Compare commits

..

2 Commits

Author SHA1 Message Date
Josephine Pfeiffer
c76fda0bf0 Merge branch 'gl-257-pkgctl-repo-sanity-check' into 'master'
[GL#257] add pkgctl repo sanity check

Closes #257

See merge request archlinux/devtools!303
2025-08-01 10:58:51 +00:00
Josephine Pfeiffer
d9ac6029d9 fix(repo): improve validation for repository configuration
The pkgctl repo configure command previously had no validation,
which could lead to accidental misconfiguration of unrelated
repositories. This change adds basic validation to ensure we're in a
git repository, while still preserving the ability to configure AUR
repositories and local git repositories for legitimate workflows.

This approach prevents accidental misconfiguration in non-git
directories while maintaining compatibility with important use cases:
- Configuring AUR repositories when promoting packages
- Configuring local git repositories during initial setup

Tests have been updated to use temporary directories with mktemp instead
of reusing existing fixtures, providing better isolation and preventing
side effects.

Fixes #257

Component: pkgctl repo configure
Signed-off-by: Josephine Pfeiffer <hi@josie.lol>
2025-03-13 18:08:05 +01:00
12 changed files with 110 additions and 60 deletions

View File

@@ -24,7 +24,7 @@ test:
stage: test stage: test
needs: [] needs: []
script: script:
- pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats bats-assert bats-support
- make test BATS_EXTRA_ARGS='--formatter junit' - make test BATS_EXTRA_ARGS='--formatter junit'
artifacts: artifacts:
reports: reports:
@@ -34,7 +34,7 @@ coverage:
stage: test stage: test
needs: [] needs: []
script: script:
- pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats kcov jq - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats bats-assert bats-support kcov jq
- make coverage - make coverage
coverage: '/Percent covered\s+\d+\.\d+/' coverage: '/Percent covered\s+\d+\.\d+/'
artifacts: artifacts:

View File

@@ -150,7 +150,6 @@ _pkgctl_cmds=(
db db
diff diff
issue issue
license
release release
repo repo
search search

View File

@@ -3,7 +3,7 @@ pkgctl-auth(1)
Name Name
---- ----
pkgctl-auth - Authenticate with services like GitLab. pkgctl-auth - Authenticate with serivces like GitLab.
Synopsis Synopsis
-------- --------

View File

@@ -39,17 +39,6 @@ placed in the `$XDG_CONFIG_HOME`/nvchecker` directory. This keyfile is
used for providing the necessary authentication tokens required for used for providing the necessary authentication tokens required for
accessing the GitHub or GitLab API. accessing the GitHub or GitLab API.
Combiner Source
---------------
To utilize the combiner source, the `pkgbase` section must be declared as the
combiner source. Additionally, individual sections should be added using a
quoted table key consisting of the `pkgbase` followed by the stage name,
separated by double colons. For example: `["sudo:stage1"]`.
This allows to chain different sources together into one result, or allow
multi stage transformation of our source via multiple regex.
Options Options
------- -------

View File

@@ -49,9 +49,6 @@ pkgctl diff::
pkgctl issue:: pkgctl issue::
Work with GitLab packaging issues Work with GitLab packaging issues
pkgctl license::
Check and manage package licenses
pkgctl release:: pkgctl release::
Release step to commit, tag and upload build artifacts Release step to commit, tag and upload build artifacts
@@ -73,7 +70,6 @@ pkgctl-build(1)
pkgctl-db(1) pkgctl-db(1)
pkgctl-diff(1) pkgctl-diff(1)
pkgctl-issue(1) pkgctl-issue(1)
pkgctl-license(1)
pkgctl-release(1) pkgctl-release(1)
pkgctl-repo(1) pkgctl-repo(1)
pkgctl-search(1) pkgctl-search(1)

View File

@@ -54,8 +54,7 @@ export RSYNC_OPTS=(
--human-readable --human-readable
--progress --progress
--partial --partial
# suffix the partial dir with the PID in order to avoid clashes --partial-dir=.partial
--partial-dir=.partial.$$
--delay-updates --delay-updates
) )
@@ -442,10 +441,3 @@ relative_date_unit() {
done done
printf "1 second" printf "1 second"
} }
# escapes regex metacharacters in a given string
regex_escape() {
# shellcheck disable=SC2001,SC2016
sed 's/[\^.\[$()|*+?{\\]/\\&/g' <<<"$1"
}

View File

@@ -94,19 +94,19 @@ pkgctl_license_check() {
pushd "${path}" >/dev/null pushd "${path}" >/dev/null
if [[ ! -f PKGBUILD ]]; then if [[ ! -f PKGBUILD ]]; then
msg_error "${BOLD}${path}:${ALL_OFF} no PKGBUILD found" msg_error "${BOLD}${pkgbase}:${ALL_OFF} no PKGBUILD found"
return 1 return 1
fi fi
if [[ ! -f .SRCINFO ]]; then # reset common PKGBUILD variables
msg_error "${BOLD}${path}:${ALL_OFF} no .SRCINFO found" unset pkgbase
return 1
fi
if ! pkgbase=$(grep --max-count=1 --extended-regexp "pkgbase = (.+)" .SRCINFO | awk '{print $3}'); then # shellcheck source=contrib/makepkg/PKGBUILD.proto
msg_error "${BOLD}${path}:${ALL_OFF} pkgbase not found in .SRCINFO" if ! . ./PKGBUILD; then
msg_error "${BOLD}${pkgbase}:${ALL_OFF} failed to source PKGBUILD"
return 1 return 1
fi fi
pkgbase=${pkgbase:-$pkgname}
if [[ ! -e LICENSE ]]; then if [[ ! -e LICENSE ]]; then
msg_error "${BOLD}${pkgbase}:${ALL_OFF} is missing the LICENSE file" msg_error "${BOLD}${pkgbase}:${ALL_OFF} is missing the LICENSE file"

View File

@@ -188,7 +188,6 @@ path = [
"README.md", "README.md",
"keys/**", "keys/**",
".SRCINFO", ".SRCINFO",
".gitignore",
".nvchecker.toml", ".nvchecker.toml",
"*.install", "*.install",
"*.sysusers", "*.sysusers",

View File

@@ -109,6 +109,11 @@ pkgctl_repo_configure() {
local -r command=${_DEVTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}} local -r command=${_DEVTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
local path realpath pkgbase remote_url project_path hook local path realpath pkgbase remote_url project_path hook
local PACKAGER GPGKEY packager_name packager_email local PACKAGER GPGKEY packager_name packager_email
# Check if we're in a git repo
if ! git rev-parse --git-dir &>/dev/null; then
die "Not in a git repository"
fi
while (( $# )); do while (( $# )); do
case $1 in case $1 in
@@ -150,7 +155,8 @@ pkgctl_repo_configure() {
# check if invoked without any path from within a packaging repo # check if invoked without any path from within a packaging repo
if (( ${#paths[@]} == 0 )); then if (( ${#paths[@]} == 0 )); then
if [[ -f PKGBUILD ]]; then if [[ -d .git ]] || git rev-parse --git-dir &>/dev/null; then
# We're in a git repository, so use current directory
paths=(".") paths=(".")
else else
pkgctl_repo_configure_usage pkgctl_repo_configure_usage
@@ -226,10 +232,19 @@ pkgctl_repo_configure() {
pushd "${path}" >/dev/null pushd "${path}" >/dev/null
project_path=$(gitlab_project_name_to_path "${pkgbase}") # Check if this is a packaging repository
remote_url="${GIT_REPO_BASE_URL}/${project_path}.git" local is_packaging_repo=0
if ! git remote add origin "${remote_url}" &>/dev/null; then if [[ -f PKGBUILD ]]; then
git remote set-url origin "${remote_url}" is_packaging_repo=1
fi
# Configure remote only for packaging repositories
if (( is_packaging_repo )); then
project_path=$(gitlab_project_name_to_path "${pkgbase}")
remote_url="${GIT_REPO_BASE_URL}/${project_path}.git"
if ! git remote add origin "${remote_url}" &>/dev/null; then
git remote set-url origin "${remote_url}"
fi
fi fi
# move the master branch to main # move the master branch to main
@@ -239,7 +254,7 @@ pkgctl_repo_configure() {
fi fi
# configure spec version and variant to avoid using development hooks in production # configure spec version and variant to avoid using development hooks in production
git config devtools.version "${GIT_REPO_SPEC_VERSION}" git config devtools.version "${GIT_REPO_SPEC_VERSION:-1.0.0}"
if [[ ${_DEVTOOLS_LIBRARY_DIR} == /usr/share/devtools ]]; then if [[ ${_DEVTOOLS_LIBRARY_DIR} == /usr/share/devtools ]]; then
git config devtools.variant canonical git config devtools.variant canonical
else else
@@ -249,8 +264,12 @@ pkgctl_repo_configure() {
git config pull.rebase true git config pull.rebase true
git config branch.autoSetupRebase always git config branch.autoSetupRebase always
git config branch.main.remote origin
git config branch.main.rebase true # Configure branch remote settings only for packaging repositories with remotes
if (( is_packaging_repo )) && git remote | grep -q "^origin$"; then
git config branch.main.remote origin
git config branch.main.rebase true
fi
git config transfer.fsckobjects true git config transfer.fsckobjects true
git config fetch.fsckobjects true git config fetch.fsckobjects true

View File

@@ -6,8 +6,6 @@
DEVTOOLS_INCLUDE_UTIL_PKGBUILD_SH=1 DEVTOOLS_INCLUDE_UTIL_PKGBUILD_SH=1
_DEVTOOLS_LIBRARY_DIR=${_DEVTOOLS_LIBRARY_DIR:-@pkgdatadir@} _DEVTOOLS_LIBRARY_DIR=${_DEVTOOLS_LIBRARY_DIR:-@pkgdatadir@}
# shellcheck source=src/lib/common.sh
source "${_DEVTOOLS_LIBRARY_DIR}"/lib/common.sh
# shellcheck source=src/lib/util/makepkg.sh # shellcheck source=src/lib/util/makepkg.sh
source "${_DEVTOOLS_LIBRARY_DIR}"/lib/util/makepkg.sh source "${_DEVTOOLS_LIBRARY_DIR}"/lib/util/makepkg.sh
@@ -23,8 +21,6 @@ pkgbuild_set_pkgver() {
local new_pkgver=$1 local new_pkgver=$1
local pkgver=${pkgver} local pkgver=${pkgver}
pkgver="$(regex_escape "${pkgver}")"
if [[ $(type -t pkgver) == function ]]; then if [[ $(type -t pkgver) == function ]]; then
# TODO: check if die or warn, if we provide _commit _gitcommit setter maybe? # TODO: check if die or warn, if we provide _commit _gitcommit setter maybe?
warning 'setting pkgver variable has no effect if the PKGBUILD has a pkgver() function' warning 'setting pkgver variable has no effect if the PKGBUILD has a pkgver() function'

View File

@@ -304,11 +304,6 @@ get_upstream_version() {
return 1 return 1
fi fi
if ! output=$(jq --raw-output --exit-status 'select(.name == "'"${pkgbase}"'")' <<< "${output}"); then
printf "failed to select pkgbase result from output"
return 1
fi
if ! upstream_version=$(jq --raw-output --exit-status '.version' <<< "${output}"); then if ! upstream_version=$(jq --raw-output --exit-status '.version' <<< "${output}"); then
printf "failed to select version from result" printf "failed to select version from result"
return 1 return 1
@@ -351,16 +346,10 @@ nvchecker_check_config() {
fi fi
# check if the config contains any section other than pkgbase # check if the config contains any section other than pkgbase
if [[ -n ${pkgbase} ]] && property=$(grep --max-count=1 --perl-regexp "^\\[(?!\"?${pkgbase//+/\\+}(:.+)?\"?\\]).+\\]" < "${config}"); then if [[ -n ${pkgbase} ]] && property=$(grep --max-count=1 --perl-regexp "^\\[(?!\"?${pkgbase//+/\\+}\"?\\]).+\\]" < "${config}"); then
printf "non-pkgbase section not supported in %s: %s" "${config}" "${property}" printf "non-pkgbase section not supported in %s: %s" "${config}" "${property}"
return 1 return 1
fi fi
# check if the config is using the 'cmd' source
if grep --extended-regexp --quiet '^\s*source\s*=\s*["'\'']cmd["'\''].*' "${config}"; then
printf "using the 'cmd' source in %s is disallowed" "${config}"
return 1
fi
} }
nvchecker_check_error() { nvchecker_check_error() {

View File

@@ -0,0 +1,71 @@
#!/usr/bin/env bats
bats_require_minimum_version 1.5.0
# Load bats libraries
load "/usr/lib/bats/bats-support/load.bash"
load "/usr/lib/bats/bats-assert/load.bash"
export _DEVTOOLS_LIBRARY_DIR="${PWD}/src"
_pkgctl_repo_configure() {
source "${_DEVTOOLS_LIBRARY_DIR}"/lib/repo/configure.sh
pkgctl_repo_configure "$@"
}
@test "repo-configure-valid-packaging" {
local tmpdir
tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
pushd "${tmpdir}"
git init
git remote add origin "https://gitlab.archlinux.org/archlinux/packaging/packages/devtools.git"
run _pkgctl_repo_configure
assert_success
popd
rm -rf "${tmpdir}"
}
@test "repo-configure-non-packaging" {
local tmpdir
tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
pushd "${tmpdir}"
git init
git remote add origin "https://gitlab.com/kicad/libraries/kicad-packages3D.git"
run _pkgctl_repo_configure
assert_success
popd
rm -rf "${tmpdir}"
}
@test "repo-configure-non-arch" {
local tmpdir
tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
pushd "${tmpdir}"
git init
git remote add origin "https://github.com/torvalds/linux.git"
run _pkgctl_repo_configure
assert_success
popd
rm -rf "${tmpdir}"
}
@test "repo-configure-no-git" {
local tmpdir
tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
pushd "${tmpdir}"
run ! _pkgctl_repo_configure
assert_failure
assert_output --partial "Not in a git repository"
popd
rm -rf "${tmpdir}"
}
@test "repo-configure-local-git" {
local tmpdir
tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
pushd "${tmpdir}"
git init
run _pkgctl_repo_configure
assert_success
popd
rm -rf "${tmpdir}"
}