Alex Muller authored Jan 03, 2017 and Lukas Fleischer committed Jan 07, 2017

There are 95 printable ASCII characters which with a minimum length of 4
gives 95^4 or 81 million possible passwords. Increasing the minimum
length to 8 increases the number of possible passwords by a factor of
about 10^7.

Relates to FS#52297.

Signed-off-by: Alex Muller <alex@mullr.net>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Move the Git interface scripts from git-interface/ to aurweb/git/. Use
setuptools to automatically create wrappers which can be installed using
`python3 setup.py install`. Update the configuration files, the test
suite as well as the INSTALL and README files to reflect these changes.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Support for multiple servers has never been used by the official aurweb
setup and the current implementation makes it impossible to use server
URIs that contain spaces. For simplicity, change the implementation such
that only a single server is supported.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Instead of writing the output to hardcoded files (relative to the
document root), make the output paths of mkpkglists configurable.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

In addition to MySQL, add support for SQLite to the database abstraction
layer. Also, add a new configuration option to select the DBMS.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Support setting the maximum blob size in the configuration file.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

From the sshd(8) man page:

    Enable all restrictions, i.e. disable port, agent and X11
    forwarding, as well as disabling PTY allocation and execution of
    ~/.ssh/rc. If any future restriction capabilities are added to
    authorized_keys files they will be included in this set.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Introduce a configuration option max_depends which can be used to
specify a maximum number of (reverse) dependencies to display on the
package details pages.

Fixes FS#49059.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a configuration option to set the path of the notification script.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Stefan Auditor authored Aug 16, 2015 and Lukas Fleischer committed Aug 16, 2015

Circumvents the temporary regression in git that clones a repository
as foo-git.git instead of foo-git and matches the format used by
other commonly used git hosting providers.

Fixes FS#45834.

Signed-off-by: Stefan Auditor <stefan.auditor@erdfisch.de>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Implement a new command that can be used to restore deleted package
bases without having to push a new commit.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Use a Python script for sending notification emails. The notification
action and additional parameters are passed via command line arguments.
For comment and package request notifications, the text is passed via
stdin.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Mikkel Oscar Lyderik authored Jun 19, 2015 and Lukas Fleischer committed Jun 19, 2015

Prior to aurweb 4.0.0, URLPath in the JSON RPC didn't include the host
name, only the path.

This removes the host name and makes the URL compatible with programs
expecting the old semantics (i.e. cower).

Closes FS#45333.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored Jun 14, 2015 and Lukas Fleischer committed Jun 14, 2015

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Allow for excluding certain IP addresses from the maintenance mode. This
allows administrators to view the web page while the site is still under
maintenance for the rest of the world.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add support for a maintenance mode that disables both the website and
the SSH interface and can be enabled easily using a configuration
option.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Make the locations of the PKGBUILD preview, the log and the snapshot
tarball configurable. This increases flexibility and simplifies the code
a bit.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Remove the template-path and git-update-hook options which are no longer
used. Update the git_clone_uri_anon default value.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

* Move scripts/git-integration/ to git-interface/.
* Move scripts/aurblup/aurblup.py to scripts/aurblup.py.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Instead of using one Git repository per package, use a single large
object storage for space efficiency. The refs of the individual package
bases are divided using gitnamespaces(7) which allows for exposing each
namespace as an independent repository easily. Also, git-serve is
modified to create a branch for each package, allowing to browse the
large repository with cgit.

Helped-by: Florian Pritz <bluewind@xinu.at>
Helped-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

We no longer use port 2222 for SSH.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

We no longer run a separate SSH daemon on port 2222. Change the default
configuration accordingly. Also remove some configuration files that are
no longer needed.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Use the latest version of Damien Miller's patch to extend the parameters
to the AuthorizedKeysCommand.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Allow users to remove their own package bases for a short period of time
after initial submission (defaults to one day).

Implements FS#43648.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Rename the project to help differentiate between the software providing
access to the Arch User Repository and the collection of source packages
itself.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Do not waste disk space by copying dozens of unneeded sample hooks. Use
a custom template directory that only includes the git-update hook.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

This should have been added in 1b627a3f

 (git-serve.py: Improve error
messages, 2015-01-01).

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

The AUR backend already uses several Python scripts, rewrite the aurblup
helper as well. This has several advantages:

* We can easily use the main configuration file without using any shell
  script wrappers.

* aurblup does not need to be recompiled on libalpm soname bumps.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Show a public clone URL (using Git over HTTP) by default and only show
the private clone URL to the package maintainer.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

* Remove package submission page from the web interface.
* Replace PKGBUILD and tarball links with links to cgit.
* Remove the "URLPath" field from RPC replies.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

This adds a script that can be used as an update hook to check all
commits for validity and to regenerate the package details page before
updating a named ref.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

This adds two scripts to be used together with Git over SSH:

* git-auth.py is supposed to be used as AuthorizedKeysCommand. It checks
  whether the public key belongs to any AUR user and invokes
  git-serve.py, passing the name of the corresponding user as a command
  line argument, if any.

* git-serve.py is a wrapper around git-shell(1) that checks whether the
  user passed as command line argument has access to the Git repository
  that a push operation writes to.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Support for non-virtual URLs has been broken for a long time and is no
longer used on the official AUR setup.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Replace web/lib/config.inc.php with an INI-style configuration file.
This allows us to get rid of several globals and makes it easier to use
the same configuration file in external scripts.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>