Ben Hutchings [Mon, 27 Jun 2016 21:34:36 +0000 (23:34 +0200)]
Add byhand script to perform code signing
It takes a tarball of code objects and generates a tarball of
corresponding detached PKCS#7 signatures (with '.sig' suffixes).
It will sign:
- EFI binaries (*.efi, vmlinuz-*) using pesign
- Linux kernel modules (*.ko) using sign-file from linux-kbuild-<version>
Currently it should work with private key files and certificates. It
may be able to sign kernel modules with a key on a PKCS#11 device.
It definitely can't sign EFI binaries using a PKCS#11 device yet.
This will allow to create comment files once release.debian.org
is no longer in the same machine as ftp-master.debian.org and
the RT loses access to the various COMMENTS folders.
Julien Cristau [Wed, 25 May 2016 12:25:45 +0000 (14:25 +0200)]
Change import_dataset.sh to take its input from stdin
We plan on moving release.debian.org to a separate host, so won't be
able to share a filesystem between release and dak. Instead take the
dataset from stdin, with a md5sum passed through the command line (via
SSH_ORIGINAL_COMMAND).
Julien Cristau [Sat, 21 May 2016 13:55:49 +0000 (15:55 +0200)]
gps2: fix logging call
The multiprocessing workers return a list already, no need to embed that
in another one.
This should change logging from
generate-packages-sources2|dak|['generate-packages', 'unstable', 'main', 's390x']
to
generate-packages-sources2|dak|generate-packages|unstable|main|s390x
Add a per-suite boolean to enable by-hash; store the by-hash files in
the db, and record when they stopped being referenced, so that
clean-suites can delete them after the archive's stayofexecution time.
In generate-release, where we have checksums for all the things,
hardlink files to the by-hash dir for each of the suite's configured
hash methods.
Signed-off-by: Julien Cristau <jcristau@debian.org>
---
changes in v2:
- use archive.stayofexecution as delay before removing files from
by-hash
- don't assume any particular ordering for suite.checksums
changes in v3:
- rebase on latest master, update115 is now update116
- handle missing files in clean_byhash
changes in v4:
- use hardlinks instead of symlinks
- don't initialize `unreferenced` to its default value
- in clean_byhash, remove useless fetchall, and handle ENOENT from
unlink instead of checking for existence beforehand
Luke Faraone [Sat, 30 Apr 2016 21:59:52 +0000 (21:59 +0000)]
Add python-debianbts as a dependency in setup/README (Closes: #823118)
Needed to run the test suite:
======================================================================
ERROR: test_importing_rm (test_imports.ImportTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/srv/daksrc/tests/test_imports.py", line 15, in test_fn
__import__('dak', fromlist=[cmd])
File "/srv/daksrc/dak/rm.py", line 54, in <module>
from daklib.rm import remove
File "/srv/daksrc/dak/daklib/rm.py", line 52, in <module>
import debianbts as bts
ImportError: No module named debianbts
Before Debian LTS started to use the security archive, all uploads that
would trigger buildds would be sourceful uploads to a policy queue. So
new packages entering the build queues and pushing the public mirrors
would likely not happen in the same cron.unchecked run.
With Debian LTS, uploads would go to both the build queues and trigger a
public mirror push. If the mirror push takes more than three minutes,
cron.buildd would however not notify w-b of changes.
This patch moves the w-b notification right behind the update of the
build queues and before the mirror push to avoid the problem. Ideally
we would not rely on anything happening within the last three minutes
though.
Let the python interpreter handle it and actually exit with the right
status, otherwise when a sub-command calls sys.exit(1) we end up exiting
0 instead, which is confusing if not dangerous.
With "wheezy" being used for Debian LTS, the archive needs to be
published not only when policy queue uploads are accepted, but also
when direct uploads to "wheezy" arrive.
Newer SQLAlchemy versions seem to track the `binary` attribute of
`BinaryMetadata`. This means the association proxy in `DBBinary`
would first create a `BinaryMetadata` with `binary` set to `None`,
flush this to the database and then set the actual value of `binary`
we want. However the flush fails, as `NULL` is not allowed for the
`binary_id` column.
The problem can be avoided by not setting `binary` to `None`. This is
treated as an "undefined value" by SQLAlchemy and changing it later
means the database row never sees `NULL`.
The same applies to the `source` attribute of `SourceMetadata`.
Move more specific source file regexes before general ones
The orig tarball regexes match also the orig tarball detached
signatures because they are not anchored at the end, and the loop
short-circuits on first match. So we have to move them before their
more general counterparts.
Guillem Jover [Thu, 11 Feb 2016 09:27:16 +0000 (10:27 +0100)]
Fix support for detached upstream signatures
We should only allow upstream tarballs with detached signatures, but not
native tarballs, «<source>_<version>.orig.asc» or «<source>_<version>.asc»
filenames. We also need to allow this on all relevant regexes. This commit
fixes and refactors the regexes to implement the above, and to make it
easier to modify a single place in the future.
Guillem Jover [Thu, 11 Feb 2016 09:27:13 +0000 (10:27 +0100)]
Stop using undefined reject function in check_dsc_files
When there's an unknown file in a source package, the function spits
this:
,---
Processing raised an exception: global name 'reject' is not defined.
Traceback (most recent call last):
File "/srv/ftp-master.debian.org/dak/dak/daklib/archive.py", line 966, in check
chk().check(self)
File "/srv/ftp-master.debian.org/dak/dak/daklib/checks.py", line 497, in check
rejects = utils.check_dsc_files(dsc_fn, control, source.files.keys())
File "/srv/ftp-master.debian.org/dak/dak/daklib/utils.py", line 343, in check_dsc_files
reject("%s: unexpected source file '%s'" % (dsc_filename, f))
NameError: global name 'reject' is not defined
`---
Just set the reject message and break from the loop.
Ansgar Burchardt [Wed, 30 Mar 2016 21:23:13 +0000 (23:23 +0200)]
Remove files that are (no longer) generated
This makes it less error-prone to switch compression methods: the files
that are no longer generated are automatically removed. Before they had
to be removed manually.
projects / dak.git / log