123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329 |
- // Copyright 2023 The Gitea Authors. All rights reserved.
- // SPDX-License-Identifier: MIT
-
- package alpine
-
- import (
- "archive/tar"
- "bytes"
- "compress/gzip"
- "context"
- "crypto"
- "crypto/rand"
- "crypto/rsa"
- "crypto/sha1"
- "crypto/x509"
- "encoding/hex"
- "encoding/pem"
- "errors"
- "fmt"
- "io"
- "strings"
-
- packages_model "code.gitea.io/gitea/models/packages"
- alpine_model "code.gitea.io/gitea/models/packages/alpine"
- user_model "code.gitea.io/gitea/models/user"
- "code.gitea.io/gitea/modules/json"
- packages_module "code.gitea.io/gitea/modules/packages"
- alpine_module "code.gitea.io/gitea/modules/packages/alpine"
- "code.gitea.io/gitea/modules/util"
- packages_service "code.gitea.io/gitea/services/packages"
- )
-
- const IndexFilename = "APKINDEX.tar.gz"
-
- // GetOrCreateRepositoryVersion gets or creates the internal repository package
- // The Alpine registry needs multiple index files which are stored in this package.
- func GetOrCreateRepositoryVersion(ctx context.Context, ownerID int64) (*packages_model.PackageVersion, error) {
- return packages_service.GetOrCreateInternalPackageVersion(ctx, ownerID, packages_model.TypeAlpine, alpine_module.RepositoryPackage, alpine_module.RepositoryVersion)
- }
-
- // GetOrCreateKeyPair gets or creates the RSA keys used to sign repository files
- func GetOrCreateKeyPair(ctx context.Context, ownerID int64) (string, string, error) {
- priv, err := user_model.GetSetting(ctx, ownerID, alpine_module.SettingKeyPrivate)
- if err != nil && !errors.Is(err, util.ErrNotExist) {
- return "", "", err
- }
-
- pub, err := user_model.GetSetting(ctx, ownerID, alpine_module.SettingKeyPublic)
- if err != nil && !errors.Is(err, util.ErrNotExist) {
- return "", "", err
- }
-
- if priv == "" || pub == "" {
- priv, pub, err = util.GenerateKeyPair(4096)
- if err != nil {
- return "", "", err
- }
-
- if err := user_model.SetUserSetting(ctx, ownerID, alpine_module.SettingKeyPrivate, priv); err != nil {
- return "", "", err
- }
-
- if err := user_model.SetUserSetting(ctx, ownerID, alpine_module.SettingKeyPublic, pub); err != nil {
- return "", "", err
- }
- }
-
- return priv, pub, nil
- }
-
- // BuildAllRepositoryFiles (re)builds all repository files for every available distributions, components and architectures
- func BuildAllRepositoryFiles(ctx context.Context, ownerID int64) error {
- pv, err := GetOrCreateRepositoryVersion(ctx, ownerID)
- if err != nil {
- return err
- }
-
- // 1. Delete all existing repository files
- pfs, err := packages_model.GetFilesByVersionID(ctx, pv.ID)
- if err != nil {
- return err
- }
-
- for _, pf := range pfs {
- if err := packages_model.DeleteAllProperties(ctx, packages_model.PropertyTypeFile, pf.ID); err != nil {
- return err
- }
- if err := packages_model.DeleteFileByID(ctx, pf.ID); err != nil {
- return err
- }
- }
-
- // 2. (Re)Build repository files for existing packages
- branches, err := alpine_model.GetBranches(ctx, ownerID)
- if err != nil {
- return err
- }
- for _, branch := range branches {
- repositories, err := alpine_model.GetRepositories(ctx, ownerID, branch)
- if err != nil {
- return err
- }
- for _, repository := range repositories {
- architectures, err := alpine_model.GetArchitectures(ctx, ownerID, repository)
- if err != nil {
- return err
- }
- for _, architecture := range architectures {
- if err := buildPackagesIndex(ctx, ownerID, pv, branch, repository, architecture); err != nil {
- return fmt.Errorf("failed to build repository files [%s/%s/%s]: %w", branch, repository, architecture, err)
- }
- }
- }
- }
-
- return nil
- }
-
- // BuildSpecificRepositoryFiles builds index files for the repository
- func BuildSpecificRepositoryFiles(ctx context.Context, ownerID int64, branch, repository, architecture string) error {
- pv, err := GetOrCreateRepositoryVersion(ctx, ownerID)
- if err != nil {
- return err
- }
-
- return buildPackagesIndex(ctx, ownerID, pv, branch, repository, architecture)
- }
-
- type packageData struct {
- Package *packages_model.Package
- Version *packages_model.PackageVersion
- Blob *packages_model.PackageBlob
- VersionMetadata *alpine_module.VersionMetadata
- FileMetadata *alpine_module.FileMetadata
- }
-
- type packageCache = map[*packages_model.PackageFile]*packageData
-
- // https://wiki.alpinelinux.org/wiki/Apk_spec#APKINDEX_Format
- func buildPackagesIndex(ctx context.Context, ownerID int64, repoVersion *packages_model.PackageVersion, branch, repository, architecture string) error {
- pfs, _, err := packages_model.SearchFiles(ctx, &packages_model.PackageFileSearchOptions{
- OwnerID: ownerID,
- PackageType: packages_model.TypeAlpine,
- Query: "%.apk",
- Properties: map[string]string{
- alpine_module.PropertyBranch: branch,
- alpine_module.PropertyRepository: repository,
- alpine_module.PropertyArchitecture: architecture,
- },
- })
- if err != nil {
- return err
- }
-
- // Delete the package indices if there are no packages
- if len(pfs) == 0 {
- pf, err := packages_model.GetFileForVersionByName(ctx, repoVersion.ID, IndexFilename, fmt.Sprintf("%s|%s|%s", branch, repository, architecture))
- if err != nil && !errors.Is(err, util.ErrNotExist) {
- return err
- }
-
- if err := packages_model.DeleteAllProperties(ctx, packages_model.PropertyTypeFile, pf.ID); err != nil {
- return err
- }
- return packages_model.DeleteFileByID(ctx, pf.ID)
- }
-
- // Cache data needed for all repository files
- cache := make(packageCache)
- for _, pf := range pfs {
- pv, err := packages_model.GetVersionByID(ctx, pf.VersionID)
- if err != nil {
- return err
- }
- p, err := packages_model.GetPackageByID(ctx, pv.PackageID)
- if err != nil {
- return err
- }
- pb, err := packages_model.GetBlobByID(ctx, pf.BlobID)
- if err != nil {
- return err
- }
- pps, err := packages_model.GetPropertiesByName(ctx, packages_model.PropertyTypeFile, pf.ID, alpine_module.PropertyMetadata)
- if err != nil {
- return err
- }
-
- pd := &packageData{
- Package: p,
- Version: pv,
- Blob: pb,
- }
-
- if err := json.Unmarshal([]byte(pv.MetadataJSON), &pd.VersionMetadata); err != nil {
- return err
- }
- if len(pps) > 0 {
- if err := json.Unmarshal([]byte(pps[0].Value), &pd.FileMetadata); err != nil {
- return err
- }
- }
-
- cache[pf] = pd
- }
-
- var buf bytes.Buffer
- for _, pf := range pfs {
- pd := cache[pf]
-
- fmt.Fprintf(&buf, "C:%s\n", pd.FileMetadata.Checksum)
- fmt.Fprintf(&buf, "P:%s\n", pd.Package.Name)
- fmt.Fprintf(&buf, "V:%s\n", pd.Version.Version)
- fmt.Fprintf(&buf, "A:%s\n", pd.FileMetadata.Architecture)
- if pd.VersionMetadata.Description != "" {
- fmt.Fprintf(&buf, "T:%s\n", pd.VersionMetadata.Description)
- }
- if pd.VersionMetadata.ProjectURL != "" {
- fmt.Fprintf(&buf, "U:%s\n", pd.VersionMetadata.ProjectURL)
- }
- if pd.VersionMetadata.License != "" {
- fmt.Fprintf(&buf, "L:%s\n", pd.VersionMetadata.License)
- }
- fmt.Fprintf(&buf, "S:%d\n", pd.Blob.Size)
- fmt.Fprintf(&buf, "I:%d\n", pd.FileMetadata.Size)
- fmt.Fprintf(&buf, "o:%s\n", pd.FileMetadata.Origin)
- fmt.Fprintf(&buf, "m:%s\n", pd.VersionMetadata.Maintainer)
- fmt.Fprintf(&buf, "t:%d\n", pd.FileMetadata.BuildDate)
- if pd.FileMetadata.CommitHash != "" {
- fmt.Fprintf(&buf, "c:%s\n", pd.FileMetadata.CommitHash)
- }
- if len(pd.FileMetadata.Dependencies) > 0 {
- fmt.Fprintf(&buf, "D:%s\n", strings.Join(pd.FileMetadata.Dependencies, " "))
- }
- if len(pd.FileMetadata.Provides) > 0 {
- fmt.Fprintf(&buf, "p:%s\n", strings.Join(pd.FileMetadata.Provides, " "))
- }
- fmt.Fprint(&buf, "\n")
- }
-
- unsignedIndexContent, _ := packages_module.NewHashedBuffer()
- h := sha1.New()
-
- if err := writeGzipStream(io.MultiWriter(unsignedIndexContent, h), "APKINDEX", buf.Bytes(), true); err != nil {
- return err
- }
-
- priv, _, err := GetOrCreateKeyPair(ctx, ownerID)
- if err != nil {
- return err
- }
-
- privPem, _ := pem.Decode([]byte(priv))
- if privPem == nil {
- return fmt.Errorf("failed to decode private key pem")
- }
-
- privKey, err := x509.ParsePKCS1PrivateKey(privPem.Bytes)
- if err != nil {
- return err
- }
-
- sign, err := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA1, h.Sum(nil))
- if err != nil {
- return err
- }
-
- owner, err := user_model.GetUserByID(ctx, ownerID)
- if err != nil {
- return err
- }
-
- fingerprint, err := util.CreatePublicKeyFingerprint(&privKey.PublicKey)
- if err != nil {
- return err
- }
-
- signedIndexContent, _ := packages_module.NewHashedBuffer()
-
- if err := writeGzipStream(
- signedIndexContent,
- fmt.Sprintf(".SIGN.RSA.%s@%s.rsa.pub", owner.LowerName, hex.EncodeToString(fingerprint)),
- sign,
- false,
- ); err != nil {
- return err
- }
-
- if _, err := io.Copy(signedIndexContent, unsignedIndexContent); err != nil {
- return err
- }
-
- _, err = packages_service.AddFileToPackageVersionInternal(
- ctx,
- repoVersion,
- &packages_service.PackageFileCreationInfo{
- PackageFileInfo: packages_service.PackageFileInfo{
- Filename: IndexFilename,
- CompositeKey: fmt.Sprintf("%s|%s|%s", branch, repository, architecture),
- },
- Creator: user_model.NewGhostUser(),
- Data: signedIndexContent,
- IsLead: false,
- OverwriteExisting: true,
- },
- )
- return err
- }
-
- func writeGzipStream(w io.Writer, filename string, content []byte, addTarEnd bool) error {
- zw := gzip.NewWriter(w)
- defer zw.Close()
-
- tw := tar.NewWriter(zw)
- if addTarEnd {
- defer tw.Close()
- }
- hdr := &tar.Header{
- Name: filename,
- Mode: 0o600,
- Size: int64(len(content)),
- }
- if err := tw.WriteHeader(hdr); err != nil {
- return err
- }
- if _, err := tw.Write(content); err != nil {
- return err
- }
- return nil
- }
|