From 8a7942d7d763d3fac09a26d3e38659c7524c81a1 Mon Sep 17 00:00:00 2001 From: pat-s Date: Sat, 17 Oct 2026 07:18:36 +0000 Subject: [PATCH 1/2] fix(ci): pass the metadata DB to per-minor reindexes and fail on errors - Pass `metadata_db_*` explicitly to every per-minor `upload_package_index()` call, so bincraft can drop its implicit production defaults (rpkgs/bincraft#211). - Replace `|| true` in the per-minor reindex loops with a failure list, so every minor is still attempted but a failed reindex fails the step. - Give the "Upload package indexes" step of build-all-versions the `PGPASS` secret, without which its per-minor reindexes always aborted. - Run the CDN purge in process-updates and prune-stale-flat-binaries even when a reindex failed, as reindex.yaml already does. - Fail local/repair-built-stamp.R when a per-minor reindex fails instead of only printing the error. --- .crow/build-all-versions.yaml | 11 ++++++- .crow/process-updates.yaml | 11 ++++++- .crow/prune-stale-flat-binaries.yaml | 11 ++++++- .crow/reindex.yaml | 7 +++- .crow/weekly-rebuild-reindex.yaml | 7 +++- local/repair-built-stamp.R | 48 +++++++++++++++++++++------- 6 files changed, 79 insertions(+), 16 deletions(-) diff --git a/.crow/build-all-versions.yaml b/.crow/build-all-versions.yaml index ce3bc09..c6d1bfb 100644 --- a/.crow/build-all-versions.yaml +++ b/.crow/build-all-versions.yaml @@ -193,6 +193,10 @@ steps: from_secret: B2_S3_ACCESS_KEY B2_S3_SECRET_KEY: from_secret: B2_S3_SECRET_KEY + # A per-minor index reads the ABI classifier cache and the flat-object + # safety table from the build database, and is not republished without it. + PGPASS: + from_secret: PGPASS R_LIBS_USER: /mnt/cache/R-pkgs volumes: - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache @@ -200,10 +204,15 @@ steps: - | CODENAME=$(/opt/R/$R_VERSION/bin/Rscript -e "cat(bincraft::set_codename(NULL))") /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" + FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true + /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done + if [ -n "$FAILED_MINORS" ]; then + echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 + exit 1 + fi backend_options: docker: resources: diff --git a/.crow/process-updates.yaml b/.crow/process-updates.yaml index 531a47f..1824de0 100644 --- a/.crow/process-updates.yaml +++ b/.crow/process-updates.yaml @@ -212,10 +212,15 @@ steps: done - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(codename = "${OS_ID}", s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))' - | + FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(codename = '${OS_ID}', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true + /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(codename = '${OS_ID}', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done + if [ -n "$FAILED_MINORS" ]; then + echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 + exit 1 + fi backend_options: docker: resources: @@ -242,3 +247,7 @@ steps: commands: - apk add --no-cache -q bash curl - bash scripts/purge_cdn_cache.sh "$BUNNYNET_API_KEY" "$ARCH" "$OS_ID" "$SUBDOMAIN1" "$SUBDOMAIN2" "$SUBDOMAIN3" + # Run it even when a per-minor re-index above failed: the generic index + # and the objects were still replaced, and a stale edge keeps them hidden. + when: + - status: [success, failure] diff --git a/.crow/prune-stale-flat-binaries.yaml b/.crow/prune-stale-flat-binaries.yaml index 79ca003..6f76c68 100644 --- a/.crow/prune-stale-flat-binaries.yaml +++ b/.crow/prune-stale-flat-binaries.yaml @@ -209,10 +209,15 @@ steps: exit 0 fi /opt/R/4.5.3/bin/R -q -e 'library(bincraft); upload_package_index(s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))' + FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/4.5.3/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true + /opt/R/4.5.3/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done + if [ -n "$FAILED_MINORS" ]; then + echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 + exit 1 + fi backend_options: docker: resources: @@ -240,3 +245,7 @@ steps: fi apk add --no-cache -q bash curl jq bash scripts/purge_cdn_zone.sh "$BUNNYNET_API_KEY" $BUNNY_PULLZONES + # Run it even when a per-minor re-index above failed: the generic index + # and the objects were still replaced, and a stale edge keeps them hidden. + when: + - status: [success, failure] diff --git a/.crow/reindex.yaml b/.crow/reindex.yaml index 803d9a5..8a681f1 100644 --- a/.crow/reindex.yaml +++ b/.crow/reindex.yaml @@ -162,10 +162,15 @@ steps: # The codename is detected from the image's /etc/os-release. - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))' - | + FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true + /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done + if [ -n "$FAILED_MINORS" ]; then + echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 + exit 1 + fi - name: Purge CDN cache image: reg.devxy.io/docker.io/library/alpine:3.24 diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml index 698f503..342b7b5 100644 --- a/.crow/weekly-rebuild-reindex.yaml +++ b/.crow/weekly-rebuild-reindex.yaml @@ -165,10 +165,15 @@ steps: # The codename is detected from the image's /etc/os-release. - /opt/R/$R_VERSION/bin/R -q -e 'library(bincraft); upload_package_index(s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", s3_region = "eu-central-003", s3_bucket = "devxy-rpkgs-binaries", s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"))' - | + FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'))" || true + /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done + if [ -n "$FAILED_MINORS" ]; then + echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 + exit 1 + fi - name: Purge CDN cache image: reg.devxy.io/docker.io/library/alpine:3.24 diff --git a/local/repair-built-stamp.R b/local/repair-built-stamp.R index 06f73be..7099bfd 100644 --- a/local/repair-built-stamp.R +++ b/local/repair-built-stamp.R @@ -152,18 +152,44 @@ bincraft::upload_package_index( s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY") ) +# A per-minor index reads the ABI classifier cache and the flat-object safety +# table from the build database. A failed minor does not stop the others, but +# it does fail the run once they are done. +failed_minors <- character(0L) for (minor in r_minors) { - try( - bincraft::upload_package_index( - codename = codename, - r_minor = minor, - s3_endpoint = endpoint, - s3_region = region, - s3_bucket = bucket, - s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), - s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY") - ), - silent = FALSE + ok <- tryCatch( + { + bincraft::upload_package_index( + codename = codename, + r_minor = minor, + s3_endpoint = endpoint, + s3_region = region, + s3_bucket = bucket, + s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"), + s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"), + metadata_db_host = "r-binaries.devxy.io", + metadata_db_name = "build_metadata", + metadata_db_port = 15432L, + metadata_db_user = "rpkgs", + metadata_db_password = Sys.getenv("PGPASS"), + metadata_db_sslmode = "require" + ) + TRUE + }, + error = function(e) { + message(sprintf("Re-indexing %s failed: %s", minor, conditionMessage(e))) + FALSE + } + ) + if (!ok) { + failed_minors <- c(failed_minors, minor) + } +} +if (length(failed_minors) > 0L) { + stop( + "Could not republish the per-minor index for: ", + paste(failed_minors, collapse = ", "), + call. = FALSE ) } -- 2.54.0 From 5c4cca6cceca88abbdf0af0a052e86df3386470b Mon Sep 17 00:00:00 2001 From: pat-s Date: Sat, 17 Oct 2026 07:45:46 +0000 Subject: [PATCH 2/2] fix: verify the metadata database certificate with sslmode=verify-full (#235) Part of https://codefloe.com/rpkgs/bincraft/issues/225. Stacked on #234. Every connection to the metadata database used `sslmode = 'require'`, which encrypts but does not authenticate the server, so anyone able to impersonate `r-binaries.devxy.io:15432` would receive `PGPASS`. ## Changes - `.crow/build-all-versions.yaml`, `process-updates.yaml`, `prune-stale-flat-binaries.yaml`, `reindex.yaml`, `weekly-rebuild-reindex.yaml`: `metadata_db_sslmode = 'verify-full'` in every bincraft call. - `local/*.R`: the same for bincraft calls; scripts that call `DBI::dbConnect()` directly also pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")`, because libpq looks for `~/.postgresql/root.crt` rather than the system trust store. - `README.md`: note that the endpoint serves a Let's Encrypt certificate and how to verify it. - air reformatted three `=` assignments to `<-` in `local/missing-cran-packages-db.R` and `local/packages-without-any-binary.R` while the hook ran on those files. ## Ordering: merge last 1. https://git.devxy.io/devxy/k8s-talos/pulls/417 must be live: today the server presents an in-cluster certificate from a private CA, which `verify-full` rejects. 2. https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: `local/install-bincraft.R` installs the latest tag, and older releases neither pass a root certificate nor export `postgres_sslrootcert()`. 3. #234 must be merged. Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline. Reviewed-on: https://git.devxy.io/devxy/build-cran-binaries/pulls/235 --- .crow/build-all-versions.yaml | 2 +- .crow/process-updates.yaml | 6 +++--- .crow/prune-stale-flat-binaries.yaml | 2 +- .crow/reindex.yaml | 2 +- .crow/weekly-rebuild-reindex.yaml | 2 +- README.md | 1 + local/backfill-abi-classification.R | 2 +- local/build-all.R | 5 +++-- local/build-newer-r.R | 4 ++-- local/build-one.R | 2 +- local/failing-builds-report.R | 3 ++- local/label-removed-cran-packages.R | 3 ++- local/list-unsafe-flat-objects.R | 3 ++- local/missing-cran-packages-db.R | 7 ++++--- local/packages-to-build.R | 3 ++- local/packages-without-any-binary.R | 5 +++-- local/proposal-tracking.R | 3 ++- local/propose-patches.R | 3 ++- local/prune-stale-flat-binaries.R | 3 ++- local/rebuild-missing.R | 2 +- local/repair-built-stamp.R | 2 +- local/weekly-missing-binaries-audit.R | 3 ++- 22 files changed, 40 insertions(+), 28 deletions(-) diff --git a/.crow/build-all-versions.yaml b/.crow/build-all-versions.yaml index c6d1bfb..c5dc8b9 100644 --- a/.crow/build-all-versions.yaml +++ b/.crow/build-all-versions.yaml @@ -207,7 +207,7 @@ steps: FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" + /opt/R/$R_VERSION/bin/R -q -e "bincraft::upload_package_index(codename = '$CODENAME', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done if [ -n "$FAILED_MINORS" ]; then echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 diff --git a/.crow/process-updates.yaml b/.crow/process-updates.yaml index 1824de0..59f2f33 100644 --- a/.crow/process-updates.yaml +++ b/.crow/process-updates.yaml @@ -194,7 +194,7 @@ steps: # rhel-10 ships xwfb-run (Xwayland) instead of xvfb-run; prefer it and start weston, else fall back to xvfb-run - XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); XVFB_ARGS="-a"; if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi # options(future.globals.onReference = NULL): for some reason s3fs::file_delete() throws 'Error: Detected a non-exportable reference ('externalptr') in one of the globals ('FUN' of class 'function') used in the future expression' otherwise - - $XVFB $XVFB_ARGS -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = ${PROCESS_NEW}, process_removed = TRUE, patches = 'local/patches', r_minor_detection = 'classifier',s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)" + - $XVFB $XVFB_ARGS -- /opt/R/$R_VERSION/bin/R -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = 'error', repos = structure(c(getOption('repos'),INLA='https://inla.r-inla-download.org/R/stable'))); progressr::handlers('cli'); progressr::handlers(global = TRUE); options(future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = ${PROCESS_NEW}, process_removed = TRUE, patches = 'local/patches', r_minor_detection = 'classifier',s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)" - | PRIMARY_MINOR=$(echo "$R_VERSION" | cut -d. -f1-2) for RBIN in /opt/R/[0-9]*/bin/R; do @@ -206,7 +206,7 @@ steps: mkdir -p "$LIB" R_LIBS_USER="$LIB" "$(dirname "$RBIN")/Rscript" local/install-bincraft.R || true R_LIBS_USER="$LIB" UVR_R_BIN="$RBIN" local/uvr-install.sh RPostgres || true - R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -- "$(dirname "$RBIN")/R" -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = FALSE, process_removed = FALSE, patches = 'local/patches', r_minor_detection = 'classifier',r_minor_sensitive_only = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)" || true + R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -- "$(dirname "$RBIN")/R" -q -e "options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = NULL); bincraft::process_cran_updates(interval = $INTERVAL, platform = '${OS}', process_updated = TRUE, process_new = FALSE, process_removed = FALSE, patches = 'local/patches', r_minor_detection = 'classifier',r_minor_sensitive_only = TRUE, s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_table = 'single_builds', metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full', metadata_db_port = 15432, archive = TRUE, upload = TRUE, store_build_metadata = TRUE)" || true # Also build current packages whose required dependency tree needs a newer R. R_LIBS_USER="$LIB" $XVFB $XVFB_ARGS -- "$(dirname "$RBIN")/Rscript" local/build-newer-r.R "$R_VERSION" done @@ -215,7 +215,7 @@ steps: FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(codename = '${OS_ID}', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" + /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(codename = '${OS_ID}', r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done if [ -n "$FAILED_MINORS" ]; then echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 diff --git a/.crow/prune-stale-flat-binaries.yaml b/.crow/prune-stale-flat-binaries.yaml index 6f76c68..dc33a9a 100644 --- a/.crow/prune-stale-flat-binaries.yaml +++ b/.crow/prune-stale-flat-binaries.yaml @@ -212,7 +212,7 @@ steps: FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/4.5.3/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" + /opt/R/4.5.3/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done if [ -n "$FAILED_MINORS" ]; then echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 diff --git a/.crow/reindex.yaml b/.crow/reindex.yaml index 8a681f1..5d61ca4 100644 --- a/.crow/reindex.yaml +++ b/.crow/reindex.yaml @@ -165,7 +165,7 @@ steps: FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" + /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done if [ -n "$FAILED_MINORS" ]; then echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml index 342b7b5..9e53848 100644 --- a/.crow/weekly-rebuild-reindex.yaml +++ b/.crow/weekly-rebuild-reindex.yaml @@ -168,7 +168,7 @@ steps: FAILED_MINORS="" for RBIN in /opt/R/[0-9]*/bin/R; do RMINOR=$(basename "$(dirname "$(dirname "$RBIN")")" | cut -d. -f1-2) - /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'require')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" + /opt/R/$R_VERSION/bin/R -q -e "library(bincraft); upload_package_index(r_minor = '$RMINOR', s3_endpoint = 'https://s3.eu-central-003.backblazeb2.com', s3_region = 'eu-central-003', s3_bucket = 'devxy-rpkgs-binaries', s3_access_key_id = Sys.getenv('B2_S3_ACCESS_KEY'), s3_secret_access_key = Sys.getenv('B2_S3_SECRET_KEY'), metadata_db_host = 'r-binaries.devxy.io', metadata_db_name = 'build_metadata', metadata_db_port = 15432L, metadata_db_user = 'rpkgs', metadata_db_password = Sys.getenv('PGPASS'), metadata_db_sslmode = 'verify-full')" || FAILED_MINORS="$FAILED_MINORS $RMINOR" done if [ -n "$FAILED_MINORS" ]; then echo "Could not republish the per-minor index for:$FAILED_MINORS" >&2 diff --git a/README.md b/README.md index 99d1143..81fd67b 100644 --- a/README.md +++ b/README.md @@ -139,6 +139,7 @@ For Alpine, no rules existed until recently, establishing a foundation for semi- The build metadata is stored in a PostgreSQL database. The database has a public endpoint at `r-binaries.devxy.io` and port `15432`. +It serves a Let's Encrypt certificate for that name, so connect with `sslmode=verify-full`; from R, pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` as well, since libpq does not read the system trust store by default. It contains one table named `single_builds`, which holds the build metadata for each package: | package_name | tag | platform | error_occurred | build_timestamp | build_duration | error | size | removed | diff --git a/local/backfill-abi-classification.R b/local/backfill-abi-classification.R index 0f48392..c964a86 100644 --- a/local/backfill-abi-classification.R +++ b/local/backfill-abi-classification.R @@ -47,7 +47,7 @@ db <- list( metadata_db_port = 15432L, metadata_db_user = "rpkgs", metadata_db_password = Sys.getenv("PGPASS"), - metadata_db_sslmode = "require" + metadata_db_sslmode = "verify-full" ) read_index <- function(index_url) { diff --git a/local/build-all.R b/local/build-all.R index 349092f..bd1aefb 100644 --- a/local/build-all.R +++ b/local/build-all.R @@ -152,7 +152,8 @@ con <- DBI::dbConnect( port = 15432, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) # Scope the skip to the R minor this pass is running under. `single_builds` # records `r_version` per attempt, but querying without it made a non-primary @@ -250,7 +251,7 @@ mapply( metadata_db_table = "single_builds", metadata_db_user = "rpkgs", metadata_db_password = Sys.getenv("PGPASS"), - metadata_db_sslmode = "require", + metadata_db_sslmode = "verify-full", metadata_db_port = 15432, archive = TRUE, patches = "local/patches", diff --git a/local/build-newer-r.R b/local/build-newer-r.R index 3d7794f..6478200 100644 --- a/local/build-newer-r.R +++ b/local/build-newer-r.R @@ -48,7 +48,7 @@ if ("--dry-run" %in% args) { metadata_db_name = "build_metadata", metadata_db_user = "rpkgs", metadata_db_password = Sys.getenv("PGPASS"), - metadata_db_sslmode = "require", + metadata_db_sslmode = "verify-full", metadata_db_port = 15432 ), s3_endpoint = "https://s3.eu-central-003.backblazeb2.com", @@ -61,7 +61,7 @@ if ("--dry-run" %in% args) { metadata_db_table = "single_builds", metadata_db_user = "rpkgs", metadata_db_password = Sys.getenv("PGPASS"), - metadata_db_sslmode = "require", + metadata_db_sslmode = "verify-full", metadata_db_port = 15432, archive = TRUE, patches = "local/patches", diff --git a/local/build-one.R b/local/build-one.R index 07c0b6a..25aae6e 100644 --- a/local/build-one.R +++ b/local/build-one.R @@ -115,7 +115,7 @@ for (ver in versions) { metadata_db_table = "single_builds", metadata_db_user = "rpkgs", metadata_db_password = Sys.getenv("PGPASS"), - metadata_db_sslmode = "require", + metadata_db_sslmode = "verify-full", metadata_db_port = 15432 ) if (sensitive) touched_minor <- TRUE else touched_generic <- TRUE diff --git a/local/failing-builds-report.R b/local/failing-builds-report.R index ce7b683..b9df756 100644 --- a/local/failing-builds-report.R +++ b/local/failing-builds-report.R @@ -69,7 +69,8 @@ con <- DBI::dbConnect( port = 15432, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) on.exit(DBI::dbDisconnect(con), add = TRUE) diff --git a/local/label-removed-cran-packages.R b/local/label-removed-cran-packages.R index 12dff9d..a6ba36a 100644 --- a/local/label-removed-cran-packages.R +++ b/local/label-removed-cran-packages.R @@ -13,7 +13,8 @@ con <- DBI::dbConnect( port = 15432, user = "r_binaries", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) pkgs_db <- query_metadata_table() |> diff --git a/local/list-unsafe-flat-objects.R b/local/list-unsafe-flat-objects.R index 60649a2..fca0a9d 100644 --- a/local/list-unsafe-flat-objects.R +++ b/local/list-unsafe-flat-objects.R @@ -30,7 +30,8 @@ con <- DBI::dbConnect( port = 15432L, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) on.exit(try(DBI::dbDisconnect(con), silent = TRUE), add = TRUE) diff --git a/local/missing-cran-packages-db.R b/local/missing-cran-packages-db.R index 882bca4..0c73e99 100644 --- a/local/missing-cran-packages-db.R +++ b/local/missing-cran-packages-db.R @@ -10,7 +10,8 @@ con <- DBI::dbConnect( port = 15432, user = "r_binaries", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) `%nin%` <- Negate(`%in%`) @@ -45,12 +46,12 @@ data <- dbGetQuery( "SELECT name FROM single_builds WHERE platform = $1 AND arch = $2 and removed = FALSE;", params = list(platform, arch) ) -removed_pkgs = get_removed_cran_packages(lubridate::interval( +removed_pkgs <- get_removed_cran_packages(lubridate::interval( lubridate::today(), lubridate::today() - 2 ))$name pkgs_db <- unique(data$name) -pkgs_db = setdiff(pkgs_db, removed_pkgs) +pkgs_db <- setdiff(pkgs_db, removed_pkgs) pkgs <- setdiff(cran_pkgs, pkgs_db) formatted_pkgs <- gsub( diff --git a/local/packages-to-build.R b/local/packages-to-build.R index 31b667f..940cf83 100644 --- a/local/packages-to-build.R +++ b/local/packages-to-build.R @@ -32,7 +32,8 @@ con <- DBI::dbConnect( port = 15432, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) cran_archive <- tools::CRAN_archive_db() diff --git a/local/packages-without-any-binary.R b/local/packages-without-any-binary.R index f42196f..870dc6e 100644 --- a/local/packages-without-any-binary.R +++ b/local/packages-without-any-binary.R @@ -8,7 +8,8 @@ con <- DBI::dbConnect( port = 15432, user = "r_binaries", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) cran_pkgs <- tools::CRAN_package_db() |> @@ -27,7 +28,7 @@ pkgs <- data |> distinct(name) |> pull(name) -pkgs = setdiff(cran_pkgs, pkgs) +pkgs <- setdiff(cran_pkgs, pkgs) # Format, remove line breaks, and print as a single line formatted_pkgs <- gsub( '"', diff --git a/local/proposal-tracking.R b/local/proposal-tracking.R index f8e1284..82d0beb 100644 --- a/local/proposal-tracking.R +++ b/local/proposal-tracking.R @@ -53,7 +53,8 @@ con <- DBI::dbConnect( port = 15432, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) on.exit(DBI::dbDisconnect(con), add = TRUE) diff --git a/local/propose-patches.R b/local/propose-patches.R index 360df9f..52a62b8 100644 --- a/local/propose-patches.R +++ b/local/propose-patches.R @@ -87,7 +87,8 @@ con <- DBI::dbConnect( port = 15432, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) on.exit(DBI::dbDisconnect(con), add = TRUE) diff --git a/local/prune-stale-flat-binaries.R b/local/prune-stale-flat-binaries.R index aea97b4..a821d3f 100644 --- a/local/prune-stale-flat-binaries.R +++ b/local/prune-stale-flat-binaries.R @@ -86,7 +86,8 @@ if (length(explicit) > 0L) { port = 15432L, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) on.exit(try(DBI::dbDisconnect(con), silent = TRUE), add = TRUE) diff --git a/local/rebuild-missing.R b/local/rebuild-missing.R index 369024e..5d518e0 100644 --- a/local/rebuild-missing.R +++ b/local/rebuild-missing.R @@ -171,7 +171,7 @@ for (i in seq_along(mine)) { metadata_db_table = "single_builds", metadata_db_user = "rpkgs", metadata_db_password = Sys.getenv("PGPASS"), - metadata_db_sslmode = "require", + metadata_db_sslmode = "verify-full", metadata_db_port = 15432, archive = TRUE, upload = TRUE, diff --git a/local/repair-built-stamp.R b/local/repair-built-stamp.R index 7099bfd..65aeaa5 100644 --- a/local/repair-built-stamp.R +++ b/local/repair-built-stamp.R @@ -172,7 +172,7 @@ for (minor in r_minors) { metadata_db_port = 15432L, metadata_db_user = "rpkgs", metadata_db_password = Sys.getenv("PGPASS"), - metadata_db_sslmode = "require" + metadata_db_sslmode = "verify-full" ) TRUE }, diff --git a/local/weekly-missing-binaries-audit.R b/local/weekly-missing-binaries-audit.R index e7ca776..c999e37 100644 --- a/local/weekly-missing-binaries-audit.R +++ b/local/weekly-missing-binaries-audit.R @@ -60,7 +60,8 @@ con <- DBI::dbConnect( port = 15432, user = "rpkgs", password = Sys.getenv("PGPASS"), - sslmode = "require" + sslmode = "verify-full", + sslrootcert = bincraft::postgres_sslrootcert("verify-full") ) errored_pkgs <- DBI::dbGetQuery( -- 2.54.0