ngcpcfg

Commit Graph

Author	SHA1	Message	Date
Michael Prokop	6adf52aa96	TT#188250 tests: use same permissions for git repos as for working directory With git v2.37.2-1, as present in current Debian/unstable, our unit tests might fail - as seen with our Github actions: \| err = ('fatal: detected dubious ownership in repository at ' \| "'/tmp/pytest-of-root/pytest-24/test_build_instance_customtt0/ngcpctl-pytest-base/ngcp-config'\n" \| 'To add an exception for this directory, call:\n' \| '\n' \| '\tgit config --global --add safe.directory ' With its underlying working directory looking like: \| root@b5a6b272fb90:/code# ls -la /tmp/pytest-of-root/pytest-24/test_build_instance_customtt0/ngcpctl-pytest-base/ngcp-config \| total 148 \| drwxr-xr-x 5 root root 4096 Aug 15 09:12 . \| drwxr-xr-x 3 root root 4096 Aug 15 09:12 .. \| drwxr-xr-x 8 1000 1000 4096 May 18 2021 .git \| -rw-r--r-- 1 1000 1000 305 Jun 11 2020 .gitignore \| -rw-r----- 1 1000 1000 47437 Jun 15 2020 config.yml \| [...] FTR, this can also be reproduced with our docker setup, when running as user root, while the underlying ngcpcfg repository is owned by a normal user: \| root@b5a6b272fb90:/code# ls -la \| total 92 \| drwxr-xr-x 16 1000 1000 4096 Aug 15 08:41 . \| drwxr-xr-x 1 root root 4096 Aug 15 08:36 .. \| drwxr-xr-x 8 1000 1000 4096 Aug 15 09:22 .git \| drwxr-xr-x 4 1000 1000 4096 Jun 23 15:37 .github \| -rw-r--r-- 1 1000 1000 125 Jun 23 15:37 .gitignore \| -rw-r--r-- 1 1000 1000 64 Jul 16 2019 .gitreview \| -rw-r--r-- 1 1000 1000 169 Aug 15 08:41 .mailmap \| [...] Quoting from git's Documentation/RelNotes/2.36.0.txt: \| * With the fixes for CVE-2022-24765 that are common with versions of \| Git 2.30.4, 2.31.3, 2.32.2, 2.33.3, 2.34.3, and 2.35.3, Git has \| been taught not to recognise repositories owned by other users, in \| order to avoid getting affected by their config files and hooks. \| You can list the path to the safe/trusted repositories that may be \| owned by others on a multi-valued configuration variable \| `safe.directory` to override this behaviour, or use '*' to declare \| that you trust anything. Whereas the following git upstream change checks if a repository is safe, by verifying the ownership of the worktree (if any), the git directory, and the gitfile (if any): \| commit 3b0bf2704980b1ed6018622bdf5377ec22289688 \| Author: Carlo Marcelo Arenas Belón <carenas@gmail.com> \| Date: Tue May 10 12:35:29 2022 -0700 \| \| setup: tighten ownership checks post CVE-2022-24765 This change made it into git v2.30.5, v2.31.4, v2.32.3, v2.33.4, v2.34.4, v2.35.4, v2.36.2, v2.37.1 + v2.37.2, and we got v2.37.2-1 in Debian/unstable as of 2022-08-12 (see https://packages.qa.debian.org/g/git/news/20220813T030422Z.html). This affects us with our mixture of root vs user permissions of the working directory vs the git directory, so let's make sure the .git directory has the according permissision as well. Change-Id: I695fbd5a3b7fb79acc2873f75b8de410c8e3a0aa	3 years ago
Michael Prokop	82abf22d10	TT#171400 Adjust git repos for new safe.directory behavior In more recent versions, Git upstream does an owner check for the top-level directory (see git upstream commit 8959555ce), also see https://github.blog/2022-04-12-git-security-vulnerability-announced/ This change is included in git versions >=2.30.3, >=2.31.2, >=2.34.2, >=2.35.2 + >=2.36.0-rc2, and therefore also affects the Git package v2.35.2-1 as present in current Debian/unstable (as of 2022-04-16). Now due to this behavioral change, our unit tests fail with e.g.: \| err = ('fatal: unsafe repository ' \| "('/tmp/pytest-of-root/pytest-0/test_status_build0/ngcpctl-pytest-base/ngcp-config' " \| 'is owned by someone else)\n' \| 'To add an exception for this directory, call:\n' \| '\n' \| '\tgit config --global --add safe.directory ' \| '/tmp/pytest-of-root/pytest-0/test_status_build0/ngcpctl-pytest-base/ngcp-config\n') \| ex = 128 We're creating many temporary git repositories. Therefore, adding every single repository via `git config --global --add safe.directory` as suggested in git's error message isn't really a viable option for us. Git upstream also recognized this, and as of git rev 0f85c4a30 it's possible to opt-out of this check via `git config --global --add safe.directory *`. This change is currently included only in Git versions 2.30.4, 2.31.3, 2.32.2, 2.33.3, 2.34.3 and 2.35.3, so not available in Debian/unstable, yet. But nevertheless, it's not really an ideal option for us, as we don't want to mess with $HOME/.gitconfig ever, as this might not always be some random directory inside a testing container, but pointing to an actual user configuration. The underlying reason, why this issue showed up in our Github actions is caused by the fact, that the checkout of the artifacts is running as user (also see https://github.com/actions/checkout/issues/47): \| uid=1001(runner) gid=121(docker) groups=121(docker),4(adm),101(systemd-journal) But the docker containers are executed with root permissions in the following steps. To properly handle this, we set the permissions of the git repository to $UID/$GID of the executing user. Even more tricky and worth being aware of, certain git actions might fail due to permission issues, without telling you directly: \| root@8d1e4156f6d8:/tmp# mkdir testrepo/ \| root@8d1e4156f6d8:/tmp# cd testrepo/ \| root@8d1e4156f6d8:/tmp/testrepo# git init \| Initialized empty Git repository in /tmp/testrepo/.git/ \| root@8d1e4156f6d8:/tmp/testrepo# chown testbuild . \| root@8d1e4156f6d8:/tmp/testrepo# git config --local user.email pytest@example.com \| fatal: --local can only be used inside a git repository \| root@8d1e4156f6d8:/tmp/testrepo# echo $? \| 128 \| root@8d1e4156f6d8:/tmp/testrepo# chown root . \| root@8d1e4156f6d8:/tmp/testrepo# git config --local user.email pytest@example.com \| root@8d1e4156f6d8:/tmp/testrepo# echo $? \| 0 While at it, let's unify our git configuration, by using the following settings for all our user configuration: \| git config --local user.email pytest@example.com \| git config --local user.name pytest Change-Id: Icad0ea4c3daf22f17481f23b27fa17750bd623da	3 years ago
ngcp-config	682ddd0293	TT#139455 tests: OUTPUT_DIRECTORY by default ngcpcfg service expects that the produced files are inside a git repository * ngcpcfgcli: - set RUN_DIR by default - set STATE_FILES_DIR by default - use default-git-repository.tar.gz as base for outdir - return outdir value too - print stdout and stderr so on failure we can debug * t/test_*: - remove unused imports - don't create OUTPUT_DIRECTORY unless really necessary - remove print stdout/stderr - black indent Change-Id: I61e475cc9c775c30c3700a8c0e560e7c5b22f0fc	4 years ago
Michael Prokop	0e84ac6e21	TT#44969 Provide test cases for `git status --porcelain` mode Change-Id: Iaf167a9a8ad12d36a9b9ebe8250c2b91a56ff239	7 years ago
Michael Prokop	acfa825767	MT#16391 Initial tests using pytest The old testsuite wasn't updated for way too long and since ngcpcfg receives more and more features we need a decent test coverage. pytest seems to provide the right level of abstraction, excellent fixtures and junit-xml reporting as needed. Inspired by Vincent Bernat's https://github.com/vincentbernat/lldpd/tree/master/tests/integration Thanks Victor Seva <vseva@sipwise.com>, Vincent Bernat <vincent@bernat.im>, Christian Hofstaedtler <christian@hofstaedtler.name> and Lukas Prokop <admin@lukas-prokop.at> for feedback, inspiration and help Change-Id: Iffed87e8cc540169bed89c00967a03e80859179e	8 years ago

5 Commits (master)