Commit graph

3713 commits

Author SHA1 Message Date
Hans-Christoph Steiner
56338cd7d0 repo_key_sha256 to list of valid config keys
fdroidserver!287
2025-04-16 11:11:57 +00:00
Hans-Christoph Steiner
17e5a59704 verify: generate <appid>.json files that list all reports 2025-04-10 15:41:46 +00:00
Hans-Christoph Steiner
029636ed61 verify: write verified.json in function to ease testing 2025-04-10 15:41:46 +00:00
linsui
2aba6fd324 checkupdates: always print remote message of git push 2025-04-09 17:48:11 +08:00
linsui
a13dd109d3 checkupdates: adjust log level 2025-04-09 14:51:27 +08:00
Michael Pöhn
69f9f52ba2 drop error prefix when raising VCSException in case retrieving git revision failed 2025-04-03 10:24:46 +00:00
Michael Pöhn
046c527ee8 vcs_git: clearer error messages for checkrepo()
This updates error messages the help identify issues when loading srclibs
and fixes pushing srclibs into build vms/containers.
2025-04-03 10:24:46 +00:00
Michael Pöhn
0d88a94192 metadata: rename srcdir -> srclibs_dir for clarity 2025-04-03 10:24:46 +00:00
Hans-Christoph Steiner
a011b34b97 black format and use returncode directly without != 0 2025-03-31 11:27:13 +02:00
Hans-Christoph Steiner
9a8d80ee6b purge dead code: apk_signer_fingerprint_short 2025-03-31 11:09:07 +02:00
Hans-Christoph Steiner
4cefec9333
fix missing comma in error message 2025-03-25 12:13:22 +01:00
Hans-Christoph Steiner
8f351d8406 publish: convert to black code format 2025-03-25 10:23:00 +00:00
Hans-Christoph Steiner
5150c721f4 verify_apk_signature: work when options is not set
Then test_signatures.py can run on the PUBLISH CI job.
2025-03-25 10:23:00 +00:00
Hans-Christoph Steiner
acbab69722 update: add execution stages to status JSON
This should help us profile what takes so long in `fdroid update`.  It also
gives feedback so that people can see how close to done it is, or where it
failed.

This is based on how incremental status JSON works for `fdroid build`.
2025-03-24 11:14:40 +01:00
Hans-Christoph Steiner
35d205a9b9 scanner: only output "X problems found" if errors or --verbose
UNIX/POSIX standard behavior is to output nothing at all if a command
succeeds.  This suppresses "0 problems found", unless the user requests it.
2025-03-21 08:45:23 +00:00
Hans-Christoph Steiner
4b9100ae80 publish: remove last use of stats/ dir
This file can be treated like the other index files in repo/. This also has
the advantage that it will automatically get synced by @CiaranG's existing
sync scripts.
2025-03-20 15:08:32 +01:00
Hans-Christoph Steiner
38378ddfb7 rename v1_sort_packages to sort_package_versions 2025-03-20 15:08:32 +01:00
Hans-Christoph Steiner
8565a97465 rename functions and variables to reflect stats/ going away 2025-03-20 15:08:32 +01:00
Hans-Christoph Steiner
20569217d9 index: fail if user sets mirrors:isPrimary wrong
Really, this is not meant to be set by the user in the config.  But if they
add something harmless that'll be ignored anyway, it seems that throwing an
error is too much.  So only throw the error if it is set wrongly.
2025-03-20 11:13:09 +00:00
linsui
5e28cd367f scanner: add bun.lock as lock file of package.json 2025-03-20 07:29:09 +00:00
Hans-Christoph Steiner
e23b196a0f
run tests/refresh-SUSS_DEFAULT.py 2025-03-19 17:45:08 +01:00
Hans-Christoph Steiner
2f4e0f47a1 signatures: make from . import net optional
This eliminates the need to have python3-requests installed on the signing
server.  This was missed in 031ae1103e
2025-03-12 17:27:26 +01:00
Hans-Christoph Steiner
d06e33697a lint: missing valid config key: apk_signing_key_block_list 2025-03-12 13:37:17 +01:00
Hans-Christoph Steiner
858068c64b only show "unsafe perms on config.yml" when secrets are present
This should make for fewer false positives.
2025-03-12 13:37:17 +01:00
Hans-Christoph Steiner
8cf1297e2c clarify config data types and structures 2025-03-12 13:37:17 +01:00
Hans-Christoph Steiner
081e02c109 expand {env: foo} in any place a string can be
`keypass: {env: keypass}` has been in use in production repos for
years.  That is not anything new. It makes it possible to maintain
_config.yml_ publicly even when it needs secrets.  This change makes
sure it is possible to use {env: foo} syntax anywhere where a string
value is valid. The "list of dicts" values can be str, list of str or
list of dicts with str.

Before the {env: keypass} syntax, the actual password was just inline
in the config file.  Before this commit, it was only possible to use
{env: key} syntax in simple, string-only configs, e.g. from
examples/config.yml:
2025-03-12 13:37:17 +01:00
Hans-Christoph Steiner
031ae1103e function-local imports to limit deps for publish/signindex/gpgsign
This eliminates the need to have these installed on the signing server:

* python3-qrcode
* python3-requests

The signing server currently uses a git clone to run _fdroidserver_ and
`apt-get install` for dependencies.  This leaves "qrcode" in
"install_requires" since moving it to "extras_require" would break
`fdroid update` and `fdroid nightly` for anything that does
`pip install fdroidserver`:

https://gitlab.com/eighthave/fdroidserver/-/jobs/9386520037
2025-03-12 13:37:13 +01:00
Hans-Christoph Steiner
3ab2baf542 _yaml.config_dump() for writing out config
This outputs YAML in a string that is suitable for use in regexps
and string replacements, as well as complete files.  It is therefore
explicitly set up to avoid writing out headers and footers.
2025-03-10 08:49:18 +01:00
Hans-Christoph Steiner
2f47938dbf standardize config on ruamel.yaml with a YAML 1.2 config
This is a key piece of the ongoing `PUBLISH` _config.yml_ migration. There was uneven implementation of which YAML parser to use, and that could lead to bugs where one parser might read a value one way, and a different parser will read the value a different way. I wanted to be sure that YAML 1.2 would always work.

This makes all code that handles config files use the same `ruamel.yaml` parsers.  This only touches other usages of YAML parsers when there is overlap.  This does not port all of _fdroidserver_ to `ruamel.yaml` and YAML 1.2.  The metadata files should already be YAML 1.2 anyway.

# Conflicts:
#	fdroidserver/lint.py
2025-03-10 08:48:58 +01:00
Hans-Christoph Steiner
53b62415d3 load lint_licenses where it is needed to avoid circular imports
This is the only thing that common.py imports from lint.py.
2025-03-07 14:52:23 +01:00
Hans-Christoph Steiner
3cc6c09ffc use common var for 'config.yml', standarize on UTF-8
This makes it easy to track all the places that use config.yml, and
hopefully makes things feel cleaner.  This also standardizes all places
where config.yml is written out to use UTF-8 as the file encoding.

This also includes a lot of black code format fixes.
2025-03-05 12:20:32 +01:00
Hans-Christoph Steiner
642499ec94
purge config.py handling, it is no longer supported 2025-02-26 17:27:58 +01:00
Hans-Christoph Steiner
1ee9ea8cf9 lint: implement for config.yml 2025-02-24 19:07:27 +01:00
Hans-Christoph Steiner
56865f9ba6
checkupdates: remove auto_author: config, it is no longer used
checkupdates-runner sets the required values anyway.
fe3cb890db/.gitlab-ci.yml (L35)
2025-02-24 11:58:56 +01:00
Hans-Christoph Steiner
ecdf47d893 update: do not crash on {env: } in paths in config.yml 2025-02-22 23:32:29 +01:00
Hans-Christoph Steiner
b933043ca1 new helpers: get_output_extension() & get_release_apk_filename()
This also moves to the standard var names: appid & versionCode
2025-02-13 17:56:30 +01:00
Hans-Christoph Steiner
f7dc89e9ba index: error if duplicate package files are in repo
Looks like the ~index-v2 work removed this error case, and the old bash
integration test case failed to catch it.  This reestablishes this error.

@mindston's refactoring of the old bash test suite caught this issue, e.g.
!1587
2025-02-12 18:38:05 +01:00
linsui
a7e56598d6 checkupdates: sort the order of dirs when finding autoname 2025-02-07 22:16:18 +08:00
linsui
2b725a5966 update.py: fix triple-t metadata extract when there is no subdir 2025-01-27 13:47:36 +00:00
Hans-Christoph Steiner
2ac925a249 ban apksigner v33, it has bugs verifying APKs with v3/v3.1 sigs 2025-01-21 15:00:23 +00:00
Hans-Christoph Steiner
5b1b1d12a1 verify: handle corrupt verified.json
verified.json can get quite large on verification.f-droid.org, and for some
unknown reason, it sometimes corrupts it when writing it out.  All the data
is already available in all the other JSON files, so this just automatically
reconstructs it.  Its a hack, but it took me much less time than I've
already spent trying to troubleshoot why it writes out corrupt verified.json.
2025-01-20 09:48:20 +00:00
Hans-Christoph Steiner
20caa6fa1c match the full file name when looking for the v1 signature block
ZipFile.namelist() produces a string per file.  The filename could contain
newline chars, including at the beginning and end.  ^$ in regex matches
around newline chars.  \A\Z matches the beginning/end of the full string.

This is exactly the same as obfusk's r'\AMETA-INF/(?s:.)*\.(DSA|EC|RSA)\Z'
but in a readable format that is also easily searchable, and standard for
this code base.

https://github.com/obfusk/fdroid-fakesigner-poc/blob/master/fdroidserver-regex.patch

#1251
2025-01-15 14:45:35 +01:00
linsui
f93e30f1e9 lint: only error out on missing extlib on versions not archived 2024-12-12 22:33:36 +08:00
linsui
9b59d5cf48 update: extract archive policy calculation to common 2024-12-12 22:20:38 +08:00
Hans-Christoph Steiner
5deb936e86 verify: --clean-up-verified to rm all files except the JSON report 2024-12-11 11:39:02 +00:00
Hans-Christoph Steiner
56814824ee new function get_src_tarball_name; deprecates getsrcname
Some places in the code that need this, like verify.py, do not have
app and build instances, but do have appid and versionCode.  And
fdroidserver/build.py is going away.
2024-12-11 11:39:02 +00:00
Hans-Christoph Steiner
bc118484e4 index.xml: XML escaping from Python < 3.13 which stopped converting "
index.xml is for old clients that are stuck in the past forever.  So the
format should not change at all.  Python 3.13 changed minidom so it no
longer converts " to an XML entity.
154477be72
2024-12-06 16:15:48 +01:00
Hans-Christoph Steiner
ad9b0c3294 update: only gen index.png when making index.html
* https://f-droid.org/repo does not use the index.png at all
* Some repos want to set their own index.png rather than the QR code
2024-12-04 13:13:30 +01:00
Hans-Christoph Steiner
8fc340aaca install: fix download dir when fetching from GitHub Releases 2024-11-26 15:31:47 +01:00
Hans-Christoph Steiner
8c81033ea3 FDroidPopenBytes: do not crash if options are not set
This makes writing test cases a lot easier. For example:

======================================================================
ERROR: test_devices (tests.test_install.InstallTest.test_devices)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/hans/code/fdroid/server/tests/test_install.py", line 31, in test_devices
    devices = fdroidserver.install.devices()
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/hans/code/fdroid/server/fdroidserver/install.py", line 225, in devices
    p = common.SdkToolsPopen(['adb', "devices"])
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/hans/code/fdroid/server/fdroidserver/common.py", line 2921, in SdkToolsPopen
    return FDroidPopen([abscmd] + commands[1:],
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/hans/code/fdroid/server/fdroidserver/common.py", line 3024, in FDroidPopen
    result = FDroidPopenBytes(commands, cwd, envs, output, stderr_to_stdout)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/hans/code/fdroid/server/fdroidserver/common.py", line 2987, in FDroidPopenBytes
    if output and options.verbose:
                  ^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'verbose'
2024-11-26 15:20:06 +01:00