pat-s
5c4cca6cce
Part of https://codefloe.com/rpkgs/bincraft/issues/225. Stacked on #234. Every connection to the metadata database used `sslmode = 'require'`, which encrypts but does not authenticate the server, so anyone able to impersonate `r-binaries.devxy.io:15432` would receive `PGPASS`. ## Changes - `.crow/build-all-versions.yaml`, `process-updates.yaml`, `prune-stale-flat-binaries.yaml`, `reindex.yaml`, `weekly-rebuild-reindex.yaml`: `metadata_db_sslmode = 'verify-full'` in every bincraft call. - `local/*.R`: the same for bincraft calls; scripts that call `DBI::dbConnect()` directly also pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")`, because libpq looks for `~/.postgresql/root.crt` rather than the system trust store. - `README.md`: note that the endpoint serves a Let's Encrypt certificate and how to verify it. - air reformatted three `=` assignments to `<-` in `local/missing-cran-packages-db.R` and `local/packages-without-any-binary.R` while the hook ran on those files. ## Ordering: merge last 1. devxy/k8s-talos#417 must be live: today the server presents an in-cluster certificate from a private CA, which `verify-full` rejects. 2. https://codefloe.com/rpkgs/bincraft/pulls/226 must be released: `local/install-bincraft.R` installs the latest tag, and older releases neither pass a root certificate nor export `postgres_sslrootcert()`. 3. #234 must be merged. Merging early fails every database connection in CI, and since #234 per-minor reindex failures fail the pipeline. Reviewed-on: #235
44 lines
1.1 KiB
R
44 lines
1.1 KiB
R
### Lists packages without any successful binaries, i.e. pkgs for which all builds errored (per platform & arch)
|
|
library(DBI)
|
|
library(dplyr)
|
|
con <- DBI::dbConnect(
|
|
RPostgres::Postgres(),
|
|
dbname = "build_metadata",
|
|
host = "r-binaries.devxy.io",
|
|
port = 15432,
|
|
user = "r_binaries",
|
|
password = Sys.getenv("PGPASS"),
|
|
sslmode = "verify-full",
|
|
sslrootcert = bincraft::postgres_sslrootcert("verify-full")
|
|
)
|
|
|
|
cran_pkgs <- tools::CRAN_package_db() |>
|
|
filter(`Date/Publication` <= "2024-12-02") |>
|
|
pull(Package)
|
|
|
|
data <- dbGetQuery(
|
|
con,
|
|
"SELECT name,platform,arch,removed,error_occurred FROM single_builds;"
|
|
)
|
|
|
|
pkgs <- data |>
|
|
filter(platform == "alpine-320", arch == "arm64") |>
|
|
filter(removed == FALSE) |>
|
|
filter(error_occurred == FALSE) |>
|
|
distinct(name) |>
|
|
pull(name)
|
|
|
|
pkgs <- setdiff(cran_pkgs, pkgs)
|
|
# Format, remove line breaks, and print as a single line
|
|
formatted_pkgs <- gsub(
|
|
'"',
|
|
"'",
|
|
capture.output(dput(as.character(na.omit(pkgs[1:900]))))
|
|
)
|
|
|
|
formatted_pkgs_one_line <- paste(formatted_pkgs, collapse = " ")
|
|
|
|
cat(formatted_pkgs_one_line, "\n", sep = "")
|
|
length(pkgs)
|
|
|
|
clipr::write_clip(formatted_pkgs_one_line)
|