merge from forgejo

modules/packages/arch/metadata_test.go

@@ -15,7 +15,7 @@ import (
 	"code.gitea.io/gitea/modules/packages"
 
 	"github.com/mholt/archiver/v3"
-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParsePackage(t *testing.T) {
@@ -40,23 +40,23 @@ arch = x86_64
 
 	// Test .PKGINFO file
 	pinf, err := fs.Stat("pkginfo")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	pfile, err := fs.Open("pkginfo")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	parcname, err := archiver.NameInArchive(pinf, ".PKGINFO", ".PKGINFO")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	// Test .MTREE file
 	minf, err := fs.Stat("mtree")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	mfile, err := fs.Open("mtree")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	marcname, err := archiver.NameInArchive(minf, ".MTREE", ".MTREE")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	t.Run("normal archive", func(t *testing.T) {
 		var buf bytes.Buffer
@@ -71,7 +71,7 @@ arch = x86_64
 			},
 			ReadCloser: pfile,
 		})
-		assert.NoError(t, errors.Join(pfile.Close(), err))
+		require.NoError(t, errors.Join(pfile.Close(), err))
 
 		err = archive.Write(archiver.File{
 			FileInfo: archiver.FileInfo{
@@ -80,7 +80,7 @@ arch = x86_64
 			},
 			ReadCloser: mfile,
 		})
-		assert.NoError(t, errors.Join(mfile.Close(), archive.Close(), err))
+		require.NoError(t, errors.Join(mfile.Close(), archive.Close(), err))
 
 		reader, err := packages.CreateHashedBufferFromReader(&buf)
 		if err != nil {
@@ -89,7 +89,7 @@ arch = x86_64
 		defer reader.Close()
 		_, err = ParsePackage(reader)
 
-		assert.NoError(t, err)
+		require.NoError(t, err)
 	})
 
 	t.Run("missing .PKGINFO", func(t *testing.T) {
@@ -97,24 +97,23 @@ arch = x86_64
 
 		archive := archiver.NewTarZstd()
 		archive.Create(&buf)
+		require.NoError(t, archive.Close())
 
-		assert.NoError(t, archive.Close())
 		reader, err := packages.CreateHashedBufferFromReader(&buf)
-		if err != nil {
+		require.NoError(t, err)
-			t.Fatal(err)
+
-		}
 		defer reader.Close()
 		_, err = ParsePackage(reader)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), ".PKGINFO file not found")
+		require.Contains(t, err.Error(), ".PKGINFO file not found")
 	})
 
 	t.Run("missing .MTREE", func(t *testing.T) {
 		var buf bytes.Buffer
 
 		pfile, err := fs.Open("pkginfo")
-		assert.NoError(t, err)
+		require.NoError(t, err)
 
 		archive := archiver.NewTarZstd()
 		archive.Create(&buf)
@@ -126,16 +125,15 @@ arch = x86_64
 			},
 			ReadCloser: pfile,
 		})
-		assert.NoError(t, errors.Join(pfile.Close(), archive.Close(), err))
+		require.NoError(t, errors.Join(pfile.Close(), archive.Close(), err))
 		reader, err := packages.CreateHashedBufferFromReader(&buf)
-		if err != nil {
+		require.NoError(t, err)
-			t.Fatal(err)
+
-		}
 		defer reader.Close()
 		_, err = ParsePackage(reader)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), ".MTREE file not found")
+		require.Contains(t, err.Error(), ".MTREE file not found")
 	})
 }
 
@@ -161,8 +159,8 @@ makedepend = cmake
 backup = usr/bin/paket1
 `
 	p, err := ParsePackageInfo(strings.NewReader(PKGINFO))
-	assert.NoError(t, err)
+	require.NoError(t, err)
-	assert.Equal(t, Package{
+	require.Equal(t, Package{
 		Name:    "a",
 		Version: "1-2",
 		VersionMetadata: VersionMetadata{
@@ -221,7 +219,7 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.NoError(t, err)
+		require.NoError(t, err)
 	})
 
 	t.Run("invalid package name", func(t *testing.T) {
@@ -230,8 +228,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid package name")
+		require.Contains(t, err.Error(), "invalid package name")
 	})
 
 	t.Run("invalid package base", func(t *testing.T) {
@@ -240,8 +238,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid package base")
+		require.Contains(t, err.Error(), "invalid package base")
 	})
 
 	t.Run("invalid package version", func(t *testing.T) {
@@ -250,8 +248,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid package base")
+		require.Contains(t, err.Error(), "invalid package base")
 	})
 
 	t.Run("invalid package version", func(t *testing.T) {
@@ -260,8 +258,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid package version")
+		require.Contains(t, err.Error(), "invalid package version")
 	})
 
 	t.Run("missing architecture", func(t *testing.T) {
@@ -270,8 +268,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "architecture should be specified")
+		require.Contains(t, err.Error(), "architecture should be specified")
 	})
 
 	t.Run("invalid URL", func(t *testing.T) {
@@ -280,8 +278,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid project URL")
+		require.Contains(t, err.Error(), "invalid project URL")
 	})
 
 	t.Run("invalid check dependency", func(t *testing.T) {
@@ -290,8 +288,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid check dependency")
+		require.Contains(t, err.Error(), "invalid check dependency")
 	})
 
 	t.Run("invalid dependency", func(t *testing.T) {
@@ -300,8 +298,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid dependency")
+		require.Contains(t, err.Error(), "invalid dependency")
 	})
 
 	t.Run("invalid make dependency", func(t *testing.T) {
@@ -310,8 +308,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid make dependency")
+		require.Contains(t, err.Error(), "invalid make dependency")
 	})
 
 	t.Run("invalid provides", func(t *testing.T) {
@@ -320,8 +318,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid provides")
+		require.Contains(t, err.Error(), "invalid provides")
 	})
 
 	t.Run("invalid optional dependency", func(t *testing.T) {
@@ -330,8 +328,8 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "invalid optional dependency")
+		require.Contains(t, err.Error(), "invalid optional dependency")
 	})
 
 	t.Run("invalid optional dependency", func(t *testing.T) {
@@ -340,82 +338,62 @@ func TestValidatePackageSpec(t *testing.T) {
 
 		err := ValidatePackageSpec(&p)
 
-		assert.Error(t, err)
+		require.Error(t, err)
-		assert.Contains(t, err.Error(), "backup file contains leading forward slash")
+		require.Contains(t, err.Error(), "backup file contains leading forward slash")
 	})
 }
 
 func TestDescString(t *testing.T) {
 	const pkgdesc = `%FILENAME%
 zstd-1.5.5-1-x86_64.pkg.tar.zst
-
 %NAME%
 zstd
-
 %BASE%
 zstd
-
 %VERSION%
 1.5.5-1
-
 %DESC%
 Zstandard - Fast real-time compression algorithm
-
 %GROUPS%
 dummy1
 dummy2
-
 %CSIZE%
 401
-
 %ISIZE%
 1500453
-
 %MD5SUM%
 5016660ef3d9aa148a7b72a08d3df1b2
-
 %SHA256SUM%
 9fa4ede47e35f5971e4f26ecadcbfb66ab79f1d638317ac80334a3362dedbabd
-
 %URL%
 https://facebook.github.io/zstd/
-
 %LICENSE%
 BSD
 GPL2
-
 %ARCH%
 x86_64
-
 %BUILDDATE%
 1681646714
-
 %PACKAGER%
 Jelle van der Waa <jelle@archlinux.org>
-
 %PROVIDES%
 libzstd.so=1-64
-
 %DEPENDS%
 glibc
 gcc-libs
 zlib
 xz
 lz4
-
 %OPTDEPENDS%
 dummy3
 dummy4
-
 %MAKEDEPENDS%
 cmake
 gtest
 ninja
-
 %CHECKDEPENDS%
 dummy5
 dummy6
-
 `
 
 	md := &Package{
@@ -443,5 +421,5 @@ dummy6
 			Arch:           "x86_64",
 		},
 	}
-	assert.Equal(t, pkgdesc, md.Desc())
+	require.Equal(t, pkgdesc, md.Desc())
 }

options/locale/locale_en-US.ini

@@ -3480,9 +3480,7 @@ alpine.repository = Repository Info
 alpine.repository.branches = Branches
 alpine.repository.repositories = Repositories
 alpine.repository.architectures = Architectures
-arch.pacman.helper.gpg = Import gpg public key:
+arch.pacman.helper.gpg = Add trust certificate for pacman:
-arch.pacman.helper.gpg.id = Use `gpg --homedir /etc/pacman.d/gnupg --list-keys` list added gpg key id.
-arch.pacman.helper.pacman = For more pacman usage guides, see <a target="_blank" rel="noopener noreferrer" href="%s">pacman wiki</a> or <a target="_blank" rel="noopener noreferrer" href="%s">pacman sign wiki</a> .
 arch.pacman.repo.multi = %s has the same version in different distributions.
 arch.pacman.repo.multi.item = Configuration for %s
 arch.pacman.conf = Add server with related distribution and architecture to <code>/etc/pacman.conf</code> :
@@ -3490,6 +3488,7 @@ arch.pacman.sync = Sync package with pacman:
 arch.version.properties = Version Properties
 arch.version.description = Description
 arch.version.provides = Provides
+arch.version.groups = Group
 arch.version.depends = Depends
 arch.version.optdepends = Optional depends
 arch.version.makedepends = Make depends

routers/web/user/package.go

@@ -4,6 +4,7 @@
 package user
 
 import (
+	"fmt"
 	"net/http"
 	"net/url"
 
@@ -213,6 +214,7 @@ func ViewPackageVersion(ctx *context.Context) {
 			registryAppURL, _ = url.Parse(setting.AppURL)
 		}
 		ctx.Data["RegistryHost"] = registryAppURL.Host
+		ctx.Data["SignMail"] = fmt.Sprintf("%s@noreply.%s", ctx.Package.Owner.Name, registryAppURL.Host)
 		groups := make(container.Set[string])
 		for _, f := range pd.Files {
 			for _, pp := range f.Properties {

services/packages/arch/repository.go

@@ -10,14 +10,17 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/url"
 	"os"
 	"sort"
 	"strings"
 
 	packages_model "code.gitea.io/gitea/models/packages"
 	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/httplib"
 	packages_module "code.gitea.io/gitea/modules/packages"
 	arch_module "code.gitea.io/gitea/modules/packages/arch"
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 	packages_service "code.gitea.io/gitea/services/packages"
 
@@ -86,7 +89,10 @@ func NewFileSign(ctx context.Context, ownerID int64, input io.Reader) (*packages
 	if err != nil {
 		return nil, err
 	}
-	pkgSig, _ := packages_module.NewHashedBuffer()
+	pkgSig, err := packages_module.NewHashedBuffer()
+	if err != nil {
+		return nil, err
+	}
 	defer pkgSig.Close()
 	if err := openpgp.DetachSign(pkgSig, e, input, nil); err != nil {
 		return nil, err
@@ -286,7 +292,15 @@ func GetOrCreateKeyPair(ctx context.Context, ownerID int64) (string, string, err
 	}
 
 	if priv == "" || pub == "" {
-		priv, pub, err = generateKeypair()
+		user, err := user_model.GetUserByID(ctx, ownerID)
+		if err != nil && !errors.Is(err, util.ErrNotExist) {
+			return "", "", err
+		}
+		registryAppURL, err := url.Parse(httplib.GuessCurrentAppURL(ctx))
+		if err != nil {
+			registryAppURL, _ = url.Parse(setting.AppURL)
+		}
+		priv, pub, err = generateKeypair(user.Name, registryAppURL.Host)
 		if err != nil {
 			return "", "", err
 		}
@@ -303,8 +317,11 @@ func GetOrCreateKeyPair(ctx context.Context, ownerID int64) (string, string, err
 	return priv, pub, nil
 }
 
-func generateKeypair() (string, string, error) {
+func generateKeypair(owner, host string) (string, string, error) {
-	e, err := openpgp.NewEntity("Arch Package Signer", "Arch Registry", "arch@localhost", &packet.Config{
+	e, err := openpgp.NewEntity(
+		owner,
+		"Arch Package signature only",
+		fmt.Sprintf("%s@noreply.%s", owner, host), &packet.Config{
 			RSABits: 4096,
 		})
 	if err != nil {

templates/package/content/arch.tmpl

@@ -7,10 +7,7 @@
 				<div class="markup">
 				<pre class="code-block"><code>wget -O sign.gpg <origin-url data-url="{{AppSubUrl}}/api/packages/{{.PackageDescriptor.Owner.Name}}/arch/repository.key"></origin-url>
 pacman-key --add sign.gpg
-
+pacman-key --lsign-key '{{$.SignMail}}'</code></pre>
-# {{ctx.Locale.Tr "packages.arch.pacman.helper.gpg.id"}}
-# {{ctx.Locale.Tr "packages.arch.pacman.helper.pacman" "https://wiki.archlinux.org/title/pacman" "https://wiki.archlinux.org/title/Pacman/Package_signing"}}
-pacman-key --lsign-key "Key ID"</code></pre>
 				</div>
 			</div>
 			<div class="field">
@@ -30,8 +27,7 @@ pacman-key --lsign-key "Key ID"</code></pre>
 							{{end -}}
 [{{$.PackageDescriptor.Owner.LowerName}}.{{$.RegistryHost}}]
 SigLevel = Required
-Server = <origin-url data-url="{{AppSubUrl}}/api/packages/{{$.PackageDescriptor.Owner.Name}}/arch/{{.}}/$arch"></origin-url>
+Server = <origin-url data-url="{{AppSubUrl}}/api/packages/{{$.PackageDescriptor.Owner.Name}}/arch/{{.}}/$arch"></origin-url>{{end -}}
-{{end -}}
 </code></pre>
 				</div>
 			</div>
@@ -42,8 +38,7 @@ Server = <origin-url data-url="{{AppSubUrl}}/api/packages/{{$.PackageDescriptor.
 				</div>
 			</div>
 			<div class="field">
-			<label>{{ctx.Locale.Tr "packages.registry.documentation" "Arch"
+				<label>{{ctx.Locale.Tr "packages.registry.documentation" "Arch" "https://docs.gitea.com/usage/packages/arch/"}}</label>
-				"https://docs.gitea.com/usage/packages/arch/"}}</label>
 			</div>
 		</div>
 	</div>

tests/integration/api_packages_arch_test.go

@@ -9,6 +9,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -25,8 +26,7 @@ import (
 
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
-	"github.com/pkg/errors"
+	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestPackageArch(t *testing.T) {
@@ -101,8 +101,8 @@ nYAR`),
 		req := NewRequest(t, "GET", rootURL+"/repository.key")
 		resp := MakeRequest(t, req, http.StatusOK)
 
-		assert.Equal(t, "application/pgp-keys", resp.Header().Get("Content-Type"))
+		require.Equal(t, "application/pgp-keys", resp.Header().Get("Content-Type"))
-		assert.Contains(t, resp.Body.String(), "-----BEGIN PGP PUBLIC KEY BLOCK-----")
+		require.Contains(t, resp.Body.String(), "-----BEGIN PGP PUBLIC KEY BLOCK-----")
 	})
 
 	t.Run("Upload", func(t *testing.T) {
@@ -116,24 +116,24 @@ nYAR`),
 		MakeRequest(t, req, http.StatusCreated)
 
 		pvs, err := packages.GetVersionsByPackageType(db.DefaultContext, user.ID, packages.TypeArch)
-		assert.NoError(t, err)
+		require.NoError(t, err)
-		assert.Len(t, pvs, 1)
+		require.Len(t, pvs, 1)
 
 		pd, err := packages.GetPackageDescriptor(db.DefaultContext, pvs[0])
-		assert.NoError(t, err)
+		require.NoError(t, err)
-		assert.Nil(t, pd.SemVer)
+		require.Nil(t, pd.SemVer)
-		assert.IsType(t, &arch_model.VersionMetadata{}, pd.Metadata)
+		require.IsType(t, &arch_model.VersionMetadata{}, pd.Metadata)
-		assert.Equal(t, "test", pd.Package.Name)
+		require.Equal(t, "test", pd.Package.Name)
-		assert.Equal(t, "1.0.0-1", pd.Version.Version)
+		require.Equal(t, "1.0.0-1", pd.Version.Version)
 
 		pfs, err := packages.GetFilesByVersionID(db.DefaultContext, pvs[0].ID)
-		assert.NoError(t, err)
+		require.NoError(t, err)
-		assert.Len(t, pfs, 2) // zst and zst.sig
+		require.Len(t, pfs, 2) // zst and zst.sig
-		assert.True(t, pfs[0].IsLead)
+		require.True(t, pfs[0].IsLead)
 
 		pb, err := packages.GetBlobByID(db.DefaultContext, pfs[0].BlobID)
-		assert.NoError(t, err)
+		require.NoError(t, err)
-		assert.Equal(t, int64(len(pkgs["any"])), pb.Size)
+		require.Equal(t, int64(len(pkgs["any"])), pb.Size)
 
 		req = NewRequestWithBody(t, "PUT", rootURL+"/default", bytes.NewReader(pkgs["any"])).
 			AddBasicAuth(user.Name)
@@ -163,11 +163,11 @@ nYAR`),
 		defer tests.PrintCurrentTest(t)()
 		req := NewRequest(t, "GET", rootURL+"/default/x86_64/test-1.0.0-1-x86_64.pkg.tar.zst")
 		resp := MakeRequest(t, req, http.StatusOK)
-		assert.Equal(t, pkgs["x86_64"], resp.Body.Bytes())
+		require.Equal(t, pkgs["x86_64"], resp.Body.Bytes())
 
 		req = NewRequest(t, "GET", rootURL+"/default/x86_64/test-1.0.0-1-any.pkg.tar.zst")
 		resp = MakeRequest(t, req, http.StatusOK)
-		assert.Equal(t, pkgs["any"], resp.Body.Bytes())
+		require.Equal(t, pkgs["any"], resp.Body.Bytes())
 
 		req = NewRequest(t, "GET", rootURL+"/default/x86_64/test-1.0.0-1-aarch64.pkg.tar.zst")
 		MakeRequest(t, req, http.StatusNotFound)
@@ -177,7 +177,7 @@ nYAR`),
 
 		req = NewRequest(t, "GET", rootURL+"/other/x86_64/test-1.0.0-1-any.pkg.tar.zst")
 		resp = MakeRequest(t, req, http.StatusOK)
-		assert.Equal(t, pkgs["any"], resp.Body.Bytes())
+		require.Equal(t, pkgs["any"], resp.Body.Bytes())
 	})
 
 	t.Run("SignVerify", func(t *testing.T) {
@@ -211,19 +211,19 @@ nYAR`),
 			t.Fatal(err)
 		}
 		files, err := listGzipFiles(respPkg.Body.Bytes())
-		assert.NoError(t, err)
+		require.NoError(t, err)
-		assert.Equal(t, 2, len(files))
+		require.Len(t, files, 2)
 		for s, d := range files {
 			name := getProperty(string(d.Data), "NAME")
 			ver := getProperty(string(d.Data), "VERSION")
-			assert.Equal(t, name+"-"+ver+"/desc", s)
+			require.Equal(t, name+"-"+ver+"/desc", s)
 			fn := getProperty(string(d.Data), "FILENAME")
 			pgp := getProperty(string(d.Data), "PGPSIG")
 			req = NewRequest(t, "GET", rootURL+"/base/x86_64/"+fn+".sig")
 			respSig := MakeRequest(t, req, http.StatusOK)
 			decodeString, err := base64.StdEncoding.DecodeString(pgp)
-			assert.NoError(t, err)
+			require.NoError(t, err)
-			assert.Equal(t, respSig.Body.Bytes(), decodeString)
+			require.Equal(t, respSig.Body.Bytes(), decodeString)
 		}
 	})
 	t.Run("Delete", func(t *testing.T) {
@@ -239,8 +239,8 @@ nYAR`),
 		req = NewRequest(t, "GET", rootURL+"/base/x86_64/base.db")
 		respPkg := MakeRequest(t, req, http.StatusOK)
 		files, err := listGzipFiles(respPkg.Body.Bytes())
-		assert.NoError(t, err)
+		require.NoError(t, err)
-		assert.Equal(t, 1, len(files))
+		require.Len(t, files, 1)
 
 		req = NewRequestWithBody(t, "DELETE", rootURL+"/base/test2/1.0.0-1", nil).
 			AddBasicAuth(user.Name)
@@ -251,8 +251,8 @@ nYAR`),
 		req = NewRequest(t, "GET", rootURL+"/default/x86_64/base.db")
 		respPkg = MakeRequest(t, req, http.StatusOK)
 		files, err = listGzipFiles(respPkg.Body.Bytes())
-		assert.NoError(t, err)
+		require.NoError(t, err)
-		assert.Equal(t, 1, len(files))
+		require.Len(t, files, 1)
 	})
 }