propellor 3.1.1 → 3.1.2

raw patch · 10 files changed

+173/−77 lines, 10 filesPVP: major bump suggested

API removals or changes: PVP suggests a major version bump

API changes (from Hackage documentation)

Files

• CHANGELOG +26/−0
• debian/README.Debian +0/−14
• debian/changelog +26/−0
• debian/propellor.README.Debian +14/−0
• propellor.cabal +2/−2
• src/Propellor/DotDir.hs +11/−1
• src/Propellor/Git.hs +13/−0
• src/Propellor/Property/Sbuild.hs +72/−31
• src/Propellor/Property/SiteSpecific/JoeySites.hs +7/−27
• src/Propellor/Property/Ssh.hs +2/−2

@@ -1,3 +1,29 @@+propellor (3.1.2) unstable; urgency=medium++  [ Joey Hess ]+  * Ssh.knownHost: Bug fix: Only fix up the owner of the known_hosts+    file after it exists.++  [ Sean Whitton ]+  * Sbuild.keypairInsecurelyGenerated: Improved to be more robust.+  * Pass --allow-unrelated-histories to git merge when run with git 2.9 or+    newer. This fixes the /usr/bin/propellor wrapper with this version of git.+  * Sbuild.built & Sbuild.builtFor no longer require Sbuild.keypairGenerated.+    Transition guide: If you are using sbuild 0.70.0 or newer, you should+    `rm -r /var/lib/sbuild/apt-keys`.  Otherwise, you should add either+    Sbuild.keypairGenerated or Sbuild.keypairInsecurelyGenerated to your host.+  * Sbuild haddock improvements:+    - State that we don't support squeeze and Buntish older than trusty.+      This is due to our enhancements, such as eatmydata.+    - State that you need sbuild 0.70.0 or newer to build for stretch.+      This is due to gpg2 hitting Debian stretch.+    - Explain when a keygen is required.+    - Update sample ~/.sbuildrc for sbuild 0.71.0.+    - Add hint for customising chroots with propellor.+    - Update example usage of System type.++ -- Joey Hess <id@joeyh.name>  Sun, 28 Aug 2016 14:39:23 -0400+ propellor (3.1.1) unstable; urgency=medium    * Haddock build fix.

@@ -1,14 +0,0 @@-The Debian package of propellor ships its full source code because-propellor is configured by rebuilding it, and embraces modification of any-of the source code.--/usr/bin/propellor is a wrapper which will set up a propellor git-repository in ~/.propellor/, and run ~/.propellor/propellor if it exists.-Edit ~/.propellor/config.hs to configure it.--Note that upgrading the propellor package will not update your-~/.propellor/ repository. This is because you may have local changes-to the source, or may need to adapt your config.hs to work with the new-version of propellor. Instead, if your ~/.propellor/ is from an older-version of propellor, /usr/bin/propellor will warn that it's out of date,-and tell you how to merge in the changes.

@@ -1,3 +1,29 @@+propellor (3.1.2) unstable; urgency=medium++  [ Joey Hess ]+  * Ssh.knownHost: Bug fix: Only fix up the owner of the known_hosts+    file after it exists.++  [ Sean Whitton ]+  * Sbuild.keypairInsecurelyGenerated: Improved to be more robust.+  * Pass --allow-unrelated-histories to git merge when run with git 2.9 or+    newer. This fixes the /usr/bin/propellor wrapper with this version of git.+  * Sbuild.built & Sbuild.builtFor no longer require Sbuild.keypairGenerated.+    Transition guide: If you are using sbuild 0.70.0 or newer, you should+    `rm -r /var/lib/sbuild/apt-keys`.  Otherwise, you should add either+    Sbuild.keypairGenerated or Sbuild.keypairInsecurelyGenerated to your host.+  * Sbuild haddock improvements:+    - State that we don't support squeeze and Buntish older than trusty.+      This is due to our enhancements, such as eatmydata.+    - State that you need sbuild 0.70.0 or newer to build for stretch.+      This is due to gpg2 hitting Debian stretch.+    - Explain when a keygen is required.+    - Update sample ~/.sbuildrc for sbuild 0.71.0.+    - Add hint for customising chroots with propellor.+    - Update example usage of System type.++ -- Joey Hess <id@joeyh.name>  Sun, 28 Aug 2016 14:39:23 -0400+ propellor (3.1.1) unstable; urgency=medium    * Haddock build fix.

@@ -0,0 +1,14 @@+The Debian package of propellor ships its full source code because+propellor is configured by rebuilding it, and embraces modification of any+of the source code.++/usr/bin/propellor is a wrapper which will set up a propellor git+repository in ~/.propellor/, and run ~/.propellor/propellor if it exists.+Edit ~/.propellor/config.hs to configure it.++Note that upgrading the propellor package will not update your+~/.propellor/ repository. This is because you may have local changes+to the source, or may need to adapt your config.hs to work with the new+version of propellor. Instead, if your ~/.propellor/ is from an older+version of propellor, /usr/bin/propellor will warn that it's out of date,+and tell you how to merge in the changes.

@@ -1,5 +1,5 @@ Name: propellor-Version: 3.1.1+Version: 3.1.2 Cabal-Version: >= 1.8 License: BSD2 Maintainer: Joey Hess <id@joeyh.name>@@ -22,7 +22,7 @@   contrib/post-merge-hook   stack.yaml   debian/changelog-  debian/README.Debian+  debian/propellor.README.Debian   debian/compat   debian/control   debian/copyright

@@ -401,7 +401,17 @@ 		changeWorkingDirectory tmprepo 		git ["fetch", distrepo, "--quiet"] 		git ["reset", "--hard", oldref, "--quiet"]-		git ["merge", newref, "-s", "recursive", "-Xtheirs", "--quiet", "-m", "merging upstream version"]+		v <- gitVersion+		let mergeparams =+			[ "merge", newref+			, "-s", "recursive"+			, "-Xtheirs"+			, "--quiet"+			, "-m", "merging upstream version"+			] ++ if v >= [2,9]+				then [ "--allow-unrelated-histories" ]+				else []+		git mergeparams  		void $ fetchUpstreamBranch tmprepo 		cleantmprepo

@@ -3,7 +3,10 @@ import Utility.Process import Utility.Exception import Utility.Directory+import Utility.Misc+import Utility.PartialPrelude +import Data.Maybe import Control.Applicative import Prelude @@ -26,3 +29,13 @@  hasGitRepo :: IO Bool hasGitRepo = doesFileExist ".git/HEAD"++type Version = [Int]++gitVersion :: IO Version+gitVersion = extract <$> readProcess "git" ["--version"]+  where+	extract s = case lines s of+		[] -> []+		(l:_) -> mapMaybe readish $ segment (== '.') $+			unwords $ drop 2 $ words l

@@ -6,52 +6,67 @@  Build and maintain schroots for use with sbuild. +For convenience we set up several enhancements, such as ccache and+eatmydata.  This means we have to make several assumptions:++1. you want to build for a Debian release strictly newer than squeeze,+or for a Buntish release newer than or equal to trusty++2. if you want to build for Debian stretch or newer, you have sbuild+0.70.0 or newer (there is a backport to jessie)++The latter is due to the migration from GnuPG v1 to GnuPG v2.1 in+Debian stretch, which older sbuild can't handle.+ Suggested usage in @config.hs@:  >  & Apt.installed ["piuparts", "autopkgtest"]->  & Sbuild.builtFor (System (Debian Unstable) X86_32)->  & Sbuild.piupartsConfFor (System (Debian Unstable) X86_32)->  & Sbuild.updatedFor (System (Debian Unstable) X86_32) `period` Weekly 1+>  & Sbuild.builtFor (System (Debian Linux Unstable) X86_32)+>  & Sbuild.piupartsConfFor (System (Debian Linux Unstable) X86_32)+>  & Sbuild.updatedFor (System (Debian Linux Unstable) X86_32) `period` Weekly 1 >  & Sbuild.usableBy (User "spwhitton") >  & Sbuild.shareAptCache >  & Schroot.overlaysInTmpfs -In @~/.sbuildrc@:+If you are using sbuild older than 0.70.0, you also need: +>  & Sbuild.keypairGenerated++In @~/.sbuildrc@ (sbuild 0.71.0 or newer):+ >  $run_piuparts = 1; >  $piuparts_opts = [ >      '--schroot',->      'unstable-i386-piuparts',+>      '%r-%a-piuparts', >      '--fail-if-inadequate', >      '--fail-on-broken-symlinks', >      ]; >->  $external_commands = {->    'post-build-commands' => [->      [->        'adt-run',->        '--changes', '%c',->        '---',->        'schroot', 'unstable-i386-sbuild;',->->        # if adt-run's exit code is 8 then the package had no tests but->        # this isn't a failure, so catch it->        'adtexit=$?;',->        'if', 'test', '$adtexit', '=', '8;', 'then',->        'exit', '0;', 'else', 'exit', '$adtexit;', 'fi'->      ],->    ],->  };+>  $run_autopkgtest = 1;+>  $autopkgtest_root_args = "";+>  $autopkgtest_opts = ["--", "schroot", "%r-%a-sbuild"]; -We use @sbuild-createchroot(1)@ to create a chroot to the specification of-@sbuild-setup(7)@.  This differs from the approach taken by picca's Sbuild.hs,-which uses 'Propellor.Property.Debootstrap' to construct the chroot.  This is-because we don't want to run propellor inside the chroot in order to keep the-sbuild environment as standard as possible.+We use @sbuild-createchroot(1)@ to create a chroot to the+specification of @sbuild-setup(7)@.  This avoids running propellor+inside the chroot to set it up.  While that approach is flexible, a+propellor spin pulls in a lot of dependencies.  This could defeat+using sbuild to determine if you've included all necessary build+dependencies in your source package control file.++Nevertheless, the chroot that @sbuild-createchroot(1)@ creates might+not meet your needs.  For example, you might need to enable an apt+cacher.  In that case you can do something like this in @config.hs@:++>  & Sbuild.built (System (Debian Linux Unstable) X86_32) `before` mySetup+>    where+>  	mySetup = Chroot.provisioned myChroot+>  	myChroot = Chroot.debootstrapped+>  		 	Debootstrap.BuilddD "/srv/chroot/unstable-i386"+>  		-- the extra configuration you need:+>  		& Apt.installed ["apt-transport-https"] -} --- If you wanted to do it with Propellor.Property.Debootstrap, note that--- sbuild-createchroot has a --setup-only option+-- Also see the --setup-only option of sbuild-createchroot  module Propellor.Property.Sbuild ( 	-- * Creating and updating sbuild schroots@@ -122,7 +137,6 @@ built :: SbuildSchroot -> Apt.Url -> RevertableProperty DebianLike UnixLike built s@(SbuildSchroot suite arch) mirror = 	(go-	`requires` keypairGenerated 	`requires` ccachePrepared 	`requires` installed 	`requires` overlaysKernel)@@ -149,6 +163,8 @@ 				`before` commandPrefix 			, return FailedChange 			)+	-- TODO we should kill any sessions still using the chroot+	-- before destroying it (as suggested by sbuild-destroychroot) 	deleted = check (not <$> unpopulated (schrootRoot s)) $ 		property ("no sbuild schroot for " ++ show s) $ do 			liftIO $ removeChroot $ schrootRoot s@@ -216,7 +232,6 @@ updated s@(SbuildSchroot suite arch) = 	check (doesDirectoryExist (schrootRoot s)) $ go 	`describe` ("updated schroot for " ++ show s)-	`requires` keypairGenerated 	`requires` installed   where 	go :: Property DebianLike@@ -340,6 +355,8 @@ usableBy u = User.hasGroup u (Group "sbuild") `requires` installed  -- | Generate the apt keys needed by sbuild+--+-- You only need this if you are using sbuild older than 0.70.0. keypairGenerated :: Property DebianLike keypairGenerated = check (not <$> doesFileExist secKeyFile) $ go 	`requires` installed@@ -358,15 +375,39 @@ -- | Generate the apt keys needed by sbuild using a low-quality source of -- randomness --+-- Note that any running rngd will be killed; if you are using rngd, you should+-- arrange for it to be restarted after this property has been ensured.  E.g.+--+-- >  & Sbuild.keypairInsecurelyGenerated+-- >  	`onChange` Systemd.started "my-rngd-service"+-- -- Useful on throwaway build VMs.+--+-- You only need this if you are using sbuild older than 0.70.0. keypairInsecurelyGenerated :: Property DebianLike keypairInsecurelyGenerated = check (not <$> doesFileExist secKeyFile) go   where 	go :: Property DebianLike 	go = combineProperties "sbuild keyring insecurely generated" $ props 		& Apt.installed ["rng-tools"]-		& cmdProperty "rngd" ["-r", "/dev/urandom"] `assume` MadeChange+		-- If this dir does not exist the sbuild key generation command+		-- will fail; the user might have deleted it to work around+		-- #831462+		& File.dirExists "/var/lib/sbuild/apt-keys"+		-- If there is already an rngd process running we have to kill+		-- it, as it might not be feeding to /dev/urandom.  We can't+		-- kill by pid file because that is not guaranteed to be the+		-- default (/var/run/rngd.pid), so we killall+		& userScriptProperty (User "root")+			[ "start-stop-daemon -q -K -R 10 -o -n rngd"+			, "rngd -r /dev/urandom"+			]+			`assume` MadeChange 		& keypairGenerated+		-- Kill off the rngd process we spawned+		& userScriptProperty (User "root")+			["kill $(cat /var/run/rngd.pid)"]+			`assume` MadeChange  -- another script from wiki.d.o/sbuild ccachePrepared :: Property DebianLike

@@ -362,40 +362,17 @@ 	`requires` Ssh.knownHost hosts "eubackup.kitenet.net" (User "joey")  tmp :: Property (HasInfo + DebianLike)-tmp = propertyList "tmp.kitenet.net" $ props+tmp = propertyList "tmp.joeyh.name" $ props 	& annexWebSite "/srv/git/joey/tmp.git"-		"tmp.kitenet.net"+		"tmp.joeyh.name" 		"26fd6e38-1226-11e2-a75f-ff007033bdba" 		[]-	& twitRss 	& pumpRss --- Twitter, you kill us.-twitRss :: Property DebianLike-twitRss = combineProperties "twitter rss" $ props-	& Git.cloned (User "joey") "git://git.kitenet.net/twitrss.git" dir Nothing-	& check (not <$> doesFileExist (dir </> "twitRss")) compiled-	& feed "http://twitter.com/search/realtime?q=git-annex" "git-annex-twitter"-	& feed "http://twitter.com/search/realtime?q=olduse+OR+git-annex+OR+debhelper+OR+etckeeper+OR+ikiwiki+-ashley_ikiwiki" "twittergrep"-  where-	dir = "/srv/web/tmp.kitenet.net/twitrss"-	crontime = Cron.Times "15 * * * *"-	feed url desc = Cron.job desc crontime (User "joey") dir $-		"./twitRss " ++ shellEscape url ++ " > " ++ shellEscape ("../" ++ desc ++ ".rss")-	compiled = userScriptProperty (User "joey")-		[ "cd " ++ dir-		, "ghc --make twitRss"-		]-		`assume` NoChange-		`requires` Apt.installed-			[ "libghc-xml-dev"-			, "libghc-feed-dev"-			, "libghc-tagsoup-dev"-			]- -- Work around for expired ssl cert.+-- (Obsolete; need to revert this.) pumpRss :: Property DebianLike-pumpRss = Cron.job "pump rss" (Cron.Times "15 * * * *") (User "joey") "/srv/web/tmp.kitenet.net/"+pumpRss = Cron.job "pump rss" (Cron.Times "15 * * * *") (User "joey") "/srv/web/tmp.joeyh.name/" 	"wget https://rss.io.jpope.org/feed/joeyh@identi.ca.atom -O pump.atom.new --no-check-certificate 2>/dev/null; sed 's/ & / /g' pump.atom.new > pump.atom"  ircBouncer :: Property (HasInfo + DebianLike)@@ -681,6 +658,9 @@ 		`describe` "pine configured to use local imap server"  	& Apt.serviceInstalledRunning "mailman"+	-- Override the default http url. (Only affects new lists.)+	& "/etc/mailman/mm_cfg.py" `File.containsLine`+		"DEFAULT_URL_PATTERN = 'https://%s/cgi-bin/mailman/'"  	& Postfix.service ssmtp 

@@ -356,8 +356,8 @@  modKnownHost :: User -> FilePath -> Property UnixLike -> Property UnixLike modKnownHost user f p = p-	`requires` File.ownerGroup f user (userGroup user)-	`requires` File.ownerGroup (takeDirectory f) user (userGroup user)+	`before` File.ownerGroup f user (userGroup user)+	`before` File.ownerGroup (takeDirectory f) user (userGroup user)  -- | Ensures that a local user's authorized_keys contains lines allowing -- logins from a remote user on the specified Host.