Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found

Target

Select target project
  • uffd/uffd
  • rixx/uffd
  • thies/uffd
  • leona/uffd
  • enbewe/uffd
  • strifel/uffd
  • thies/uffd-2
7 results
Show changes
Commits on Source (161)
61 additional commits have been omitted to prevent performance issues.
Hide whitespace changes
Inline Side-by-side
Showing
with 726 additions and 233 deletions
.gitlab-ci.yml
View file @ 98fe5690
image: registry.git.cccv.de/uffd/docker-images/buster image: registry.git.cccv.de/uffd/docker-images/bookworm
variables: variables:
DEBIAN_FRONTEND: noninteractive DEBIAN_FRONTEND: noninteractive
GIT_SUBMODULE_STRATEGY: normal GIT_SUBMODULE_STRATEGY: normal
PYTHONPATH: deps/ldapalchemy APT_API_URL: https://packages.cccv.de
APT_REPO: uffd
PYLINT_PIN: pylint~=2.16.2
before_script: before_script:
- python3 -V - python3 -V
...@@ -11,7 +13,7 @@ before_script: ...@@ -11,7 +13,7 @@ before_script:
- uname -a - uname -a
- python3 -m pylint --version - python3 -m pylint --version
- python3 -m coverage --version - python3 -m coverage --version
- echo "${CI_COMMIT_TAG}" | grep -qE "v[0-9]+[.][0-9]+[.][0-9]+.*" && export UFFD_PACKAGE_VERSION="${CI_COMMIT_TAG#v}" || export UFFD_PACKAGE_VERSION="${CI_COMMIT_SHA}" - export PACKAGE_VERSION="$(git describe | sed -E -n -e 's/^v([0-9.]*)$/\1/p' -e 's/^v([0-9.]*)-([0-9]*)-g([0-9a-z]*)$/\1.dev+git.\3/p' | grep .)"
.build: .build:
stage: build stage: build
...@@ -19,8 +21,7 @@ before_script: ...@@ -19,8 +21,7 @@ before_script:
build:pip: build:pip:
extends: .build extends: .build
script: script:
- pip3 install build - python3 -m build
- PACKAGE_VERSION="${UFFD_PACKAGE_VERSION}" python3 -m build
artifacts: artifacts:
paths: paths:
- dist/* - dist/*
...@@ -28,32 +29,31 @@ build:pip: ...@@ -28,32 +29,31 @@ build:pip:
build:apt: build:apt:
extends: .build extends: .build
script: script:
- apt update - ./debian/create_changelog.py uffd > debian/changelog
- apt-get install -y python3-all debhelper python3-pip git-buildpackage - export PYBUILD_INSTALL_ARGS="--install-lib=/usr/share/uffd/ --install-scripts=/usr/share/uffd/"
- cp CHANGELOG debian/changelog - export DEB_BUILD_OPTIONS=nocheck
- export PYBUILD_INSTALL_ARGS="--install-lib=/usr/share/uffd/ --install-scripts=/usr/share/uffd/" - dpkg-buildpackage -us -uc
- gbp dch --ignore-branch --debian-tag=v%\(version\)s - mv ../*.deb ./
- dpkg-buildpackage -us -uc - dpkg-deb -I *.deb
- mkdir build - dpkg-deb -c *.deb
- mv ../*.deb build/
artifacts: artifacts:
paths: paths:
- build/*.deb - ./*.deb
- debian/changelog
db_migrations_updated: db_migrations_updated:
stage: test stage: test
needs: []
script: script:
- FLASK_APP=uffd flask db upgrade - FLASK_APP=uffd FLASK_ENV=testing flask db upgrade
- FLASK_APP=uffd flask db migrate 2>&1 | grep -q 'No changes in schema detected' - FLASK_APP=uffd FLASK_ENV=testing flask db migrate 2>&1 | grep -q 'No changes in schema detected'
linter: linter:buster:
image: registry.git.cccv.de/uffd/docker-images/buster
stage: test stage: test
needs: []
script: script:
- pip3 install pylint-gitlab # this force-updates jinja2 and some other packages! - pip3 install $PYLINT_PIN pylint-gitlab pylint-flask-sqlalchemy # this force-updates jinja2 and some other packages!
- python3 -m pylint --exit-zero --rcfile .pylintrc --output-format=pylint_gitlab.GitlabCodeClimateReporter uffd > codeclimate.json - python3 -m pylint --output-format=pylint_gitlab.GitlabCodeClimateReporter:codeclimate.json,pylint_gitlab.GitlabPagesHtmlReporter:pylint.html,colorized uffd
- python3 -m pylint --exit-zero --rcfile .pylintrc --output-format=pylint_gitlab.GitlabPagesHtmlReporter uffd > pylint.html
- python3 -m pylint --rcfile .pylintrc --output-format=text uffd
artifacts: artifacts:
when: always when: always
paths: paths:
...@@ -61,33 +61,125 @@ linter: ...@@ -61,33 +61,125 @@ linter:
reports: reports:
codequality: codeclimate.json codequality: codeclimate.json
unittests: linter:bullseye:
image: registry.git.cccv.de/uffd/docker-images/bullseye
stage: test stage: test
needs: []
script: script:
- service slapd start - pip3 install $PYLINT_PIN pylint-gitlab pylint-flask-sqlalchemy # this force-updates jinja2 and some other packages!
- UNITTEST_OPENLDAP=1 python3-coverage run --include 'uffd/*.py' -m pytest --junitxml=report.xml || true - python3 -m pylint --output-format=pylint_gitlab.GitlabCodeClimateReporter:codeclimate.json,pylint_gitlab.GitlabPagesHtmlReporter:pylint.html,colorized uffd
artifacts:
when: always
paths:
- pylint.html
reports:
codequality: codeclimate.json
linter:bookworm:
image: registry.git.cccv.de/uffd/docker-images/bookworm
stage: test
needs: []
script:
- pip3 install $PYLINT_PIN pylint-gitlab pylint-flask-sqlalchemy # this force-updates jinja2 and some other packages!
- python3 -m pylint --output-format=pylint_gitlab.GitlabCodeClimateReporter:codeclimate.json,pylint_gitlab.GitlabPagesHtmlReporter:pylint.html,colorized uffd
artifacts:
when: always
paths:
- pylint.html
reports:
codequality: codeclimate.json
tests:buster:sqlite:
image: registry.git.cccv.de/uffd/docker-images/buster
stage: test
needs: []
script:
- python3 -m pytest --junitxml=report.xml
artifacts:
when: always
reports:
junit: report.xml
tests:buster:mysql:
image: registry.git.cccv.de/uffd/docker-images/buster
stage: test
needs: []
script:
- service mysql start
- TEST_WITH_MYSQL=1 python3 -m pytest --junitxml=report.xml
artifacts:
when: always
reports:
junit: report.xml
tests:bullseye:sqlite:
image: registry.git.cccv.de/uffd/docker-images/bullseye
stage: test
needs: []
script:
- python3 -m pytest --junitxml=report.xml
artifacts:
when: always
reports:
junit: report.xml
tests:bullseye:mysql:
image: registry.git.cccv.de/uffd/docker-images/bullseye
stage: test
needs: []
script:
- service mariadb start
- TEST_WITH_MYSQL=1 python3 -m pytest --junitxml=report.xml
artifacts:
when: always
reports:
junit: report.xml
tests:bookworm:sqlite:
image: registry.git.cccv.de/uffd/docker-images/bookworm
stage: test
needs: []
script:
- rm -rf pages
- mkdir -p pages
- cp -r uffd/static pages/static
- DUMP_PAGES=pages python3-coverage run --include 'uffd/*.py' -m pytest --junitxml=report.xml || touch failed
- sed -i -e 's/href="\/static\//href=".\/static\//g' -e 's/src="\/static\//src=".\/static\//g' pages/*.html || true
- python3-coverage report -m - python3-coverage report -m
- python3-coverage html - python3-coverage html
- python3-coverage xml - python3-coverage xml
- test ! -e failed
artifacts: artifacts:
when: always when: always
paths: paths:
- htmlcov/index.html - htmlcov/index.html
- htmlcov - htmlcov
- pages
expose_as: 'Coverage Report' expose_as: 'Coverage Report'
reports: reports:
cobertura: coverage.xml coverage_report:
coverage_format: cobertura
path: coverage.xml
junit: report.xml junit: report.xml
coverage: '/^TOTAL.*\s+(\d+\%)$/' coverage: '/^TOTAL.*\s+(\d+\%)$/'
tests:bookworm:mysql:
image: registry.git.cccv.de/uffd/docker-images/bookworm
stage: test
needs: []
script:
- service mariadb start
- TEST_WITH_MYSQL=1 python3 -m pytest --junitxml=report.xml
artifacts:
when: always
reports:
junit: report.xml
html5validator: html5validator:
stage: test stage: test
needs:
- job: tests:bookworm:sqlite
script: script:
- rm -rf pages
- mkdir -p pages
- cp -r uffd/static pages/static
- DUMP_PAGES=pages python3 -m unittest discover tests
- sed -i -e 's/href="\/static\//href=".\/static\//g' -e 's/src="\/static\//src=".\/static\//g' pages/*.html
- html5validator --root pages 2>&1 | tee html5validator.log - html5validator --root pages 2>&1 | tee html5validator.log
artifacts: artifacts:
when: on_failure when: on_failure
...@@ -97,36 +189,86 @@ html5validator: ...@@ -97,36 +189,86 @@ html5validator:
.trans: .trans:
stage: test stage: test
needs: []
script: script:
- ./update_translations.sh $TRANSLATION_LANGUAGE - ./update_translations.sh $TRANSLATION_LANGUAGE
coverage: '/^TOTAL.*\s+(\d+\%)$/' coverage: '/^TOTAL.*\s+(\d+\%)$/'
trans_de: trans_de:
extends: .trans extends: .trans
variables: variables:
TRANSLATION_LANGUAGE: de TRANSLATION_LANGUAGE: de
test:package:pip: test:package:pip:buster:
image: registry.git.cccv.de/uffd/docker-images/buster
stage: test stage: test
needs:
- job: build:pip
script: script:
- pip3 install dist/*.tar.gz - pip3 install dist/*.tar.gz
dependencies:
- build:pip
test:package:apt: test:package:pip:bullseye:
image: registry.git.cccv.de/uffd/docker-images/bullseye
stage: test stage: test
needs:
- job: build:pip
script: script:
- apt -y install ./build/*.deb - pip3 install dist/*.tar.gz
- apt -y install curl
- ln -s /etc/uffd/uwsgi.ini /etc/uwsgi/apps-available/uffd.ini test:package:pip:bookworm:
- ln -s /etc/uwsgi/apps-available/uffd.ini /etc/uwsgi/apps-enabled/uffd.ini image: registry.git.cccv.de/uffd/docker-images/bookworm
stage: test
needs:
- job: build:pip
script:
- pip3 install dist/*.tar.gz
# Since we want to test if the package installs correctly on a fresh Debian
# install (has correct dependencies, etc.), we don't use uffd/docker-images
# here
test:package:apt:buster:
image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/debian:buster
stage: test
needs:
- job: build:apt
before_script: []
script:
- apt -y update
- apt -y install curl ./*.deb
- service uwsgi start uffd || ( service uwsgi status uffd ; sleep 15; cat /var/log/uwsgi/app/uffd.log; ) - service uwsgi start uffd || ( service uwsgi status uffd ; sleep 15; cat /var/log/uwsgi/app/uffd.log; )
- echo "server { listen 127.0.0.1:5000 default_server; include /etc/uffd/nginx.include.conf; }" > /etc/nginx/sites-enabled/uffd.ini - echo "server { listen 127.0.0.1:5000 default_server; include /etc/uffd/nginx.include.conf; }" > /etc/nginx/sites-enabled/uffd.ini
- service nginx start || ( service nginx status; nginx -t; exit 1; ) - service nginx start || ( service nginx status; nginx -t; exit 1; )
- sleep 5 - uffd-admin routes
- curl -Lv 127.0.0.1:5000
test:package:apt:bullseye:
image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/debian:bullseye
stage: test
needs:
- job: build:apt
before_script: []
script:
- apt -y update
- apt -y install curl ./*.deb
- service uwsgi start uffd || ( service uwsgi status uffd ; sleep 15; cat /var/log/uwsgi/app/uffd.log; )
- echo "server { listen 127.0.0.1:5000 default_server; include /etc/uffd/nginx.include.conf; }" > /etc/nginx/sites-enabled/uffd.ini
- service nginx start || ( service nginx status; nginx -t; exit 1; )
- uffd-admin routes
- curl -Lv 127.0.0.1:5000
test:package:apt:bookworm:
image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/debian:bookworm
stage: test
needs:
- job: build:apt
before_script: []
script:
- apt -y update
- apt -y install curl ./*.deb
- service uwsgi start uffd || ( service uwsgi status uffd ; sleep 15; cat /var/log/uwsgi/app/uffd.log; )
- echo "server { listen 127.0.0.1:5000 default_server; include /etc/uffd/nginx.include.conf; }" > /etc/nginx/sites-enabled/uffd.ini
- service nginx start || ( service nginx status; nginx -t; exit 1; )
- uffd-admin routes
- curl -Lv 127.0.0.1:5000 - curl -Lv 127.0.0.1:5000
dependencies:
- build:apt
.publish: .publish:
stage: deploy stage: deploy
...@@ -136,7 +278,6 @@ test:package:apt: ...@@ -136,7 +278,6 @@ test:package:apt:
publish:pip: publish:pip:
extends: .publish extends: .publish
script: script:
- pip3 install twine
- TWINE_USERNAME="${GITLABPKGS_USERNAME}" TWINE_PASSWORD="${GITLABPKGS_PASSWORD}" python3 -m twine upload --repository-url ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi dist/* - TWINE_USERNAME="${GITLABPKGS_USERNAME}" TWINE_PASSWORD="${GITLABPKGS_PASSWORD}" python3 -m twine upload --repository-url ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/pypi dist/*
- TWINE_USERNAME="${PYPI_USERNAME}" TWINE_PASSWORD="${PYPI_PASSWORD}" python3 -m twine upload dist/* - TWINE_USERNAME="${PYPI_USERNAME}" TWINE_PASSWORD="${PYPI_PASSWORD}" python3 -m twine upload dist/*
dependencies: dependencies:
...@@ -145,6 +286,14 @@ publish:pip: ...@@ -145,6 +286,14 @@ publish:pip:
publish:apt: publish:apt:
extends: .publish extends: .publish
script: script:
- exit 0 - export DEBPATH="$(echo *.deb)"
- echo Upload deb file, add it to repo and clean up upload
- curl --user "${APTLY_API_USER}:${APTLY_API_PW}" -X POST -F file=@"$DEBPATH" "${APT_API_URL}/api/files/${APT_REPO}-ci-upload-${CI_JOB_ID}"
- curl --user "${APTLY_API_USER}:${APTLY_API_PW}" -X POST "${APT_API_URL}/api/repos/${APT_REPO}/file/${APT_REPO}-ci-upload-${CI_JOB_ID}"
- curl --user "${APTLY_API_USER}:${APTLY_API_PW}" -X DELETE "${APT_API_URL}/api/files/${APT_REPO}-ci-upload-${CI_JOB_ID}"
- echo Update published repo for all distros
- 'curl --user "${APTLY_API_USER}:${APTLY_API_PW}" -X PUT -H "Content-Type: application/json" --data "{ }" "${APT_API_URL}/api/publish/uffd/buster"'
- 'curl --user "${APTLY_API_USER}:${APTLY_API_PW}" -X PUT -H "Content-Type: application/json" --data "{ }" "${APT_API_URL}/api/publish/uffd/bullseye"'
- 'curl --user "${APTLY_API_USER}:${APTLY_API_PW}" -X PUT -H "Content-Type: application/json" --data "{ }" "${APT_API_URL}/api/publish/uffd/bookworm"'
dependencies: dependencies:
- build:apt - build:apt
.pylintrc
View file @ 98fe5690
...@@ -28,7 +28,7 @@ limit-inference-results=100 ...@@ -28,7 +28,7 @@ limit-inference-results=100
# List of plugins (as comma separated values of python module names) to load, # List of plugins (as comma separated values of python module names) to load,
# usually to register additional checkers. # usually to register additional checkers.
load-plugins= load-plugins=pylint_flask_sqlalchemy
# Pickle collected data for later comparisons. # Pickle collected data for later comparisons.
persistent=yes persistent=yes
...@@ -63,92 +63,13 @@ confidence= ...@@ -63,92 +63,13 @@ confidence=
disable=missing-module-docstring, disable=missing-module-docstring,
missing-class-docstring, missing-class-docstring,
missing-function-docstring, missing-function-docstring,
print-statement,
parameter-unpacking,
unpacking-in-except,
old-raise-syntax,
backtick,
long-suffix,
old-ne-operator,
old-octal-literal,
import-star-module-level,
non-ascii-bytes-literal,
raw-checker-failed,
bad-inline-option,
locally-disabled,
file-ignored,
suppressed-message,
useless-suppression,
deprecated-pragma,
use-symbolic-message-instead,
unused-wildcard-import,
apply-builtin,
basestring-builtin,
buffer-builtin,
cmp-builtin,
coerce-builtin,
execfile-builtin,
file-builtin,
long-builtin,
raw_input-builtin,
reduce-builtin,
standarderror-builtin,
unicode-builtin,
xrange-builtin,
coerce-method,
delslice-method,
getslice-method,
setslice-method,
no-absolute-import,
old-division,
dict-iter-method,
dict-view-method,
next-method-called,
metaclass-assignment,
indexing-exception,
raising-string,
reload-builtin,
oct-method,
hex-method,
nonzero-method,
cmp-method,
input-builtin,
round-builtin,
intern-builtin,
unichr-builtin,
map-builtin-not-iterating,
zip-builtin-not-iterating,
range-builtin-not-iterating,
filter-builtin-not-iterating,
using-cmp-argument,
eq-without-hash,
div-method,
idiv-method,
rdiv-method,
exception-message-attribute,
invalid-str-codec,
sys-max-int,
bad-python3-import,
deprecated-string-function,
deprecated-str-translate-call,
deprecated-itertools-function,
deprecated-types-field,
next-method-defined,
dict-items-not-iterating,
dict-keys-not-iterating,
dict-values-not-iterating,
deprecated-operator-function,
deprecated-urllib-function,
xreadlines-attribute,
deprecated-sys-function,
exception-escape,
comprehension-escape,
too-few-public-methods, too-few-public-methods,
method-hidden, method-hidden,
bad-continuation,
too-many-ancestors, too-many-ancestors,
no-self-use,
duplicate-code, duplicate-code,
redefined-builtin,
superfluous-parens,
consider-using-f-string, # Temporary
# Enable the message, report, category or checker with the given id(s). You can # Enable the message, report, category or checker with the given id(s). You can
# either give multiple identifier separated by comma (,) or put this option # either give multiple identifier separated by comma (,) or put this option
...@@ -467,13 +388,6 @@ max-line-length=160 ...@@ -467,13 +388,6 @@ max-line-length=160
# Maximum number of lines in a module. # Maximum number of lines in a module.
max-module-lines=1000 max-module-lines=1000
# List of optional constructs for which whitespace checking is disabled. `dict-
# separator` is used to allow tabulation in dicts, etc.: {1 : 1,\n222: 2}.
# `trailing-comma` allows a space between comma and closing bracket: (a, ).
# `empty-line` allows space-only lines.
no-space-check=trailing-comma,
dict-separator
# Allow the body of a class to be on the same line as the declaration if body # Allow the body of a class to be on the same line as the declaration if body
# contains single statement. # contains single statement.
single-line-class-stmt=no single-line-class-stmt=no
...@@ -594,5 +508,5 @@ min-public-methods=2 ...@@ -594,5 +508,5 @@ min-public-methods=2
# Exceptions that will emit a warning when being caught. Defaults to # Exceptions that will emit a warning when being caught. Defaults to
# "BaseException, Exception". # "BaseException, Exception".
overgeneral-exceptions=BaseException, overgeneral-exceptions=builtin.BaseException,
Exception builtin.Exception
CHANGELOG deleted 100644 → 0
View file @ 7704f23c
uffd (0.2.0) unstable; urgency=medium
* Working debian packages
-- CCCV <it@cccv.de> Sat, 31 Jul 2021 20:26:25 +0200
uffd (0.1.2) unstable; urgency=medium
* Initial release.
-- Andreas Valder <nd@cccv.de> Fri, 30 Jul 2021 23:02:31 +0200
README.md
View file @ 98fe5690
# uffd # Uffd
This is the UserFerwaltungsFrontend. Uffd (UserFerwaltungsFrontend) is a web-based user management and single sign-on software.
A web service to manage LDAP users, groups and permissions.
Development chat: [#uffd-development](https://rocket.cccv.de/channel/uffd-development) Development chat: [#uffd-development](https://rocket.cccv.de/channel/uffd-development)
## dependencies ## Dependencies
Please note that we refer to Debian packages here and **not** pip packages.
- python3 - python3
- python3-ldap3
- python3-flask - python3-flask
- python3-flask-sqlalchemy - python3-flask-sqlalchemy
- python3-flask-migrate - python3-flask-migrate
- python3-qrcode - python3-qrcode
- python3-fido2 (version 0.5.0, optional) - python3-fido2 (version 0.5.0 or 0.9.1, optional)
- python3-flask-oauthlib - python3-prometheus-client (optional, needed for metrics)
- python3-jwt
- python3-cryptography
- python3-flask-babel - python3-flask-babel
- python3-argon2
- python3-itsdangerous (also a dependency of python3-flask)
- python3-mysqldb or python3-pymysql for MariaDB support
- python3-ua-parser (optional, better user agent parsing)
Some of the dependencies (especially fido2 and flask-oauthlib) changed their API in recent versions, so make sure to install the versions from Debian Buster. Some of the dependencies (especially fido2) changed their API in recent versions, so make sure to install the versions from Debian Bookworm, Bullseye or Buster.
You can also use virtualenv with the supplied `requirements.txt`. For development, you can also use virtualenv with the supplied `requirements.txt`.
## development
Clone this repository with the `--recurse-submodules` flag to retrieve submodule dependencies. ## Development
Before running uffd, you need to create the database with `flask db upgrade`. The database is placed in Before running uffd, you need to create the database with `flask db upgrade`. The database is placed in
`instance/uffd.sqlit3`. `instance/uffd.sqlit3`.
...@@ -33,35 +38,56 @@ FLASK_APP=uffd flask db upgrade ...@@ -33,35 +38,56 @@ FLASK_APP=uffd flask db upgrade
FLASK_APP=uffd FLASK_ENV=development flask run FLASK_APP=uffd FLASK_ENV=development flask run
``` ```
During development, you may want to enable LDAP mocking, as you otherwise need to have access to an actual LDAP server with the required schema. During development, you may want to create some example data:
You can do so by setting `LDAP_SERVICE_MOCK=True` in the config.
```
export FLASK_APP=uffd
flask group create 'uffd_access' --description 'Access to Single-Sign-On and Selfservice'
flask group create 'uffd_admin' --description 'Admin access to uffd'
flask role create 'base' --default --add-group 'uffd_access'
flask role create 'admin' --add-group 'uffd_admin'
flask user create 'testuser' --password 'userpassword' --mail 'test@example.com' --displayname 'Test User'
flask user create 'testadmin' --password 'adminpassword' --mail 'admin@example.com' --displayname 'Test Admin' --add-role 'admin'
```
Afterwards you can login as a normal user with "testuser" and "userpassword", or as an admin with "testadmin" and "adminpassword". Afterwards you can login as a normal user with "testuser" and "userpassword", or as an admin with "testadmin" and "adminpassword".
Please note that the mocked LDAP functionality is very limited and many uffd features do not work correctly without a real LDAP server.
## deployment ## Deployment
Do not use `pip install uffd` for production deployments!
The dependencies of the pip package roughly represent the versions shipped by Debian stable.
We do not keep them updated and we do not test the pip package!
The pip package only exists for local testing/development and to help build the Debian package.
We provide packages for Debian stable, oldstable and oldoldstable (currently Bookworm, Bullseye and Buster).
Since all dependencies are available in the official package mirrors, you will get security updates for everything but uffd itself from Debian.
To install uffd on Debian Bullseye, add our package mirror to `/etc/sources.list`:
Use uwsgi. Make sure to run `flask db upgrade` after every update! ```
deb https://packages.cccv.de/uffd bullseye main
```
Then download [cccv-archive-key.gpg](https://packages.cccv.de/docs/cccv-archive-key.gpg) and add it to the trusted repository keys in `/etc/apt/trusted.gpg.d/`.
Afterwards run `apt update && apt install uffd` to install the package.
The Debian package uses uwsgi to run uffd and ships an `uffd-admin` script to execute flask commands in the correct context.
If you upgrade, make sure to run `flask db upgrade` after every update! The Debian package takes care of this by itself using uwsgi pre start hooks.
For an example uwsgi config, see our [uswgi.ini](uwsgi.ini). You might find our [nginx include file](nginx.include.conf) helpful to setup a web server in front of uwsgi. For an example uwsgi config, see our [uswgi.ini](uwsgi.ini). You might find our [nginx include file](nginx.include.conf) helpful to setup a web server in front of uwsgi.
## python style conventions Uffd supports SQLite and MariaDB. To use MariaDB, create the database with the options `CHARACTER SET utf8mb4 COLLATE utf8mb4_nopad_bin` and make sure to add the `?charset=utf8mb4` parameter to `SQLALCHEMY_DATABASE_URI`.
## Python Coding Style Conventions
PEP 8 without double new lines, tabs instead of spaces and a max line length of 160 characters. PEP 8 without double new lines, tabs instead of spaces and a max line length of 160 characters.
We ship a [pylint](https://pylint.org/) config to verify changes with.
## Config ## Configuration
Uffd reads its default config from `uffd/default_config.cfg`. Uffd reads its default config from `uffd/default_config.cfg`.
You can overwrite config variables by creating a config file in the `instance` folder. You can overwrite config variables by creating a config file in the `instance` folder.
The file must be named `conifg.cfg` (Python syntax), `config.json` or `config.yml`/`config.yaml`. The file must be named `config.cfg` (Python syntax), `config.json` or `config.yml`/`config.yaml`.
You can also set a custom file name with the environment variable `CONFIG_FILENAME`. You can also set a custom file path with the environment variable `CONFIG_PATH`.
## Bind with service account or as user?
Uffd can use a dedicated service account for LDAP operations by setting `LDAP_SERVICE_BIND_DN`.
Leave that variable blank to use anonymouse bind.
Or set `LDAP_SERVICE_USER_BIND` to use the credentials of the currently logged in user.
If you choose to run with user credentials, some features are not available, like password resets
or self signup, since in both cases, no user credentials can exist.
## OAuth2 Single-Sign-On Provider ## OAuth2 Single-Sign-On Provider
...@@ -73,7 +99,9 @@ The services need to be setup to use the following URLs with the Authorization C ...@@ -73,7 +99,9 @@ The services need to be setup to use the following URLs with the Authorization C
* `/oauth2/token`: token request endpoint * `/oauth2/token`: token request endpoint
* `/oauth2/userinfo`: endpoint that provides information about the current user * `/oauth2/userinfo`: endpoint that provides information about the current user
The userinfo endpoint returns json data with the following structure: If the service supports server metadata discovery ([RFC 8414](https://www.rfc-editor.org/rfc/rfc8414)), configuring the base url of your uffd installation or `/.well-known/openid-configuration` as the discovery endpoint should be sufficient.
The only OAuth2 scope supported is `profile`. The userinfo endpoint returns json data with the following structure:
``` ```
{ {
...@@ -81,7 +109,6 @@ The userinfo endpoint returns json data with the following structure: ...@@ -81,7 +109,6 @@ The userinfo endpoint returns json data with the following structure:
"name": "Test User", "name": "Test User",
"nickname": "testuser" "nickname": "testuser"
"email": "testuser@example.com", "email": "testuser@example.com",
"ldap_dn": "uid=testuser,ou=users,dc=example,dc=com",
"groups": [ "groups": [
"uffd_access", "uffd_access",
"users" "users"
...@@ -89,8 +116,67 @@ The userinfo endpoint returns json data with the following structure: ...@@ -89,8 +116,67 @@ The userinfo endpoint returns json data with the following structure:
} }
``` ```
`id` is the uidNumber, `name` the display name (cn) and `nickname` the uid of the user's LDAP object. `id` is the numeric (Unix) user id, `name` the display name and `nickname` the loginname of the user.
## OpenID Connect Single-Sign-On Provider
In addition to plain OAuth2, uffd also has basic OpenID Connect support.
Endpoint URLs are the same as for plain OAuth2.
OpenID Connect support is enabled by requesting the `openid` scope.
ID token signing keys are served at `/oauth2/keys`.
See [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) specification for more details.
Supported flows and response types:
* Only Authorization Code Flow with `code` response type
Supported scopes:
* `openid`: Enables OpenID Connect support and returns mandatory `sub` claim
* `profile`: Returns `name` and `preferred_username` claims
* `email`: Returns `email` and `email_verified` claims
* `groups`: Returns non-standard `groups` claim
Supported claims:
* `sub` (string): Decimal encoded numeric (Unix) user id
* `name` (string): Display name
* `preferred_username`(string): Loginname
* `email` (string): Service-specific or primary email address
* `email_verified` (boolean): Verification status of `email` value (always `true`)
* `groups` (array of strings): Names of groups the user is a member of (non-standard)
uffd supports the optional `claims` authorization request parameter for requesting claims individually.
Note that there is a IANA-registered `groups` claim with a syntax borrowed from [SCIM](https://www.rfc-editor.org/rfc/rfc7643.html).
The syntax used by uffd is different and incompatible, although arguably more common for a claim named "groups" in this context.
uffd aims for complience with OpenID provider conformance profiles Basic and Config.
It is, however, not a certified OpenID provider and it has the following limitations:
* Only the `none` value for the `prompt` authorization request parameter is recognized. Other values (`login`, `consent` and `select_account`) are ignored.
* The `max_age` authorization request parameter is not supported and ignored by uffd.
* The `auth_time` claim is not supported and neither returned if the `max_age` authorization request parameter is present nor if it is requested via the `claims` parameter.
* Requesting the `sub` claim with a specific value for the ID Token (or passing the `id_token_hint` authorization request parameter) is only supported if the `prompt` authorization request parameter is set to `none`. The authorization request is rejected otherwise.
## Metrics
Uffd can export metrics in a prometheus compatible way. It needs python3-prometheus-client for this feature to work.
Metrics can be accessed via `/metrics` and `/api/v1/metrics_prometheus`.
Those endpoints are protected via api credentials. Add prometheus in the uffd UI as a service and create an
api client with the `metrics` permission. Then you can access the metrics like that:
```
$ curl localhost:5000/api/v1/metrics_prometheus --user api-user:api-password
# HELP python_info Python platform information
# TYPE python_info gauge
python_info{implementation="CPython",major="3",minor="9",patchlevel="2",version="3.9.2"} 1.0
# HELP uffd_version_info Various version infos
# TYPE uffd_version_info gauge
uffd_version_info{version="local"} 1.0
[..]
```
## Translation ## Translation
...@@ -99,7 +185,9 @@ The web frontend is initially written in English and translated in the following ...@@ -99,7 +185,9 @@ The web frontend is initially written in English and translated in the following
![status](https://git.cccv.de/uffd/uffd/badges/master/coverage.svg?job=trans_de&key_text=DE) ![status](https://git.cccv.de/uffd/uffd/badges/master/coverage.svg?job=trans_de&key_text=DE)
The selection uses the language browser header by default but can be overwritten via a UI element. The selection uses the language browser header by default but can be overwritten via a UI element.
You can specify the availble languages in the config. You can specify the available languages in the config.
Use the `update_translations.sh` to update the translation files.
## License ## License
......
UPGRADE.md 0 → 100644
View file @ 98fe5690
# Upgrading from v1 to v2
Prior to v2 uffd stored users, groups and mail aliases on an LDAP server.
OAuth2 and API client credentials were defined in the config. Starting with
v2 uffd stores all of this in its database and no longer supports LDAP.
A number of other features and configurations are no longer supported. See the
changelog for details on changed and removed features.
## Preparations
Create a backup of the database before attempting an upgrade. The database
migration scripts are quite complex and somewhat fragile. If anything fails,
you will end up with a broken database that is difficult or impossible to
recover from. Furthermore downgrading from v2 to v1 is not supported.
Make sure no service (besides uffd) directly accesses your LDAP server.
Migrate any remaining services to [uffd-ldapd][] or other solutions that
solely rely on uffds API and OAuth2 endpoints. Uffd will cease to update
any data stored in the LDAP directory.
Migrate all API clients defined with the `API_CLIENTS` config option to the
`API_CLIENTS_2` option. This includes changing authentication from a
token-based mechanism to HTTP Basic Authentication and consequently replacing
affected credentials.
The imported OAuth2 and API clients are grouped by service objects. These
service objects will be auto-created for each client with unique names derived
from the `client_id` parameter. Add the `service_name` parameter to clients to
set a custom name. This name is visible to users in place of the OAuth2
`client_id`. Use the same `service_name` for multiple clients to group them
together. This is recommended for OAuth2 and API credentials used by the same
services, as future features like service-specific email addresses will be
added as service-level options. The OAuth2 client parameter `required_group` is
imported as a service-level option. Make sure that grouped OAuth2 clients have
the same `required_group` value, otherwise nobody will be able to access the
service. Note that values other than a single group name are not supported.
Adjust the ACLs of your LDAP server so uffd can read the `userPassword`
attribute of user objects. Note that uffd will not perform any writes to the
LDAP server during or after the upgrade.
If you use user bind (config option `LDAP_SERVICE_USER_BIND`), i.e. if you
have uffd authenticate with the LDAP server using the credentials of the
currently logged in user, you will have to replace this configuration and
grant uffd full read access to all user, group and mail alias data with
config-defined credentials.
Install the new dependency `python3-argon2`. (Dist-)Upgrading the Debian
package will do that for you. Do not uninstall the removed dependency
`python3-ldap3` (i.e. do not run `apt autoremove`)! It is required to import
data from the LDAP server.
There is a safeguard in place to prevent accidental upgrades. Add the
following line to your config file to disable the safeguard:
```
UPGRADE_V1_TO_V2=True
```
## Running the Upgrade
Upgrade the Debian package to v2. This will restart the uffd UWSGI app. With
the default UWSGI configuration, the database migration scripts will run
automatically.
Otherwise run them manually:
```
uffd-admin db upgrade
```
The database migration scripts import users, groups and mail aliases from the
configured LDAP server. They also import OAuth2 and API clients defined with
the `OAUTH2_CLIENTS` and `API_CLIENTS_2` config options to the database.
Due to data being split between the LDAP server and the database, uffd v1
tended to accumulate orphaned database objects (e.g. role memberships of
deleted users). All orphaned objects are deleted during the upgrade.
As a side-effect upgrading resets all rate limits.
## Follow-up
Rename the following config options:
* `LDAP_USER_GID` -> `USER_GID`
* `LDAP_USER_MIN_UID` -> `USER_MIN_UID`
* `LDAP_USER_MAX_UID` -> `USER_MAX_UID`
* `LDAP_USER_SERVICE_MIN_UID` -> `USER_SERVICE_MIN_UID`
* `LDAP_USER_SERVICE_MAX_UID` -> `USER_SERVICE_MAX_UID`
Add the following config options:
* `GROUP_MIN_GID`
* `GROUP_MAX_GID`
Remove the following config options:
* `UPGRADE_V1_TO_V2`
* `LDAP_USER_SEARCH_BASE`
* `LDAP_USER_SEARCH_FILTER`
* `LDAP_USER_OBJECTCLASSES`
* `LDAP_USER_DN_ATTRIBUTE`
* `LDAP_USER_UID_ATTRIBUTE`
* `LDAP_USER_UID_ALIASES`
* `LDAP_USER_LOGINNAME_ATTRIBUTE`
* `LDAP_USER_LOGINNAME_ALIASES`
* `LDAP_USER_DISPLAYNAME_ATTRIBUTE`
* `LDAP_USER_DISPLAYNAME_ALIASES`
* `LDAP_USER_MAIL_ATTRIBUTE`
* `LDAP_USER_MAIL_ALIASES`
* `LDAP_USER_DEFAULT_ATTRIBUTES`
* `LDAP_GROUP_SEARCH_BASE`
* `LDAP_GROUP_SEARCH_FILTER`
* `LDAP_GROUP_GID_ATTRIBUTE`
* `LDAP_GROUP_NAME_ATTRIBUTE`
* `LDAP_GROUP_DESCRIPTION_ATTRIBUTE`
* `LDAP_GROUP_MEMBER_ATTRIBUTE`
* `LDAP_MAIL_SEARCH_BASE`
* `LDAP_MAIL_SEARCH_FILTER`
* `LDAP_MAIL_OBJECTCLASSES`
* `LDAP_MAIL_DN_ATTRIBUTE`
* `LDAP_MAIL_UID_ATTRIBUTE`
* `LDAP_MAIL_RECEIVERS_ATTRIBUTE`
* `LDAP_MAIL_DESTINATIONS_ATTRIBUTE`
* `LDAP_SERVICE_URL`
* `LDAP_SERVICE_USE_STARTTLS`
* `LDAP_SERVICE_BIND_DN`
* `LDAP_SERVICE_BIND_PASSWORD`
* `LDAP_SERVICE_USER_BIND`
* `ENABLE_INVITE`
* `ENABLE_PASSWORDRESET`
* `ENABLE_ROLESELFSERVICE`
* `OAUTH2_CLIENTS`
* `API_CLIENTS` (should not be set, see "Preperation")
* `API_CLIENTS_2`
* `LDAP_SERVICE_MOCK` (development option, should not be set)
If you set a custom config filename with the environment variable
`CONFIG_FILENAME`, replace it with `CONFIG_PATH`. The new variable must be
set to a full path instead of a filename.
If you set the config option `ACL_SELFSERVICE_GROUP`, but not
`ACL_ACCESS_GROUP`, make sure to set `ACL_ACCESS_GROUP` to the same value as
`ACL_SELFSERVICE_GROUP`.
Add a cron job that runs `uffd-admin cleanup` at least daily. Unless you
modified `/etc/cron.d/uffd`, upgrading the Debian package will do this for you.
Uninstall the previous dependency `python3-ldap3` (i.e. run `apt autoremove`).
[uffd-ldapd]: https://git.cccv.de/uffd/uffd-ldapd
cccv-archive-key.gpg 0 → 100644
View file @ 98fe5690
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQGNBGEXIFwBDADRhAYP8td+AVcnbMkswu3SaF1FzqVldwQSHA0tVXpAw7wUtE9s
QEnbLE3cD//SEMQGzwr8LsMpnuWImcS5nk9gIc5p9M076tgyAeS4NFzbvaIpOZJL
V0VK2Q+o6fyaAriY5lb88pU3cR6uTJInwR5MgEki7RLCIjOPW/Nzvw8LdBhgtbJv
jW04IPI1gAiqSfPCjXY8z81JOSLhsk1ED8zrJ/kTWm4yIBbVLMhFu7Snz9UbbF2n
40dA9VydoxlVdjzH+AM7+Ga8FTYu4UivGO+5WFp+iWcoXLqmECSvW+H+Evy8ES9M
7QIkgGTXWsL3YrjrxcwOAu/dXhQVV9woDXWWQRwILNG2poSLUjmVuXMPKnofJpMO
34+n3dvaiPTp31YxTWhOSXdbO3e6Abpd+PKoXqaRy/HrulBuBRf+5/edDKLNVUC/
tPqs61AL9cw6Jxx1vFdmmZm6RWK2CgVWPc9e3GPGfbZYuUBgOphhkJ+3yXRcc1sN
VRyc3Ve87OG6GiUAEQEAAbQgcGFja2FnZXMuY2Njdi5kZSA8aW5mcmFAY2Njdi5k
ZT6JAdQEEwEIAD4CGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQRVPlzDYknN
/1ubu7WpKBpvpuSJcQUCZPjPbAUJDUdK5QAKCRCpKBpvpuSJcVuFC/45TV/8Dvt8
VTS2yoFUjpy0las7qm0fPNkazSVpMhQkxcEz/LysEr5sbc0jZIQZ1zD+rm0RfahM
g7vytTs/xqplgmIXOEPub6CPr+G1ZHgU5pHAc2DqFUR4z3pp37RNtFuhi0TyK0Pp
qVJgAg6/Hf9dkEIwI5orUTTDWhAvxz7wo7/3tb4fqkrWk/Fp0qM8kMEjYyh9/PSb
V4HfhJauXxzBx8T/Wc7TveGyRGVMYH29bK0SssDDvzGJD3Mxd/dXV4JYTk8sw//k
zQwN3lZ7SfsZR5rddRr/BpghdR1k451FdCj9iWF3v3p1TwN93AL6TQ6AF2aFykkB
1JWxockDlGrlRkk+0WiEOYvDUaBo3ppz4QhrO8TFrluGyifv2BNSFMKHdhkvF2IE
DRQles45+CmhgPxVw7qc69pLsXRxN/0BE5P6wNl8DGnk2ZYDlYW/vcosHYbeeRCp
OUpsKF6OSHXjCfMObuG6wYulFhMqrDHtLiD0e6fxWjATqoj+F6TX7Te5AY0EYRcg
XAEMAKNhLd8nN2AYPdqn/9OfTzXOFEoHMGFKVH9E9LRFEp7SXI0Phr+2gPsBEP13
In0dGbvABRvywtTRih+3Jg/5QxyEDcVB0bbWK44XZLmShm9TYmJSqrW8sgOh2Nqi
2LcGroWg2crrd6t+HDmXFZVtiBRy/5Y7s5mqTM/byEvMnReczeTSlwmJHNLTOmME
tganIwmQxfbit99gxjjoz/sGqVxf59/Ytq8P6J+3LMt9ApmPFgK6wB0BAtTJGaOJ
rgSIVdNQ082laXQlHXKMguVKk8ivErzwsCs7ukxSVhIvfwgbM7WZfdM7l6h1ZhDr
mBBGGj+9Ag0mPHF3ycrh9fW43r8KYONbzQq0xtsE+WeOKPaFhMQ/dwv6d4Sn0gTV
crV++l6ut1DLlGHCZtSsB0z1LBUu4jMvpHwVfCeqZ4f5Al27oUhjTh3eoe184+VG
/M3nkh9C1wyvLBFo69AS+9VQSwnsWu/CXnWrzPZeX0KmbezNeNvwCbYgXIrEEWhy
XJgYLQARAQABiQG8BBgBCAAmAhsMFiEEVT5cw2JJzf9bm7u1qSgab6bkiXEFAmT4
z18FCQ1HSukACgkQqSgab6bkiXFVagv+LFrGoHKm4woVvlWHWfanok/YsPyGFsvL
Ogz6U0nhRB5f3wSq9kl0t1esdyNsFGfz+E0fCzyAyML6dBzKv9uHp2+TtcdKLTQ1
kSo/JdbMsva+/e8Y9OHmmv7pAFatLln7XXwa2cPiFRg0VkOQgByR1yEiGAyMIYL8
VLAqdE6fywGLXE5k91+XZCFqKu90+XrtiJo2xy4RQ8C5u2WQWI0k5V/oGgTxOh/J
uhXzmU1Goeie4ukjZYdzwZjzzm2vY9LWfZRaRtkJ0itxNezYCtWEOKHvto5PqtT4
thSsNuC9qQruh3itVykI7lZ9yxkOyuzqjFGKQDNcUlvnZHqdoKuW121/cgMXbAvz
HWHdY4cbc74obm8V8Gx4dX/GNFL868twzMVoBoEgQVA1PURz5Xu73RvWcBpOpYj0
GP3nLdP3s2J9rAhrzS6K+MIHeEUnPi1MavRd4bROpnbJ32yvkSGWR55mWCpdCepj
JRWMzY9EoBOHB1PubZuzUNIUQeui1vyX
=uRc5
-----END PGP PUBLIC KEY BLOCK-----
\ No newline at end of file
debian/contrib/uffd-admin 0 → 100755
View file @ 98fe5690
#!/bin/sh
set -eu
export FLASK_APP=/usr/share/uffd/uffd
export CONFIG_PATH=/etc/uffd/uffd.cfg
if [ "$(whoami)" = "uffd" ]; then
flask "$@"
elif command -v sudo > /dev/null 2>&1; then
exec sudo --preserve-env=FLASK_APP,CONFIG_PATH -u uffd flask "$@"
elif command -v runuser > /dev/null 2>&1; then
exec runuser --preserve-environment -u uffd -- flask "$@"
else
echo "Could not not become 'uffd' user, exiting"
exit 255
fi
debian/uffd.cfg → debian/contrib/uffd.cfg
View file @ 98fe5690
FLASK_ENV="production" FLASK_ENV="production"
SQLALCHEMY_DATABASE_URI="sqlite:////var/lib/uffd/db.sqlite" SQLALCHEMY_DATABASE_URI="sqlite:////var/lib/uffd/db.sqlite"
#SECRET_KEY=autogenerated by postinst script
debian/control
View file @ 98fe5690
...@@ -12,20 +12,27 @@ Homepage: https://git.cccv.de/uffd/uffd ...@@ -12,20 +12,27 @@ Homepage: https://git.cccv.de/uffd/uffd
Vcs-Git: https://git.cccv.de/uffd/uffd.git Vcs-Git: https://git.cccv.de/uffd/uffd.git
Package: uffd Package: uffd
Architecture: any Architecture: all
Depends: Depends:
${misc:Depends}, ${misc:Depends},
${python3:Depends}, # Unlike most debian python packages, we depend directly on the deb packages and do not want to populate our dependencies from the setup.py .
python3-ldap3, # Because of this we do not use the variable from pybuild.
# ${python3:Depends},
python3-flask, python3-flask,
python3-flask-sqlalchemy, python3-flask-sqlalchemy,
python3-flask-migrate, python3-flask-migrate,
python3-qrcode, python3-qrcode,
python3-fido2, python3-fido2,
python3-flask-oauthlib, python3-jwt,
python3-cryptography,
python3-flask-babel, python3-flask-babel,
Recommends: python3-argon2,
nginx, python3-itsdangerous,
uwsgi, uwsgi,
uwsgi-plugin-python3, uwsgi-plugin-python3,
Description: UserFerwaltungsFrontend: Ldap based single sign on and user management web software Recommends:
nginx,
python3-mysqldb,
python3-prometheus-client,
python3-ua-parser,
Description: Web-based user management and single sign-on software
debian/create_changelog.py 0 → 100755
View file @ 98fe5690
#!/usr/bin/python3
import sys
import re
import textwrap
import datetime
import email.utils
import git
package_name = 'UNKNOWN'
alias_names = {
'julian': 'Julian Rother',
'Julian': 'Julian Rother',
}
ignore_commit_regexes = [
'^fixup!',
]
def print_release(tag=None, commits=tuple(), last_tag=None):
release_version = '0.0.0'
release_author = git.objects.util.Actor('None', 'undefined@example.com')
release_date = 0
release_status = 'UNRELEASED'
message = ''
if tag:
release_status = 'unstable'
release_version = tag.name[1:] # strip leading "v"
if isinstance(tag.object, git.TagObject):
release_author = tag.object.tagger
release_date = tag.object.tagged_date
message = tag.object.message.split('-----BEGIN PGP SIGNATURE-----')[0].strip()
else:
release_author = tag.object.committer
release_date = tag.object.committed_date
elif commits:
release_author = commits[0].committer
release_date = commits[0].committed_date
date = datetime.datetime.fromtimestamp(release_date).strftime('%Y%m%dT%H%M%S')
last_version = '0.0.0'
if last_tag:
last_version = last_tag.name[1:] # strip leading "v"
release_version = f'{last_version}+git{date}-{commits[0].hexsha[:8]}'
print(f'{package_name} ({release_version}) {release_status}; urgency=medium')
print()
if message:
print(textwrap.indent(message, ' '))
print()
commit_authors = [] # list of (key, author), sorted by first commit date
commit_author_emails = {} # author email -> key
commit_author_names = {} # author name -> key
commit_author_commits = {} # key -> list of commits
for commit in commits:
if any(filter(lambda pattern: re.match(pattern, commit.summary), ignore_commit_regexes)):
continue
if len(commit.parents) > 1:
continue # Ignore merge commits
author_name = alias_names.get(commit.author.name, commit.author.name)
key = commit_author_emails.get(commit.author.email)
if key is None:
key = commit_author_names.get(author_name)
if key is None:
key = commit.author.email
commit_authors.append((key, author_name))
commit_author_emails[commit.author.email] = key
commit_author_names[author_name] = key
commit_author_commits[key] = commit_author_commits.get(key, []) + [commit]
commit_authors.sort(key=lambda args: len(commit_author_commits[args[0]]))
for key, author_name in commit_authors:
print(f' [ {author_name} ]')
for commit in commit_author_commits[key]:
lines = '\n'.join(textwrap.wrap(commit.summary, 90))
lines = ' * ' + textwrap.indent(lines, ' ').strip()
print(lines)
print()
print(f' -- {alias_names.get(release_author.name, release_author.name)} <{release_author.email}> {email.utils.formatdate(release_date)}')
if __name__ == '__main__':
repo = git.Repo('.')
package_name = sys.argv[1]
version_commits = {}
for tag in repo.tags:
if not re.fullmatch('v[0-9]+[.][0-9]+[.][0-9]+.*', tag.name):
continue
if isinstance(tag.object, git.TagObject):
commit_hexsha = tag.object.object.hexsha
else:
commit_hexsha = tag.object.hexsha
version_commits[commit_hexsha] = tag
tag = None
commits = []
for commit in repo.iter_commits('HEAD'):
if commit.hexsha in version_commits:
prev_tag = version_commits[commit.hexsha]
if commits:
print_release(tag, commits, last_tag=prev_tag)
print()
tag = prev_tag
commits = []
commits.append(commit)
print_release(tag, commits)
debian/cron.d 0 → 100644
View file @ 98fe5690
# Cronjobs for uffd
@daily uffd flock -n /var/run/uffd/cron.roles-update-all.lock /usr/bin/uffd-admin roles-update-all --check-only 2> /dev/null
@daily uffd flock -n /var/run/uffd/cron.cleanup.lock /usr/bin/uffd-admin cleanup > /dev/null
debian/dirs
View file @ 98fe5690
/etc/uffd /etc/uffd
/var/lib/uffd /var/lib/uffd
/usr/share/uffd/uffd/instance
debian/install
View file @ 98fe5690
uwsgi.ini /etc/uffd/ uwsgi.ini /etc/uffd/
nginx.include.conf /etc/uffd/ nginx.include.conf /etc/uffd/
debian/uffd.cfg /etc/uffd/ debian/contrib/uffd.cfg /etc/uffd/
debian/contrib/uffd-admin /usr/bin/
README.md /usr/share/doc/uffd/
UPGRADE.md /usr/share/doc/uffd/
debian/links
View file @ 98fe5690
/etc/uffd/uffd.cfg /usr/share/uffd/uffd/instance/config.cfg /etc/uffd/uwsgi.ini /etc/uwsgi/apps-available/uffd.ini
/etc/uwsgi/apps-available/uffd.ini /etc/uwsgi/apps-enabled/uffd.ini
debian/postinst
View file @ 98fe5690
...@@ -10,8 +10,17 @@ case "$1" in ...@@ -10,8 +10,17 @@ case "$1" in
chown -R uffd:uffd /var/lib/uffd chown -R uffd:uffd /var/lib/uffd
chmod 0770 /var/lib/uffd chmod 0770 /var/lib/uffd
python3 <<EOF
import secrets
cfg = open('/etc/uffd/uffd.cfg', 'r').read()
cfg = cfg.replace('\n#SECRET_KEY=autogenerated by postinst script\n',
'\nSECRET_KEY="'+secrets.token_hex(128)+'"\n', 1)
open('/etc/uffd/uffd.cfg', 'w').write(cfg)
EOF
chown root:uffd /etc/uffd/uffd.cfg chown root:uffd /etc/uffd/uffd.cfg
chmod 0640 /etc/uffd/uffd.cfg chmod 0640 /etc/uffd/uffd.cfg
invoke-rc.d uwsgi restart uffd
;; ;;
abort-upgrade|abort-remove|abort-deconfigure) abort-upgrade|abort-remove|abort-deconfigure)
......
debian/tmpfile 0 → 100644
View file @ 98fe5690
#Type Path Mode UID GID Age Argument
d /run/uffd 0755 uffd uffd - -
pytest.ini 0 → 100644
View file @ 98fe5690
[pytest]
filterwarnings =
# DeprecationWarning from dependencies that we use
ignore:`formatargspec` is deprecated since Python 3.5. Use `signature` and the `Signature` object directly:DeprecationWarning
ignore:Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated since Python 3.3, and in 3.10 it will stop working:DeprecationWarning
requirements.txt
View file @ 98fe5690
# Versions from Debian Buster .
ldap3==2.4.1
flask==1.0.2
Flask-SQLAlchemy==2.1
qrcode==6.1
fido2==0.5.0
Flask-OAuthlib==0.9.5
Flask-Migrate==2.1.1
Flask-Babel==0.11.2
alembic==1.0.0
# The main dependencies on their own lead to version collisions and pip is
# not very good at resolving them, so we pin the versions from Debian Buster
# for all dependencies.
certifi==2018.8.24
#cffi==1.12.2
cffi # v1.12.2 no longer works with python3.9. Newer versions seem to work fine.
chardet==3.0.4
click==7.0
cryptography==2.6.1
idna==2.6
itsdangerous==0.24
Jinja2==2.10
MarkupSafe==1.1.0
oauthlib==2.1.0
pyasn1==0.4.2
pycparser==2.19
requests==2.21.0
requests-oauthlib==1.0.0
six==1.12.0
SQLAlchemy==1.2.18
urllib3==1.24.1
Werkzeug==0.14.1
python-dateutil==2.7.3
#editor==1.0.3
Mako==1.0.7
# Testing # Testing
pytest==3.10.1 pytest==3.10.1
......
setup.py
View file @ 98fe5690
...@@ -3,17 +3,18 @@ import os ...@@ -3,17 +3,18 @@ import os
with open('README.md', 'r', encoding='utf-8') as f: with open('README.md', 'r', encoding='utf-8') as f:
long_description = f.read() long_description = f.read()
long_description = '**DO NOT INSTALL FROM PIP FOR PRODUCTION DEPLOYMENTS**, see [Deployment](#Deployment) for more information.\n\n\n\n' + long_description
setup( setup(
name='uffd', name='uffd',
version=os.environ.get('PACKAGE_VERSION', 'local'), version=os.environ.get('PACKAGE_VERSION', 'local'),
description='UserFerwaltungsFrontend: Ldap based single sign on and user management web software', description='Web-based user management and single sign-on software',
long_description=long_description, long_description=long_description,
long_description_content_type='text/markdown', long_description_content_type='text/markdown',
url='https://git.cccv.de/uffd/uffd', url='https://git.cccv.de/uffd/uffd',
classifiers=[ classifiers=[
'Programming Language :: Python :: 3', 'Programming Language :: Python :: 3',
'Development Status :: 4 - Beta', 'Development Status :: 5 - Production/Stable',
'License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)', 'License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)',
'Operating System :: OS Independent', 'Operating System :: OS Independent',
'Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP', 'Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP',
...@@ -24,8 +25,48 @@ setup( ...@@ -24,8 +25,48 @@ setup(
author='CCCV', author='CCCV',
author_email='it@cccv.de', author_email='it@cccv.de',
license='AGPL3', license='AGPL3',
packages=find_packages(), packages=['uffd'],
include_package_data=True, include_package_data=True,
zip_safe=False, zip_safe=False,
python_requires='>=3.7', python_requires='>=3.7',
install_requires=[
# Versions Debian Buster packages are based on.
# DO NOT USE FOR PRODUCTION, those in the setup.py are not updated regularly
'flask==1.0.2',
'Flask-SQLAlchemy==2.1',
'qrcode==6.1',
'fido2==0.5.0',
'cryptography==2.6.1',
'pyjwt==1.7.0',
'Flask-Migrate==2.1.1',
'Flask-Babel==0.11.2',
'alembic==1.0.0',
'argon2-cffi==18.3.0',
'itsdangerous==0.24',
'prometheus-client==0.9',
'ua-parser==0.8.0',
# The main dependencies on their own lead to version collisions and pip is
# not very good at resolving them, so we pin the versions from Debian Buster
# for all dependencies.
'certifi==2018.8.24',
#cffi==1.12.2'
'cffi # v1.12.2 no longer works with python3.9. Newer versions seem to work fine.',
'chardet==3.0.4',
'click==7.0',
'idna==2.6',
'Jinja2==2.10',
'MarkupSafe==1.1.0',
'pyasn1==0.4.2',
'pycparser==2.19',
'requests==2.21.0',
'requests-oauthlib==1.0.0',
'six==1.12.0',
'SQLAlchemy==1.2.18',
'urllib3==1.24.1',
'Werkzeug==0.14.1',
'python-dateutil==2.7.3',
#editor==1.0.3
'Mako==1.0.7',
],
) )
tests/__init__.py 0 → 100644
View file @ 98fe5690

Impressum - Datenschutzerklärung