Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

new-updates-sync: set umask to be more permissive for ostree operations

Browse source 
See https://github.com/ostreedev/ostree/pull/1984 where OSTree was
changed to try to set group write on directories. We need to set a more
permissive umask to take advantage of it.

This is all done to support writing to the OSTree repo from OpenShift
projects that run as a random UID, but have ftpsync (gid:263) in their
supplemental groups. For more context see: https://pagure.io/releng/issue/8811#comment-629051
This commit is contained in:
Dusty Mabe 2020-04-08 17:06:19 -04:00 • committed by Pierre-Yves Chibon
parent 9bc3ceb2a2
commit b5438172b2
1 changed files with 16 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

26
roles/bodhi2/backend/files/new-updates-sync
View file

@ -234,16 +234,22 @@ def sync_ostree(dst, ref):
if src_commit == dst_commit:
logger.info('OSTree at %s, ref %s in sync', dst, ref)
else:
print('Syncing ostree ref %s: %s -> %s'
% (ref, src_commit, dst_commit))
logger.info('Syncing OSTree to %s, ref %s: %s -> %s',
dst, ref, src_commit, dst_commit)
cmd = ['ostree', 'pull-local', '--verbose', '--repo',
dst, OSTREESOURCE, ref]
out = run_command(cmd)
cmd = ['ostree', 'summary', '--verbose', '--repo', dst, '--update']
run_command(cmd)
print('Ostree ref %s now at %s' % (ref, src_commit))
# Set the umask to be more permissive so directories get group write
# https://github.com/ostreedev/ostree/pull/1984
oldumask = os.umask(0o0002)
try:
print('Syncing ostree ref %s: %s -> %s'
% (ref, src_commit, dst_commit))
logger.info('Syncing OSTree to %s, ref %s: %s -> %s',
dst, ref, src_commit, dst_commit)
cmd = ['ostree', 'pull-local', '--verbose', '--repo',
dst, OSTREESOURCE, ref]
out = run_command(cmd)
cmd = ['ostree', 'summary', '--verbose', '--repo', dst, '--update']
run_command(cmd)
print('Ostree ref %s now at %s' % (ref, src_commit))
finally:
os.umask(oldumask)
def update_fullfilelist(modules):