Commit graph

88 commits

Author SHA1 Message Date
Mathieu Bridon
af02e32085 distgit: Ensure the hardlinked sources all belong to apache
Without this, client uploads and downloads aren't working any more.
2015-07-15 17:20:35 +02:00
Mathieu Bridon
3ff24f67b2 distgit: Generators don't have a length
This is fallout from the previous commit.
2015-07-13 23:03:44 +02:00
Mathieu Bridon
a11c53cb4d distgit: Harden the hardlink script a bit
Turns out the lookaside cache is not as clean as I expected.

Specifically, it contains some files where we'd expect directories, for
example:

/srv/cache/lookaside/pkgs/GFS-kernel/@13013.1e77f453ba1c86cd7616087d0643bbd8e
/srv/cache/lookaside/pkgs/openswan/tmpLRV5Gn5556cb2fcea6ba862ce14e1debf98b6d

This commit makes the script print an error instead of crashing on an
OSError in such a case.
2015-07-13 22:55:57 +02:00
Mathieu Bridon
e7074e8ad9 distgit: Add a script to make the new paths in the lookaside cache
We are migrating from the following path scheme:
    /%(srpmname)s/%(filename)s/%(hash)s/%(filename)s

To:
    /%(srpmname)s/%(filename)s/%(hashtype)s/%(hash)s/%(filename)s

As a result, we need to hardlink all the files existing under the old
path to their new path.

This script does just that.

Given that it should only ever be run once anyway, it is added as a
file to the distgit role, but not set to be installed anywhere.
2015-07-13 20:16:30 +00:00
Mathieu Bridon
6ea2c97f74 Add the full traceback to the logs 2015-06-05 18:33:13 +02:00
Mathieu Bridon
c474289e3b distgit: Catch all errors
With this, we should never fail silently any more.
2015-06-05 18:19:05 +02:00
Mathieu Bridon
635611cfb7 distgit: Reuse the same code to create directories
This avoids some race conditions, as testing for a directory existence
before creating it is racy.

The best way is to try creating it no matter what, and ignore errors
when the directory already exists.
2015-06-05 18:19:01 +02:00
Mathieu Bridon
8ecd6b0fd0 distgit: Add some logs when hardlinks are made 2015-06-05 18:18:32 +02:00
Mathieu Bridon
bd10dee3c1 distgit: Simplify forming the fedmsg path 2015-06-05 18:17:35 +02:00
Mathieu Bridon
b3d5bd9d8e distgit: Avoid reupload
The script checks for the file at the new location.

As a result, it will report that the file is missing if it had only been
uploaded to the old location, which will prompt the client to reupload.

With this change, the script will check at the new location, and if it
doesn't find the file it will try checking for it at the old location as
well.

If the file is found at the old location, we hardlink it to the new
location, and report the file is available.
2015-06-05 17:49:53 +02:00
Mathieu Bridon
d6e5e69ebd distgit: Drop unused imports 2015-06-05 17:49:17 +02:00
Patrick Uiterwijk
4b22cd9f2a Update upload_cgi and add cgi-nfs for pkgs
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
2015-06-05 09:02:28 +00:00
Mathieu Bridon
fefea74100 distgit: Properly make the symlink 2015-06-04 18:12:10 +02:00
Mathieu Bridon
9b1e60ece2 distgit: One more case of error handling 2015-06-04 16:11:42 +02:00
Pierre-Yves Chibon
cbeaa9437c Store the new version of the selinux policy for distgit 2015-06-04 09:33:10 +00:00
Pierre-Yves Chibon
c7678aed77 Require the types git_script_t and nfs_t 2015-06-04 09:29:26 +00:00
Mathieu Bridon
8cb0fa5632 Add a docstring to send_error 2015-06-04 10:58:50 +02:00
Mathieu Bridon
187de33c8a distgit: Improve error reporting to the client
There is a send_error method, which sends the error message back to the
client. (pyrpkg in our case)

Unfortunately, that method doesn't send back an error HTTP status code,
which I'm assuming must be interpreted as a "200 OK" status.

pyrpkg completely ignore the text sent back by the server, unless the
status code is not 200, which means all those errors are silently
ignored.

This commit makes sure the send_error method will always return an error
status ("500 Internal Server Error" by default), and moves all the error
handling code to use that method, specifying their own status code if
needed.
2015-06-04 10:58:50 +02:00
Pierre-Yves Chibon
3108b3b1fe Allow git_script_t to create link on NFS 2015-06-04 10:34:47 +02:00
Mathieu Bridon
0897e5d042 distgit: Don't raise, return the error to the client
Raising only sends the error to the logs, the client thinks everything
went fine.
2015-06-04 10:00:17 +02:00
Mathieu Bridon
c166eadb79 distgit: Actually hardlink over the existing source at the old path
Without this, the file could exist at both the old and new path, taking
the space on the disk twice.

This forces a hardlink if the file already existed at the old path.
2015-05-29 19:07:47 +02:00
Mathieu Bridon
1de198612a distgit: And so does os.makedirs 2015-05-29 18:05:04 +02:00
Mathieu Bridon
015c24618c distgit: os.link fails if the dest already exists 2015-05-29 18:00:31 +02:00
Mathieu Bridon
2e35fa64a3 distgit: Ensure the folder exists
We can't hard link the file if the folder containing the link
destination does not exist.

Hurray for testing in staging!
2015-05-29 11:59:57 +02:00
Mathieu Bridon
e570c2f271 distgit: Upload files to both the new and old path
Currently, the CGI script is set to upload files:
- to the old path if the upload uses md5
- to the new path if the upload uses sha512

The old path is as follows:
    /%(srpmname)s/%(filename)s/%(hash)s/%(filename)s

The new path is:
    /%(srpmname)s/%(filename)s/%(hashtype)s/%(hash)s/%(filename)s

This was meant to ensure compatibility with current fedpkg which
always downloads from the old path, but will eventually download from
the new path when we move to sha512.

However, working more on this, I now think it would make for a smoother
transition if we instead always stored the files at the new path, but
just hardlinked to the old path if the upload is using md5.

This is what this patch achieves.

With this deployed in production, fedpkg could be patched to try
downloading from the new path, and fallback to the old one if necessary,
which decouples the migration to the new path from the migration to the
new hash.
2015-05-29 11:24:24 +02:00
Ralph Bean
00c0c89076 Undo this stg/prod distinction. 2015-04-24 17:31:24 +00:00
Ralph Bean
fbccedc4e6 Try adding a custom cgit header for staging. 2015-04-24 17:17:53 +00:00
Ralph Bean
48c540664c Make cgitrc into separate files for prod and staging. 2015-04-24 17:11:03 +00:00
Kevin Fenzi
52ecc14e3a Fix http{s} git cloning on pkgs. Fixes ticket 4688 2015-04-23 17:03:48 +00:00
Ralph Bean
04c59d4eee Remove the lookaside email hook (rely on fedmsg now). 2015-03-24 14:41:16 +00:00
Patrick Uiterwijk
8d3fc995d8 Update policies to be compatible with RHEL7 2015-03-12 15:26:30 +00:00
Patrick Uiterwijk
6e98a2dc66 Fix setup_git_package to handle setting up after gitolite setup a broken repo
setup_git_package did the same check as pkgdb_sync did [1].

Also, if gitolite already came by, it will have created an update hook, which blocks us from pushing the initial commit (since gitolite has no idea who we are).
So in that case, we will just remove the update hook: gitolite will recreate it when it comes by the repo with genacls.sh.

The change to mkdir -p is just synto make it not print an error in case the directory already existed.

[1]: https://lists.fedoraproject.org/pipermail/infrastructure/2015-February/015600.html

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
2015-02-27 23:44:20 +00:00
Patrick Uiterwijk
54097dc186 Just always take the first commit returned on the master branch
Some repos have multiple first master commits due to force-pushes.
Without this, that would crash upon branching for those packages.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
2015-02-25 13:41:18 +00:00
Patrick Uiterwijk
1365500c17 Creating branches is now started by genacls.sh.
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
2015-02-24 09:40:25 +00:00
Patrick Uiterwijk
2969d0d188 Lets first create all repos before creating ACLs for them
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
2015-02-23 22:02:22 +00:00
Patrick Uiterwijk
afa5f86ab9 Feel free to run this as root, mmkey? 2015-02-23 21:51:43 +00:00
Patrick Uiterwijk
4b55f9a4ff Make genacls call pkgdb_sync_git_branches.py
gitolite compile creates empty git repos during compile for repos in its acl  that don't exist.
Since this is automagically run by fedmsg, it triggers before scm-admins can run pkgdb_sync_git_branches.py

Because of this, pkgdb_sync_git_branches sees a git repo, thus does not execute setup_git_package.
But since setup_git_package creates master, and pkgdb_sync_git_branches later on tries to create new branches from master....

Aka, this broke process-git-requests.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
2015-02-23 21:34:16 +00:00
Patrick Uiterwijk
ea48d2a2a9 When a bare repo is created, HEAD is invalid, so cloning won't work. 2015-02-19 15:56:46 +00:00
Ralph Bean
9b5b3b531d Strip unwanted prefix from git.lookaside.new messages. 2015-02-19 15:01:14 +00:00
Ralph Bean
c50b0de2ab Try to fix lookaside.new fedmsg messages. 2015-02-19 13:26:59 +00:00
Mathieu Bridon
33ea9998d1 distgit: Add the path to the source file to the emitted messages
This is the counterpart of this change:

https://github.com/fedora-infra/fedmsg_meta_fedora_infrastructure/pull/170

Now that is has been deployed, we can start emitting the new messages.
2015-02-09 10:27:29 +01:00
Pierre-Yves Chibon
869802eddc RemiFedora said 0002 was better, especially if we want to access directories 2015-01-30 14:55:21 +01:00
Pierre-Yves Chibon
25ac7e8793 Give other the right to read the file
This will make cgit happy

Thanks Mathieu :)
2015-01-30 14:48:40 +01:00
Pierre-Yves Chibon
d2e73c5d91 Add our own SELinux policy for upload.cgi
Many thanks to tfirg on #selinux for helping out making this policy
2015-01-28 12:22:16 +01:00
Mathieu Bridon
5996178fd3 distgit: Don't try reloading apache if it's off 2015-01-27 15:58:24 +01:00
Mathieu Bridon
8a6719517b Revert "distgit: Merge in the cgit/make_pkgs_list role"
This reverts commit a29f50a19a.

Turns out, Fedora People needs this as well, so it needs to remain
separated.

Sorry for the noise!
2015-01-27 15:33:45 +01:00
Mathieu Bridon
a29f50a19a distgit: Merge in the cgit/make_pkgs_list role
Having it split out was causing trouble, because distgit depends on it,
but it depends on the /srv/git folder being created, which is created
in the distgit role...

Nothing else uses this though, so merging it is the easy way out.
2015-01-27 15:31:17 +01:00
Mathieu Bridon
e39ab5d3e8 lookaside: Try again allowing the CGI script 2015-01-26 17:15:52 +01:00
Mathieu Bridon
2562566485 lookaside: Also grant access for the upload 2015-01-26 16:44:10 +01:00
Pierre-Yves Chibon
1351f8609e In EL7 we need to specify who can access 2015-01-26 16:43:18 +01:00