Skip to content
Snippets Groups Projects
Commit 253d6017 authored by Balasankar "Balu" C's avatar Balasankar "Balu" C
Browse files

Merge branch 'security-67-adopt-security' into 'master'

Prefer TOP_UPSTREAM_SOURCE_PROJECT if available and add security sources

See merge request gitlab-org/omnibus-gitlab!4302
parents 8f6032e0 39fbd0d7
No related branches found
No related tags found
No related merge requests found
gitlab-rails:
remote: "git@dev.gitlab.org:gitlab/gitlabhq.git"
alternative: "https://gitlab.com/gitlab-org/gitlab-foss.git"
security: "https://gitlab.com/gitlab-org/security/gitlab-foss.git"
gitlab-rails-ee:
remote: "git@dev.gitlab.org:gitlab/gitlab-ee.git"
alternative: "https://gitlab.com/gitlab-org/gitlab.git"
......@@ -4,6 +5,7 @@
gitlab-rails-ee:
remote: "git@dev.gitlab.org:gitlab/gitlab-ee.git"
alternative: "https://gitlab.com/gitlab-org/gitlab.git"
security: "https://gitlab.com/gitlab-org/security/gitlab.git"
gitlab-shell:
remote: "git@dev.gitlab.org:gitlab/gitlab-shell.git"
alternative: "https://gitlab.com/gitlab-org/gitlab-shell.git"
......
require 'yaml'
require 'uri'
require_relative "util.rb"
......@@ -10,6 +11,7 @@
@read_version = version || get_software_version
@project_root = File.join(File.dirname(__dir__), '../')
@software_sources = Gitlab::Util.get_env("ALTERNATIVE_SOURCES").to_s == "true" ? "alternative" : "remote"
@security_sources = Gitlab::Util.get_env("SECURITY_SOURCES").to_s == "true" ? "security" : nil
end
def get_software_version
......@@ -82,5 +84,5 @@
def remote
filepath = File.expand_path(".custom_sources.yml", @project_root)
software = YAML.load_file(filepath)[@software]
sources = YAML.load_file(filepath)[@software]
......@@ -86,7 +88,8 @@
if software
software[@software_sources]
if sources
security_source = attach_remote_credential(sources[@security_sources])
security_source || sources[@software_sources]
else
""
end
end
......@@ -89,6 +92,18 @@
else
""
end
end
def attach_remote_credential(url)
return unless url
uri = URI.parse(url)
uri.user = "gitlab-ci-token"
uri.password = Gitlab::Util.get_env("CI_JOB_TOKEN")
uri.to_s
rescue URI::InvalidURIError
# Git may use scp address which is not valid URI. Ignore it
url
end
end
end
......@@ -42,6 +42,51 @@
expect(subject.remote).to eq('https://gitlab.com/gitlab-org/gitlab.git')
end
end
context 'with SECURITY_SOURCES env variable explicitly set' do
before do
allow(ENV).to receive(:[]).and_call_original
allow(ENV).to receive(:[]).with("SECURITY_SOURCES").and_return("true")
allow(ENV).to receive(:[]).with("CI_JOB_TOKEN").and_return("CJT")
end
context 'when security source is defined for the software' do
let(:software) { 'gitlab-rails-ee' }
it 'returns "security" link attached with credential from custom_sources yml' do
expect(subject.remote).to eq('https://gitlab-ci-token:CJT@gitlab.com/gitlab-org/security/gitlab.git')
end
context 'when "security" link is in not URI compliant' do
before do
allow(YAML).to receive(:load_file)
.and_return(software => { "security" => "git@dev.gitlab.org:gitlab/gitlab-ee.git" })
end
it 'returns "security" link without attaching credential' do
expect(subject.remote).to eq("git@dev.gitlab.org:gitlab/gitlab-ee.git")
end
end
end
context 'when security source is not defined for the software' do
let(:software) { 'prometheus' }
it 'returns "remote" link from custom_sources yml' do
allow(ENV).to receive(:[]).with("ALTERNATIVE_SOURCES").and_return("false")
expect(subject.remote).to eq('git@dev.gitlab.org:omnibus-mirror/prometheus.git')
end
context 'with ALTERNATIVE_SOURCES env variable explicitly set' do
it 'returns "alternative" link from custom_sources yml' do
allow(ENV).to receive(:[]).with("ALTERNATIVE_SOURCES").and_return("true")
expect(subject.remote).to eq('https://gitlab.com/gitlab-org/build/omnibus-mirror/prometheus.git')
end
end
end
end
end
describe :print do
......
......@@ -13,5 +13,15 @@
ee_project="gitlab-ee"
fi
if [ -n "${TOP_UPSTREAM_SOURCE_PROJECT}" ]
then
project_path="${TOP_UPSTREAM_SOURCE_PROJECT}"
elif ${curdir}/is_gitlab_ee.sh
then
project_path="${group_name}/${ee_project}"
else
project_path="${group_name}/${ce_project}"
fi
if ${curdir}/is_gitlab_ee.sh
then
......@@ -16,4 +26,4 @@
if ${curdir}/is_gitlab_ee.sh
then
assets_image="${group_name}/${ee_project}/gitlab-assets-ee"
assets_image="${project_path}/gitlab-assets-ee"
else
......@@ -19,5 +29,5 @@
else
assets_image="${group_name}/${ce_project}/gitlab-assets-ce"
assets_image="${project_path}/gitlab-assets-ce"
fi
gitlab_version=$(echo "${1}" | awk '
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment