Commit Graph

1120 Commits

Author SHA1 Message Date
Tim Orling
a2e23f1e20 build(deps): bump gitpython from 3.1.32 to 3.1.37
This release contains another security fix that further improves validation
of symbolic references and thus properly fixes this CVE:
https://github.com/advisories/GHSA-cwvm-v4w8-q58c (CVE-2023-41040).

https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2023-09-29 08:06:53 -07:00
Tim Orling
7b316cddfb layerindex/urls.py: fix submit/thanks/ url
The url returned by the reverse lookup ends in /submit/thanks/ but
the regex was improperly searching for a string without the terminating "/".

Thank you to Pawel Zalewski for reporting the 404 error.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2023-09-29 07:57:59 -07:00
dependabot[bot]
a3a5a209a4 build(deps): bump gitpython from 3.1.30 to 3.1.32
Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.30 to 3.1.32.
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.30...3.1.32)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2023-08-25 13:08:00 -07:00
dependabot[bot]
6b56e5c067 build(deps): bump pillow from 9.2.0 to 9.3.0
Bumps [pillow](https://github.com/python-pillow/Pillow) from 9.2.0 to 9.3.0.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/9.2.0...9.3.0)

---
updated-dependencies:
- dependency-name: pillow
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2023-08-25 13:08:00 -07:00
Chee Yang Lee
7e6854335a requirements.txt: bump gitpython and pillow
bump gitpython and pillow to version with fixes for these CVEs

pillow: CVE-2022-22817 CVE-2022-24303 CVE-2022-45198

gitpython: CVE-2022-24439

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
2023-08-25 13:08:00 -07:00
Robert Yang
5976f9fc68 layerindex/utils.py: Add to baseconfig=True for bb.parse.handle()
Bitbake's api has been changed via:
afb8478d3 parse: Add support for addpylib conf file directive and BB_GLOBAL_PYMODULES

The conf file won't be parsed without baseconfig=True:
bb.parse.ParseError: ParseError at /path/to/oe-core/meta/conf/layer.conf:132: unparsed line: 'addpylib ${LAYERDIR}/lib oe'

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-12-20 08:38:45 -08:00
Tim Orling
0cc6d8eb1f global: replace deprecated distutils
Replace distutils.version.LooseVersion with pkg_resource.parse_version

https://majornetwork.net/2021/05/comparing-version-numbers-in-python/

[YOCTO #14990]

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-12-16 08:59:37 -08:00
Michael Halstead
13c94088b4 Dockerfile: switch to ubuntu:jammy for >python3.8
ubuntu:jammy provides python 3.10.6 which supports current bitbake.
Dropped unneeded python2 packages.
Moved locale generation high to reduce error messages during image building.

Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-12-16 08:59:37 -08:00
Robert Yang
61c857a7df utils.py: Fix for is_commit_ancestor()
The runcmd() would print an "ERROR" on failure which causes confusion since
the failure is expected on old branches, so subprocess.getstatusoutput to fix
the problem.

Minor rewording.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-12-16 08:59:37 -08:00
Robert Yang
2d7906ff3b admin.py: Remove has_delete_permission()
The following commit has added on_delete=models.CASCADE to the ForeignKey:

===
commit 2d526f9b0d
Author: Amber Elliot <amber.n.elliot@intel.com>
Date:   Thu Jun 25 15:57:34 2020 -0700

    Updating models and imports for Django 2.2 upgrade.
===

The on_delete=models.CASCADE will remove the objects which reference the
removed objects, so there will be errors when removing a LayerBranch
with admin permissions:

===
Cannot delete layer branch
Deleting the selected layer branch would result in deleting related objects, but your account doesn't have permission to delete the following types of objects:

Append
distro
===

This is because has_delete_permission() always return False, remove it to use
Django's implementation to fix the problem.

Minor rewording.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-12-16 08:59:37 -08:00
Robert Yang
edb574ae7e utils.py: Use get_layer_var() to get BBFILE_COLLECTIONS
The commit 38e6288c7d has added oe-core to
BBLAYERS by default, and then there will be multiple BBFILE_COLLECTIONS which
causes update.py failure to update layers (most of the dependencies or
recommends are missing), use get_layer_var() to get BBFILE_COLLECTIONS to fix
the problem since it can ignore the extra oe-core from BBFILE_COLLECTIONS.

Fix minor typos. Minor rewording.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-12-16 08:59:37 -08:00
Michael Halstead
c7b02096e0 Dockerfile: add captcha dependencies
The current version of django-simple-captcha requires libz and freetype
development libraries.

Refactor to apply. Fix typo. Fix previous mixed use of space vs tab.

Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-12-16 08:59:37 -08:00
Tim Orling
d8ab1beebe layerindex/utils.py: ignore 'core' in BBFILES_COLLECTIONS
Many layers append BBFILE_COLLECTIONS and therefore have 'core <layer>'

During update.py, this means we are likely not handling the collection we
expect:

WARNING: /opt/workdir/git___git_openembedded_org_meta-openembedded/meta-oe: multiple collections found, handling first one (core) only
BBFILE_COLLECTIONS = "core"

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-04-28 08:15:22 -07:00
Tim Orling
242db27bf9 recipe{desc,parse}.py: BB_ENV_PASSTHROUGH_ADDITIONS
ERROR: Variable BB_ENV_EXTRAWHITE has been renamed to BB_ENV_PASSTHROUGH_ADDITIONS
ERROR: Variable BB_ENV_EXTRAWHITE from the shell environment has been renamed to BB_ENV_PASSTHROUGH_ADDITIONS
ERROR: Exiting to allow enviroment variables to be corrected

Replace BB_ENV_EXTRAWHITE with new variable BB_ENV_PASSTHROUGH_ADDITIONS

In order to be backward compatible with older branches, we must first check
for the presence of the bitbake commit which implemented the variable name
change, using layerindex.utils.is_commit_ancestor().

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-04-28 08:15:22 -07:00
Tim Orling
ee30a2e037 layerindex/utils.py: add is_commit_ancestor check
Add a helper function to check if a given SHA1 hash is an ancestor in
the currently checked out branch, using:

git merge-branch --is-ancestor <commit> HEAD

NOTE: This will not match commits which have been cherry-picked.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-04-28 08:15:22 -07:00
Tim Orling
4dd7f0ee8f layerindex/models.py: add Inactive-Upstream
Add the newish Inactive-Upstream upstream status.

Add 0046_alter_patch_status.py migration.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>

layerindex/migrations: update patch status

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-04-18 12:56:51 -07:00
Tim Orling
7ef8152266 layerindex/urls.py: fix about url pattern
The url pattern was not including the trailing /

[YOCTO #14445]

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-04-18 12:56:51 -07:00
Tim Orling
796d2455bb templates/*: staticfiles -> static
In Django 3.0 the staticfiles tag was changed to static

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 23:36:22 -08:00
Tim Orling
f074aece70 requirements.txt: bump all to latest
Run pip-upgrade and update all to latest

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 21:16:46 -08:00
Tim Orling
88b13592c3 Dockerfile: add back python2 dependencies
We have some layers and especially older releases that still support
python2. Add python2 dependencies back to the container so that the
older releases still function.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 21:00:38 -08:00
Tim Orling
722f1f3a37 rrs: add 0030_alter_recipeupgrade_maintainer.py miagration
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 21:00:36 -08:00
Tim Orling
c99a1ed4e7 Dockerfile: fix warnings
* Define LANGUAGE to quiet perl warnings
* Set DEBIAN_FRONTEND=noninteractive before apt call to quiet TERM/Dialog
  warnings

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 21:00:33 -08:00
Tim Orling
743c8f449d rrs/admin.py: drop curry import
Dropped in Django 3.0 [1]
Suggested replacements are functools.partial() or
functools.partialmethod() [2]

[1] https://docs.djangoproject.com/en/4.0/releases/3.0/
[2] 5b1c389603

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 21:00:14 -08:00
Tim Orling
8f648093c7 README.devel: update versions
This updated code-base should be compatible with
Django 3.1 and obviously 3.2 (but not 3.0 or earlier).

Django 3.2 requires Python 3.6+.

With the upgrade to Celery 5, it is safer to recommend
RabbitMQ 3.8.x, since that is what we are using.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 21:00:03 -08:00
Tim Orling
f1dbcde4c4 docker-compose: fix celery
In celery 5, the --workdir argument must come
before the 'worker' subcommand.

Without this, celery cannot load the layerindex
module and this causes the celery container to
continually restart.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:59:54 -08:00
Tim Orling
67679306b0 settings: set DEFAULT_AUTO_FIELD
New in Django 3.2

To quiet warnings, set DEFAULT_AUTO_FIELD to the
default value 'django.db.models.AutoField'

NOTE: The default value for newly created Django 3.2
      projects is django.db.models.BigAutoField, but
      this causes the need for a migration in 'captcha'.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:59:44 -08:00
Tim Orling
314d29deda requirements.txt: bump to Django 3.2 LTS
Upgrade to the latest Django 3.2.x LTS for
extended support up until April 2024.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:59:31 -08:00
Tim Orling
08d7f96e10 requirements.txt: update all to latest
Since we are on a "modern" version of Python in
Debian buster container (3.7) and a modern version
of Django (3.1.x) we should be able to run with
the latest of all dependencies.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:59:22 -08:00
Tim Orling
ecd1005ae2 docker-compose: bump mariadb to 10.3
10.2 was based on Ubuntu bionic 18.04,
bumping to 10.3 as it is the first release
on Ubuntu focal 20.04

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:59:10 -08:00
Tim Orling
49b41802e4 requirements.txt: bump to Django 3.1
Another incremental upgrade towards 3.2 LTS

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:59:02 -08:00
Tim Orling
a027959343 Updates for Django 3.0
* Update requirements.txt versions
  - Mostly update to latest pre-Django 3.1 versions
* Fix deprecated axes.backends.AxesModelBackend
  - settings.py
  - docker/settings.py
* Fix template syntax 'staticfiles' -> 'static'
  - base.html
* Add migrations for layerbranch classicrecipe

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:58:52 -08:00
Tim Orling
094c89bc70 requirements.txt: bump to Django 3.0
Incremental upgrade towards 3.2 LTS version.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:58:40 -08:00
Tim Orling
4e857f68f4 layerindex/*: make all shebangs python3
Several scripts still had /usr/bin/env python

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:58:28 -08:00
Tim Orling
1f41512758 dockersetup.py: letsencrypt 2048 bit rsa
The minimum length for an RSA pem is 2048 for the dummy cert.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:58:14 -08:00
Tim Orling
f9c640a7c0 Dockerfile: cleanup, install python3-wheel
Remove duplicate python3-pip, etc. lines
Need python3-wheel for bdist_wheel command

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
2022-01-13 20:57:42 -08:00
Tim Orling
df4a764d59 dockersetup.py: fix EMAIL_USE_SSL/TLS
Need to concatenate str(boolean), not bool

Signed-off-by: Tim Orling <timothy.t.orling@intel.com>
2022-01-13 09:15:50 -08:00
Paul Eggleton
ccc1fa775b Report charset for text & CSV views
I noticed in the branch comparison plain text view ("Plain text" button
in the Tools -> Branch Comparison page) that in current versions of
Firefox the ellipses were coming through corrupted, though they looked
fine in the HTML version, and it turns out this is because I wasn't
specifying a character set encoding. It should be UTF-8, so add a
charset to the content type stating as such for this and other similar
views.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2021-10-20 11:07:46 +13:00
Paul Eggleton
308805f04a about: add Amber & Tim to contributors list
Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2021-10-20 10:20:31 +13:00
Paul Eggleton
fdc8209b29 rrs: make changes to support Django 2.2
Removed obsolete references to django.core.urlresolvers. Added the
newly required on_delete parameters to foreign key relationships in
models.py and in all migrations.

(Amber Elliot's 2d526f9b0d served as a
reference for these changes).

Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2021-10-20 10:02:58 +13:00
Paul Eggleton
e01254dd0d utils: ensure we show error messages on server startup
If a BBHandledException occurs that means some error was logged, so we
need to handle any pending events so that we can actually have the error
logged. Tinfoil should really be doing this for us but at this stage in
the release we can't really fix this there, so do it here for now.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2021-10-20 10:02:56 +13:00
Paul Eggleton
38e6288c7d update: fix setup of BBLAYERS
So with honister / current master we can no longer get away with
bypassing BBLAYERS - it now needs to point to the core layer at
minimum. This is fine, we just need to skip parsing layer.conf if we're
parsing the core layer or we get some extra warnings we don't need.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2021-10-20 10:02:53 +13:00
Paul Eggleton
fe0bd7ddf5 README.devel: update versions
Update version requirements in line with recent changes.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2021-10-20 10:02:50 +13:00
Paul Eggleton
848ca10920 requirements.txt: set proper version restriction for Django
Without a comma, pip3 will currently install Django 4.0 which does not
work.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.microsoft.com>
2021-10-20 10:02:46 +13:00
Meh Mbeh Ida Delphine
2314fb2811 Add SPDX license headers to layerindex-web source files
Added SPDX identifiers to all .py files except those in migrations directory.

Fixes: [YOCTO #13527]

Signed-off-by: Meh Mbeh Ida Delphine <idadelm@gmail.com>
Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
2021-04-21 08:22:51 +12:00
Tim Orling
3b2b1f4948 docker/settings.py: MIDDLEWARE
The docker/settings.py file also needs the change from
"Changing MIDDLEWARE_CLASSES to MIDDLEWARE."

Signed-off-by: Tim Orling <ticotimo@gmail.com>
Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
2020-06-30 05:37:09 +12:00
Tim Orling
2da03f4711 Dockerfile: debian 10 "buster" and drop python2
Debian 10 "buster" actually has Django 2.2 available
python2 is now EOL, so drop all usage

Signed-off-by: Tim Orling <ticotimo@gmail.com>
Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
2020-06-30 05:37:09 +12:00
Amber Elliot
6c2f153784 requirements.txt: Updating Django requirement to the 2.2 LTS release.
Signed-off-by: Amber Elliot <amber.n.elliot@intel.com>
Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
2020-06-30 05:37:09 +12:00
Amber Elliot
7482d57175 Replacing is_authenticated() with is_authenticated for Django upgrade.
Signed-off-by: Amber Elliot <amber.n.elliot@intel.com>
Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
2020-06-30 05:37:09 +12:00
Amber Elliot
4e35c18f94 settings.py: Replacing MIDDLEWARE_CLASSES with MIDDLEWARE for Django 2.2 upgrade.
Signed-off-by: Amber Elliot <amber.n.elliot@intel.com>
Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
2020-06-30 05:37:09 +12:00
Amber Elliot
2d526f9b0d Updating models and imports for Django 2.2 upgrade.
Removed all obsolete references to django.core.urlresolvers. Added the
newly required on_delete fields to foreign key relationships in models.py
and in all migrations.

Signed-off-by: Amber Elliot  <amber.n.elliot@intel.com>
Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
2020-06-30 05:37:09 +12:00