diff --git a/CHANGELOG b/CHANGELOG --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,29 @@ +propellor (3.1.2) unstable; urgency=medium + + [ Joey Hess ] + * Ssh.knownHost: Bug fix: Only fix up the owner of the known_hosts + file after it exists. + + [ Sean Whitton ] + * Sbuild.keypairInsecurelyGenerated: Improved to be more robust. + * Pass --allow-unrelated-histories to git merge when run with git 2.9 or + newer. This fixes the /usr/bin/propellor wrapper with this version of git. + * Sbuild.built & Sbuild.builtFor no longer require Sbuild.keypairGenerated. + Transition guide: If you are using sbuild 0.70.0 or newer, you should + `rm -r /var/lib/sbuild/apt-keys`. Otherwise, you should add either + Sbuild.keypairGenerated or Sbuild.keypairInsecurelyGenerated to your host. + * Sbuild haddock improvements: + - State that we don't support squeeze and Buntish older than trusty. + This is due to our enhancements, such as eatmydata. + - State that you need sbuild 0.70.0 or newer to build for stretch. + This is due to gpg2 hitting Debian stretch. + - Explain when a keygen is required. + - Update sample ~/.sbuildrc for sbuild 0.71.0. + - Add hint for customising chroots with propellor. + - Update example usage of System type. + + -- Joey Hess Sun, 28 Aug 2016 14:39:23 -0400 + propellor (3.1.1) unstable; urgency=medium * Haddock build fix. diff --git a/debian/README.Debian b/debian/README.Debian deleted file mode 100644 --- a/debian/README.Debian +++ /dev/null @@ -1,14 +0,0 @@ -The Debian package of propellor ships its full source code because -propellor is configured by rebuilding it, and embraces modification of any -of the source code. - -/usr/bin/propellor is a wrapper which will set up a propellor git -repository in ~/.propellor/, and run ~/.propellor/propellor if it exists. -Edit ~/.propellor/config.hs to configure it. - -Note that upgrading the propellor package will not update your -~/.propellor/ repository. This is because you may have local changes -to the source, or may need to adapt your config.hs to work with the new -version of propellor. Instead, if your ~/.propellor/ is from an older -version of propellor, /usr/bin/propellor will warn that it's out of date, -and tell you how to merge in the changes. diff --git a/debian/changelog b/debian/changelog --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,29 @@ +propellor (3.1.2) unstable; urgency=medium + + [ Joey Hess ] + * Ssh.knownHost: Bug fix: Only fix up the owner of the known_hosts + file after it exists. + + [ Sean Whitton ] + * Sbuild.keypairInsecurelyGenerated: Improved to be more robust. + * Pass --allow-unrelated-histories to git merge when run with git 2.9 or + newer. This fixes the /usr/bin/propellor wrapper with this version of git. + * Sbuild.built & Sbuild.builtFor no longer require Sbuild.keypairGenerated. + Transition guide: If you are using sbuild 0.70.0 or newer, you should + `rm -r /var/lib/sbuild/apt-keys`. Otherwise, you should add either + Sbuild.keypairGenerated or Sbuild.keypairInsecurelyGenerated to your host. + * Sbuild haddock improvements: + - State that we don't support squeeze and Buntish older than trusty. + This is due to our enhancements, such as eatmydata. + - State that you need sbuild 0.70.0 or newer to build for stretch. + This is due to gpg2 hitting Debian stretch. + - Explain when a keygen is required. + - Update sample ~/.sbuildrc for sbuild 0.71.0. + - Add hint for customising chroots with propellor. + - Update example usage of System type. + + -- Joey Hess Sun, 28 Aug 2016 14:39:23 -0400 + propellor (3.1.1) unstable; urgency=medium * Haddock build fix. diff --git a/debian/propellor.README.Debian b/debian/propellor.README.Debian new file mode 100644 --- /dev/null +++ b/debian/propellor.README.Debian @@ -0,0 +1,14 @@ +The Debian package of propellor ships its full source code because +propellor is configured by rebuilding it, and embraces modification of any +of the source code. + +/usr/bin/propellor is a wrapper which will set up a propellor git +repository in ~/.propellor/, and run ~/.propellor/propellor if it exists. +Edit ~/.propellor/config.hs to configure it. + +Note that upgrading the propellor package will not update your +~/.propellor/ repository. This is because you may have local changes +to the source, or may need to adapt your config.hs to work with the new +version of propellor. Instead, if your ~/.propellor/ is from an older +version of propellor, /usr/bin/propellor will warn that it's out of date, +and tell you how to merge in the changes. diff --git a/propellor.cabal b/propellor.cabal --- a/propellor.cabal +++ b/propellor.cabal @@ -1,5 +1,5 @@ Name: propellor -Version: 3.1.1 +Version: 3.1.2 Cabal-Version: >= 1.8 License: BSD2 Maintainer: Joey Hess @@ -22,7 +22,7 @@ contrib/post-merge-hook stack.yaml debian/changelog - debian/README.Debian + debian/propellor.README.Debian debian/compat debian/control debian/copyright diff --git a/src/Propellor/DotDir.hs b/src/Propellor/DotDir.hs --- a/src/Propellor/DotDir.hs +++ b/src/Propellor/DotDir.hs @@ -401,7 +401,17 @@ changeWorkingDirectory tmprepo git ["fetch", distrepo, "--quiet"] git ["reset", "--hard", oldref, "--quiet"] - git ["merge", newref, "-s", "recursive", "-Xtheirs", "--quiet", "-m", "merging upstream version"] + v <- gitVersion + let mergeparams = + [ "merge", newref + , "-s", "recursive" + , "-Xtheirs" + , "--quiet" + , "-m", "merging upstream version" + ] ++ if v >= [2,9] + then [ "--allow-unrelated-histories" ] + else [] + git mergeparams void $ fetchUpstreamBranch tmprepo cleantmprepo diff --git a/src/Propellor/Git.hs b/src/Propellor/Git.hs --- a/src/Propellor/Git.hs +++ b/src/Propellor/Git.hs @@ -3,7 +3,10 @@ import Utility.Process import Utility.Exception import Utility.Directory +import Utility.Misc +import Utility.PartialPrelude +import Data.Maybe import Control.Applicative import Prelude @@ -26,3 +29,13 @@ hasGitRepo :: IO Bool hasGitRepo = doesFileExist ".git/HEAD" + +type Version = [Int] + +gitVersion :: IO Version +gitVersion = extract <$> readProcess "git" ["--version"] + where + extract s = case lines s of + [] -> [] + (l:_) -> mapMaybe readish $ segment (== '.') $ + unwords $ drop 2 $ words l diff --git a/src/Propellor/Property/Sbuild.hs b/src/Propellor/Property/Sbuild.hs --- a/src/Propellor/Property/Sbuild.hs +++ b/src/Propellor/Property/Sbuild.hs @@ -6,52 +6,67 @@ Build and maintain schroots for use with sbuild. +For convenience we set up several enhancements, such as ccache and +eatmydata. This means we have to make several assumptions: + +1. you want to build for a Debian release strictly newer than squeeze, +or for a Buntish release newer than or equal to trusty + +2. if you want to build for Debian stretch or newer, you have sbuild +0.70.0 or newer (there is a backport to jessie) + +The latter is due to the migration from GnuPG v1 to GnuPG v2.1 in +Debian stretch, which older sbuild can't handle. + Suggested usage in @config.hs@: > & Apt.installed ["piuparts", "autopkgtest"] -> & Sbuild.builtFor (System (Debian Unstable) X86_32) -> & Sbuild.piupartsConfFor (System (Debian Unstable) X86_32) -> & Sbuild.updatedFor (System (Debian Unstable) X86_32) `period` Weekly 1 +> & Sbuild.builtFor (System (Debian Linux Unstable) X86_32) +> & Sbuild.piupartsConfFor (System (Debian Linux Unstable) X86_32) +> & Sbuild.updatedFor (System (Debian Linux Unstable) X86_32) `period` Weekly 1 > & Sbuild.usableBy (User "spwhitton") > & Sbuild.shareAptCache > & Schroot.overlaysInTmpfs -In @~/.sbuildrc@: +If you are using sbuild older than 0.70.0, you also need: +> & Sbuild.keypairGenerated + +In @~/.sbuildrc@ (sbuild 0.71.0 or newer): + > $run_piuparts = 1; > $piuparts_opts = [ > '--schroot', -> 'unstable-i386-piuparts', +> '%r-%a-piuparts', > '--fail-if-inadequate', > '--fail-on-broken-symlinks', > ]; > -> $external_commands = { -> 'post-build-commands' => [ -> [ -> 'adt-run', -> '--changes', '%c', -> '---', -> 'schroot', 'unstable-i386-sbuild;', -> -> # if adt-run's exit code is 8 then the package had no tests but -> # this isn't a failure, so catch it -> 'adtexit=$?;', -> 'if', 'test', '$adtexit', '=', '8;', 'then', -> 'exit', '0;', 'else', 'exit', '$adtexit;', 'fi' -> ], -> ], -> }; +> $run_autopkgtest = 1; +> $autopkgtest_root_args = ""; +> $autopkgtest_opts = ["--", "schroot", "%r-%a-sbuild"]; -We use @sbuild-createchroot(1)@ to create a chroot to the specification of -@sbuild-setup(7)@. This differs from the approach taken by picca's Sbuild.hs, -which uses 'Propellor.Property.Debootstrap' to construct the chroot. This is -because we don't want to run propellor inside the chroot in order to keep the -sbuild environment as standard as possible. +We use @sbuild-createchroot(1)@ to create a chroot to the +specification of @sbuild-setup(7)@. This avoids running propellor +inside the chroot to set it up. While that approach is flexible, a +propellor spin pulls in a lot of dependencies. This could defeat +using sbuild to determine if you've included all necessary build +dependencies in your source package control file. + +Nevertheless, the chroot that @sbuild-createchroot(1)@ creates might +not meet your needs. For example, you might need to enable an apt +cacher. In that case you can do something like this in @config.hs@: + +> & Sbuild.built (System (Debian Linux Unstable) X86_32) `before` mySetup +> where +> mySetup = Chroot.provisioned myChroot +> myChroot = Chroot.debootstrapped +> Debootstrap.BuilddD "/srv/chroot/unstable-i386" +> -- the extra configuration you need: +> & Apt.installed ["apt-transport-https"] -} --- If you wanted to do it with Propellor.Property.Debootstrap, note that --- sbuild-createchroot has a --setup-only option +-- Also see the --setup-only option of sbuild-createchroot module Propellor.Property.Sbuild ( -- * Creating and updating sbuild schroots @@ -122,7 +137,6 @@ built :: SbuildSchroot -> Apt.Url -> RevertableProperty DebianLike UnixLike built s@(SbuildSchroot suite arch) mirror = (go - `requires` keypairGenerated `requires` ccachePrepared `requires` installed `requires` overlaysKernel) @@ -149,6 +163,8 @@ `before` commandPrefix , return FailedChange ) + -- TODO we should kill any sessions still using the chroot + -- before destroying it (as suggested by sbuild-destroychroot) deleted = check (not <$> unpopulated (schrootRoot s)) $ property ("no sbuild schroot for " ++ show s) $ do liftIO $ removeChroot $ schrootRoot s @@ -216,7 +232,6 @@ updated s@(SbuildSchroot suite arch) = check (doesDirectoryExist (schrootRoot s)) $ go `describe` ("updated schroot for " ++ show s) - `requires` keypairGenerated `requires` installed where go :: Property DebianLike @@ -340,6 +355,8 @@ usableBy u = User.hasGroup u (Group "sbuild") `requires` installed -- | Generate the apt keys needed by sbuild +-- +-- You only need this if you are using sbuild older than 0.70.0. keypairGenerated :: Property DebianLike keypairGenerated = check (not <$> doesFileExist secKeyFile) $ go `requires` installed @@ -358,15 +375,39 @@ -- | Generate the apt keys needed by sbuild using a low-quality source of -- randomness -- +-- Note that any running rngd will be killed; if you are using rngd, you should +-- arrange for it to be restarted after this property has been ensured. E.g. +-- +-- > & Sbuild.keypairInsecurelyGenerated +-- > `onChange` Systemd.started "my-rngd-service" +-- -- Useful on throwaway build VMs. +-- +-- You only need this if you are using sbuild older than 0.70.0. keypairInsecurelyGenerated :: Property DebianLike keypairInsecurelyGenerated = check (not <$> doesFileExist secKeyFile) go where go :: Property DebianLike go = combineProperties "sbuild keyring insecurely generated" $ props & Apt.installed ["rng-tools"] - & cmdProperty "rngd" ["-r", "/dev/urandom"] `assume` MadeChange + -- If this dir does not exist the sbuild key generation command + -- will fail; the user might have deleted it to work around + -- #831462 + & File.dirExists "/var/lib/sbuild/apt-keys" + -- If there is already an rngd process running we have to kill + -- it, as it might not be feeding to /dev/urandom. We can't + -- kill by pid file because that is not guaranteed to be the + -- default (/var/run/rngd.pid), so we killall + & userScriptProperty (User "root") + [ "start-stop-daemon -q -K -R 10 -o -n rngd" + , "rngd -r /dev/urandom" + ] + `assume` MadeChange & keypairGenerated + -- Kill off the rngd process we spawned + & userScriptProperty (User "root") + ["kill $(cat /var/run/rngd.pid)"] + `assume` MadeChange -- another script from wiki.d.o/sbuild ccachePrepared :: Property DebianLike diff --git a/src/Propellor/Property/SiteSpecific/JoeySites.hs b/src/Propellor/Property/SiteSpecific/JoeySites.hs --- a/src/Propellor/Property/SiteSpecific/JoeySites.hs +++ b/src/Propellor/Property/SiteSpecific/JoeySites.hs @@ -362,40 +362,17 @@ `requires` Ssh.knownHost hosts "eubackup.kitenet.net" (User "joey") tmp :: Property (HasInfo + DebianLike) -tmp = propertyList "tmp.kitenet.net" $ props +tmp = propertyList "tmp.joeyh.name" $ props & annexWebSite "/srv/git/joey/tmp.git" - "tmp.kitenet.net" + "tmp.joeyh.name" "26fd6e38-1226-11e2-a75f-ff007033bdba" [] - & twitRss & pumpRss --- Twitter, you kill us. -twitRss :: Property DebianLike -twitRss = combineProperties "twitter rss" $ props - & Git.cloned (User "joey") "git://git.kitenet.net/twitrss.git" dir Nothing - & check (not <$> doesFileExist (dir "twitRss")) compiled - & feed "http://twitter.com/search/realtime?q=git-annex" "git-annex-twitter" - & feed "http://twitter.com/search/realtime?q=olduse+OR+git-annex+OR+debhelper+OR+etckeeper+OR+ikiwiki+-ashley_ikiwiki" "twittergrep" - where - dir = "/srv/web/tmp.kitenet.net/twitrss" - crontime = Cron.Times "15 * * * *" - feed url desc = Cron.job desc crontime (User "joey") dir $ - "./twitRss " ++ shellEscape url ++ " > " ++ shellEscape ("../" ++ desc ++ ".rss") - compiled = userScriptProperty (User "joey") - [ "cd " ++ dir - , "ghc --make twitRss" - ] - `assume` NoChange - `requires` Apt.installed - [ "libghc-xml-dev" - , "libghc-feed-dev" - , "libghc-tagsoup-dev" - ] - -- Work around for expired ssl cert. +-- (Obsolete; need to revert this.) pumpRss :: Property DebianLike -pumpRss = Cron.job "pump rss" (Cron.Times "15 * * * *") (User "joey") "/srv/web/tmp.kitenet.net/" +pumpRss = Cron.job "pump rss" (Cron.Times "15 * * * *") (User "joey") "/srv/web/tmp.joeyh.name/" "wget https://rss.io.jpope.org/feed/joeyh@identi.ca.atom -O pump.atom.new --no-check-certificate 2>/dev/null; sed 's/ & / /g' pump.atom.new > pump.atom" ircBouncer :: Property (HasInfo + DebianLike) @@ -681,6 +658,9 @@ `describe` "pine configured to use local imap server" & Apt.serviceInstalledRunning "mailman" + -- Override the default http url. (Only affects new lists.) + & "/etc/mailman/mm_cfg.py" `File.containsLine` + "DEFAULT_URL_PATTERN = 'https://%s/cgi-bin/mailman/'" & Postfix.service ssmtp diff --git a/src/Propellor/Property/Ssh.hs b/src/Propellor/Property/Ssh.hs --- a/src/Propellor/Property/Ssh.hs +++ b/src/Propellor/Property/Ssh.hs @@ -356,8 +356,8 @@ modKnownHost :: User -> FilePath -> Property UnixLike -> Property UnixLike modKnownHost user f p = p - `requires` File.ownerGroup f user (userGroup user) - `requires` File.ownerGroup (takeDirectory f) user (userGroup user) + `before` File.ownerGroup f user (userGroup user) + `before` File.ownerGroup (takeDirectory f) user (userGroup user) -- | Ensures that a local user's authorized_keys contains lines allowing -- logins from a remote user on the specified Host.