From 9c167efb48c86bd5c9b0ac30ffc9855c35e81189 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Aug 21 2017 09:26:01 +0000 Subject: [PATCH 1/5] Add support for the provenpackager group in pagure-dist-git Signed-off-by: Pierre-Yves Chibon --- diff --git a/dist_git_auth.py b/dist_git_auth.py index 596fede..c188d80 100644 --- a/dist_git_auth.py +++ b/dist_git_auth.py @@ -130,6 +130,9 @@ class DistGitoliteAuth(Gitolite3Auth): # Then, blacklist a pattern over that (after). config.append(_blacklist) + if repos == '' and not project.is_fork: + config.append(' %s = @provenpackager' % (access, )) + if project.committer_groups: config.append(' %s = @%s' % (access, ' @'.join( [ diff --git a/dist_git_auth_tests.py b/dist_git_auth_tests.py index 2f07ec8..0c9600d 100644 --- a/dist_git_auth_tests.py +++ b/dist_git_auth_tests.py @@ -24,6 +24,7 @@ repo test - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/test @@ -38,6 +39,7 @@ repo test2 - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/test2 @@ -52,6 +54,7 @@ repo somenamespace/test3 - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/somenamespace/test3 @@ -170,6 +173,7 @@ class DistGitoliteAuthTestCase(tests.Modeltests): - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/test2 @@ -184,6 +188,7 @@ repo somenamespace/test3 - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/somenamespace/test3 @@ -200,6 +205,7 @@ repo test - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = foo RWC = pingou @@ -277,6 +283,7 @@ repo test2 - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/test2 @@ -291,6 +298,7 @@ repo somenamespace/test3 - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/somenamespace/test3 @@ -305,6 +313,7 @@ repo test - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = @test_grp RWC = foo @@ -357,6 +366,7 @@ repo requests/test - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/test @@ -371,6 +381,7 @@ repo test2 - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/test2 @@ -385,6 +396,7 @@ repo somenamespace/test3 - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all + RWC = @provenpackager RWC = pingou repo requests/somenamespace/test3 From 582a250ee5b59657ebf8f4c30d4e1b4fb9d32574 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Aug 21 2017 09:26:01 +0000 Subject: [PATCH 2/5] Fix running the tests Signed-off-by: Pierre-Yves Chibon --- diff --git a/dist_git_auth_tests.py b/dist_git_auth_tests.py index 0c9600d..4ef8ce8 100644 --- a/dist_git_auth_tests.py +++ b/dist_git_auth_tests.py @@ -218,7 +218,7 @@ repo requests/test def test_get_supported_branches(self): """ Test for real what is returned by PDC. """ - expected = ['master', 'f26', 'f25', 'el6'] + expected = ['master', 'f27', 'f26', 'f25', 'el6'] actual = dist_git_auth.get_supported_branches('rpms', 'nethack') self.assertEquals(set(actual), set(expected)) From 8bc00630c77a8d4ef1402b0e6661708a71768a3e Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Aug 21 2017 09:26:01 +0000 Subject: [PATCH 3/5] Adjust the logic to group the users and groups in a single line This mimic the behavior we had before and help reading the configuration file. Signed-off-by: Pierre-Yves Chibon --- diff --git a/dist_git_auth.py b/dist_git_auth.py index c188d80..01ce9d2 100644 --- a/dist_git_auth.py +++ b/dist_git_auth.py @@ -116,35 +116,33 @@ class DistGitoliteAuth(Gitolite3Auth): if project.is_fork: access = 'RW+C' + users = sorted(set([project.user.user]).union( + set([ + user.user + for user in project.committers + if user != project.user]))) + groups = sorted(set([ + group.group_name + for group in project.committer_groups + ])) + if repos == '' and not project.is_fork: + groups.append('provenpackager') # First, whitelist the supported branches from PDC for branch in get_supported_branches( project.namespace, project.name): config.append(' %s %s = %s' % ( - access, branch, project.user.user)) - for user in project.committers: - if user != project.user: - config.append(' %s %s = %s' % ( - access, branch, user.user)) + access, branch, ' '.join(users) + ) + ) # Then, blacklist a pattern over that (after). config.append(_blacklist) - if repos == '' and not project.is_fork: - config.append(' %s = @provenpackager' % (access, )) - - if project.committer_groups: - config.append(' %s = @%s' % (access, ' @'.join( - [ - group.group_name - for group in project.committer_groups - ] - ))) - - config.append(' %s = %s' % (access, project.user.user)) - for user in project.committers: - if user != project.user: - config.append(' %s = %s' % (access, user.user)) + if groups: + config.append(' %s = @%s' % (access, ' @'.join(groups))) + + config.append(' %s = %s' % (access, ' '.join(users))) for deploykey in project.deploykeys: access = 'R' diff --git a/dist_git_auth_tests.py b/dist_git_auth_tests.py index 4ef8ce8..3ee4f5e 100644 --- a/dist_git_auth_tests.py +++ b/dist_git_auth_tests.py @@ -196,22 +196,18 @@ repo requests/somenamespace/test3 repo test R = @all - RWC master = foo - RWC master = pingou - RWC f9000 = foo - RWC f9000 = pingou + RWC master = foo pingou + RWC f9000 = foo pingou - f[0-9][0-9] = @all - epel[0-9] = @all - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all RWC = @provenpackager - RWC = foo - RWC = pingou + RWC = foo pingou repo requests/test - RWC = foo - RWC = pingou + RWC = foo pingou # end of body''' self.assertMultiLineEqual(expected, contents.strip()) @@ -313,8 +309,7 @@ repo test - epel[0-9][0-9] = @all - el[0-9] = @all - olpc[0-9] = @all - RWC = @provenpackager - RWC = @test_grp + RWC = @test_grp @provenpackager RWC = foo repo requests/test From cc4f9bab535b97b2acf36cc00ad6183473eb8b04 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Aug 21 2017 09:26:01 +0000 Subject: [PATCH 4/5] Drop using set([]) where not needed Signed-off-by: Pierre-Yves Chibon --- diff --git a/dist_git_auth.py b/dist_git_auth.py index 01ce9d2..a3181bf 100644 --- a/dist_git_auth.py +++ b/dist_git_auth.py @@ -117,14 +117,14 @@ class DistGitoliteAuth(Gitolite3Auth): access = 'RW+C' users = sorted(set([project.user.user]).union( - set([ + set( user.user for user in project.committers - if user != project.user]))) - groups = sorted(set([ + if user != project.user))) + groups = sorted(set( group.group_name for group in project.committer_groups - ])) + )) if repos == '' and not project.is_fork: groups.append('provenpackager') From 0b41db1510ad95dfee5707773fa8daafd485f182 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Aug 21 2017 09:49:50 +0000 Subject: [PATCH 5/5] Some package do not allow provenpackager access Add the corresponding tests for it Signed-off-by: Pierre-Yves Chibon --- diff --git a/dist_git_auth.py b/dist_git_auth.py index a3181bf..fb81a61 100644 --- a/dist_git_auth.py +++ b/dist_git_auth.py @@ -27,6 +27,8 @@ from pagure.lib import model # noqa: E402 from pagure.lib.git_auth import Gitolite3Auth, _read_file # noqa: E402 +_NOT_PROVENPACKAGER = ['rpms/firefox', 'rpms/thunderbird', 'rpms/xulrunner'] + _log = logging.getLogger(__name__) cache = dogpile.cache.make_region().configure( @@ -127,7 +129,8 @@ class DistGitoliteAuth(Gitolite3Auth): )) if repos == '' and not project.is_fork: - groups.append('provenpackager') + if project.fullname not in _NOT_PROVENPACKAGER: + groups.append('provenpackager') # First, whitelist the supported branches from PDC for branch in get_supported_branches( project.namespace, project.name): diff --git a/dist_git_auth_tests.py b/dist_git_auth_tests.py index 3ee4f5e..10aaf68 100644 --- a/dist_git_auth_tests.py +++ b/dist_git_auth_tests.py @@ -406,3 +406,95 @@ repo requests/forks/pingou/test # end of body''' self.assertMultiLineEqual(expected, contents.strip()) + + @mock.patch('dist_git_auth.get_supported_branches') + def test_write_gitolite_acls_rpms_firefox(self, get_supported_branches): + """ Test generating the entire gitolite configuration file + with the firefox project in the rpms namespace (ie a project not + allowing provenpackager access). + + """ + get_supported_branches.return_value = ['master', 'f9000'] + print("Initializing DB.") + item = pagure.lib.model.Project( + user_id=1, # pingou + name='firefox', + description='The firefox project', + hook_token='aaabbbeee', + namespace='rpms', + ) + self.session.add(item) + self.session.commit() + + print("Generating %r" % self.configfile) + dist_git_auth.DistGitoliteAuth.write_gitolite_acls( + self.session, + configfile=self.configfile, + project=-1) + + print("Checking the contents of %r" % self.configfile) + with open(self.configfile, 'r') as f: + contents = f.read() + expected = """repo rpms/firefox + R = @all + RWC master = pingou + RWC f9000 = pingou + - f[0-9][0-9] = @all + - epel[0-9] = @all + - epel[0-9][0-9] = @all + - el[0-9] = @all + - olpc[0-9] = @all + RWC = pingou + +repo requests/rpms/firefox + RWC = pingou + +# end of body +""" + self.assertMultiLineEqual(contents.strip(), expected.strip()) + + @mock.patch('dist_git_auth.get_supported_branches') + def test_write_gitolite_acls_firefox(self, get_supported_branches): + """ Test generating the entire gitolite configuration file + with the firefox project. + + """ + get_supported_branches.return_value = ['master', 'f9000'] + print("Initializing DB.") + item = pagure.lib.model.Project( + user_id=1, # pingou + name='firefox', + description='The firefox project', + hook_token='aaabbbeee', + namespace=None, + ) + self.session.add(item) + self.session.commit() + + print("Generating %r" % self.configfile) + dist_git_auth.DistGitoliteAuth.write_gitolite_acls( + self.session, + configfile=self.configfile, + project=-1) + + print("Checking the contents of %r" % self.configfile) + with open(self.configfile, 'r') as f: + contents = f.read() + expected = """repo firefox + R = @all + RWC master = pingou + RWC f9000 = pingou + - f[0-9][0-9] = @all + - epel[0-9] = @all + - epel[0-9][0-9] = @all + - el[0-9] = @all + - olpc[0-9] = @all + RWC = @provenpackager + RWC = pingou + +repo requests/firefox + RWC = pingou + +# end of body +""" + self.assertMultiLineEqual(contents.strip(), expected.strip())