pat-s
5c4cca6cce
Part of https://codefloe.com/rpkgs/bincraft/issues/225. Stacked on #234. Every connection to the metadata database used `sslmode = 'require'`, which encrypts but does not authenticate the server, so anyone able to impersonate `r-binaries.devxy.io:15432` would receive `PGPASS`. ## Changes - `.crow/build-all-versions.yaml`, `process-updates.yaml`, `prune-stale-flat-binaries.yaml`, `reindex.yaml`, `weekly-rebuild-reindex.yaml`: `metadata_db_sslmode = 'verify-full'` in every bincraft call. - `local/*.R`: the same for bincraft calls; scripts that call `DBI::dbConnect()` directly also pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")`, because libpq looks for `~/.postgresql/root.crt` rather than the system trust store. - `README.md`: note that the endpoint serves a Let's Encrypt certificate and how to verify it. - air reformatted three `=` assignments to `<-` in `local/missing-cran-packages-db.R` and `local/packages-without-any-binary.R` while the hook ran on those files. ## Ordering: merge last 1. devxy/k8s-talos#417 must be live: today the server presents an in-cluster certificate from a private CA, which `verify-full` rejects. 2. https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: `local/install-bincraft.R` installs the latest tag, and older releases neither pass a root certificate nor export `postgres_sslrootcert()`. 3. #234 must be merged. Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline. Reviewed-on: #235
78 lines
2.1 KiB
R
78 lines
2.1 KiB
R
### Scope: Lists packages which are missing any DB entry compared to what is available on CRAN
|
|
library(bincraft)
|
|
library(dplyr)
|
|
library(DBI)
|
|
|
|
con <- DBI::dbConnect(
|
|
RPostgres::Postgres(),
|
|
dbname = "build_metadata",
|
|
host = "r-binaries.devxy.io",
|
|
port = 15432,
|
|
user = "r_binaries",
|
|
password = Sys.getenv("PGPASS"),
|
|
sslmode = "verify-full",
|
|
sslrootcert = bincraft::postgres_sslrootcert("verify-full")
|
|
)
|
|
|
|
`%nin%` <- Negate(`%in%`)
|
|
|
|
new_packages <- get_new_cran_packages(lubridate::interval(
|
|
lubridate::today(),
|
|
lubridate::today() - 2
|
|
))$name
|
|
removed_pkgs <- get_removed_cran_packages(lubridate::interval(
|
|
lubridate::today(),
|
|
lubridate::today() - 2
|
|
))$name
|
|
# filter windows packages
|
|
# filter new packages from the last X days
|
|
cran_pkgs <- unique(
|
|
tools::CRAN_package_db() |>
|
|
filter(`OS_type` != "windows" | is.na(`OS_type`)) |>
|
|
filter(`Package` %nin% new_packages) |>
|
|
pull(Package)
|
|
)
|
|
|
|
arch <- "arm64"
|
|
platform <- "redhat-8"
|
|
platform <- "redhat-9"
|
|
platform <- "alpine-320"
|
|
platform <- "alpine-321"
|
|
platform <- "ubuntu-2204"
|
|
platform <- "ubuntu-2404"
|
|
|
|
data <- dbGetQuery(
|
|
con,
|
|
"SELECT name FROM single_builds WHERE platform = $1 AND arch = $2 and removed = FALSE;",
|
|
params = list(platform, arch)
|
|
)
|
|
removed_pkgs <- get_removed_cran_packages(lubridate::interval(
|
|
lubridate::today(),
|
|
lubridate::today() - 2
|
|
))$name
|
|
pkgs_db <- unique(data$name)
|
|
pkgs_db <- setdiff(pkgs_db, removed_pkgs)
|
|
|
|
pkgs <- setdiff(cran_pkgs, pkgs_db)
|
|
formatted_pkgs <- gsub(
|
|
'"',
|
|
"'",
|
|
capture.output(dput(as.character(na.omit(pkgs[1:length(pkgs)]))))
|
|
)
|
|
formatted_pkgs_one_line <- paste(formatted_pkgs, collapse = " ")
|
|
|
|
cat(formatted_pkgs_one_line, "\n", sep = "")
|
|
length(pkgs)
|
|
|
|
clipr::write_clip(formatted_pkgs_one_line)
|
|
|
|
# sapply(pkgs, function(x) which(grepl(sprintf("^%s$", x), cran_pkgs)))
|
|
|
|
s3fs::s3_file_system(
|
|
aws_access_key_id = Sys.getenv("HETZNER_S3_ACCESS_KEY_K3S"),
|
|
aws_secret_access_key = Sys.getenv("HETZNER_S3_SECRET_KEY_K3S"),
|
|
endpoint = "https://hel1.your-objectstorage.com",
|
|
region_name = "hel1",
|
|
)
|
|
|
|
s3fs::s3_dir_delete("devxy-r-package-binaries-docs/_site")
|