+++ /dev/null
-#!/usr/bin/env ruby
-# Copyright (C) The Arvados Authors. All rights reserved.
-#
-# SPDX-License-Identifier: AGPL-3.0
-
-require 'rubygems'
-require 'pp'
-require 'arvados'
-require 'tempfile'
-require 'yaml'
-require 'fileutils'
-
-# This script does the actual gitolite config management on disk.
-#
-# Ward Vandewege <ward@curoverse.com>
-
-# Default is development
-production = ARGV[0] == "production"
-
-ENV["RAILS_ENV"] = "development"
-ENV["RAILS_ENV"] = "production" if production
-
-DEBUG = 1
-
-# load and merge in the environment-specific application config info
-# if present, overriding base config parameters as specified
-path = File.absolute_path('../../config/arvados-clients.yml', __FILE__)
-if File.exist?(path) then
- cp_config = YAML.load_file(path)[ENV['RAILS_ENV']]
-else
- puts "Please create a\n #{path}\n file"
- exit 1
-end
-
-gitolite_url = cp_config['gitolite_url']
-gitolite_arvados_git_user_key = cp_config['gitolite_arvados_git_user_key']
-
-gitolite_tmpdir = cp_config['gitolite_tmp']
-gitolite_admin = File.join(gitolite_tmpdir, 'gitolite-admin')
-gitolite_admin_keydir = File.join(gitolite_admin, 'keydir')
-gitolite_keydir = File.join(gitolite_admin, 'keydir', 'arvados')
-
-ENV['ARVADOS_API_HOST'] = cp_config['arvados_api_host']
-ENV['ARVADOS_API_TOKEN'] = cp_config['arvados_api_token']
-if cp_config['arvados_api_host_insecure']
- ENV['ARVADOS_API_HOST_INSECURE'] = 'true'
-else
- ENV.delete('ARVADOS_API_HOST_INSECURE')
-end
-
-def ensure_directory(path, mode)
- begin
- Dir.mkdir(path, mode)
- rescue Errno::EEXIST
- end
-end
-
-def replace_file(path, contents)
- unlink_now = true
- dirname, basename = File.split(path)
- FileUtils.mkpath(dirname)
- new_file = Tempfile.new([basename, ".tmp"], dirname)
- begin
- new_file.write(contents)
- new_file.flush
- File.rename(new_file, path)
- unlink_now = false
- ensure
- new_file.close(unlink_now)
- end
-end
-
-def file_has_contents?(path, contents)
- begin
- IO.read(path) == contents
- rescue Errno::ENOENT
- false
- end
-end
-
-module TrackCommitState
- module ClassMethods
- # Note that all classes that include TrackCommitState will have
- # @@need_commit = true if any of them set it. Since this flag reports
- # a boolean state of the underlying git repository, that's OK in the
- # current implementation.
- @@need_commit = false
-
- def changed?
- @@need_commit
- end
-
- def ensure_in_git(path, contents)
- unless file_has_contents?(path, contents)
- replace_file(path, contents)
- system("git", "add", path)
- @@need_commit = true
- end
- end
- end
-
- def ensure_in_git(path, contents)
- self.class.ensure_in_git(path, contents)
- end
-
- def self.included(base)
- base.extend(ClassMethods)
- end
-end
-
-class UserSSHKeys
- include TrackCommitState
-
- def initialize(user_keys_map, key_dir)
- @user_keys_map = user_keys_map
- @key_dir = key_dir
- @installed = {}
- end
-
- def install(filename, pubkey)
- unless pubkey.nil?
- key_path = File.join(@key_dir, filename)
- ensure_in_git(key_path, pubkey)
- end
- @installed[filename] = true
- end
-
- def ensure_keys_for_user(user_uuid)
- return unless key_list = @user_keys_map.delete(user_uuid)
- key_list.map { |k| k[:public_key] }.compact.each_with_index do |pubkey, ii|
- # Handle putty-style ssh public keys
- pubkey.sub!(/^(Comment: "r[^\n]*\n)(.*)$/m,'ssh-rsa \2 \1')
- pubkey.sub!(/^(Comment: "d[^\n]*\n)(.*)$/m,'ssh-dss \2 \1')
- pubkey.gsub!(/\n/,'')
- pubkey.strip!
- install("#{user_uuid}@#{ii}.pub", pubkey)
- end
- end
-
- def installed?(filename)
- @installed[filename]
- end
-end
-
-class Repository
- include TrackCommitState
-
- @@aliases = {}
-
- def initialize(arv_repo, user_keys)
- @arv_repo = arv_repo
- @user_keys = user_keys
- end
-
- def self.ensure_system_config(conf_root)
- ensure_in_git(File.join(conf_root, "conf", "gitolite.conf"),
- %Q{include "auto/*.conf"\ninclude "admin/*.conf"\n})
- ensure_in_git(File.join(conf_root, "arvadosaliases.pl"), alias_config)
-
- conf_path = File.join(conf_root, "conf", "admin", "arvados.conf")
- conf_file = %Q{
-@arvados_git_user = arvados_git_user
-
-repo gitolite-admin
- RW = @arvados_git_user
-
-}
- ensure_directory(File.dirname(conf_path), 0755)
- ensure_in_git(conf_path, conf_file)
- end
-
- def ensure_config(conf_root)
- if name and (File.exist?(auto_conf_path(conf_root, name)))
- # This gitolite installation knows the repository by name, rather than
- # UUID. Leave it configured that way until a separate migration is run.
- basename = name
- else
- basename = uuid
- @@aliases[name] = uuid unless name.nil?
- end
- conf_file = "\nrepo #{basename}\n"
- @arv_repo[:user_permissions].sort.each do |user_uuid, perm|
- conf_file += "\t#{perm[:gitolite_permissions]}\t= #{user_uuid}\n"
- @user_keys.ensure_keys_for_user(user_uuid)
- end
- ensure_in_git(auto_conf_path(conf_root, basename), conf_file)
- end
-
- private
-
- def auto_conf_path(conf_root, basename)
- File.join(conf_root, "conf", "auto", "#{basename}.conf")
- end
-
- def uuid
- @arv_repo[:uuid]
- end
-
- def name
- if @arv_repo[:name].nil?
- nil
- else
- @clean_name ||=
- @arv_repo[:name].sub(/^[^A-Za-z]+/, "").gsub(/[^\w\.\/]/, "")
- end
- end
-
- def self.alias_config
- conf_s = "{\n"
- @@aliases.sort.each do |(repo_name, repo_uuid)|
- conf_s += "\t'#{repo_name}' \t=> '#{repo_uuid}',\n"
- end
- conf_s += "};\n"
- conf_s
- end
-end
-
-begin
- # Get our local gitolite-admin repo up to snuff
- if not File.exist?(gitolite_admin) then
- ensure_directory(gitolite_tmpdir, 0700)
- Dir.chdir(gitolite_tmpdir)
- `git clone #{gitolite_url}`
- Dir.chdir(gitolite_admin)
- else
- Dir.chdir(gitolite_admin)
- `git pull`
- end
-
- arv = Arvados.new
- permissions = arv.repository.get_all_permissions
-
- ensure_directory(gitolite_keydir, 0700)
- admin_user_ssh_keys = UserSSHKeys.new(permissions[:user_keys], gitolite_admin_keydir)
- # Make sure the arvados_git_user key is installed; put it in gitolite_admin_keydir
- # because that is where gitolite will try to put it if we do not.
- admin_user_ssh_keys.install('arvados_git_user.pub', gitolite_arvados_git_user_key)
-
- user_ssh_keys = UserSSHKeys.new(permissions[:user_keys], gitolite_keydir)
- permissions[:repositories].each do |repo_record|
- repo = Repository.new(repo_record, user_ssh_keys)
- repo.ensure_config(gitolite_admin)
- end
- Repository.ensure_system_config(gitolite_admin)
-
- # Clean up public key files that should not be present
- Dir.chdir(gitolite_keydir)
- stale_keys = Dir.glob('*.pub').reject do |key_file|
- user_ssh_keys.installed?(key_file)
- end
- if stale_keys.any?
- stale_keys.each { |key_file| puts "Extra file #{key_file}" }
- system("git", "rm", "--quiet", *stale_keys)
- end
-
- if UserSSHKeys.changed? or Repository.changed? or stale_keys.any?
- message = "#{Time.now().to_s}: update from API"
- Dir.chdir(gitolite_admin)
- `git add --all`
- `git commit -m '#{message}'`
- `git push`
- end
-
-rescue => bang
- puts "Error: " + bang.to_s
- puts bang.backtrace.join("\n")
- exit 1
-end
-
projects / arvados.git / blobdiff