Commit Graph

1164 Commits

Author SHA1 Message Date
Maxwell G 17b1e159d8 images: move fedora/latest alias to fedora/39
Fedora 39 was officially released on 7 November 2023.

Ref: https://fedoramagazine.org/announcing-fedora-linux-39/
2023-11-16 12:44:52 +01:00
Simon Ser 12bb3fd8a9 api/graph: validate OAuth grants when submitting build
An OAuth grants string can be supplied when submitting a build
manifest. Validate it to make sure it's well-formed.
2023-10-24 12:26:45 +02:00
Drew DeVault 9910ba36f6 API: update dependencies 2023-10-24 12:25:18 +02:00
Josh Soref 440ff2bbd5 spelling: submitted
Signed-off-by: Josh Soref <jsoref@gmail.com>
2023-10-04 11:03:11 +02:00
Josh Soref 9b0fdf51b4 spelling: separator
Signed-off-by: Josh Soref <jsoref@gmail.com>
2023-10-04 11:03:10 +02:00
Josh Soref 2d69bb71ad spelling: occurred
Signed-off-by: Josh Soref <jsoref@gmail.com>
2023-10-04 11:03:10 +02:00
Josh Soref 71d38da5fb spelling: facilitate
Signed-off-by: Josh Soref <jsoref@gmail.com>
2023-10-04 11:03:09 +02:00
Josh Soref 4a99d95d49 spelling: connection
Signed-off-by: Josh Soref <jsoref@gmail.com>
2023-10-04 11:03:09 +02:00
Josh Soref 04aac44005 spelling: because
Signed-off-by: Josh Soref <jsoref@gmail.com>
2023-10-04 11:03:09 +02:00
Nessdoor 0d9ff479f8 images/nixos: pass optional system attribute to evalConfig
This allows for image.nix to be used inside hermetic builds where
builtins.currentSystem is not available as an attribute.
2023-10-04 11:01:13 +02:00
Zack Weinberg ef4808ca7c images/archlinux: Enable installation of multilib packages.
Build manifests that want to compile 32-bit binaries can now
enable `gcc -m32` and the like with

```
packages:
  - multilib-devel
```

instead of a task that patches pacman.conf.
2023-10-04 11:00:59 +02:00
Pinghao Wu bf7b34b3f3 images/archlinux: build: fix qemu package name
qemu-headless had been replaced by qemu-base, and the replace was
recently removed.

See: 6b17907e83 (9b9baac1eb9b72790eef5540a1685306fc43fd6c_1043_1056)
2023-10-04 11:00:18 +02:00
Simon Ser 20aaddd4ef api/graph: simplify status for new jobs
The status is always "pending". Mimick what the "INSERT INTO task"
query is doing below.
2023-10-04 10:59:42 +02:00
unwox a17bcc9461 images/guix: Update maintainer contact 2023-10-04 10:59:18 +02:00
Jacob Moody 3cb88b0ca8 images/9front: Add genimg and build.yml 2023-09-01 16:51:07 +02:00
Simon Ser 2d32b4f4e9 contrib/submit_image_build: ensure secrets are enabled 2023-09-01 10:36:55 +02:00
Maxwell G bb37d94483 images: add fedora/40 and move fedora/rawhide to it
Fedora 40 is now Fedora Rawhide and Fedora 39 is the branched release.
fedora/latest will be moved to fedora/39 when Fedora 39 is officially
released around October.
2023-09-01 10:35:56 +02:00
Simon Ser 8c44f5d6c1 api/loaders: fix job group loader
This loader always fails with:

    pq: missing FROM-clause entry for table ""job_group""
2023-09-01 10:34:36 +02:00
Masanori Ogino ce250672a3 images/openbsd: Update for 7.3
Signed-off-by: Masanori Ogino <omasanori@proton.me>
2023-09-01 10:32:16 +02:00
Masanori Ogino 37338f2967 images/netbsd: Update 9.x to 9.3
Signed-off-by: Masanori Ogino <omasanori@proton.me>
2023-09-01 10:32:07 +02:00
Haowen Liu 7b8e66e4dd ubuntu/kinetic: EOF 2023-09-01 09:47:09 +02:00
Drew DeVault 45812de33a api: fix fromUser implementation issues 2023-08-30 09:08:27 +02:00
Thorben Günther 663ad82298 api/graph: Fix valid's field name
The html template uses "username" and not "user".
2023-08-30 09:05:13 +02:00
Drew DeVault 6657f4a82e all: implement secret sharing 2023-08-28 11:01:14 +02:00
Simon Ser b456338259 api/graph: enable secrets by default if oauth is specified
Enable secrets by default if the manifest contains a "oauth" field.
Generating an OAuth token tied to a build job requires secrets to
be enabled.
2023-08-16 18:11:41 +02:00
Simon Ser 73b6d3b3a5 api/graph: fix SECRETS:RO check for non-OAuth2 clients
AuthContext.Grants is only populated for OAuth2 clients.

Use the new AuthContext.Access method to check for the SECRETS:RO
permission instead, to account for other auth kinds.
2023-08-16 15:50:05 +02:00
Conrad Hoffmann 509ebedfc8 worker: set Content-Type header to JSON
The GQL webhooks already do this, and it seems appropriate.
2023-08-16 11:56:34 +02:00
Simon Ser 8e7e303c49 api/graph: fix invalid @access directive in WebhookEvent enum
Fixes the following schema error:

    schema.graphqls:280: Directive access is not applicable on ENUM_VALUE.
2023-08-16 11:53:11 +02:00
Francesco Gazzetta 8ce0ebf3b1 images/nixos: set latest to 23.05 2023-08-16 11:53:04 +02:00
Haowen Liu 8df2feef16 Remove non-existent ubuntu/oldoldlts 2023-08-16 11:52:17 +02:00
Conrad Hoffmann 1b706b4b65 Use correct internal URL for fetching logs
In a setup where internal traffic is meant to stay internal (i.e. the
`internal-origin` config is used) fetching logs is currently broken. The
logs are served by the api component, but as is the request will be sent
to the Python frontend.

Fix this by using the value of `api-origin`, just falling back to
`get_origin` if that is not set. This is the same technique already
employed in the Python GraphQL client.

Signed-off-by: Conrad Hoffmann <ch@bitfehler.net>
2023-08-16 11:51:22 +02:00
Conrad Hoffmann c02243f368 images/*: start uploading new images to AMS infra
The destination is backed by a CephFS volume that can be mounted by
build workers running in AMS.
2023-08-16 11:51:19 +02:00
Simon Ser c58ac2b2b1 api/graph: check SECRETS:RO in submit(secrets: true) mutation
Submitting a build with secrets enabled grants access to secrets.
Let's reflect this in the token scope requirements.

In order to not break builds with no secrets argument specified,
make the default value a bit smarter: enable secrets if at least
one is specified in the manifest and the SECRETS:RO grant is
available.
2023-08-16 11:51:11 +02:00
Drew DeVault 34a2271713 jobs.py: allow admins to view builds unconditionally 2023-08-09 11:02:59 +02:00
Simon Ser b7cf38ae98 Check username when showing job page
This is the first step towards preventing unlisted build jobs
enumeration.
2023-07-07 09:40:25 +02:00
Taavi Väänänen 04544535b7 images/control: Clarify error messages
Changes the error message for trying to run a non-existent architecture
to mention that it's specifically the architecture that's missing and
not the specific image (which is checked at the very start of the file).

The error message for a non-existent image is clarified a bit too, to
make it more clear what's wrong in the manifest, instead of how the
runner is detecting that.
2023-07-07 09:39:56 +02:00
Denis Laxalde 979c15eaa3 Set url_map.strict_slashes = False
This should fix 404 when requesting /~<username>/ instead of
/~<username>, the rule defining the route.
2023-07-06 11:11:41 +02:00
Drew DeVault 93a547179c image/debian: disable KVM on sanity check 2023-07-06 10:58:50 +02:00
Maxwell G 6b1f66e9ea Fix fedora/latest symlink location
Resolves: 3ee8fabf4e
2023-07-06 10:58:36 +02:00
Taavi Väänänen 5295e2ce6d contrib/submit_image_build: Make builds public
This patch restores the status quo for the refresh jobs being visible
at https://builds.sr.ht/~sircmpwn/refresh from before builds.sr.ht
gained the concept of job visibility.
2023-07-06 09:59:11 +02:00
Drew DeVault 0be575e44c alpine: update symlinks 2023-06-22 10:26:41 +02:00
Maxwell G 669fda8006 Remove references to fedora/latest in crontab
fedora/latest is just an alias and referencing it in the crontab leads
to ambiguity and confusion.
This makes image references explicit.
2023-06-22 10:22:26 +02:00
Maxwell G 3ee8fabf4e Move fedora/latest alias to fedora/38
Fedora 38 was officially released on 17 April 2023.

Ref: https://fedoramagazine.org/announcing-fedora-38/
2023-06-22 10:22:26 +02:00
Maxwell G c3b98144af images/fedora: don't use dnf install --refresh
The --refresh flag is not supported by dnf5 which is now the default in
Fedora Rawhide. The fedora/rawhide image is completely broken without
this change.
2023-06-22 10:02:41 +02:00
Maxwell G 45d4a84c16 images/fedora: clean package cache
The package metadata cache unnecessarily inflates the size of the image.
2023-06-22 10:02:39 +02:00
Thorben Günther ec7575edc0 archlinux: Update pacman config
The community repository got merged into extra [1].

[1]: https://archlinux.org/news/git-migration-announcement/
2023-06-22 10:02:19 +02:00
Conrad Hoffmann 9032a100d0 images/alpine: add 3.18 2023-06-22 10:02:15 +02:00
Taavi Väänänen dcb4e98ff5 images/debian: Drop buster (now oldoldstable) 2023-06-22 10:02:12 +02:00
Taavi Väänänen f88dd29122 images/debian: Update for bookworm release
* Add trixie as the new testing release.
* Update the testing,stable,oldstable aliases to point to the correct
  distributions (trixie,bookworm,bullseye).
2023-06-22 10:02:12 +02:00
Ignas Kiela 9ad4dbb8e9 Track number of builds currently running and export number of build slots
Duration histogram tracks the number of builds finished, and having
the number of builds running, number of builds started is trivial to
calculate, while having a gauge for currently running jobs makes it
easier to find current utilization. Additionally, a status label for
duration metric is added, to keep track of the distribution of different
build statuses that was kept by the builds finished metric.
2023-06-22 10:00:01 +02:00