From 40e20f490ec67428f7f879820c28244052228ce9 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Fri, 21 Aug 2026 19:16:41 -0700 Subject: [PATCH] fix(packages): restore generated tree ownership --- internal/adapter/repogen/generator.go | 6 ++++++ internal/adapter/repogen/generator_test.go | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/internal/adapter/repogen/generator.go b/internal/adapter/repogen/generator.go index 0518db3..fcc0e4e 100644 --- a/internal/adapter/repogen/generator.go +++ b/internal/adapter/repogen/generator.go @@ -194,6 +194,7 @@ func validateGenerateRequest(ctx context.Context, generator *Generator, request // generateAPT runs apt-ftparchive and gzip with reproducible release metadata. func (g *Generator) generateAPT(ctx context.Context, request pkgrepo.GenerateRequest) error { script := `set -eu +owner="$(stat -c '%u:%g' /repo)" apt-get update -qq DEBIAN_FRONTEND=noninteractive apt-get install -y -qq apt-utils gzip >/dev/null cd /repo/apt @@ -214,6 +215,7 @@ apt-ftparchive \ -o APT::FTPArchive::Release::Date="` + request.ReleaseTime.UTC().Format(http.TimeFormat) + `" \ -o APT::FTPArchive::Release::Valid-Until="` + request.ValidUntil.UTC().Format(http.TimeFormat) + `" \ release dists/stable >dists/stable/Release +chown -R "$owner" /repo/apt ` if err := g.runDocker(ctx, request.Root, nil, g.debianImage, "sh", "-ceu", script); err != nil { return fmt.Errorf("generate APT metadata: %w", err) @@ -226,11 +228,13 @@ apt-ftparchive \ func (g *Generator) generateRPM(ctx context.Context, request pkgrepo.GenerateRequest) error { epoch := strconv.FormatInt(request.ReleaseTime.Unix(), 10) script := `set -eu +owner="$(stat -c '%u:%g' /repo)" dnf install -y -q createrepo_c >/dev/null for arch in x86_64 aarch64; do touch -d "@` + epoch + `" "/repo/rpm/stable/${arch}/packages/"*.rpm createrepo_c --quiet --unique-md-filenames --revision ` + epoch + ` --set-timestamp-to-revision "/repo/rpm/stable/${arch}" done +chown -R "$owner" /repo/rpm ` if err := g.runDocker(ctx, request.Root, nil, g.fedoraImage, "sh", "-ceu", script); err != nil { return fmt.Errorf("generate RPM metadata: %w", err) @@ -245,6 +249,7 @@ func (g *Generator) generateAPK(ctx context.Context, request pkgrepo.GenerateReq keyName := filepath.Base(g.apkSigningKey) containerKey := path.Join(containerKeys, keyName) script := `set -eu +owner="$(stat -c '%u:%g' /repo)" export SOURCE_DATE_EPOCH=` + epoch + ` apk add --no-cache abuild >/dev/null cp /repo/keys/*.rsa.pub /etc/apk/keys/ @@ -253,6 +258,7 @@ for arch in x86_64 aarch64; do apk index -o APKINDEX.tar.gz ./*.apk abuild-sign -k "` + containerKey + `" APKINDEX.tar.gz done +chown -R "$owner" /repo/apk ` keyMount := g.apkSigningKey + ":" + containerKey + ":ro" if err := g.runDocker( diff --git a/internal/adapter/repogen/generator_test.go b/internal/adapter/repogen/generator_test.go index 80d720f..0ba7713 100644 --- a/internal/adapter/repogen/generator_test.go +++ b/internal/adapter/repogen/generator_test.go @@ -45,15 +45,21 @@ func TestGenerateInvokesAcceptedToolsAndPublishesStrongByHash(t *testing.T) { assert.Contains(t, invocations[0][7], "apt-ftparchive") assert.Contains(t, invocations[0][7], "Acquire-By-Hash=yes") assert.Contains(t, invocations[0][7], "Fri, 21 Aug 2026 12:00:00 GMT") + assert.Contains(t, invocations[0][7], `owner="$(stat -c '%u:%g' /repo)"`) + assert.Contains(t, invocations[0][7], `chown -R "$owner" /repo/apt`) assert.Equal(t, "fedora@sha256:99e203b80b1c3d8f7e161ec10a68fd02b081ef83a3963553e513c82846b97814", invocations[1][4]) assert.Contains(t, invocations[1][7], `touch -d "@1787313600"`) assert.Contains(t, invocations[1][7], "--unique-md-filenames --revision 1787313600") + assert.Contains(t, invocations[1][7], `owner="$(stat -c '%u:%g' /repo)"`) + assert.Contains(t, invocations[1][7], `chown -R "$owner" /repo/rpm`) assert.Equal(t, "-v", invocations[2][4]) assert.Equal(t, fixture.key+":/keys/apk-index-001.rsa:ro", invocations[2][5]) assert.Equal(t, "alpine@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce", invocations[2][6]) assert.Contains(t, invocations[2][9], "SOURCE_DATE_EPOCH=1787313600") assert.Contains(t, invocations[2][9], "cp /repo/keys/*.rsa.pub /etc/apk/keys/") assert.Contains(t, invocations[2][9], `abuild-sign -k "/keys/apk-index-001.rsa"`) + assert.Contains(t, invocations[2][9], `owner="$(stat -c '%u:%g' /repo)"`) + assert.Contains(t, invocations[2][9], `chown -R "$owner" /repo/apk`) for _, architecture := range []string{"amd64", "arm64"} { for _, name := range []string{"Packages", "Packages.gz"} {