pat-s
5c4cca6cce
Part of https://codefloe.com/rpkgs/bincraft/issues/225. Stacked on #234. Every connection to the metadata database used `sslmode = 'require'`, which encrypts but does not authenticate the server, so anyone able to impersonate `r-binaries.devxy.io:15432` would receive `PGPASS`. ## Changes - `.crow/build-all-versions.yaml`, `process-updates.yaml`, `prune-stale-flat-binaries.yaml`, `reindex.yaml`, `weekly-rebuild-reindex.yaml`: `metadata_db_sslmode = 'verify-full'` in every bincraft call. - `local/*.R`: the same for bincraft calls; scripts that call `DBI::dbConnect()` directly also pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")`, because libpq looks for `~/.postgresql/root.crt` rather than the system trust store. - `README.md`: note that the endpoint serves a Let's Encrypt certificate and how to verify it. - air reformatted three `=` assignments to `<-` in `local/missing-cran-packages-db.R` and `local/packages-without-any-binary.R` while the hook ran on those files. ## Ordering: merge last 1. devxy/k8s-talos#417 must be live: today the server presents an in-cluster certificate from a private CA, which `verify-full` rejects. 2. https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: `local/install-bincraft.R` installs the latest tag, and older releases neither pass a root certificate nor export `postgres_sslrootcert()`. 3. #234 must be merged. Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline. Reviewed-on: #235
35 lines
919 B
R
35 lines
919 B
R
### Scope: List decomisisoned CRAN packages and updates them in the metadata DB
|
|
library(dplyr)
|
|
library(bincraft)
|
|
archived <- quickcode::archivedPkg() |>
|
|
filter(arch.status == "decom") |>
|
|
pull(name)
|
|
|
|
# Query all distinct pkgs in the DB
|
|
con <- DBI::dbConnect(
|
|
RPostgres::Postgres(),
|
|
dbname = "build_metadata",
|
|
host = "r-binaries.devxy.io",
|
|
port = 15432,
|
|
user = "r_binaries",
|
|
password = Sys.getenv("PGPASS"),
|
|
sslmode = "verify-full",
|
|
sslrootcert = bincraft::postgres_sslrootcert("verify-full")
|
|
)
|
|
|
|
pkgs_db <- query_metadata_table() |>
|
|
filter(removed == FALSE) |>
|
|
distinct(name) |>
|
|
pull(name)
|
|
|
|
# Check which pkgs in the DB match with the decomissioned ones
|
|
to_process <- pkgs_db[pkgs_db %in% archived]
|
|
|
|
# for all matches, set 'removed = TRUE'
|
|
sapply(to_process, function(.x) {
|
|
DBI::dbExecute(
|
|
con,
|
|
"UPDATE single_builds SET removed = 'TRUE' where name = $1",
|
|
params = list(.x)
|
|
)
|
|
})
|