- Mar 12, 2025
-
-
Georges Racinet authored
-
Georges Racinet authored
-
Georges Racinet authored
Forgot to amend that one.
-
Georges Racinet authored
The access control rationale is that once users are receiving the clone bundle URL, it means that they have access, so we issue a temporary S3 link (so-called presigned URL, meaning that it contains a signature issued by a user having access). This is easily done, thanks to the separate `alter_bundle_url` function, meant exactly for this kind of override.
-
Georges Racinet authored
Some S3 providers do not support the bucket policy, but do support ACLs to open up the bundle to anonymous download. We split out the S3 client instantiation in the `heptapod.clone_bundles` module, because that makes it easier to monkey-patch than `hgext3rd.heptapod`. Of course, this should be generalized when we have time to do so.
-
Georges Racinet authored
This will allow us to use ACLs (not supported by Minio) and thus solve heptapod#2083. We had to restrict the version because of https://github.com/boto/boto3/issues/4401 (additional parameters to try out when we decide to upgrade are suggested in the GitHub issue)
-
- Mar 10, 2025
-
-
Georges Racinet authored
-
Georges Racinet authored
-
Georges Racinet authored
-
- Mar 06, 2025
-
-
Georges Racinet authored
-
Georges Racinet authored
-
Georges Racinet authored
The clone bundles autogeneration support is well worth a minor version bump.
-
Georges Racinet authored
We had to replace the call of the "internal" subprocess by our own because fully detached `procutil.bgcommand` does not pass `stdin` correctly (seen systematically to be empty), so instead we go the environment variable way, which is ok for a tiny pickle of a descriptor object. Many choices, notably: - the parent dir for the bundles is derived from the namspace full path, so that it looks familiar to users, but the project slug is replaced by its `GL_REPOSITORY`, typically `project-#ID`, so that rename attacks could not work (when we have private clone bundles, this will matter) - `on-change` implemented for HTTP transactions by expecting Workhorse to pass the namespace path and the public boolean in headers - `on-change` implemented for SSH transactions by expecting Heptapod Shell to set the proper environment variables (hence we do not need to pass them to the background generation job) - the refresh command takes the path and the public indication form the command line instead of from environment, because that is easier in the first iteration: we will not have to change RHGitaly for this. - ACL is expected to be set on the bucket, hence the `public-bucket` configuration subsubkey. We will later need a `private-bucket` one,
-
Georges Racinet authored
-
Georges Racinet authored
We are basically putting almost everything under the `heptapod` section, because 1. it makes clear to the users that the meaning of the configuration is specific to Heptapod 2. it avoids future collisions 3. it can be readily updated from the Rails app (case of the `heptapod.clone-bundles` item. Caveat: the `disabled` value can be used to prevent all auto-generations, but it will not be possible to disable serving of existing clone bundles at this point (the only way would be currently to disable the `clonebundles` extension, which probably cannot be done from `uipopulate`).
-
Georges Racinet authored
When running under WSGI, if we need to spawn a subprocess, as will be the case with clonebundles integration, we meed to set `HGRCPATH` in the subprocess environment, hence we need to remember the value.
-
- Feb 19, 2025
-
-
Georges Racinet authored
-
Georges Racinet authored
-
- Feb 17, 2025
-
-
Georges Racinet authored
Will be useful in HGitaly tests
-
- Feb 19, 2025
-
-
Georges Racinet authored
Its own `test_git` is a good example of how it can be useful.
-
- Feb 11, 2025
-
-
Georges Racinet authored
-
Georges Racinet authored
-
Georges Racinet authored
Unfortunately, 5.0.3 was released from the wrong head (forgot to pull). Hence we will have to release a 5.0.4 immediately
-
Georges Racinet authored
-
Georges Racinet authored
-
Georges Racinet authored
As heptapod#2021 demonstrate, special refs are a liability (a keep-around in this case). At this point, the command is used for mirroring to external Git services only (no more rollback of the native migration), so we simply stop synchronizing any special ref. Also, we treat the case where some Mercurial changeset is not properly mapped to Git (hard to come by in unit tests). In this case, we do not sync the ref, log a warning, and also avoid to remove the ref from the Git side.
-
- Jan 22, 2025
-
-
Georges Racinet authored
-
Georges Racinet authored
-
- Jan 21, 2025
-
-
Georges Racinet authored
These were made for Heptapod 17.6.2
-
Georges Racinet authored
-
Georges Racinet authored
-
Georges Racinet authored
and also stop setting it to `master`. This is the root resolution for heptapod#1987
-
Georges Racinet authored
This is obviously to reduce duplication. It is worthwile to note that in Heptapod 17.7, it will be equivalent to which subclass is in use (we still use `HeptapodGitHandler` for native projects with mirrors to Git in Heptapod 17.6). That is why we preferred using a property, as it can simply be replaced by a class attribute later on.
-
- Jan 20, 2025
-
-
Georges Racinet authored
In the default branch, we have already stopped calling by mere instantiation of the handler the "ensure" method and the resync of the Git repo (supporting the mirrors for native projects). It is now done from the commands themselves, hence the tests have to be slightly adapted to call them as well.
-
Georges Racinet authored
Should solve heptapod#1984, especially given that the migration to native Projects calls `hg move-hg-git-repo-out-of-gitaly-reach`. Given that this is a one shot and we happen to have the same Python dependencies in the default and stable series of Heptapod, we're hardcoding the series in the CI configuration. Obviously to be reverted upon merge in the default branch.
-