|
|
@@ -0,0 +1,256 @@
|
|
|
+# -*- coding: utf-8 -*-
|
|
|
+
|
|
|
+"""
|
|
|
+ (c) 2015-2017 - Copyright Red Hat Inc
|
|
|
+
|
|
|
+ Authors:
|
|
|
+ Pierre-Yves Chibon <pingou@pingoured.fr>
|
|
|
+
|
|
|
+"""
|
|
|
+from __future__ import print_function
|
|
|
+
|
|
|
+import abc
|
|
|
+import logging
|
|
|
+import os
|
|
|
+import pkg_resources
|
|
|
+import subprocess
|
|
|
+
|
|
|
+import werkzeug
|
|
|
+
|
|
|
+import pagure
|
|
|
+import pagure.exceptions
|
|
|
+from pagure import APP
|
|
|
+from pagure.lib import model
|
|
|
+
|
|
|
+logging.config.dictConfig(APP.config.get('LOGGING') or {'version': 1})
|
|
|
+_log = logging.getLogger(__name__)
|
|
|
+
|
|
|
+
|
|
|
+def get_git_auth_helper(backend, *args, **kwargs):
|
|
|
+ """ Instantiate and return the appropriate git auth helper backend.
|
|
|
+
|
|
|
+ :arg backend: The name of the backend to find on the system (declared via
|
|
|
+ the entry_points in setup.py).
|
|
|
+ Pagure comes by default with the following backends:
|
|
|
+ test_auth, gitolite2, gitolite3
|
|
|
+ :type backend: str
|
|
|
+
|
|
|
+ """
|
|
|
+ points = pkg_resources.iter_entry_points('pagure.git_auth.helpers')
|
|
|
+ classes = dict([(point.name, point.load()) for point in points])
|
|
|
+ _log.debug("Found the following installed helpers %r" % classes)
|
|
|
+ cls = classes[backend]
|
|
|
+ _log.debug("Instantiating helper %r from backend key %r" % (cls, backend))
|
|
|
+ return cls(*args, **kwargs)
|
|
|
+
|
|
|
+
|
|
|
+class GitAuthHelper(object):
|
|
|
+ """ The class to inherit from when creating your own git authentication
|
|
|
+ helper.
|
|
|
+ """
|
|
|
+
|
|
|
+ __metaclass__ = abc.ABCMeta
|
|
|
+
|
|
|
+ @classmethod
|
|
|
+ @abc.abstractmethod
|
|
|
+ def generate_acls(self):
|
|
|
+ """ This is the method that is called by pagure to generate the
|
|
|
+ configuration file.
|
|
|
+ """
|
|
|
+ pass
|
|
|
+
|
|
|
+
|
|
|
+def _read_file(filename):
|
|
|
+ """ Reads the specified file and return its content.
|
|
|
+ Returns None if it could not read the file for any reason.
|
|
|
+ """
|
|
|
+ if not os.path.exists(filename):
|
|
|
+ _log.info('Could not find file: %s', filename)
|
|
|
+ else:
|
|
|
+ with open(filename) as stream:
|
|
|
+ return stream.read()
|
|
|
+
|
|
|
+
|
|
|
+class Gitolite2Auth(GitAuthHelper):
|
|
|
+ """ A gitolite 2 authentication module. """
|
|
|
+
|
|
|
+ @classmethod
|
|
|
+ def write_gitolite_acls(
|
|
|
+ cls, session, configfile, preconf=None, postconf=None):
|
|
|
+ ''' Generate the configuration file for gitolite for all projects
|
|
|
+ on the forge.
|
|
|
+
|
|
|
+ :arg cls: the current class
|
|
|
+ :type: Gitolite2Auth
|
|
|
+ :arg session: a session to connect to the database with
|
|
|
+ :arg configfile: the name of the configuration file to generate/write
|
|
|
+ :type configfile: str
|
|
|
+ :kwarg preconf: a file to include at the top of the configuration
|
|
|
+ file
|
|
|
+ :type preconf: None or str
|
|
|
+ :kwarg postconf: a file to include at the bottom of the
|
|
|
+ configuration file
|
|
|
+ :type postconf: None or str
|
|
|
+
|
|
|
+ '''
|
|
|
+ _log.info('Write down the gitolite configuration file')
|
|
|
+
|
|
|
+ preconfig = None
|
|
|
+ if preconf:
|
|
|
+ _log.info(
|
|
|
+ 'Loading the file to include at the top of the generated one')
|
|
|
+ preconfig = _read_file(preconf)
|
|
|
+
|
|
|
+ postconfig = None
|
|
|
+ if postconf:
|
|
|
+ _log.info(
|
|
|
+ 'Loading the file to include at the end of the generated one')
|
|
|
+ postconfig = _read_file(postconf)
|
|
|
+
|
|
|
+ global_pr_only = pagure.APP.config.get('PR_ONLY', False)
|
|
|
+ config = []
|
|
|
+ groups = {}
|
|
|
+ query = session.query(
|
|
|
+ model.Project
|
|
|
+ ).order_by(
|
|
|
+ model.Project.id
|
|
|
+ )
|
|
|
+ for project in query.all():
|
|
|
+ _log.debug(' Processing project: %s', project.fullname)
|
|
|
+ for group in project.committer_groups:
|
|
|
+ if group.group_name not in groups:
|
|
|
+ groups[group.group_name] = [
|
|
|
+ user.username for user in group.users]
|
|
|
+
|
|
|
+ # Check if the project or the pagure instance enforce the PR only
|
|
|
+ # development model.
|
|
|
+ pr_only = project.settings.get('pull_request_access_only', False)
|
|
|
+
|
|
|
+ for repos in ['repos', 'docs/', 'tickets/', 'requests/']:
|
|
|
+ if repos == 'repos':
|
|
|
+ # Do not grant access to project enforcing the PR model
|
|
|
+ if pr_only or (global_pr_only and not project.is_fork):
|
|
|
+ continue
|
|
|
+ repos = ''
|
|
|
+
|
|
|
+ config.append('repo %s%s' % (repos, project.fullname))
|
|
|
+ if repos not in ['tickets/', 'requests/']:
|
|
|
+ config.append(' R = @all')
|
|
|
+ if project.committer_groups:
|
|
|
+ config.append(' RW+ = @%s' % ' @'.join(
|
|
|
+ [
|
|
|
+ group.group_name
|
|
|
+ for group in project.committer_groups
|
|
|
+ ]
|
|
|
+ ))
|
|
|
+ config.append(' RW+ = %s' % project.user.user)
|
|
|
+ for user in project.committers:
|
|
|
+ # This should never be the case (that the project.user
|
|
|
+ # is in the committers) but better safe than sorry
|
|
|
+ if user.user != project.user.user:
|
|
|
+ config.append(' RW+ = %s' % user.user)
|
|
|
+ for deploykey in project.deploykeys:
|
|
|
+ access = 'R'
|
|
|
+ if deploykey.pushaccess:
|
|
|
+ access = 'RW+'
|
|
|
+ # Note: the replace of / with _ is because gitolite
|
|
|
+ # users can't contain a /. At first, this might look
|
|
|
+ # like deploy keys in a project called
|
|
|
+ # $namespace_$project would give access to the repos of
|
|
|
+ # a project $namespace/$project or vica versa, however
|
|
|
+ # this is NOT the case because we add the deploykey.id
|
|
|
+ # to the end of the deploykey name, which means it is
|
|
|
+ # unique. The project name is solely there to make it
|
|
|
+ # easier to determine what project created the deploykey
|
|
|
+ # for admins.
|
|
|
+ config.append(' %s = deploykey_%s_%s' %
|
|
|
+ (access,
|
|
|
+ werkzeug.secure_filename(project.fullname),
|
|
|
+ deploykey.id))
|
|
|
+ config.append('')
|
|
|
+
|
|
|
+ with open(configfile, 'w') as stream:
|
|
|
+ if preconfig:
|
|
|
+ stream.write(preconfig + '\n')
|
|
|
+
|
|
|
+ for key, users in groups.iteritems():
|
|
|
+ stream.write('@%s = %s\n' % (key, ' '.join(users)))
|
|
|
+ stream.write('\n')
|
|
|
+
|
|
|
+ for row in config:
|
|
|
+ stream.write(row + '\n')
|
|
|
+
|
|
|
+ if postconfig:
|
|
|
+ stream.write(postconfig + '\n')
|
|
|
+
|
|
|
+ @staticmethod
|
|
|
+ def _get_gitolite_command():
|
|
|
+ """ Return the gitolite command to run based on the info in the
|
|
|
+ configuration file.
|
|
|
+ """
|
|
|
+ _log.info('Compiling the gitolite configuration')
|
|
|
+ gitolite_folder = pagure.APP.config.get('GITOLITE_HOME', None)
|
|
|
+ if gitolite_folder:
|
|
|
+ cmd = 'GL_RC=%s GL_BINDIR=%s gl-compile-conf' % (
|
|
|
+ pagure.APP.config.get('GL_RC'),
|
|
|
+ pagure.APP.config.get('GL_BINDIR')
|
|
|
+ )
|
|
|
+ _log.debug('Command: %s', cmd)
|
|
|
+ return cmd
|
|
|
+
|
|
|
+ @classmethod
|
|
|
+ def generate_acls(cls):
|
|
|
+ """ Generate the gitolite configuration file for all repos
|
|
|
+ """
|
|
|
+ _log.info('Refresh gitolite configuration')
|
|
|
+ cls.write_gitolite_acls(
|
|
|
+ pagure.SESSION,
|
|
|
+ pagure.APP.config['GITOLITE_CONFIG'],
|
|
|
+ preconf=pagure.APP.config.get('GITOLITE_PRE_CONFIG') or None,
|
|
|
+ postconf=pagure.APP.config.get('GITOLITE_POST_CONFIG') or None
|
|
|
+ )
|
|
|
+
|
|
|
+ cmd = cls._get_gitolite_command()
|
|
|
+ if cmd:
|
|
|
+ proc = subprocess.Popen(
|
|
|
+ cmd,
|
|
|
+ shell=True,
|
|
|
+ stdout=subprocess.PIPE,
|
|
|
+ stderr=subprocess.PIPE,
|
|
|
+ cwd=pagure.APP.config['GITOLITE_HOME']
|
|
|
+ )
|
|
|
+ stdout, stderr = proc.communicate()
|
|
|
+ if proc.returncode != 0:
|
|
|
+ error_msg = (
|
|
|
+ 'The command "{0}" failed with'
|
|
|
+ '\n\n out: "{1}\n\n err:"{2}"'
|
|
|
+ .format(' '.join(cmd), stdout, stderr))
|
|
|
+ raise pagure.exceptions.PagureException(error_msg)
|
|
|
+
|
|
|
+
|
|
|
+class Gitolite3Auth(Gitolite2Auth):
|
|
|
+ """ A gitolite 3 authentication module. """
|
|
|
+
|
|
|
+ @staticmethod
|
|
|
+ def _get_gitolite_command():
|
|
|
+ """ Return the gitolite command to run based on the info in the
|
|
|
+ configuration file.
|
|
|
+ """
|
|
|
+ _log.info('Compiling the gitolite configuration')
|
|
|
+ gitolite_folder = pagure.APP.config.get('GITOLITE_HOME', None)
|
|
|
+ if gitolite_folder:
|
|
|
+ cmd = 'HOME=%s gitolite compile && HOME=%s gitolite trigger '\
|
|
|
+ 'POST_COMPILE' % (gitolite_folder, gitolite_folder)
|
|
|
+ _log.debug('Command: %s', cmd)
|
|
|
+ return cmd
|
|
|
+
|
|
|
+
|
|
|
+class GitAuthTestHelper(GitAuthHelper):
|
|
|
+ """ Simple test auth module to check the auth customization system. """
|
|
|
+
|
|
|
+ @classmethod
|
|
|
+ def generate_acls(cls):
|
|
|
+ """ Print a statement when called, useful for debugging, only. """
|
|
|
+ out = 'Called GitAuthTestHelper.generate_acls()'
|
|
|
+ print(out)
|
|
|
+ return out
|
Pierre-Yves Chibon