When issuing a GET or HEAD request on a format folder that contains a
single artifact file, the response is an HTTP redirection to that
file. In that case, add a "Content-Disposition" HTTP header to the
response, so that it can be used with e.g. "curl -JOL" to save the
downloaded file using the actual file name instead of that of the
format folder.

Signed-off-by: Julien Floret <julien.floret@6wind.com>
Acked-by: Thomas Faivre <thomas.faivre@6wind.com>
---
 dlrepo/views/fmt.py | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/dlrepo/views/fmt.py b/dlrepo/views/fmt.py
[message trimmed]

Le mer. 24 janv. 2024 à 21:08, Robin Jarry <robin@jarry.cc> a écrit :
>
> Julien Floret <julien.floret@6wind.com> wrote:
> > Patches 1 and 2 add missing restrictions on deleting a job format.
> > Patch 3 is for allowing modification of an internal format even when the
> > job is locked.
> >
> > Julien Floret (3):
> >   fmt: refuse deletion in product view
> >   fmt: refuse deletion if job is locked
> >   fmt: allow modifying internal format in locked job
>
> Acked-by: Robin Jarry <robin@jarry.cc>
>

Hi,

Oops, I forgot to run "make lint". The changes made by black are
trivial formatting of long lines in patch 1.
Robin, do you want me to send a v2 of this series?

Julien


Le mer. 24 janv. 2024 à 14:39, Julien Floret <julien.floret@6wind.com> a écrit :
>
> Deleting product formats is not supported.
>
> Fixes: 6de1f15cfcf8 ("format: add delete method")

Internal formats are not released and are not included in the
calculation of the job digest.
They can then be safely added to or deleted from a locked job, without
needing to unlock it prior, so the uploader will not need the "update"
access, only the "add" access.

It is useful to add extra info after a job has been released, like
test results, or transient data like CVE scans updated daily with an
up-to-date vulnerability database, without giving too many permissions
to the uploader.

Signed-off-by: Julien Floret <julien.floret@6wind.com>
Acked-by: Thomas Faivre <thomas.faivre@6wind.com>
---
[message trimmed]

A format should not be deleted in a locked job.

Fixes: 6de1f15cfcf8 ("format: add delete method")
Signed-off-by: Julien Floret <julien.floret@6wind.com>
Acked-by: Thomas Faivre <thomas.faivre@6wind.com>
---
 dlrepo/views/fmt.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlrepo/views/fmt.py b/dlrepo/views/fmt.py
index fca4ae4cdc8b..654d30468f77 100644
--- a/dlrepo/views/fmt.py
+++ b/dlrepo/views/fmt.py
@@ -188,12 +188,14 @@ def _get_format(repo, match_info, access_cb: Callable[[str], bool] = None, delet
[message trimmed]

Deleting product formats is not supported.

Fixes: 6de1f15cfcf8 ("format: add delete method")
Signed-off-by: Julien Floret <julien.floret@6wind.com>
Acked-by: Thomas Faivre <thomas.faivre@6wind.com>
---
 dlrepo/views/fmt.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dlrepo/views/fmt.py b/dlrepo/views/fmt.py
index 33876764141c..fca4ae4cdc8b 100644
--- a/dlrepo/views/fmt.py
+++ b/dlrepo/views/fmt.py
@@ -78,7 +78,7 @@ class FormatDirView(BaseView):
[message trimmed]

Patches 1 and 2 add missing restrictions on deleting a job format.
Patch 3 is for allowing modification of an internal format even when the
job is locked.

Julien Floret (3):
  fmt: refuse deletion in product view
  fmt: refuse deletion if job is locked
  fmt: allow modifying internal format in locked job

 dlrepo/views/artifact.py |  2 +-
 dlrepo/views/fmt.py      | 12 ++++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

--

When a file is uploaded, it is first uploaded to .uploads/<uuid>, then
moved to .blobs/<digest>.
The .blobs/<digest> file is then hardlinked to the actual file path
into the job.
If however the same file is uploaded more than once, without checking
that its digest already exists on the server, then any existing
.blobs/<digest> file is replaced with the same newly uploaded
file. As a consequence, the existing hardlinks become orphaned.

What's more, if the most recent job is deleted afterwards, the
associated .blobs/<digest> file will have no other hardlink to it, so
it will be deleted at the next run of the cleanup task.
This is catastrophic for containers, because it breaks container
pull. Indeed "docker pull", for example, downloads its layers
[message trimmed]

It is not used. Thus the return value of the _check_and_move() can be
removed too.
No functional change.

Signed-off-by: Julien Floret <julien.floret@6wind.com>
Acked-by: Thomas Faivre <thomas.faivre@6wind.com>
---
 dlrepo/fs/__init__.py | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/dlrepo/fs/__init__.py b/dlrepo/fs/__init__.py
index 9d98b124349d..00c68f00f92f 100644
--- a/dlrepo/fs/__init__.py
+++ b/dlrepo/fs/__init__.py
[message trimmed]

This small series is for fixing potential orphan hardlinks when the
same file is uploaded several times into different places.
Patch 1 is a preliminary code cleanup without functional changes.
Patch 2 actually fixes the bug by adding a check before moving the
uploaded file into the .blobs folder.

Julien Floret (2):
  fs: rm return value for finalize_upload
  fs: ensure upload never replaces an existing blob

 dlrepo/fs/__init__.py | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

--