pat-s
5c4cca6cce
Part of https://codefloe.com/rpkgs/bincraft/issues/225. Stacked on #234. Every connection to the metadata database used `sslmode = 'require'`, which encrypts but does not authenticate the server, so anyone able to impersonate `r-binaries.devxy.io:15432` would receive `PGPASS`. ## Changes - `.crow/build-all-versions.yaml`, `process-updates.yaml`, `prune-stale-flat-binaries.yaml`, `reindex.yaml`, `weekly-rebuild-reindex.yaml`: `metadata_db_sslmode = 'verify-full'` in every bincraft call. - `local/*.R`: the same for bincraft calls; scripts that call `DBI::dbConnect()` directly also pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")`, because libpq looks for `~/.postgresql/root.crt` rather than the system trust store. - `README.md`: note that the endpoint serves a Let's Encrypt certificate and how to verify it. - air reformatted three `=` assignments to `<-` in `local/missing-cran-packages-db.R` and `local/packages-without-any-binary.R` while the hook ran on those files. ## Ordering: merge last 1. devxy/k8s-talos#417 must be live: today the server presents an in-cluster certificate from a private CA, which `verify-full` rejects. 2. https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: `local/install-bincraft.R` installs the latest tag, and older releases neither pass a root certificate nor export `postgres_sslrootcert()`. 3. #234 must be merged. Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline. Reviewed-on: #235
72 lines
2.4 KiB
R
72 lines
2.4 KiB
R
source(file.path("local", "newer-r-helpers.R"))
|
|
source(file.path("local", "rebuild-missing-helpers.R"))
|
|
|
|
args <- commandArgs(trailingOnly = TRUE)
|
|
pos <- args[!startsWith(args, "--")]
|
|
if (!length(pos) %in% c(1L, 3L)) {
|
|
stop("Usage: build-newer-r.R PRIMARY_R [SPLIT_INTO SPLIT_INDEX] [--dry-run]")
|
|
}
|
|
primary_r <- pos[1L]
|
|
target_r <- as.character(getRversion())
|
|
pkgs <- newer_r_candidates(tools::CRAN_package_db(), primary_r, target_r)
|
|
exclude <- jsonlite::fromJSON("local/excluded-packages.json")[["package"]]
|
|
pkgs <- pkgs[!pkgs$Package %in% exclude, , drop = FALSE]
|
|
if (length(pos) == 3L) {
|
|
pkgs <- pkgs[
|
|
shard_slice(seq_len(nrow(pkgs)), pos[2L], pos[3L]),
|
|
,
|
|
drop = FALSE
|
|
]
|
|
}
|
|
message(sprintf(
|
|
"R %s: %d package(s) unsupported by primary R %s",
|
|
target_r,
|
|
nrow(pkgs),
|
|
primary_r
|
|
))
|
|
if ("--dry-run" %in% args) {
|
|
print(pkgs, row.names = FALSE)
|
|
} else {
|
|
options(crayon.enabled = TRUE, Ncpus = 4, future.globals.onReference = NULL)
|
|
for (i in seq_len(nrow(pkgs))) {
|
|
message(sprintf(
|
|
"[%d/%d] %s %s",
|
|
i,
|
|
nrow(pkgs),
|
|
pkgs$Package[i],
|
|
pkgs$Version[i]
|
|
))
|
|
bincraft::build_binary_package(
|
|
pkgs$Package[i],
|
|
tag = pkgs$Version[i],
|
|
# Keep bincraft's normal ABI routing: safe binaries can be shared;
|
|
# sensitive ones use this interpreter's minor for presence and output.
|
|
is_r_minor_sensitive = bincraft::classify_r_minor_sensitive(
|
|
pkgs$Package[i],
|
|
pkgs$Version[i],
|
|
metadata_db_host = "r-binaries.devxy.io",
|
|
metadata_db_name = "build_metadata",
|
|
metadata_db_user = "rpkgs",
|
|
metadata_db_password = Sys.getenv("PGPASS"),
|
|
metadata_db_sslmode = "verify-full",
|
|
metadata_db_port = 15432
|
|
),
|
|
s3_endpoint = "https://s3.eu-central-003.backblazeb2.com",
|
|
s3_region = "eu-central-003",
|
|
s3_bucket = "devxy-rpkgs-binaries",
|
|
s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
|
|
s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"),
|
|
metadata_db_host = "r-binaries.devxy.io",
|
|
metadata_db_name = "build_metadata",
|
|
metadata_db_table = "single_builds",
|
|
metadata_db_user = "rpkgs",
|
|
metadata_db_password = Sys.getenv("PGPASS"),
|
|
metadata_db_sslmode = "verify-full",
|
|
metadata_db_port = 15432,
|
|
archive = TRUE,
|
|
patches = "local/patches",
|
|
upload = TRUE,
|
|
store_build_metadata = TRUE
|
|
)
|
|
}
|
|
}
|