summaryrefslogtreecommitdiffstats
path: root/services/packages
Commit message (Collapse)AuthorAgeFilesLines
* remove util.OptionalBool and related functions (#29513)65432024-03-023-8/+8
| | | | | | and migrate affected code _last refactoring bits to replace **util.OptionalBool** with **optional.Option[bool]**_
* Integrate alpine `noarch` packages into other architectures index (#29137)KN4CK3R2024-02-251-8/+48
| | | | | | | | | | | | Fixes #26691 Revert #24972 The alpine package manager expects `noarch` packages in the index of other architectures too. --------- Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Use general token signing secret (#29205)wxiaoguang2024-02-181-2/+2
| | | Use a clearly defined "signing secret" for token signing.
* Fix debian InRelease Acquire-By-Hash newline (#29204)Robin Schoonover2024-02-171-1/+1
| | | | | | | | | | | | | | | | There is a missing newline when generating the debian apt repo InRelease file, which results in output like: ``` [...] Date: Wed, 14 Feb 2024 05:03:01 UTC Acquire-By-Hash: yesMD5Sum: 51a518dbddcd569ac3e0cebf330c800a 3018 main-dev/binary-amd64/Packages [...] ``` It appears this would probably result in apt ignoring the Acquire-By-Hash setting and not using the by-hash functionality, although I'm not sure how to confirm it.
* Propagate install_if and provider_priority to APKINDEX (#28899)Sergey Bugaev2024-02-051-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves https://github.com/go-gitea/gitea/issues/28704 Example of an entry in the generated `APKINDEX` file: ``` C:Q1xCO3H9LTTEbhKt9G1alSC87I56c= P:hello V:2.12-r1 A:x86_64 T:The GNU Hello program produces a familiar, friendly greeting U:https://www.gnu.org/software/hello/ L:GPL-3.0-or-later S:15403 I:36864 o:hello m: t:1705934118 D:so:libc.musl-x86_64.so.1 p:cmd:hello=2.12-r1 i:foobar=1.0 !baz k:42 ``` the `i:` and `k:` entries are new. --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Fix some RPM registry flaws (#28782)KN4CK3R2024-01-192-17/+57
| | | | | | | | | | | | | | | | | | | Related #26984 (https://github.com/go-gitea/gitea/pull/26984#issuecomment-1889588912) Fix admin cleanup message. Fix models `Get` not respecting default values. Rebuild RPM repository files after cleanup. Do not add RPM group to package version name. Force stable sorting of Alpine/Debian/RPM repository data. Fix missing deferred `Close`. Add tests for multiple RPM groups. Removed non-cached `ReplaceAllStringRegex`. If there are multiple groups available, it's stated in the package installation screen: ![grafik](https://github.com/go-gitea/gitea/assets/1666336/8f132760-882c-4ab8-9678-77e47dfc4415)
* Fix reverting a merge commit failing (#28794)Mihir Joshi2024-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #22236 --- Error occurring currently while trying to revert commit using read-tree -m approach: > 2022/12/26 16:04:43 ...rvices/pull/patch.go:240:AttemptThreeWayMerge() [E] [63a9c61a] Unable to run read-tree -m! Error: exit status 128 - fatal: this operation must be run in a work tree > - fatal: this operation must be run in a work tree We need to clone a non-bare repository for `git read-tree -m` to work. https://github.com/go-gitea/gitea/commit/bb371aee6ecf5e570cdf7b5f7f0d6f47a607a325 adds support to create a non-bare cloned temporary upload repository. After cloning a non-bare temporary upload repository, we [set default index](https://github.com/go-gitea/gitea/blob/main/services/repository/files/cherry_pick.go#L37) (`git read-tree HEAD`). This operation ends up resetting the git index file (see investigation details below), due to which, we need to call `git update-index --refresh` afterward. Here's the diff of the index file before and after we execute SetDefaultIndex: https://www.diffchecker.com/hyOP3eJy/ Notice the **ctime**, **mtime** are set to 0 after SetDefaultIndex. You can reproduce the same behavior using these steps: ```bash $ git clone https://try.gitea.io/me-heer/test.git -s -b main $ cd test $ git read-tree HEAD $ git read-tree -m 1f085d7ed8 1f085d7ed8 9933caed00 error: Entry '1' not uptodate. Cannot merge. ``` After which, we can fix like this: ``` $ git update-index --refresh $ git read-tree -m 1f085d7ed8 1f085d7ed8 9933caed00 ```
* Support for grouping RPMs using paths (#26984)Exploding Dragon2024-01-121-22/+25
| | | | | | | | | | | | The current rpm repository places all packages in the same repository, and different systems (el7,f34) may hit packages that do not belong to this distribution ( #25304 ) , which now supports grouping of rpm. ![图片](https://github.com/go-gitea/gitea/assets/33776693/d1e1d99f-7799-4b2b-a19b-cb2a5c692914) Fixes #25304 . Fixes #27056 . Refactor: [#25866](https://github.com/go-gitea/gitea/pull/25866)
* Fix alpine package files are not rebuilt (#28638)Nanguan Lin2023-12-311-0/+5
| | | | | I noticed the `BuildAllRepositoryFiles` function under the Alpine folder is unused and I thought it was a bug. But I'm not sure about this. Was it on purpose?
* Adjust object format interface (#28469)Lunny Xiao2023-12-171-1/+1
| | | | | | | - Remove `ObjectFormatID` - Remove function `ObjectFormatFromID`. - Use `Sha1ObjectFormat` directly but not a pointer because it's an empty struct. - Store `ObjectFormatName` in `repository` struct
* Abstract hash function usage (#28138)Adam Majer2023-12-131-1/+1
| | | | | | Refactor Hash interfaces and centralize hash function. This will allow easier introduction of different hash function later on. This forms the "no-op" part of the SHA256 enablement patch.
* Fix possible nil pointer access (#28428)KN4CK3R2023-12-124-28/+14
| | | | There could be a nil pointer exception if the file is not found because that specific error is suppressed but not handled.
* Fix RPM/Debian signature key creation (#28352)KN4CK3R2023-12-052-4/+3
| | | | | | | Fixes #28324 The name parameter can't contain some characters (https://github.com/keybase/go-crypto/blob/master/openpgp/keys.go#L680) but is optional. Therefore just use an empty string.
* Revert "packages: Calculate package size quota using package creator ID ↵Lunny Xiao2023-11-141-1/+3
| | | | | instead of owner ID (#28007)" (#28049) This reverts commit #28007 60522fc96f1fa4675e95010e4b1535e0eac21910.
* packages: Calculate package size quota using package creator ID instead of ↵Danila Fominykh2023-11-141-3/+1
| | | | | | | | | | | | | | | | | | | | owner ID (#28007) Changed behavior to calculate package quota limit using package `creator ID` instead of `owner ID`. Currently, users are allowed to create an unlimited number of organizations, each of which has its own package limit quota, resulting in the ability for users to have unlimited package space in different organization scopes. This fix will calculate package quota based on `package version creator ID` instead of `package version owner ID` (which might be organization), so that users are not allowed to take more space than configured package settings. Also, there is a side case in which users can publish packages to a specific package version, initially published by different user, taking that user package size quota. Version in fix should be better because the total amount of space is limited to the quota for users sharing the same organization scope.
* List all Debian package versions in `Packages` (#27786)KN4CK3R2023-10-291-7/+8
| | | | | | Closes #27783 This PR lists all and not only the latest package versions in the `Packages` index.
* Close all hashed buffers (#27787)KN4CK3R2023-10-253-0/+18
| | | | Add missing `.Close()` calls. The current code does not delete the temporary files if the data grows over 32mb.
* Do not force creation of _cargo-index repo on publish (#27266)merlleu2023-10-242-5/+11
| | | | | | | | | | | | | | | | | | | | | | Hello there, Cargo Index over HTTP is now prefered over git for package updates: we should not force users who do not need the GIT repo to have the repo created/updated on each publish (it can still be created in the packages settings). The current behavior when publishing is to check if the repo exist and create it on the fly if not, then update it's content. Cargo HTTP Index does not rely on the repo itself so this will be useless for everyone not using the git protocol for cargo registry. This PR only disable the creation on the fly of the repo when publishing a crate. This is linked to #26844 (error 500 when trying to publish a crate if user is missing write access to the repo) because it's now optional. --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-254-50/+55
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-153-19/+20
| | | Next step of #27065
* move repository deletion to service layer (#26948)Lunny Xiao2023-09-081-1/+1
| | | Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Move createrepository from module to service layer (#26927)Lunny Xiao2023-09-061-2/+2
| | | | Repository creation depends on many models, so moving it to service layer is better.
* Move notification interface to services layer (#26915)Lunny Xiao2023-09-051-4/+4
| | | Extract from #22266
* Reduce some allocations in type conversion (#26772)Chongyi Zheng2023-08-291-1/+1
|
* Add auth-required to config.json for Cargo http registry (#26729)merlleu2023-08-281-6/+9
| | | | | | | | | | | | | | | | | | | | | | | Cargo registry-auth feature requires config.json to have a property auth-required set to true in order to send token to all registry requests. This is ok for git index because you can manually edit the config.json file to add the auth-required, but when using sparse (setting index url to "sparse+https://git.example.com/api/packages/{owner}/cargo/"), the config.json is dynamically rendered, and does not reflect changes to the config.json file in the repo. I see two approaches: - Serve the real config.json file when fetching the config.json on the cargo service. - Automatically detect if the registry requires authorization. (This is what I implemented in this PR). What the PR does: - When a cargo index repository is created, on the config.json, set auth-required to wether or not the repository is private. - When the cargo/config.json endpoint is called, set auth-required to wether or not the request was authorized using an API token.
* Allow package cleanup from admin page (#25307)KN4CK3R2023-08-081-4/+22
| | | | | | | | | | | | | | | Until now expired package data gets deleted daily by a cronjob. The admin page shows the size of all packages and the size of unreferenced data. The users (#25035, #20631) expect the deletion of this data if they run the cronjob from the admin page but the job only deletes data older than 24h. This PR adds a new button which deletes all expired data. ![grafik](https://github.com/go-gitea/gitea/assets/1666336/b3e35d73-9496-4fa7-a20c-e5d30b1f6850) --------- Co-authored-by: silverwind <me@silverwind.io>
* Prevent newline errors with Debian packages (#26332)KN4CK3R2023-08-051-1/+1
| | | Fixes #26313
* Fix version in rpm repodata/primary.xml.gz (#26009)Peter Verraedt2023-07-211-3/+3
| | | | | | | | The version listed in rpm repodata should only contain the rpm version (1.0.0) and not the combination of version and release (1.0.0-2). We correct this behaviour in primary.xml.gz, filelists.xml.gz and others.xml.gz. Signed-off-by: Peter Verraedt <peter@verraedt.be>
* Bump github.com/golang-jwt/jwt to v5 (#25975)harryzcy2023-07-191-1/+1
| | | | | | | | | | | | | | | | Bumping `github.com/golang-jwt/jwt` from v4 to v5. `github.com/golang-jwt/jwt` v5 is bringing some breaking changes: - standard `Valid()` method on claims is removed. It's replaced by `ClaimsValidator` interface implementing `Validator()` method instead, which is called after standard validation. Gitea doesn't seem to be using this logic. - `jwt.Token` has a field `Valid`, so it's checked in `ParseToken` function in `services/auth/source/oauth2/token.go` --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Replace `interface{}` with `any` (#25686)silverwind2023-07-042-2/+2
| | | | | Result of running `perl -p -i -e 's#interface\{\}#any#g' **/*` and `make fmt`. Basically the same [as golang did](https://github.com/golang/go/commit/2580d0e08d5e9f979b943758d3c49877fb2324cb).
* Add direct serving of package content (#25543)KN4CK3R2023-07-031-40/+34
| | | | | | | Fixes #24723 Direct serving of content aka HTTP redirect is not mentioned in any of the package registry specs but lots of official registries do that so it should be supported by the usual clients.
* Add CRAN package registry (#22331)KN4CK3R2023-05-221-0/+2
| | | | | This PR adds a [CRAN](https://cran.r-project.org/) package registry. ![grafik](https://user-images.githubusercontent.com/1666336/210450039-d6fa6f77-20cd-4741-89a8-1624def267f7.png)
* Add Go package registry (#24687)KN4CK3R2023-05-141-0/+2
| | | | | | | Fixes #7608 This PR adds a Go package registry usable with the Go proxy protocol. ![grafik](https://github.com/go-gitea/gitea/assets/1666336/328feb5c-3df2-4f9d-8eae-fe3126d14c37)
* Add Alpine package registry (#23714)KN4CK3R2023-05-122-0/+371
| | | | | | | | | | | | | | | | | | This PR adds an Alpine package registry. You can follow [this tutorial](https://wiki.alpinelinux.org/wiki/Creating_an_Alpine_package) to build a *.apk package for testing. This functionality is similar to the Debian registry (#22854) and therefore shares some methods. I marked this PR as blocked because it should be merged after #22854. ![grafik](https://user-images.githubusercontent.com/1666336/227779595-b76163aa-eea1-4a79-9583-775c24ad74e8.png) --------- Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io>
* Add RPM registry (#23380)KN4CK3R2023-05-053-39/+644
| | | | | | | | | | | | | | | Fixes #20751 This PR adds a RPM package registry. You can follow [this tutorial](https://opensource.com/article/18/9/how-build-rpm-packages) to build a *.rpm package for testing. This functionality is similar to the Debian registry (#22854) and therefore shares some methods. I marked this PR as blocked because it should be merged after #22854. ![grafik](https://user-images.githubusercontent.com/1666336/223806549-d8784fd9-9d79-46a2-9ae2-f038594f636a.png)
* Implement Cargo HTTP index (#24452)KN4CK3R2023-05-031-10/+26
| | | | | | | | | | | | | | | | This implements the HTTP index [RFC](https://rust-lang.github.io/rfcs/2789-sparse-index.html) for Cargo registries. Currently this is a preview feature and you need to use the nightly of `cargo`: `cargo +nightly -Z sparse-registry update` See https://github.com/rust-lang/cargo/issues/9069 for more information. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Add Debian package registry (#24426)KN4CK3R2023-05-023-13/+487
| | | | | | | | | | | | | | | | | | | | | | | | Co-authored-by: @awkwardbunny This PR adds a Debian package registry. You can follow [this tutorial](https://www.baeldung.com/linux/create-debian-package) to build a *.deb package for testing. Source packages are not supported at the moment and I did not find documentation of the architecture "all" and how these packages should be treated. ![grafik](https://user-images.githubusercontent.com/1666336/218126879-eb80a866-775c-4c8e-8529-5797203a64e6.png) Part of #20751. Revised copy of #22854. --------- Co-authored-by: Brian Hong <brian@hongs.me> Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Giteabot <teabot@gitea.io>
* Revert "Add Debian package registry" (#24412)Yarden Shoham2023-04-283-487/+13
| | | Reverts go-gitea/gitea#22854
* Add Debian package registry (#22854)KN4CK3R2023-04-283-13/+487
| | | | | | | | | | | | | | Co-authored-by: @awkwardbunny This PR adds a Debian package registry. You can follow [this tutorial](https://www.baeldung.com/linux/create-debian-package) to build a *.deb package for testing. Source packages are not supported at the moment and I did not find documentation of the architecture "all" and how these packages should be treated. --------- Co-authored-by: Brian Hong <brian@hongs.me> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Introduce path Clean/Join helper functions (#23495)wxiaoguang2023-03-211-3/+1
| | | | | | | | | | | | | | | Since #23493 has conflicts with latest commits, this PR is my proposal for fixing #23371 Details are in the comments And refactor the `modules/options` module, to make it always use "filepath" to access local files. Benefits: * No need to do `util.CleanPath(strings.ReplaceAll(p, "\\", "/"))), "/")` any more (not only one before) * The function behaviors are clearly defined
* Add Swift package registry (#22404)KN4CK3R2023-03-131-0/+2
| | | | | | This PR adds a [Swift](https://www.swift.org/) package registry. ![grafik](https://user-images.githubusercontent.com/1666336/211842523-07521cbd-8fb6-400f-820c-ee8048b05ae8.png)
* Use CleanPath instead of path.Clean (#23371)Lunny Xiao2023-03-081-2/+2
| | | As title.
* Use import of OCI structs (#22765)KN4CK3R2023-02-061-2/+3
| | | | | | Fixes #22758 Otherwise we would need to rewrite the structs in `oci.go`.
* Add Chef package registry (#22554)KN4CK3R2023-02-061-0/+2
| | | | | | | | | | | | | This PR implements a [Chef registry](https://chef.io/) to manage cookbooks. This package type was a bit complicated because Chef uses RSA signed requests as authentication with the registry. ![grafik](https://user-images.githubusercontent.com/1666336/213747995-46819fd8-c3d6-45a2-afd4-a4c3c8505a4a.png) ![grafik](https://user-images.githubusercontent.com/1666336/213748145-d01c9e81-d4dd-41e3-a3cc-8241862c3166.png) Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add Cargo package registry (#21888)KN4CK3R2023-02-053-119/+446
| | | | | | | | | | | | | | | | | | This PR implements a [Cargo registry](https://doc.rust-lang.org/cargo/) to manage Rust packages. This package type was a little bit more complicated because Cargo needs an additional Git repository to store its package index. Screenshots: ![grafik](https://user-images.githubusercontent.com/1666336/203102004-08d812ac-c066-4969-9bda-2fed818554eb.png) ![grafik](https://user-images.githubusercontent.com/1666336/203102141-d9970f14-dca6-4174-b17a-50ba1bd79087.png) ![grafik](https://user-images.githubusercontent.com/1666336/203102244-dc05743b-78b6-4d97-998e-ef76341a978f.png) --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add Conda package registry (#22262)KN4CK3R2023-02-011-0/+2
| | | This PR adds a [Conda](https://conda.io/) package registry.
* Check quota limits for container uploads (#22450)KN4CK3R2023-01-291-4/+8
| | | | The test coverage has revealed that container packages were not checked against the quota limits.
* Display unreferenced packages total size in package admin panel (#22498)Lunny Xiao2023-01-181-2/+2
|
* refactor auth interface to return error when verify failure (#22119)Lunny Xiao2022-12-281-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | This PR changed the Auth interface signature from `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User` to `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)`. There is a new return argument `error` which means the verification condition matched but verify process failed, we should stop the auth process. Before this PR, when return a `nil` user, we don't know the reason why it returned `nil`. If the match condition is not satisfied or it verified failure? For these two different results, we should have different handler. If the match condition is not satisfied, we should try next auth method and if there is no more auth method, it's an anonymous user. If the condition matched but verify failed, the auth process should be stop and return immediately. This will fix #20563 Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Jason Song <i@wolfogre.com>
* Update gitea-vet to check FSFE REUSE (#22004)Jason Song2022-12-021-2/+1
| | | | | | | | | | | | | Related to: - #21840 - https://gitea.com/gitea/gitea-vet/pulls/21 What it looks like when it's working: https://drone.gitea.io/go-gitea/gitea/64040/1/5 All available SPDX license identifiers: [SPDX License List](https://spdx.org/licenses/). Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-23 18:16:18 +0000