commit df2d40deb1ee8a811f0fc310abbfa45ba25a29a652cd21cc8e50f8202c702f21 Author: Dirk Mueller Date: Wed Aug 21 11:33:39 2024 +0000 Add pagure-pygit2.patch to repair service startup on Leap 15.6 and Tumbleweed OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm/pagure?expand=0&rev=64 diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9b03811 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,23 @@ +## Default LFS +*.7z filter=lfs diff=lfs merge=lfs -text +*.bsp filter=lfs diff=lfs merge=lfs -text +*.bz2 filter=lfs diff=lfs merge=lfs -text +*.gem filter=lfs diff=lfs merge=lfs -text +*.gz filter=lfs diff=lfs merge=lfs -text +*.jar filter=lfs diff=lfs merge=lfs -text +*.lz filter=lfs diff=lfs merge=lfs -text +*.lzma filter=lfs diff=lfs merge=lfs -text +*.obscpio filter=lfs diff=lfs merge=lfs -text +*.oxt filter=lfs diff=lfs merge=lfs -text +*.pdf filter=lfs diff=lfs merge=lfs -text +*.png filter=lfs diff=lfs merge=lfs -text +*.rpm filter=lfs diff=lfs merge=lfs -text +*.tbz filter=lfs diff=lfs merge=lfs -text +*.tbz2 filter=lfs diff=lfs merge=lfs -text +*.tgz filter=lfs diff=lfs merge=lfs -text +*.ttf filter=lfs diff=lfs merge=lfs -text +*.txz filter=lfs diff=lfs merge=lfs -text +*.whl filter=lfs diff=lfs merge=lfs -text +*.xz filter=lfs diff=lfs merge=lfs -text +*.zip filter=lfs diff=lfs merge=lfs -text +*.zst filter=lfs diff=lfs merge=lfs -text diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..57affb6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.osc diff --git a/5486.patch b/5486.patch new file mode 100644 index 0000000..c8b6e3d --- /dev/null +++ b/5486.patch @@ -0,0 +1,44 @@ +From 7abc9608afe37e28221d12afb5c2078518febf9f Mon Sep 17 00:00:00 2001 +From: Dominik Wombacher +Date: May 27 2024 18:52:55 +0000 +Subject: [PATCH 1/2] fix(oidc): Edge case, avoid 'KeyError' after pagure update if a cached session is used + + +--- + +diff --git a/pagure/ui/oidc_login.py b/pagure/ui/oidc_login.py +index 2495387..225646b 100644 +--- a/pagure/ui/oidc_login.py ++++ b/pagure/ui/oidc_login.py +@@ -34,6 +34,8 @@ _log = logging.getLogger(__name__) + def fas_user_from_oidc(): + if "oidc_cached_userdata" in flask.session: + flask.g.fas_user = munch.Munch(**flask.session["oidc_cached_userdata"]) ++ # Edge case, avoid 'KeyError' after pagure update if a cached session is used ++ flask.g.fas_user.can_create = flask.g.fas_user.get("can_create", False) + elif oidc.user_loggedin and "oidc_logintime" in flask.session: + email_key, fulln_key, usern_key, ssh_key, groups_key = [ + pagure_config["OIDC_PAGURE_EMAIL"], + +From 6ff9732cb86b305ebcc32cdb0e7ff578171f4dd1 Mon Sep 17 00:00:00 2001 +From: Dominik Wombacher +Date: May 27 2024 18:54:54 +0000 +Subject: [PATCH 2/2] fix(5.14.x): Use '==' instead of 'is' in template if condition because of old Jinja2 version on EL8 + + +--- + +diff --git a/pagure/templates/master.html b/pagure/templates/master.html +index 4e2bc55..fa23194 100644 +--- a/pagure/templates/master.html ++++ b/pagure/templates/master.html +@@ -40,7 +40,7 @@ + {% if (config.get('ENABLE_NEW_PROJECTS', True) and config.get('ENABLE_UI_NEW_PROJECTS', True)) + or config.get('ENABLE_GROUP_MNGT', False) %} + {#can_create is only defined if using OIDC so assume we cancreate #} +- {% if (g.fas_user.can_create is not defined) or (g.fas_user.can_create is true)%} ++ {% if (g.fas_user.can_create is not defined) or (g.fas_user.can_create == true)%} +
  • + +# +# Copyright (c) 2013, Patrick Uiterwijk +# This file is part of python-fedora +# +# python-fedora is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# python-fedora is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with python-fedora; if not, see + +''' +FAS-OpenID authentication plugin for the flask web framework + +.. moduleauthor:: Patrick Uiterwijk + +..versionadded:: 0.3.33 +''' +from functools import wraps + +import logging +import time +from munch import Munch +import flask +try: + from flask import _app_ctx_stack as stack +except ImportError: + from flask import _request_ctx_stack as stack + +from openid.consumer import consumer +from openid.fetchers import setDefaultFetcher, Urllib2Fetcher +from openid.extensions import pape, sreg, ax +from openid_cla import cla +from openid_teams import teams + +import six +log = logging.getLogger(__name__) + + +# http://flask.pocoo.org/snippets/45/ +def request_wants_json(): + ''' Return wether the user requested the data in JSON or not. ''' + best = flask.request.accept_mimetypes \ + .best_match(['application/json', 'text/html']) + return best == 'application/json' and \ + flask.request.accept_mimetypes[best] > \ + flask.request.accept_mimetypes['text/html'] + + +class FASJSONEncoder(flask.json.JSONEncoder): + """ Dedicated JSON encoder for the FAS openid information. """ + + def default(self, o): + """Implement this method in a subclass such that it returns a + serializable object for ``o``, or calls the base implementation (to + raise a ``TypeError``). + + For example, to support arbitrary iterators, you could implement + default like this:: + + def default(self, o): + try: + iterable = iter(o) + except TypeError: + pass + else: + return list(iterable) + return JSONEncoder.default(self, o) + """ + if isinstance(o, (set, frozenset)): + return list(o) + return flask.json.JSONEncoder.default(self, o) + + +class FAS(object): + """ The Flask plugin. """ + + def __init__(self, app=None): + self.postlogin_func = None + self.app = app + if self.app is not None: + self.init_app(app) + + def init_app(self, app): + """ Constructor for the Flask application. """ + self.app = app + app.config.setdefault('FAS_OPENID_ENDPOINT', + 'https://id.fedoraproject.org/openid/') + app.config.setdefault('FAS_OPENID_CHECK_CERT', True) + + if not self.app.config['FAS_OPENID_CHECK_CERT']: + setDefaultFetcher(Urllib2Fetcher()) + + # json_encoder is only available from flask 0.10 + version = flask.__version__.split('.') + assume_recent = False + try: + major = int(version[0]) + minor = int(version[1]) + except ValueError: + # We'll assume we're using a recent enough flask as the packages + # of old versions used sane version numbers. + assume_recent = True + + if assume_recent or (major > 0 or minor >= 10): + self.app.json_encoder = FASJSONEncoder + + @app.route('/_flask_fas_openid_handler/', methods=['GET', 'POST']) + def flask_fas_openid_handler(): + """ Endpoint for OpenID results. """ + return self._handle_openid_request() + + app.before_request(self._check_session) + + def postlogin(self, f): + """Marks a function as post login handler. This decorator calls your + function after the login has been performed. + """ + self.postlogin_func = f + return f + + def _handle_openid_request(self): + return_url = flask.session.get('FLASK_FAS_OPENID_RETURN_URL', None) + cancel_url = flask.session.get('FLASK_FAS_OPENID_CANCEL_URL', None) + base_url = self.normalize_url(flask.request.base_url) + oidconsumer = consumer.Consumer(flask.session, None) + info = oidconsumer.complete(flask.request.values, base_url) + display_identifier = info.getDisplayIdentifier() + + if info.status == consumer.FAILURE and display_identifier: + return 'FAILURE. display_identifier: %s' % display_identifier + elif info.status == consumer.CANCEL: + if cancel_url: + return flask.redirect(cancel_url) + return 'OpenID request was cancelled' + elif info.status == consumer.SUCCESS: + if info.endpoint.server_url != \ + self.app.config['FAS_OPENID_ENDPOINT']: + log.warn('Claim received from invalid issuer: %s', + info.endpoint.server_url) + return 'Invalid provider issued claim!' + + sreg_resp = sreg.SRegResponse.fromSuccessResponse(info) + teams_resp = teams.TeamsResponse.fromSuccessResponse(info) + cla_resp = cla.CLAResponse.fromSuccessResponse(info) + ax_resp = ax.FetchResponse.fromSuccessResponse(info) + user = {'fullname': '', 'username': '', 'email': '', + 'timezone': '', 'cla_done': False, 'groups': []} + if not sreg_resp: + # If we have no basic info, be gone with them! + return flask.redirect(cancel_url) + user['username'] = sreg_resp.get('nickname') + user['fullname'] = sreg_resp.get('fullname') + user['email'] = sreg_resp.get('email') + user['timezone'] = sreg_resp.get('timezone') + user['login_time'] = time.time() + if cla_resp: + user['cla_done'] = cla.CLA_URI_FEDORA_DONE in cla_resp.clas + if teams_resp: + # The groups do not contain the cla_ groups + user['groups'] = frozenset(teams_resp.teams) + if ax_resp: + ssh_keys = ax_resp.get( + 'http://fedoauth.org/openid/schema/SSH/key') + if isinstance(ssh_keys, (list, tuple)): + ssh_keys = '\n'.join( + ssh_key + for ssh_key in ssh_keys + if ssh_key.strip() + ) + if ssh_keys: + user['ssh_key'] = ssh_keys + user['gpg_keyid'] = ax_resp.get( + 'http://fedoauth.org/openid/schema/GPG/keyid') + flask.session['FLASK_FAS_OPENID_USER'] = user + flask.session.modified = True + if self.postlogin_func is not None: + self._check_session() + return self.postlogin_func(return_url) + else: + return flask.redirect(return_url) + else: + return 'Strange state: %s' % info.status + + def _check_session(self): + if 'FLASK_FAS_OPENID_USER' not in flask.session \ + or flask.session['FLASK_FAS_OPENID_USER'] is None: + flask.g.fas_user = None + else: + user = flask.session['FLASK_FAS_OPENID_USER'] + # Add approved_memberships to provide backwards compatibility + # New applications should only use g.fas_user.groups + user['approved_memberships'] = [] + for group in user['groups']: + membership = dict() + membership['name'] = group + user['approved_memberships'].append(Munch.fromDict(membership)) + flask.g.fas_user = Munch.fromDict(user) + flask.g.fas_user.groups = frozenset(flask.g.fas_user.groups) + flask.g.fas_session_id = 0 + + def _check_safe_root(self, url): + if url is None: + return None + if url.startswith(flask.request.url_root) or url.startswith('/'): + # A URL inside the same app is deemed to always be safe + return url + return None + + def login(self, username=None, password=None, return_url=None, + cancel_url=None, groups=['_FAS_ALL_GROUPS_']): + """Tries to log in a user. + + Sets the user information on :attr:`flask.g.fas_user`. + Will set 0 to :attr:`flask.g.fas_session_id, for compatibility + with flask_fas. + + :kwarg username: Not used, but accepted for compatibility with the + flask_fas module + :kwarg password: Not used, but accepted for compatibility with the + flask_fas module + :kwarg return_url: The URL to forward the user to after login + :kwarg groups: A string or a list of group the user should belong + to to be authentified. + :returns: True if the user was succesfully authenticated. + :raises: Might raise an redirect to the OpenID endpoint + """ + if return_url is None: + if 'next' in flask.request.args.values(): + return_url = flask.request.args.values['next'] + else: + return_url = flask.request.url_root + # This makes sure that we only allow stuff where + # ?next= value is in a safe root (the application + # root) + return_url = (self._check_safe_root(return_url) or + flask.request.url_root) + session = {} + oidconsumer = consumer.Consumer(session, None) + try: + request = oidconsumer.begin(self.app.config['FAS_OPENID_ENDPOINT']) + except consumer.DiscoveryFailure as exc: + # VERY strange, as this means it could not discover an OpenID + # endpoint at FAS_OPENID_ENDPOINT + log.warn(exc) + return 'discoveryfailure' + if request is None: + # Also very strange, as this means the discovered OpenID + # endpoint is no OpenID endpoint + return 'no-request' + + if isinstance(groups, six.string_types): + groups = [groups] + + request.addExtension(sreg.SRegRequest( + required=['nickname', 'fullname', 'email', 'timezone'])) + request.addExtension(pape.Request([])) + request.addExtension(teams.TeamsRequest(requested=groups)) + request.addExtension(cla.CLARequest( + requested=[cla.CLA_URI_FEDORA_DONE])) + + ax_req = ax.FetchRequest() + ax_req.add(ax.AttrInfo( + type_uri='http://fedoauth.org/openid/schema/GPG/keyid')) + ax_req.add(ax.AttrInfo( + type_uri='http://fedoauth.org/openid/schema/SSH/key', + count='unlimited')) + request.addExtension(ax_req) + + trust_root = self.normalize_url(flask.request.url_root) + return_to = trust_root + '_flask_fas_openid_handler/' + + flask.session['FLASK_FAS_OPENID_RETURN_URL'] = return_url + flask.session['FLASK_FAS_OPENID_CANCEL_URL'] = cancel_url + + if request_wants_json(): + output = request.getMessage(trust_root, + return_to=return_to).toPostArgs() + output['server_url'] = request.endpoint.server_url + return flask.jsonify(output) + elif request.shouldSendRedirect(): + redirect_url = request.redirectURL(trust_root, return_to, False) + return flask.redirect(redirect_url) + else: + return request.htmlMarkup( + trust_root, return_to, + form_tag_attrs={'id': 'openid_message'}, immediate=False) + + def logout(self): + '''Logout the user associated with this session + ''' + flask.session['FLASK_FAS_OPENID_USER'] = None + flask.g.fas_session_id = None + flask.g.fas_user = None + flask.session.modified = True + + def normalize_url(self, url): + ''' Replace the scheme prefix of a url with our preferred scheme. + ''' + scheme = self.app.config['PREFERRED_URL_SCHEME'] + scheme_index = url.index('://') + return scheme + url[scheme_index:] + + +# This is a decorator we can use with any HTTP method (except login, obviously) +# to require a login. +# If the user is not logged in, it will redirect them to the login form. +# http://flask.pocoo.org/docs/patterns/viewdecorators/#login-required-decorator +def fas_login_required(function): + """ Flask decorator to ensure that the user is logged in against FAS. + To use this decorator you need to have a function named 'auth_login'. + Without that function the redirect if the user is not logged in will not + work. + """ + @wraps(function) + def decorated_function(*args, **kwargs): + if flask.g.fas_user is None: + return flask.redirect(flask.url_for('auth_login', + next=flask.request.url)) + return function(*args, **kwargs) + return decorated_function + + +def cla_plus_one_required(function): + """ Flask decorator to retrict access to CLA+1. + To use this decorator you need to have a function named 'auth_login'. + Without that function the redirect if the user is not logged in will not + work. + """ + @wraps(function) + def decorated_function(*args, **kwargs): + if flask.g.fas_user is None or not flask.g.fas_user.cla_done \ + or len(flask.g.fas_user.groups) < 1: + # FAS-OpenID does not return cla_ groups + return flask.redirect(flask.url_for('auth_login', + next=flask.request.url)) + else: + return function(*args, **kwargs) + return decorated_function diff --git a/pagure-5.0-default-example-cfg.patch b/pagure-5.0-default-example-cfg.patch new file mode 100644 index 0000000..fbe0ebd --- /dev/null +++ b/pagure-5.0-default-example-cfg.patch @@ -0,0 +1,197 @@ +diff -rup pagure/files/gitolite3.rc pagure.cfg-defs/files/gitolite3.rc +--- pagure/files/gitolite3.rc 2020-06-21 09:19:34.924187087 -0400 ++++ pagure.cfg-defs/files/gitolite3.rc 2020-06-21 09:20:06.922455887 -0400 +@@ -16,7 +16,7 @@ + + # ------------------------------------------------------------------ + +- GL_REPO_BASE => '/path/to/git/repositories', ++ GL_REPO_BASE => '/srv/gitolite/repositories', + + # default umask gives you perms of '0700'; see the rc file docs for + # how/why you might change this +diff -rup pagure/files/pagure-apache-httpd.conf pagure.cfg-defs/files/pagure-apache-httpd.conf +--- pagure/files/pagure-apache-httpd.conf 2020-06-21 09:19:34.926187104 -0400 ++++ pagure.cfg-defs/files/pagure-apache-httpd.conf 2020-06-21 09:20:06.923455896 -0400 +@@ -29,9 +29,9 @@ + ## Use secure TLSv1.1 and TLSv1.2 ciphers + #Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" + +- #SSLCertificateFile /etc/pki/tls/....crt +- #SSLCertificateChainFile /etc/pki/tls/....intermediate.crt +- #SSLCertificateKeyFile /etc/pki/tls/....key ++ #SSLCertificateFile /etc/ssl/....crt ++ #SSLCertificateChainFile /etc/ssl/....intermediate.crt ++ #SSLCertificateKeyFile /etc/ssl/....key + + # + #WSGIProcessGroup paguredocs +@@ -58,9 +58,9 @@ + ## Use secure TLSv1.1 and TLSv1.2 ciphers + #Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" + +- #SSLCertificateFile /etc/pki/tls/....crt +- #SSLCertificateChainFile /etc/pki/tls/....intermediate.crt +- #SSLCertificateKeyFile /etc/pki/tls/....key ++ #SSLCertificateFile /etc/ssl/....crt ++ #SSLCertificateChainFile /etc/ssl/....intermediate.crt ++ #SSLCertificateKeyFile /etc/ssl/....key + + #Alias /releases /var/www/releases + +@@ -94,7 +94,7 @@ + # + # + +- # ++ # + #Options +Indexes + # + +diff -rup pagure/files/pagure.cfg.sample pagure.cfg-defs/files/pagure.cfg.sample +--- pagure/files/pagure.cfg.sample 2020-06-21 09:19:34.927187112 -0400 ++++ pagure.cfg-defs/files/pagure.cfg.sample 2020-06-21 09:20:06.923455896 -0400 +@@ -72,25 +72,33 @@ DOC_APP_URL = 'http://docs.localhost.loc + + ### The URL to use to clone git repositories. + GIT_URL_SSH = 'ssh://git@localhost.localdomain/' +-GIT_URL_GIT = 'git://localhost.localdomain/' ++GIT_URL_GIT = 'http://localhost.localdomain/' ++ ++ ++### Folder containing the pagure user SSH authorized keys ++SSH_FOLDER = os.path.join( ++ '/srv', ++ 'gitolite', ++ '.ssh' ++) + + ### Folder containing to the git repos + GIT_FOLDER = os.path.join( +- os.path.abspath(os.path.dirname(__file__)), +- '..', +- 'repos' ++ '/srv', ++ 'gitolite', ++ 'repositories' + ) + + REPOSPANNER_PSEUDO_FOLDER = os.path.join( +- os.path.abspath(os.path.dirname(__file__)), +- '..', ++ '/srv', ++ 'gitolite', + 'pseudo' + ) + + ### Folder containing the clones for the remote pull-requests + REMOTE_GIT_FOLDER = os.path.join( +- os.path.abspath(os.path.dirname(__file__)), +- '..', ++ '/srv', ++ 'gitolite', + 'remotes' + ) + +@@ -100,21 +108,23 @@ VIRUS_SCAN_ATTACHMENTS = False + + ### Configuration file for gitolite + GITOLITE_CONFIG = os.path.join( +- os.path.abspath(os.path.dirname(__file__)), +- '..', ++ '/srv', ++ 'gitolite', ++ '.gitolite', ++ 'conf', + 'gitolite.conf' + ) + + + ### Home folder of the gitolite user + ### Folder where to run gl-compile-conf from +-GITOLITE_HOME = None ++GITOLITE_HOME = '/srv/gitolite' + + ### Version of gitolite used: 2 or 3? + GITOLITE_VERSION = 3 + + ### Folder containing all the public ssh keys for gitolite +-GITOLITE_KEYDIR = None ++GITOLITE_KEYDIR = os.path.join(GITOLITE_HOME, '.gitolite', 'keydir') + + ### Path to the gitolite.rc file + GL_RC = None +diff -rup pagure/files/pagure_docs_web.service pagure.cfg-defs/files/pagure_docs_web.service +--- pagure/files/pagure_docs_web.service 2020-06-21 09:19:34.928187121 -0400 ++++ pagure.cfg-defs/files/pagure_docs_web.service 2020-06-21 09:20:06.924455904 -0400 +@@ -5,7 +5,7 @@ Documentation=https://pagure.io/pagure + + + [Service] +-ExecStart=/usr/bin/gunicorn --workers 4 --env PAGURE_CONFIG=/etc/pagure/pagure.cfg --access-logfile /var/log/pagure/access_docs_web.log --error-logfile /var/log/pagure/error_docs_web.log --bind unix:/tmp/pagure_docs_web.sock pagure.docs_server:APP ++ExecStart=/usr/bin/gunicorn --workers 4 --env PAGURE_CONFIG=/etc/pagure/pagure.cfg --access-logfile /var/log/pagure/access_docs_web.log --error-logfile /var/log/pagure/error_docs_web.log --bind unix:/srv/gitolite/.pagure_docs_web.sock pagure.docs_server:APP + Type=simple + User=git + Group=git +diff -rup pagure/files/pagure-nginx.conf pagure.cfg-defs/files/pagure-nginx.conf +--- pagure/files/pagure-nginx.conf 2020-06-21 09:19:34.926187104 -0400 ++++ pagure.cfg-defs/files/pagure-nginx.conf 2020-06-21 09:20:06.924455904 -0400 +@@ -12,15 +12,15 @@ + #access_log /var/log/nginx/pagure_docs.access.log; + #error_log /var/log/nginx/pagure_docs.error.log; + +- #ssl_certificate /etc/pki/tls/....crt +- #ssl_certificate_key /etc/pki/tls/....key ++ #ssl_certificate /etc/ssl/....crt ++ #ssl_certificate_key /etc/ssl/....key + + #location @pagure_docs { + #proxy_set_header Host $http_host; + #proxy_set_header X-Real-IP $remote_addr; + #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + #proxy_set_header X-Forwarded-Proto $scheme; +- #proxy_pass http://unix:/tmp/pagure_docs_web.sock; ++ #proxy_pass http://unix:/srv/gitolite/.pagure_docs_web.sock; + #} + + #location / { +@@ -43,15 +43,15 @@ + #access_log /var/log/nginx/pagure.access.log; + #error_log /var/log/nginx/pagure.error.log; + +- #ssl_certificate /etc/pki/tls/....crt +- #ssl_certificate_key /etc/pki/tls/....key ++ #ssl_certificate /etc/ssl/....crt ++ #ssl_certificate_key /etc/ssl/....key + + #location @pagure { + #proxy_set_header Host $http_host; + #proxy_set_header X-Real-IP $remote_addr; + #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + #proxy_set_header X-Forwarded-Proto $scheme; +- #proxy_pass http://unix:/tmp/pagure_web.sock; ++ #proxy_pass http://unix:/srv/gitolite/.pagure_web.sock; + #} + + #location / { +@@ -59,7 +59,7 @@ + #} + + #location /releases { +- #alias /var/www/releases/; ++ #alias /srv/www/pagure-releases/; + #autoindex on; + #} + +diff -rup pagure/files/pagure_web.service pagure.cfg-defs/files/pagure_web.service +--- pagure/files/pagure_web.service 2020-06-21 09:19:34.928187121 -0400 ++++ pagure.cfg-defs/files/pagure_web.service 2020-06-21 09:20:06.924455904 -0400 +@@ -5,7 +5,7 @@ Documentation=https://pagure.io/pagure + + + [Service] +-ExecStart=/usr/bin/gunicorn --workers 4 --env PAGURE_CONFIG=/etc/pagure/pagure.cfg --access-logfile /var/log/pagure/access_web.log --error-logfile /var/log/pagure/error_web.log --bind unix:/tmp/pagure_web.sock "pagure.flask_app:create_app()" ++ExecStart=/usr/bin/gunicorn --workers 4 --env PAGURE_CONFIG=/etc/pagure/pagure.cfg --access-logfile /var/log/pagure/access_web.log --error-logfile /var/log/pagure/error_web.log --bind unix:/srv/gitolite/.pagure_web.sock "pagure.flask_app:create_app()" + Type=simple + User=git + Group=git diff --git a/pagure-5.14.1.tar.gz b/pagure-5.14.1.tar.gz new file mode 100644 index 0000000..2d7dd8e --- /dev/null +++ b/pagure-5.14.1.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4bdab80fb36b161cef6805dcadaa6db5513898e213ca15f9684be06d24b71a54 +size 17738653 diff --git a/pagure-README.SUSE b/pagure-README.SUSE new file mode 100644 index 0000000..83c31cb --- /dev/null +++ b/pagure-README.SUSE @@ -0,0 +1,149 @@ +# Setting up pagure + +0. Prepare the filesystem (this step is usually performed on package install) + +mkdir -p /srv/www/pagure-releases +mkdir -p /srv/gitolite/repositories/{,docs,forks,requests,tickets} +mkdir -p /srv/gitolite/pseudo +mkdir -p /srv/gitolite/remotes +mkdir -p /srv/gitolite/.gitolite/{conf,keydir,logs} +mkdir -p /srv/gitolite/.ssh +chmod 750 /srv/gitolite/.ssh + +touch /srv/gitolite/.gitolite/conf/gitolite.conf + +cp /usr/share/doc/packages/pagure/gitolite3.rc /srv/gitolite/.gitolite.rc + +chown git:git -R /srv/gitolite +chown git:git /srv/www/pagure-releases + +mkdir -p /srv/www/run + +1. Install and set up a database + +Option A: PostgreSQL + +Note: If your PostgreSQL server is not on the same machine, just install 'python3-psycopg2' +on the pagure host machine and follow the installation and database creation steps below +on the designated database server. This also requires the database port opened on the +database server's firewall. + +zypper install postgresql-server +systemctl start postgresql + +A1. Edit /var/lib/pgsql/data/pg_hba.conf and change auth method from `ident` to `md5` for localhost + +A2. Create the pagure database + +sudo -u postgres psql + +CREATE DATABASE pagure; +CREATE USER pagure; +ALTER USER pagure WITH ENCRYPTED PASSWORD '--PagureDBUserPW--'; +GRANT ALL PRIVILEGES ON DATABASE pagure to pagure; +GRANT ALL PRIVILEGES ON ALL tables IN SCHEMA public TO pagure; +GRANT ALL PRIVILEGES ON ALL sequences IN SCHEMA public TO pagure; +\q + +A3. Enable and restart PostgreSQL + +systemctl stop postgresql +systemctl enable --now postgresql + +Option B: MariaDB + +Note: If your MariaDB server is not on the same machine, just install 'python3-PyMySQL' +on the pagure host machine and follow the installation and database creation steps below +on the designated database server. This also requires the database port opened on the +database server's firewall. + +zypper install mariadb mariadb-client +systemctl enable --now mariadb +mysql_secure_installation + +B1. Create the pagure database + +mysql -u root -p + +mysql> create database pagure; +mysql> grant all privileges on pagure.* to pagure identified by '--PagureDBUserPW--'; +mysql> flush privileges; +mysql> exit + +2. Install Redis + +zypper install redis + +3. Configure redis + +cp /etc/redis/default.conf.example /etc/redis/default.conf +chown root:redis /etc/redis/default.conf +systemctl enable --now redis@default.service + +4. Edit /etc/pagure/pagure.cfg to set up pagure settings as appropriate. + +As we set up a database earlier using PostgreSQL or MariaDB, comment out the DB_URL for SQLite and +uncomment the correct one. Change the URL to match your database server location. + +You'll also want to change email address and domain used for this instance to something real, especially if +you're using with HTTPS or having it public facing. + +While currently Pagure defaults to the somewhat brittle legacy Gitolite backend, you should use +the more reliable and performant internal backend. + +This is done by setting the following in /etc/pagure/pagure.cfg: + +GIT_AUTH_BACKEND = "pagure_authorized_keys" +HTTP_REPO_ACCESS_GITOLITE = None + +SSH_COMMAND_NON_REPOSPANNER = ([ + "/usr/bin/%(cmd)s", + "/srv/gitolite/repositories/%(reponame)s", +], {"GL_USER": "%(username)s"}) + + +For details on all the options in pagure.cfg, see https://docs.pagure.org/pagure/configuration.html + +5. Populate the database + +python3 /usr/share/pagure/pagure_createdb.py -c /etc/pagure/pagure.cfg -i /etc/pagure/alembic.ini + +Note: On upgrades, just drop the "-i /etc/pagure/alembic.ini", and the script will do the correct +thing to upgrade the database. + +6. Install either Apache HTTPD or Nginx web server and set up web configuration + +Option A: Apache HTTPD + +zypper install pagure-web-apache-httpd + +A1. Edit /etc/apache2/vhosts.d/pagure.conf to set up web settings as appropriate. + +Most of the settings just need to be uncommented to work. However, you may need to tweak based +on whether or not you're using HTTPS and if you are using HTTPS, where your certs are and what your domain(s) are. + +Option B: Nginx + +zypper install pagure-web-nginx +systemctl enable --now pagure_web.service pagure_docs_web.service + +B1. Edit /etc/nginx/vhosts.d/pagure.conf to set up web settings as appropriate. + +Most of the settings just need to be uncommented to work. However, you may need to tweak based +on whether or not you're using HTTPS and if you are using HTTPS, where your certs are and what your domain(s) are. + +7. Open ports in the firewall as appropriate + +firewall-cmd --add-service=ssh +firewall-cmd --add-service=http +firewall-cmd --add-service=https +firewall-cmd --add-service=redis +firewall-cmd --runtime-to-permanent + +8. Enable and start pagure services + +systemctl enable --now pagure_worker.service pagure_authorized_keys_worker.service pagure_api_key_expire_mail.timer pagure_mirror_project_in.timer + +9. Enable and start your webserver, or restart if it's already running + +For more details on setup, take a look at the official Pagure documentation: https://docs.pagure.org/pagure/ diff --git a/pagure-pygit2.patch b/pagure-pygit2.patch new file mode 100644 index 0000000..5fd79b8 --- /dev/null +++ b/pagure-pygit2.patch @@ -0,0 +1,39 @@ +commit 8a1a7ba9f789ba446bab63783f7b963246861cb8 +Author: Dominik Wombacher +Date: Tue Apr 16 18:17:03 2024 +0000 + + tests: Fix issue 'No module named pygit2.remote' +diff '--color=auto' -ur a/pagure/lib/git.py b/pagure/lib/git.py +--- a/pagure/lib/git.py 2024-05-24 16:43:47.000000000 +0200 ++++ b/pagure/lib/git.py 2024-08-17 13:39:06.096428774 +0200 +@@ -33,8 +33,10 @@ + + from sqlalchemy.exc import SQLAlchemyError + +-# from sqlalchemy.orm.session import Session +-from pygit2.remote import RemoteCollection ++try: ++ from pygit2.remote import RemoteCollection ++except ImportError: ++ from pygit2.remotes import RemoteCollection + + import pagure.utils + import pagure.exceptions +diff '--color=auto' -ur a/tests/test_pagure_lib_git.py b/tests/test_pagure_lib_git.py +--- a/tests/test_pagure_lib_git.py 2024-05-24 16:43:47.000000000 +0200 ++++ b/tests/test_pagure_lib_git.py 2024-08-17 13:35:21.848131790 +0200 +@@ -3645,8 +3645,12 @@ + + # make sure the function works fine even if there's a leftover + # ref from previous failed run of the function +- with patch("pygit2.remote.RemoteCollection.delete"): +- pagure.lib.git.update_pull_ref(fake_pr, fork) ++ try: ++ with patch("pygit2.remote.RemoteCollection.delete"): ++ pagure.lib.git.update_pull_ref(fake_pr, fork) ++ except ImportError: ++ with patch("pygit2.remotes.RemoteCollection.delete"): ++ pagure.lib.git.update_pull_ref(fake_pr, fork) + self.assertIsNotNone(fork.remotes["pingou_1234567"]) + tests.add_content_git_repo(projects[1], append="foobarbaz") + newesthex = fork.references["refs/heads/master"].peel().hex diff --git a/pagure.changes b/pagure.changes new file mode 100644 index 0000000..b915f55 --- /dev/null +++ b/pagure.changes @@ -0,0 +1,658 @@ +------------------------------------------------------------------- +Sat Aug 17 11:28:25 UTC 2024 - Georg Pfuetzenreuter + +- Add pagure-pygit2.patch to repair service startup on Leap 15.6 and Tumbleweed + +------------------------------------------------------------------- +Sun Jun 2 09:16:20 UTC 2024 - Dominik Wombacher + +- Backport patches to fix issues after 5.14.1 release (https://pagure.io/pagure/pull-request/5486) + + fix(5.14.x): Use '==' instead of 'is' in template if condition because to work with old Jinja2 versions + + fix(oidc): Edge case, avoid 'KeyError' after pagure update if a cached session is used + + Patch: 5486.patch + +------------------------------------------------------------------- +Sun May 26 20:11:46 UTC 2024 - Georg Pfuetzenreuter + +- Update to 5.14.1 + * no upstream changelog + +------------------------------------------------------------------- +Tue May 3 16:57:56 UTC 2022 - Ferdinand Thiessen + +- Update to 5.13.3 + + Warn users when a PR contains some characters + + srcfpo theme: + + Change "Packages" link to new packages website + + left-align the lines in description + + fas user url updated for new accounts system + + Change fas link from admin.fp.o to accounts.fp.o + + Remove message about 60 day key length + + Escape $ to fix Jenkins interpolation warning + + Fix another invalid width/height attribute + + Fix missing space before src in