poudriered: retain queue while listing it
The list operation passes the global queue to send_object(), which
consumes its argument. A subsequent list request can then release the
stale queue again and terminate the daemon.
Take a temporary queue reference for the response so the global queue
remains valid.
(cherry picked from commit dbabedc99030f7d13696a8dd4382c4756c31fb9d)
poudriered: retain queue while listing it
The list operation passes the global queue to send_object(), which
consumes its argument. A subsequent list request can then release the
stale queue again and terminate the daemon.
Take a temporary queue reference for the response so the global queue
remains valid.
Do not import symlinks from non-pkg package builds
The package phase lets the jail build user write to a host-backed
/.npkg directory. build_port() imported every file and symlink from
that directory into the host package repository. An absolute symlink
changes meaning at this boundary: it points inside the jail while
mounted but at the host after import.
Only the pkg bootstrap variants need package-manager compatibility
links. Process those links before their targets and reject any that
resolve outside staging. Import only regular files for other ports,
preventing their build output from introducing host-resolved symlinks
into the repository.
Reject untrusted poudriered log paths
Poudriered allowed any client-authorized command to specify a log
path. The root daemon created its parent directories and opened the
path with O_TRUNC.
Reject log fields on client requests. Preserve configured schedule
logs, use a root-owned /var/log fallback, and refuse to follow final
symlinks when opening logs.
(cherry picked from commit 01d5de2876a23701e41957826cd8115702c41684)
build.html: update "Failed Ports" title bar to match others
a63486e introduced a new title bar style, but failed_div seems to have have been missed. This brings failed_div into line with the others.
Reject untrusted poudriered log paths
Poudriered allowed any client-authorized command to specify a log
path. The root daemon created its parent directories and opened the
path with O_TRUNC.
Reject log fields on client requests. Preserve configured schedule
logs, use a root-owned /var/log fallback, and refuse to follow final
symlinks when opening logs.
Reject unsafe package names from ports metadata
PKGNAME is used to construct host-side package staging paths. A port
can supply traversal components and cause those paths to escape the
staging directory.
Validate package names when reading port metadata and before a build
worker uses one. This prevents path separators and dot traversal
components from reaching host filesystem operations.
Revert "bulk checksum: Don't retry fetch on failure if networking disabled."
This reverts commit 20dc590c29e35866065bcbccc60a8d015289488e.
Networking is disabled pre-fetch and post-checksum. So the refetch does
still have networking. It is done in case a cached file does not match
what's in distinfo / rerolled upstream. That is, reverting this fixes
fetching distinfo-expected rerolled distfiles.
What we want is probably to only call `make checksum` and not `make fetch`.
This would cause 1 fetch attempt and would redownload a rerolled
distfile. Rather than risk more regression here though just revert to
what works.
(cherry picked from commit 0198103a348b99189259957ff1edfa5636237c37)
Revert "bulk checksum: Don't retry fetch on failure if networking disabled."
This reverts commit 20dc590c29e35866065bcbccc60a8d015289488e.
Networking is disabled pre-fetch and post-checksum. So the refetch does
still have networking. It is done in case a cached file does not match
what's in distinfo / rerolled upstream. That is, reverting this fixes
fetching distinfo-expected rerolled distfiles.
What we want is probably to only call `make checksum` and not `make fetch`.
This would cause 1 fetch attempt and would redownload a rerolled
distfile. Rather than risk more regression here though just revert to
what works.
options: Improve performance by loading ports_env.
This is normally handled by jail_start() but poudriere-options does not use a
jail. Call setup_ports_env() directly like poudriere-distclean does.
Fixes #1335
(cherry picked from commit b8937a8306487fd94142b31315c6e15f5eb17000)
Conflicts:
src/share/poudriere/options.sh
Fix some fallout from removing DEPENDS_ARGS.
The have_ports_feature() was broken before and did not properly
have FLAVORS set where listed_ports() was used.
(cherry picked from commit af0f63dfcee7dfb2824e421cf3e80c865d4091a7)
