Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* glsamaker/models: add reference URL for XSA advisoriesglsamakerv4John Helmert III2024-02-022-0/+7
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/reference: add GLIBC-SAJohn Helmert III2024-02-021-0/+1
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* tests/models/test_reference: test validity for all prefixesJohn Helmert III2024-02-021-0/+4
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* views: edit_glsa: allow empty referencesJohn Helmert III2024-02-012-0/+16
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* views: validate references pulled in via referenced bugsJohn Helmert III2024-02-012-2/+34
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* views: better cleanup reference whitespaceJohn Helmert III2024-01-301-1/+1
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* views: fix duplicate reference errorJohn Helmert III2024-01-291-4/+7
| | | | | | | | In some cases, alias_refs and the references input via the GLSA form might not be mutually exclusive sets (lists), so it is necessary to deduplicate the union of both lists, rather than each list separately. Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: more debug logging for xml/mail generation failuresJohn Helmert III2024-01-212-2/+27
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* autoglsa: handle and test case of no fixed version in summaryJohn Helmert III2024-01-212-2/+21
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* glsamaker/views: more auth nicetiesJohn Helmert III2024-01-213-3/+25
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* test -> glsamaker/testsJohn Helmert III2024-01-2117-12/+13
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_views: more testing of reference invalidationJohn Helmert III2024-01-151-1/+27
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* templates/edit_glsa: add user-visible error for invalid referencesJohn Helmert III2024-01-152-2/+21
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* glsamaker/templates: add some bootstrap/tyrian nicenessJohn Helmert III2024-01-158-362/+522
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* drop unused docker-compose override fileJohn Helmert III2024-01-151-27/+0
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* autoglsa: validate aliases as referencesJohn Helmert III2023-12-261-0/+1
| | | | | | | We only want to use vulnerability identifiers as GLSA references, but those aren't the only things that we might pick up in bug aliases. Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_reference: use well formatted references in testsJohn Helmert III2023-12-261-2/+4
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/reference: add reference format validationJohn Helmert III2023-12-262-0/+51
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_reference: test both comparison directions on Reference objectsJohn Helmert III2023-12-261-0/+1
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* autoglsa: type bugs_aliases()John Helmert III2023-12-261-1/+1
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: fixup another column relationship assignmentJohn Helmert III2023-12-262-2/+4
| | | | | Fixes: 9285344 ("autoglsa: switch Relationship column assignments to appends") Signed-off-by: John Helmert III <ajak@gentoo.org>
* mypy.ini: drop unnecessary ignore statementsJohn Helmert III2023-12-251-12/+0
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* glsamaker/create_user: rewrite using glsamaker internalsJohn Helmert III2023-12-251-28/+39
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: fixup relationship typing with sqlalchemy.orm.relationshipJohn Helmert III2023-12-251-3/+6
| | | | | | | | | | This proper typing fixes the following mypy errors: glsamaker/autoglsa.py:253: error: Unsupported left operand type for + ("RelationshipProperty[Any]") [operator] glsamaker/autoglsa.py:254: error: "RelationshipProperty[Any]" has no attribute "__iter__"; maybe "__str__"? (not iterable) [attr-defined] glsamaker/autoglsa.py:255: error: Unsupported left operand type for + ("RelationshipProperty[Any]") [operator] Signed-off-by: John Helmert III <ajak@gentoo.org>
* mypy: drop apparently unnecessary sqlalchemy ignoreJohn Helmert III2023-12-251-3/+0
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* autoglsa: add newlines between multiple packages' resolutionsJohn Helmert III2023-12-252-2/+37
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: catch another edge case in mail table generationJohn Helmert III2023-12-252-1/+25
| | | | | | | | | | | | | | | | We were always using the "vulnerable version" objects to find which package name to output into the table, but that doesn't work if there's no vulnerable version. Since there's always one package in either of the vulnerable or unaffected objects, use whichever happens to provide the string we're looking for. Since we were (and are) relying on the caller providing us a pair of queries which includes only one package, raise an exception if that assumption is broken. Also add a test case which catches the original issue. Signed-off-by: John Helmert III <ajak@gentoo.org>
* tox: add lint/type to py311 github actions environmentJohn Helmert III2023-12-251-1/+1
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* github: drop python 3.10 from actionsJohn Helmert III2023-12-251-1/+0
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* autoglsa: switch Relationship column assignments to appendsJohn Helmert III2023-12-251-3/+3
| | | | | | | | | | This prevents a few type-clashing issues on assignment: glsamaker/autoglsa.py:253: error: Incompatible types in assignment (expression has type "list[Any]", variable has type "RelationshipProperty[Any]") [assignment] glsamaker/autoglsa.py:260: error: Incompatible types in assignment (expression has type "list[Any]", variable has type "RelationshipProperty[Any]") [assignment] glsamaker/autoglsa.py:270: error: Incompatible types in assignment (expression has type "list[Affected]", variable has type "RelationshipProperty[Any]") [assignment] Signed-off-by: John Helmert III <ajak@gentoo.org>
* autoglsa: previous_glsa(): avoid returning None for typingJohn Helmert III2023-12-251-1/+7
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: convert self.affected to list to fix typingJohn Helmert III2023-12-251-1/+1
| | | | | | | | Fixes mypy error: glsamaker/models/glsa.py:130: error: "RelationshipProperty[Any]" has no attribute "__iter__"; maybe "__str__"? (not iterable) [attr-defined] Signed-off-by: John Helmert III <ajak@gentoo.org>
* move all dependencies out of tox.ini into setup.cfgJohn Helmert III2023-12-252-6/+15
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: add a bunch of return typingJohn Helmert III2023-12-251-11/+11
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: return tuple in generate_mail_table_rowJohn Helmert III2023-12-251-3/+4
| | | | | | | Tuples are better when the object is intended to be a particular length, as it is in this case. Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_glsa: ensure assert_diff gets correctly typed inputJohn Helmert III2023-12-251-2/+2
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* models/glsa: better handle "Affected" objects with no vulnerable versionsJohn Helmert III2023-12-251-7/+9
| | | | | | Just like we do below with Affected objects with no unaffected versions. Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_glsa: add test case for presently seen webkit-gtk crashJohn Helmert III2023-12-251-0/+20
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* pre-commit autoupdateJohn Helmert III2023-12-241-2/+2
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* views: newbugs: don't emit error parameter when successfulJohn Helmert III2023-12-191-1/+5
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* Revert "models/bug: instances are implicitly deduplicated"John Helmert III2023-12-174-3/+12
| | | | | | | | This reverts commit 03ebd8805524fb7d98ab6db6b987a36e32d0a95f. This turned out to be wrong, and now triggers an exception with duplicate bug rows. Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_views: add a test to trigger bug table primary key errorJohn Helmert III2023-12-171-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SQLAlchemy's implicit handling of uniqueness of primary keys in merges seems to have changed, and this triggers the following error when submitting an edited GLSA twice. It ends up attempting to merge multiple bug rows with the same ID, rather than simply reusing existing rows. glsamaker-http-1 | sqlalchemy.exc.IntegrityError: (raised as a result of Query-invoked autoflush; consider using a session.no_autoflush block if this flush is occurring prematurely) glsamaker-http-1 | (psycopg2.errors.UniqueViolation) duplicate key value violates unique constraint "bug_pkey" glsamaker-http-1 | DETAIL: Key (bug_id)=(713098) already exists. glsamaker-http-1 | glsamaker-http-1 | [SQL: INSERT INTO bug (bug_id) VALUES (%(bug_id)s)] glsamaker-http-1 | [parameters: {'bug_id': '713098'}] glsamaker-http-1 | (Background on this error at: https://sqlalche.me/e/20/gkpj) Interestingly, this seems to trigger when creating Affected rows, which shouldn't touch the bugs table: glsamaker-http-1 | File "/usr/local/lib/python3.11/site-packages/glsamaker/views.py", line 205, in edit_glsa glsamaker-http-1 | glsa.affected = parse_atoms(request, "unaffected") + parse_atoms( glsamaker-http-1 | ^^^^^^^^^^^^ glsamaker-http-1 | File "/usr/local/lib/python3.11/site-packages/glsamaker/views.py", line 166, in parse_atoms glsamaker-http-1 | ret.append(atom_to_affected(pkg, arch, range_type)) glsamaker-http-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ glsamaker-http-1 | File "/usr/local/lib/python3.11/site-packages/glsamaker/views.py", line 151, in atom_to_affected glsamaker-http-1 | return Affected(pn, version, pkg_range, arch, slot, range_type) glsamaker-http-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: John Helmert III <ajak@gentoo.org>
* views: edit_glsa: oops, guard against empty errorJohn Helmert III2023-12-172-1/+15
| | | | | | And add a trivial test. Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_views: add basic autoglsa testing from client's perspectiveJohn Helmert III2023-12-171-0/+10
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_autoglsa: add real test for autogenerate_glsaJohn Helmert III2023-12-171-0/+20
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* pre-commit: add isortJohn Helmert III2023-12-172-2/+6
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* glsamaker/autoglsa: recovery nicer when we misparse bug summariesJohn Helmert III2023-12-174-82/+146
| | | | | | | | | | This includes a bit of refactoring of autoglsa.get_max_versions to allow for easy recovery when parsing of a particular bug fails. Bugs which fail the "autoglsa" process will be returned as a list of exceptions for the caller to handle as necessary. Currently, this means spitting out an error message on the edit_glsa page. Signed-off-by: John Helmert III <ajak@gentoo.org>
* test_autoglsa: adjust est_autogenerate_glsa namingJohn Helmert III2023-12-161-1/+1
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>
* docker-compose: correct ulimit commentJohn Helmert III2023-12-121-4/+9
| | | | | | Mystery finally solved... Signed-off-by: John Helmert III <ajak@gentoo.org>
* glsamaker/autoglsa: standardize multiline string formatJohn Helmert III2023-12-101-6/+6
| | | | Signed-off-by: John Helmert III <ajak@gentoo.org>