With this change python packages in pypi will be
verified using the MD5 hash posted in pypi along
the package if all the other verifications are
not possible.
Enabling the security_sensitive flag in options.conf will append
security-related flags to CFLAGS. Currently only
-fstack-protector-strong is added but we will add more as necessary.
The docs module was only used to copy news and changelog files to the
autospec directory, which is then parsed for a commitmessage. This patch
removes the docs module and incorporates it into commitmessage.py.
commitmessage module no longer has global variables. The CVEs list now
lives in the config module. The parsing logic for news files is
simplified to look for start and end patterns of relevant blocks of
information.
The goal here was to keep as closely as possible to the previous parsing
functionality, but it is very possible not every pattern was accounted
for. The start and end pattern lists make it much easier to add patterns
and modify the parsing if this is the case.
This patch adds handling for two cases for interactive
mode. 1- when non pty, the interactive mode is disabled
, and 2- timeout input function, when user fails to type
an input in interactive mode the script will continue
after a timeout.
This flag will be used for package verification interactive
mode, currently package verification will attempt to import
a public key if a public key id is found. With the addition
of this flag is possible to disable the default interactive
mode and instead fail the verification if the public key is
not already in the keyring.
Changes have been pushed recently that require testing updates. This
patch updates the configuration file and spec file expectations for the
functional tests.
When config.config_opts['broken_c++'] is set, only add it to the
CXXFLAGS, because adding it to every flag list (such as CFLAGS) causes a
compiler error.
The hhvm binary in particular has extra elf sections added to it to
store php code, and these are removed by the generic build macros that
create the debug information.
Other packages which need this are bazil, docker, go, linux-*.
Signed-off-by: Icarus Sparry <icarus.w.sparry@intel.com>
The abireport portion of autospec has since been ported (in concept) to
a new Golang tool of the same name. This tool is decidedly more accurate
and considerably faster, as it does not have to call out to execute more
system commands for each file processed.
In addition, it is able to differentiate correctly between multiple
architectures, allowing for two new files to exist, used_libs32 and
symbols32. These permit a finer granularity in the view of multilib
as exposed by the package.
In the instance that abireport is not available on the host, we fall
back to the internal abireport scanning, and emit a warning.
Minor tweaks have been made to the binary_in_path function to make it
reusable as part of util, and to make it lazily initialise the os paths
to cut down on unnecessary duplication.
Signed-off-by: Ikey Doherty <michael.i.doherty@intel.com>
In some environments it might be neccesary to pass
http_proxy env var if this is not set otherwise the
attempt of find a key will fail since gpg will not
be able to find a keyserver if behind proxy.
Tests most helper functions in the abireport module. Excludes some
helpers that are just wrappers for os and shutil calls. Also excludes
the 100-line examine_abi main method, which may require functional
tests.
Autospec should show an error and exit if the key the package was
verified with has changed from previous autospec runs, as it may
indicate a compromised key. The previous key is recorded in the existing
spec file.
When autospec fails to find a key it just quits
even when a keyid exists. With these changes users
will have the option to import a key without
quiting autospec.
in some cases '/usr/sbin/mock' may not exist, which will break autospec
execution, previous code checks that '/usr/sbin/mock' and
'/usr/bin/mock' are equal to prepend 'sudo' to the command.
check if current user doesn't belong to the 'mock' group
to add 'sudo' in the command
Signed-off-by: Simental Magana, Marcos <marcos.simental.magana@intel.com>
Previously, it was assumed if a dash appeared in the version string the
actual version information was after the dash. This is not always the
case, so check if the second part of the string is formatted like a
version before using it. If not, try the first part. If neither look
like the version just remove the dash so it is at least a valid version
string.
Add a test case to packageurls to test this.
Functional tests take a long time to run, some longer than others. This
adds the option to run specific test cases defined by passing
whitespace-separated options to the '-c' flag, allowing the tester to
avoid long-running tests like libjpeg-turbo if they don't need to. This
can be run with make by setting the CASES argument:
make test_autospec CASES="c-helloworld c-helloworld-32"
Packages that are linking into update-triggers.target.wants folders
should not have those symlinks move into -autostart subrpms, since this
breaks the very thing they're set out to do. On update, all triggers
must be executed.
Resolves CLEAR-1797
If git add fails to find the first file in a list it fails and does not
add the remaining files. Separate out the git adds for signature files
so they are not ignored.
Also, use 'bash -c' combined with shopt to get around subprocess
restrictions against globbing.
Add the package signature URL as a Source99 file to include it with the
source rpm. This allows the signature to be more traceable and
accessible even without a network connection.
There are three shared libraries from elfutils with a .so extension and
live in /usr/lib{32,64}. Normally, files with this pattern are installed
in the -dev subpackage, so to ensure that all elfutils libraries are
installed to -lib, make autospec detect these libraries before the -dev
rules apply.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Because some repos return 200 http code with a
404 page when a signature is not found, validating
signatures is needed to make sure the downloaded
data can be read by gpg.
This will print the proper error messages for
CLEAR-1752 and CLEAR-1756, right now it just
returns a None and gives the impression that
a signature is available, which is missleading.
This change adds the ability for autospec to package projects using the
cargo build tool. Note that source files are installed into
/usr/share/rust/src and an empty checksums file is prepopulated into the
source folders for now. This is an implementation taking advantage of
cargo's recently added ability to handle vendored source directories and
may evolve further as distro support is still not fully baked in.
When autospec is run concurrently with itself it may race creating the
parent folder for the tarbal extraction. To avoid this simply allow the
folder to already exist.
Since pkg_integrity now depends on config.py, it is necessary to change
how imports are done in the tests so mocking can be achieved. This also
required renaming the tests/pkg_integrity.py file to
tests/test_pkg_integrity.py to avoid a name collision. Before each test
the necessary config option is set correctly and the configuration file
rewrite is mocked away.
Alex Jaramillo