Use `/usr/bin/env python3` instead of `/usr/bin/python3` in the shebang
of Python scripts. This adds support for non-standard Python interpreter
paths such as the paths used in virtualenv environments.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Eli Schwartz authored Jul 24, 2017 and Lukas Fleischer committed Jul 25, 2017

AUR_PRIVILEGED allows people with privileged AUR accounts to evade the
block on non-fast-forward commits. While valid in this case, we should
not do so by default, since in at least one case a TU did this without
realizing there was an existing package.
( https://aur.archlinux.org/packages/rtmidi/

 )

Switch to using allow_overwrite to check for destructive actions.
Use .ssh/config "SendEnv" on the TU's side and and sshd_config
"AcceptEnv" in the AUR server to specifically request overwrite access.
TUs should use: `AUR_OVERWRITE=1 git push --force`

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since commit 09cb61ab

 (schema: Remove invalid default values for TEXT
columns, 2017-04-15), the PackageBases.FlaggerComment field no longer
has a default value. Initialize this field explicitly whenever a new row
is added to the PackageBases table.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Split optional dependency descriptions from dependency names before
storing them in the database and use a separate column to store the
descriptions.

This allows us to simplify and optimize the SQL queries in
pkg_dependencies() as well as pkg_required().

Suggested-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Reject commits containing .SRCINFO files without any pkgname entries.

Suggested-by: Bruno Pagani <bruno.n.pagani@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Bail out early if the source array contains an entry with more than 8000
characters.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

According to RFC 7230, URLs can be up too 8000 characters long. Resize
all URL fields accordingly.

Also, add a test to verify that URLs with more than 8000 characters are
rejected by the update hook.

Reported-by: Andreas Linz <klingt.net@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Move the Git interface scripts from git-interface/ to aurweb/git/. Use
setuptools to automatically create wrappers which can be installed using
`python3 setup.py install`. Update the configuration files, the test
suite as well as the INSTALL and README files to reflect these changes.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Instead of using relative imports, add support for installing the config
and db Python modules to a proper location using setuptools. Change all
git-interface scripts to access those modules from the search path.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Move the main program logic of git-update to a main() method such that
it can be used as a module and easily be invoked by setuptools wrapper
scripts.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

The repo variable is already used to store the pygit2.Repository.

Fixes a regression introduced in d273ee5e

 (Use the official provider list
to detect duplicates, 2016-05-17).

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

When using SQLite as backend, we need to close the cursor before closing
the database to avoid the following error:

    sqlite3.OperationalError: unable to close due to unfinalized statements or unfinished backups

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Create new package bases just before saving package metadata. This
protects from stray package bases left behind when new packages are
rejected, e.g. when the user tries to push a package that is available
from the official repositories already.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Explicitly remove all package sources, dependencies, relations, licenses
and groups before inserting new ones.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Avoid using UNIX_TIMESTAMP which is not part of the SQL standard.
Retrieve the current UNIX time in Python and substitute it into the SQL
queries instead.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Avoid using Cursor.rowcount to obtain the number of rows returned by a
SELECT statement as this is not guaranteed to be supported by every
database engine.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a new module that automatically locates the configuration file and
provides methods to obtain the values of configuration options.

Use the new module instead of ConfigParser everywhere.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a new class that connects to the database specified in the
configuration file and provides an interface to execute SQL queries.
Prepared statements with qmark ("?") placeholders are supported.

Replace all direct database accesses with calls to the new abstraction
layer.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Support setting the maximum blob size in the configuration file.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Instead of looking up the account type of the current user again, use
the AUR_PRIVILEGED environment variable to check whether the user is
allowed to perform non-fast-forward ref updates.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Show a warning when a Trusted User or a developer creates a package that
is blacklisted or already provided by an official package.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Instead of automatically adding packages from the official binary
repositories to the package blacklist, use the official provider list to
prevent users from uploading duplicates.

This does not only result in reduced disk usage but also has a nice
visible side effect. The error messages printed by the update hook now
look like

    error: package already provided by [community]: powerline-fonts

instead of

    error: package is blacklisted: powerline-fonts

which was confusing to most end users.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Introduce a new notification option to receive notifications when a new
commit is pushed to a package repository.

Implements FS#30109.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

As a preparatory step to adding support for package notifications on
events other than comments, rename the database table accordingly.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored Jun 13, 2015 and Lukas Fleischer committed Feb 07, 2016

python-srcinfo is a more transparent and simpler library for parsing
SRCINFO files.

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Fix several style issues and remove unneeded imports/assignments.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since 612300b3

 (Show a warning if .SRCINFO is unchanged, 2015-09-29), the
git-update script displays a warning when a ref update does not affect
the content of the package base meta data. We also invoke git-update to
rebuild the package base details in the aurweb database when a package
base is restored via the SSH interface. In that case, fake information
is passed to the update hook: Both the old and the new object IDs refer
to the current HEAD. Check for such "Everything up-to-date" updates and
not display the ".SRCINFO unchanged" in these cases.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Warn users when a remote ref update does not change the content of
.SRCINFO such that users are reminded of updating package meta data.

Implements FS#46130.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Fixes a regression introduced in 4112e572

 (Add a restore command to the
SSH interface, 2015-08-14).

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Implement a new command that can be used to restore deleted package
bases without having to push a new commit.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add some comments to explain the major steps performed in the update
hook.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

The pkgbase variable already contains the package base name at this
point, no need to reassign it.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since c4870a95

 (git-update: Only check HEAD for blacklisted packages,
2015-06-04), only the HEAD commit package name is looked up in the
blacklist. This means that we no longer need to read the blacklist
before running the commit walker. Moving the blacklist reading code
further down makes the code easier to read.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Fixes FS#45646.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored Jul 04, 2015 and Lukas Fleischer committed Jul 04, 2015

This commit fixes a bug introduced by ae2907a5

 (git: Use .format
everywhere instead of %, 2015-06-27) where passing the error tuple to
.format wasn't prefixed with an asterisk.

Fixes FS#45545.

Reported-by: Marty <vadmium+al@gmail.com>
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

When the package base does not match the repository name, we currently
show an error message that only mentions the package base name:

    error: invalid pkgbase: yate-qt4

To the end user this sounds like the package base name is malformed
itself (and we show exactly the same error message when it contains
invalid characters, indeed). Clarify that there is a name mismatch by
also printing the expected value:

    error: invalid pkgbase: yate-qt4, expected: yate4-qt

Inspired by FS#45483.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored Jun 23, 2015 and Lukas Fleischer committed Jun 27, 2015

Fixes FS#45410.

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored Jun 27, 2015 and Lukas Fleischer committed Jun 27, 2015

% formatting is deprecated, and .format should be used instead.

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored Jun 20, 2015 and Lukas Fleischer committed Jun 20, 2015

The url and pkgdesc PKGBUILD variables are optional, so they should be
in the AUR as well.

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>