcs($base_id) { >>> + $suffixes = array("-cvs", "-svn", "-git", "-hg", "-bzr", "-darcs"); >> What about false positives and missing items like -nightly’s? I think it >> would be a good time to implement FS#56602, auto-seed the value >> depending on your above list and let maintainers override this. > Yes, there are false positives and false negatives. That is why we only > display a warning and do not automatically disable the feature for VCS > packages. Read the comments in FS#62733 for details. All I’ve read was the same thing as before regarding the impossibility to correctly detect all VCS packages and just them, but I did not see why manual override wouldn’t be an option. ;) Regarding false positives, without override possibility they will be misleading to users, so I don’t agree on “it’s OK because we are not plainly disabling the feature”. Also for me the strongest reason to not disable the feature for VCS packages is rather because it is still useful even for those, as stated by Eli. :) Regards, Bruno

3 3

[PATCH] Display warning when flagging VCS packages
by Lukas Fleischer 25 May '19

25 May '19

VCS packages should not be flagged out-of-date when the package version does not match the most recent commit. Implements FS#62733. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/css/aurweb.css | 4 ++++ web/html/pkgflag.php | 5 +++++ web/lib/pkgbasefuncs.inc.php | 21 +++++++++++++++++++++ 3 files changed, 30 insertions(+) diff --git a/web/html/css/aurweb.css b/web/html/css/aurweb.css index ef37bf5..81bf9ab 100644 --- a/web/html/css/aurweb.css +++ b/web/html/css/aurweb.css @@ -195,3 +195,7 @@ label.confirmation, .comments .more { font-weight: normal; } + +.error { + color: red; +} diff --git a/web/html/pkgflag.php b/web/html/pkgflag.php index 61346b9..2fba6bd 100644 --- a/web/html/pkgflag.php +++ b/web/html/pkgflag.php @@ -50,6 +50,11 @@ if (has_credential(CRED_PKGBASE_FLAG)): ?> <li><?= htmlspecialchars($pkgname) ?></li> <?php endforeach; ?> </ul> + <?php if (pkgbase_is_vcs($base_id)): ?> + + This is a VCS package. Please do not flag this package out-of-date when the package version in the AUR does not match the most recent commit. + + <?php endif; ?> <?= __('Please do %snot%s use this form to report bugs. Use the package comments instead.', '', ''); ?> diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 1df21a2..a492589 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -367,6 +367,27 @@ function pkgbase_get_pkgnames($base_id) { return $result->fetchAll(PDO::FETCH_COLUMN, 0); } +/** + * Determine whether a package base is (or contains a) VCS package + * + * @param int $base_id The ID of the package base + * + * @return bool True if the package base is/contains a VCS package + */ +function pkgbase_is_vcs($base_id) { + $suffixes = array("-cvs", "-svn", "-git", "-hg", "-bzr", "-darcs"); + $haystack = pkgbase_get_pkgnames($base_id); + array_push($haystack, pkgbase_name_from_id($base_id)); + foreach ($haystack as $pkgname) { + foreach ($suffixes as $suffix) { + if (substr_compare($pkgname, $suffix, -strlen($suffix)) === 0) { + return true; + } + } + } + return false; +} + /** * Delete all packages belonging to a package base * -- 2.21.0

2 3

[PATCH] Sync CSS with archweb
by Lukas Fleischer 25 May '19

25 May '19

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/css/archweb.css | 72 ++++++++++++++-------------------------- 1 file changed, 25 insertions(+), 47 deletions(-) diff --git a/web/html/css/archweb.css b/web/html/css/archweb.css index 209561f..2dc5be1 100644 --- a/web/html/css/archweb.css +++ b/web/html/css/archweb.css @@ -264,25 +264,6 @@ td { } /* table pretty styles */ -table.pretty1 { - width: auto; - margin-top: 0.25em; - margin-bottom: 0.5em; - border-collapse: collapse; - border: 1px solid #bcd; -} - - .pretty1 th { - padding: 0.35em; - background: #e4eeff; - border: 1px solid #bcd; - } - - .pretty1 td { - padding: 0.35em; - border: 1px dotted #bcd; - } - table.pretty2 { width: auto; margin-top: 0.25em; @@ -433,6 +414,10 @@ table thead th.sorter-false { cursor: default; } +.tablesorter-header:focus { + outline: none; +} + /** * PAGE SPECIFIC STYLES */ @@ -541,7 +526,7 @@ h3 span.arrow { padding: 0.15em 0.1em; margin: 0; min-width: 10em; - font-size: 0.812em; + font-size: 1em; text-align: left; list-style: none; background-color: #f6f9fc; @@ -552,6 +537,7 @@ h3 span.arrow { color: #000; } + .pkgsearch-typeahead li:hover a, .pkgsearch-typeahead li.active a { color: #07b; } @@ -652,6 +638,10 @@ div.news-article .article-info { width: 75%; } +#news-preview { + display: none; +} + /* todolists: list */ .todolist-nav { float: right; @@ -816,6 +806,10 @@ table.results { width: 45%; } +#flag-pkg-form #id_website { + display: none; +} + /* pkgdetails: deps, required by and file lists */ #pkgdetails #metadata { clear: both; @@ -983,33 +977,7 @@ table td.country { background: #ffd; } -/* dev dashboard: flagged packages */ -#dash-pkg-notify { - text-align: right; - padding: 1em 0 0; - margin-top: 1em; - font-size: 0.85em; - border-top: 1px dotted #bbb; -} - - #dash-pkg-notify label { - width: auto; - font-weight: normal; - } - - #dash-pkg-notify input { - vertical-align: middle; - margin: 0 0.25em; - } - - #dash-pkg-notify input[type=submit] { - margin-top: -0.25em; - } - - #dash-pkg-notify p { - margin: 0; - } - +/* dev dashboard: */ table.dash-stats .key { width: 50%; } @@ -1121,3 +1089,13 @@ ul.signoff-list { width: 100%; height: 100%; } + +/* releases */ +#release-table th:first-of-type { + width: 30px; +} + +/* itemprops */ +.itemprop { + display: none; +} -- 2.21.0

1 0

[PATCH] Use native language name for Finnish
by Lukas Fleischer 24 May '19

24 May '19

Addresses FS#61803. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/translator.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/translator.inc.php b/web/lib/translator.inc.php index 334d0e7..cbed127 100644 --- a/web/lib/translator.inc.php +++ b/web/lib/translator.inc.php @@ -30,7 +30,7 @@ $SUPPORTED_LANGS = array( "el" => "Ελληνικά", "es" => "Español", "es_419" => "Español (Latinoamérica)", - "fi" => "Finnish", + "fi" => "Suomi", "fr" => "Français", "he" => "עברית", "hr" => "Hrvatski", -- 2.21.0

1 0

[PATCH] Ignore merge target for non-merge requests
by Lukas Fleischer 24 May '19

24 May '19

Fixes FS#59837. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgreqfuncs.inc.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/web/lib/pkgreqfuncs.inc.php b/web/lib/pkgreqfuncs.inc.php index 774ebe7..b8be7e5 100644 --- a/web/lib/pkgreqfuncs.inc.php +++ b/web/lib/pkgreqfuncs.inc.php @@ -127,6 +127,11 @@ function pkgreq_file($ids, $type, $merge_into, $comments) { return array(false, __("You must be logged in to file package requests.")); } + /* Ignore merge target for non-merge requests. */ + if ($type !== 'merge') { + $merge_into = ''; + } + if (!empty($merge_into) && !preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/D", $merge_into)) { return array(false, __("Invalid name: only lowercase letters are allowed.")); } -- 2.21.0

1 0

[aur-dev][PATCH] Correctly handle package sources which do not validate as an url
by Eli Schwartz 28 Apr '19

28 Apr '19

php's parse_url does not handle proper rfc3986 URIs, specifically, it does not handle the case of an empty authority such as file:/// or local:/// and only handles the case of file by applying a special case for file itself. These URIs are deemed "malformed" and return false. When such URIs were used, we would end up always treating the package source as a filename (despite that this is incorrect, since plain files will be correctly handled by parse_url, we will correctly determine that there is no schema, and we will go to the source_file_uri). Instead, handle the case of a "malformed" URI by treating it as another example of a source with a schema, and linking it as-is. See https://lists.archlinux.org/pipermail/aur-general/2019-January/034782.html for details. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- This fixes the case of local:///, but are there other cases where php would claim a malformed url where we would actually want to link to cgit? Should we just be dumb like makepkg and git/update.py, and check if it has the string literal '://'? Given the other two places where a source url might be handled don't even make a pretense of being proper rfc3986 parsers, this would at least mean we're highly consistent in our behavior. web/lib/pkgfuncs.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index ced1f8e..126b5c3 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -481,7 +481,7 @@ function pkg_source_link($url, $arch, $package) { $url = explode('::', $url); $parsed_url = parse_url($url[0]); - if (isset($parsed_url['scheme']) || isset($url[1])) { + if ($parsed_url === false || isset($parsed_url['scheme']) || isset($url[1])) { $link = '<a href="' . htmlspecialchars((isset($url[1]) ? $url[1] : $url[0]), ENT_QUOTES) . '">' . htmlspecialchars($url[0]) . '</a>'; } else { $file_url = sprintf(config_get('options', 'source_file_uri'), htmlspecialchars($url[0]), $package); -- 2.20.1

2 4

[PATCH] git-auth: deny login if no password has been set
by Lukas Fleischer 27 Apr '19

27 Apr '19

After creating a new account, users need to verify their email address and set an initial password. Without setting a password, users cannot use their account on the web interface. However, when logging in via SSH, we did not check whether the account is verified. Fix this by only allowing SSH access once a password is set. Reported-by: Pat Hogan <pathtofile(a)gmail.com> Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/git/auth.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/aurweb/git/auth.py b/aurweb/git/auth.py index 828ed4e..3b1e485 100755 --- a/aurweb/git/auth.py +++ b/aurweb/git/auth.py @@ -39,7 +39,8 @@ def main(): cur = conn.execute("SELECT Users.Username, Users.AccountTypeID FROM Users " "INNER JOIN SSHPubKeys ON SSHPubKeys.UserID = Users.ID " - "WHERE SSHPubKeys.PubKey = ? AND Users.Suspended = 0", + "WHERE SSHPubKeys.PubKey = ? AND Users.Suspended = 0 " + "AND NOT Users.Passwd = ''", (keytype + " " + keytext,)) row = cur.fetchone() -- 2.21.0

1 0

Re: [aur-general] Spammers in AUR user comments
by Lukas Fleischer 11 Apr '19

11 Apr '19

On Thu, 11 Apr 2019 at 15:13:32, Daniel M. Capella via aur-general wrote: > On April 5, 2019 7:54:44 AM EDT, NicoHood <archlinux at nicohood.de> wrote: > >Should and how can we better protect ourselves from spam comments? > > Perhaps we should add CAPTCHA for account registrations. IIRC, we had an issue with spam bots several years ago. We tried adding a CAPTCHA back then and it did not help (which, of course, does not imply that CAPTCHAs do not work in general). The issue was eventually resolved by requiring users to confirm their email address and set an initial password from the confirmation email before using their accounts. If this no longer works and massive spamming continues to be a problem, I am open to trying other techniques again. That being said, I think we should first figure out whether spammer account creation is automated or done manually this time. Lukas

1 0

[PATCH] git/update: Fix exception on encountering non-blob type
by Johannes Löthberg 05 Mar '19

05 Mar '19

Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- aurweb/git/update.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aurweb/git/update.py b/aurweb/git/update.py index 39128f8..5228abc 100755 --- a/aurweb/git/update.py +++ b/aurweb/git/update.py @@ -284,7 +284,7 @@ def main(): str(commit.id)) if not isinstance(blob, pygit2.Blob): - die_commit("not a blob object: {:s}".format(treeobj), + die_commit("not a blob object: {:s}".format(str(treeobj.id)), str(commit.id)) if blob.size > max_blob_size: -- 2.20.1

1 0

[PATCH] Fix German translation for DISCLAIMER line on the home page.
by Kevin Morris 25 Feb '19

25 Feb '19

Something was leftover (probably from a previous update?) Took out the extra line to sync up with how the other languages handle it. Signed-off-by: Kevin Morris <kevr.gtalk(a)gmail.com> --- po/de.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/po/de.po b/po/de.po index 00ab95c..ee5631d 100644 --- a/po/de.po +++ b/po/de.po @@ -233,7 +233,7 @@ msgstr "Manche Pakete könnten als Binär-Pakete in [community] bereitgestellt s #: html/home.php msgid "DISCLAIMER" -msgstr "DISCLAIMER: Offiziell nicht unterstützte PKGBUILDS werden von den Benutzern erstellt - durch den Download willigt man ein, diese auf eigene Gefahr zu benutzen." +msgstr "DISCLAIMER" #: html/home.php template/footer.php msgid "" -- 2.20.1

1 0