e66aead87b
Downloader sometimes fails on external .dsc files signed with unusable
GPG keys:
- expired keys
- .dsc file signed with a key that is not in apt's GPG database.
These files are typically signed by individual package maintainers, not
the official Debian/binary repository key that APT uses for binary
package indexes.
Downloader uses 2 different methods to fetch source packages, which
behave differently w.r.t. GPG checks:
- with "archive" key present in meta_data.yaml, we download using the
"dget" utility, which in turn validates against a set of known keys
in /usr/share/keyrings/
- without "archive", we download using "apt-get source", which doesn't
validate GPG at all
This patch makes the downloader script ignore GPG signature errors, but
print a warning in the log. We also allow package maintainers to add an
additional option, "dsc_sha256", to check the .dsc file's checksum,
instead of its GPG signature (this will suppress the warning).
Rationale:
- it's difficult to make GPG verification accept expired keys
- we always verify sha256 checksums of the files making up the source
package (ie the files referenced by .dsc)
- as for the .dsc file itself, we only verify its checksum if it is
present in meta_data.yaml, "dsc_sha256". No packages do that as of
this writing.
CHANGES
=====================
- utils.py: add a slightly different version of run_shell_cmd that
captures and returns both STDOUT and STDERR
- debrepack.py:
* use "dscverify" (from "devscripts" package) to verify .dsc files
* if normal verification fails, try again with GPG check disabled
* new key in meta_data.yaml: dsc_sha256. If present, make sure .dsc
file's checksum matches.
* workaround for "dget" and "dscverify" falsely succeeding when
files referenced by .dsc are missing
* removed functions "download_check_dsc" and "check_dsc" as they are
no longer used after this change
HOW TO REPRODUCE
=====================
One example of a package signed with a key that is not in the current
(bullseye) version of debian-keyring, is golang-github-golang-jwt-jwt
[1]. The download fails on that package.
TESTS
=====================
- Remove golang-github-golang-jwt-jwt from /import/mirrors and reproduce
the download error (unknown GPG key)
- Apply this patch, remove all downloaded sources, re-run downloader and
make sure it succeeds with GPG-related warnings
- Simulate various problems with a .dsc file and make sure they are
detected (ie the script fails):
* .dsc URL in meta_data.yml returns http 404
* one of the files referenced by .dsc returns http 404
* one of the checksums in .dsc doesn't match
* .dsc checksum it self doesn't match "dsc_sha256" in meta_data.yaml
[1] 2b7ac3c340/golang-github-dev/golang-github-golang-jwt-jwt-dev/debian/meta_data.yaml
Closes-Bug: 2072650
Signed-off-by: Davlet Panech <davlet.panech@windriver.com>
Change-Id: I2c91a997eafdcfd546d79e575c81bf6f9530ca0a
251 lines
7.9 KiB
Python
Executable File
251 lines
7.9 KiB
Python
Executable File
# Copyright (c) 2021 Wind River Systems, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
#
|
|
# Copyright (C) 2021 Wind River Systems,Inc
|
|
|
|
import logging
|
|
import os
|
|
import pathlib
|
|
import subprocess
|
|
import urllib.parse
|
|
import urllib.request
|
|
|
|
# The CENGNURL reference is retained for backward compatability
|
|
# with pre-existing build environmnets.
|
|
CENGNURL = os.environ.get('CENGNURL')
|
|
if CENGNURL:
|
|
CENGN_BASE = os.path.join(CENGNURL, "debian")
|
|
STX_MIRROR_URL = os.environ.get('STX_MIRROR_URL')
|
|
if STX_MIRROR_URL:
|
|
STX_MIRROR_BASE = os.path.join(STX_MIRROR_URL, "debian")
|
|
if not STX_MIRROR_BASE:
|
|
STX_MIRROR_BASE=CENGN_BASE
|
|
|
|
log_levels = {
|
|
'debug': logging.DEBUG,
|
|
'info': logging.INFO,
|
|
'warning': logging.WARNING,
|
|
'error': logging.ERROR,
|
|
'crit': logging.CRITICAL
|
|
}
|
|
|
|
def set_logger(logger, log_level='debug'):
|
|
logger.setLevel(log_levels[log_level])
|
|
|
|
class ColorFormatter(logging.Formatter):
|
|
FORMAT = ("%(asctime)s - $BOLD%(name)-s$RESET - %(levelname)s: %(message)s")
|
|
|
|
BLACK, RED, GREEN, YELLOW, BLUE, MAGENTA, CYAN, WHITE = list(range(8))
|
|
|
|
RESET_SEQ = "\033[0m"
|
|
COLOR_SEQ = "\033[1;%dm"
|
|
BOLD_SEQ = "\033[1m"
|
|
|
|
COLORS = {
|
|
'WARNING': YELLOW,
|
|
'INFO': GREEN,
|
|
'DEBUG': BLUE,
|
|
'ERROR': RED
|
|
}
|
|
|
|
def formatter_msg(self, msg, use_color=True):
|
|
if use_color:
|
|
msg = msg.replace("$RESET", self.RESET_SEQ)
|
|
msg = msg.replace("$BOLD", self.BOLD_SEQ)
|
|
else:
|
|
msg = msg.replace("$RESET", "").replace("$BOLD", "")
|
|
return msg
|
|
|
|
def __init__(self, use_color=True):
|
|
msg = self.formatter_msg(self.FORMAT, use_color)
|
|
logging.Formatter.__init__(self, msg)
|
|
self.use_color = use_color
|
|
|
|
def format(self, record):
|
|
lname = record.levelname
|
|
if self.use_color and lname in self.COLORS:
|
|
fcolor = 30 + self.COLORS[lname]
|
|
lncolor = self.COLOR_SEQ % fcolor + lname + self.RESET_SEQ
|
|
record.levelname = lncolor
|
|
return logging.Formatter.format(self, record)
|
|
|
|
# create log and console handler and set level
|
|
fh = logging.FileHandler('/localdisk/builder.log')
|
|
fh.setLevel(log_levels[log_level])
|
|
fh.setFormatter(ColorFormatter(use_color=False))
|
|
logger.addHandler(fh)
|
|
|
|
ch = logging.StreamHandler()
|
|
ch.setLevel(log_levels[log_level])
|
|
ch.setFormatter(ColorFormatter())
|
|
logger.addHandler(ch)
|
|
|
|
logger.propagate = 0
|
|
|
|
|
|
# Read file 'lst_file', sprip out blank lines and lines starting with '#'.
|
|
# Return the remaining lines as a list. Optionally subject the lines
|
|
# to additional processing via the entry_handler prior to inclusion in
|
|
# the list
|
|
def bc_safe_fetch(lst_file, entry_handler=None, entry_handler_arg=None):
|
|
entries = []
|
|
try:
|
|
with open(lst_file, 'r') as flist:
|
|
lines = list(line for line in (p.strip() for p in flist) if line)
|
|
except IOError as e:
|
|
logger.error(str(e))
|
|
except Exception as e:
|
|
logger.error(str(e))
|
|
else:
|
|
for entry in lines:
|
|
entry = entry.strip()
|
|
if entry.startswith('#'):
|
|
continue
|
|
if entry == "":
|
|
continue
|
|
if entry_handler:
|
|
if entry_handler_arg:
|
|
entries.extend(entry_handler(entry, entry_handler_arg))
|
|
else:
|
|
entries.extend(entry_handler(entry))
|
|
else:
|
|
entries.append(entry)
|
|
return entries
|
|
|
|
|
|
def limited_walk(dir, max_depth=1):
|
|
dir = dir.rstrip(os.path.sep)
|
|
assert os.path.isdir(dir)
|
|
num_sep_dir = dir.count(os.path.sep)
|
|
for root, dirs, files in os.walk(dir):
|
|
yield root, dirs, files
|
|
num_sep_root = root.count(os.path.sep)
|
|
if num_sep_dir + max_depth <= num_sep_root:
|
|
del dirs[:]
|
|
|
|
|
|
def run_shell_cmd_full(cmd, logger, error_level=logging.ERROR):
|
|
if type(cmd) is str:
|
|
shell = True
|
|
elif type(cmd) in (tuple, list):
|
|
shell = False
|
|
else:
|
|
raise Exception("Unrecognized 'cmd' type '%s'. Must be one of [str, list, tuple]." % (type(cmd)))
|
|
|
|
logger.info(f'[ Run - "{cmd}" ]')
|
|
try:
|
|
process = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
|
|
universal_newlines=True, shell=shell)
|
|
except Exception as e:
|
|
msg = f'[ Failed to execute command: "{cmd}" Exception: "{e}" ]'
|
|
logger.log(error_level, msg)
|
|
# Suppress the original exception when raising our own exception.
|
|
# Syntax is acquired from: https://peps.python.org/pep-0409/#proposal
|
|
raise Exception(msg) from None
|
|
|
|
outs, errs = process.communicate()
|
|
|
|
for log in outs.strip().split("\n"):
|
|
log = log.strip()
|
|
if log:
|
|
logger.debug("stdout: %s", log)
|
|
|
|
for log in errs.strip().split("\n"):
|
|
log = log.strip()
|
|
if log:
|
|
logger.debug("stderr: %s", log)
|
|
|
|
if process.returncode != 0:
|
|
msg = f'[ Command failed with a non-zero return code: "{cmd}" return code: {process.returncode} ]'
|
|
logger.log(error_level, msg)
|
|
raise subprocess.CalledProcessError(
|
|
returncode=process.returncode,
|
|
cmd=cmd,
|
|
output=outs,
|
|
stderr=errs
|
|
)
|
|
|
|
return outs.strip(),errs.strip()
|
|
|
|
def run_shell_cmd(cmd, logger, error_level=logging.ERROR):
|
|
return run_shell_cmd_full(cmd, logger, error_level)[0]
|
|
|
|
def url_to_stx_mirror(url):
|
|
|
|
url_change = urllib.parse.urlparse(url)
|
|
url_path = pathlib.Path(url_change.path)
|
|
if url_change.netloc != '':
|
|
path = pathlib.Path(url_change.netloc, url_path.relative_to("/"))
|
|
else:
|
|
path = url_path
|
|
|
|
# FIXME: the ":" in a path is converted to "%25", after
|
|
# uploading to STX_MIRROR, the "%25" in the path is converted
|
|
# to "%2525".
|
|
return os.path.join(STX_MIRROR_BASE, path).replace("%25", "%2525")
|
|
|
|
|
|
def get_download_url(url, strategy):
|
|
|
|
alt_rt_url = None
|
|
stx_mirror_url = url_to_stx_mirror(url)
|
|
if strategy == "stx_mirror":
|
|
rt_url = stx_mirror_url
|
|
elif strategy == "upstream":
|
|
rt_url = url
|
|
elif strategy == "stx_mirror_first":
|
|
try:
|
|
urllib.request.urlopen(stx_mirror_url)
|
|
rt_url = stx_mirror_url
|
|
alt_rt_url = url
|
|
except:
|
|
rt_url = url
|
|
elif strategy == "upstream_first":
|
|
try:
|
|
urllib.request.urlopen(url)
|
|
rt_url = url
|
|
alt_rt_url = stx_mirror_url
|
|
except:
|
|
rt_url = stx_mirror_url
|
|
else:
|
|
raise Exception(f'Invalid value "{strategy}" of STX_MIRROR_STRATEGY')
|
|
|
|
return (rt_url, alt_rt_url)
|
|
|
|
def deb_file_name_to_dict(deb_file):
|
|
ver_array = []
|
|
arch = None
|
|
pkg_epoch = None
|
|
pkg_ver = None
|
|
deb_array = deb_file.split("_")
|
|
pkg_name = deb_array[0]
|
|
if len(deb_array) >= 3:
|
|
arch = deb_array[2].split(".")[0]
|
|
if len(deb_array) >= 2:
|
|
ver_array = deb_array[1].split(":")
|
|
if len(ver_array) >= 2:
|
|
pkg_ver = ver_array[-1]
|
|
pkg_epoch = ver_array[0]
|
|
elif len(ver_array) == 1:
|
|
pkg_ver = ver_array[0]
|
|
pkg_epoch = None
|
|
pkg_dict = {'name':pkg_name, 'ver':pkg_ver, 'epoch':pkg_epoch, 'arch':arch, 'url':None}
|
|
return pkg_dict
|
|
|
|
def deb_url_name_to_dict(deb_url):
|
|
deb_file = os.path.basename(dub_url)
|
|
pkg_dict = deb_file_name_to_dict(deb_file)
|
|
pkg_dict['url'] = deb_url
|
|
return pkg_dict
|