Merge pull request #149 from YunoHost-Apps/testing

Testing

.github/workflows/updater.sh

@@ -0,0 +1,126 @@
+#!/bin/bash
+
+#=================================================
+# PACKAGE UPDATING HELPER
+#=================================================
+
+# This script is meant to be run by GitHub Actions
+# The YunoHost-Apps organisation offers a template Action to run this script periodically
+# Since each app is different, maintainers can adapt its contents so as to perform
+# automatic actions when a new upstream release is detected.
+
+# Remove this exit command when you are ready to run this Action
+#exit 1
+
+#=================================================
+# FETCHING LATEST RELEASE AND ITS ASSETS
+#=================================================
+
+# Fetching information
+current_version=$(cat manifest.json | jq -j '.version|split("~")[0]')
+repo=$(cat manifest.json | jq -j '.upstream.code|split("https://github.com/")[1]')
+# Some jq magic is needed, because the latest upstream release is not always the latest version (e.g. security patches for older versions)
+version=$(curl --silent "https://api.github.com/repos/$repo/releases" | jq -r '.[] | select( .prerelease != true ) | .tag_name' | sort -V | tail -1)
+assets=($(curl --silent "https://api.github.com/repos/$repo/releases" | jq -r '[ .[] | select(.tag_name=="'$version'").assets[].browser_download_url ] | join(" ") | @sh' | tr -d "'"))
+
+if [[ ${version:0:1} == "v" || ${version:0:1} == "V" ]]; then
+    version=${version:1}
+fi
+
+# Setting up the environment variables
+echo "Current version: $current_version"
+echo "Latest release from upstream: $version"
+echo "VERSION=$version" >> $GITHUB_ENV
+# For the time being, let's assume the script will fail
+echo "PROCEED=false" >> $GITHUB_ENV
+
+# Proceed only if the retrieved version is greater than the current one
+if ! dpkg --compare-versions "$current_version" "lt" "$version" ; then
+    echo "::warning ::No new version available"
+    exit 0
+# Proceed only if a PR for this new version does not already exist
+elif git ls-remote -q --exit-code --heads https://github.com/$GITHUB_REPOSITORY.git ci-auto-update-v$version ; then
+    echo "::warning ::A branch already exists for this update"
+    exit 0
+fi
+
+# Each release can hold multiple assets (e.g. binaries for different architectures, source code, etc.)
+echo "${#assets[@]} available asset(s)"
+
+#=================================================
+# UPDATE SOURCE FILES
+#=================================================
+
+# Here we use the $assets variable to get the resources published in the upstream release.
+# Here is an example for Grav, it has to be adapted in accordance with how the upstream releases look like.
+
+# Let's loop over the array of assets URLs
+for asset_url in ${assets[@]}; do
+
+echo "Handling asset at $asset_url"
+
+# Assign the asset to a source file in conf/ directory
+# Here we base the source file name upon a unique keyword in the assets url (admin vs. update)
+# Leave $src empty to ignore the asset
+case $asset_url in
+  *".tar.gz"*)
+    src="app"
+    ;;
+esac
+
+# If $src is not empty, let's process the asset
+if [ ! -z "$src" ]; then
+
+# Create the temporary directory
+tempdir="$(mktemp -d)"
+
+# Download sources and calculate checksum
+filename=${asset_url##*/}
+curl --silent -4 -L $asset_url -o "$tempdir/$filename"
+checksum=$(sha256sum "$tempdir/$filename" | head -c 64)
+
+# Delete temporary directory
+rm -rf $tempdir
+
+# Get extension
+if [[ $filename == *.tar.gz ]]; then
+  extension=tar.gz
+else
+  extension=${filename##*.}
+fi
+
+# Rewrite source file
+cat <<EOT > conf/$src.src
+SOURCE_URL=$asset_url
+SOURCE_SUM=$checksum
+SOURCE_SUM_PRG=sha256sum
+SOURCE_FORMAT=$extension
+SOURCE_IN_SUBDIR=true
+EOT
+echo "... conf/$src.src updated"
+
+else
+echo "... asset ignored"
+fi
+
+done
+
+#=================================================
+# SPECIFIC UPDATE STEPS
+#=================================================
+
+# Any action on the app's source code can be done.
+# The GitHub Action workflow takes care of committing all changes after this script ends.
+
+#=================================================
+# GENERIC FINALIZATION
+#=================================================
+
+# Install moreutils, needed for sponge
+echo "$(jq -s --indent 4 ".[] | .version = \"$version~ynh1\"" manifest.json)" > manifest.json
+
+# No need to update the README, yunohost-bot takes care of it
+
+# The Action will proceed only if the PROCEED environment variable is set to true
+echo "PROCEED=true" >> $GITHUB_ENV
+exit 0

.github/workflows/updater.yml

@@ -0,0 +1,49 @@
+# This workflow allows GitHub Actions to automagically update your app whenever a new upstream release is detected.
+# You need to enable Actions in your repository settings, and fetch this Action from the YunoHost-Apps organization.
+# This file should be enough by itself, but feel free to tune it to your needs.
+# It calls updater.sh, which is where you should put the app-specific update steps.
+name: Check for new upstream releases
+on:
+  # Allow to manually trigger the workflow
+  workflow_dispatch:
+  # Run it every day at 6:00 UTC
+  schedule:
+    - cron:  '0 6 * * *'
+jobs:
+  updater:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch the source code
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run the updater script
+        id: run_updater
+        run: |
+          # Setting up Git user
+          git config --global user.name 'yunohost-bot'
+          git config --global user.email 'yunohost-bot@users.noreply.github.com'
+          # Run the updater script
+          /bin/bash .github/workflows/updater.sh
+      - name: Commit changes
+        id: commit
+        if: ${{ env.PROCEED == 'true' }}
+        run: |
+          git commit -am "Upgrade to v$VERSION"
+      - name: Create Pull Request
+        id: cpr
+        if: ${{ env.PROCEED == 'true' }}
+        uses: peter-evans/create-pull-request@v3
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Update to version ${{ env.VERSION }}
+          committer: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
+          author: 'yunohost-bot <yunohost-bot@users.noreply.github.com>'
+          signoff: false
+          branch: ci-auto-update-v${{ env.VERSION }}
+          base: testing
+          delete-branch: true
+          title: 'Upgrade to version ${{ env.VERSION }}'
+          body: |
+            Upgrade etherpad_mypads to v${{ env.VERSION }}
+          draft: false

CHANGELOG.md

@@ -1,6 +1,15 @@
 Changelog
 =========
 
+
+## [1.8.14~ynh2]() - 2021-10-01
+
+#### Changed
+* [Harden systemd](https://github.com/YunoHost-Apps/etherpad_mypads_ynh/pull/149/commits/5900064ea950d98c0bf28e336a5e2d85012e5e52)
+* [Fix login to admin page](https://github.com/YunoHost-Apps/etherpad_mypads_ynh/pull/149/commits/3659fb84bcd52d16937a25998395e7889a731412)
+* [Add autoupdate mecanism](https://github.com/YunoHost-Apps/etherpad_mypads_ynh/pull/149/commits/b53b5830e5c3521db00fe2f4c8b8c1d953e5664a)
+* [Code clean up](https://github.com/YunoHost-Apps/etherpad_mypads_ynh/pull/149/commits/e4168cde0a8611a09ff5bfea6059bdc98a36af38)
+
 ## [1.8.14~ynh1]() - 2021-06-04
 
 #### Changed

README.md

@@ -17,7 +17,7 @@ If you don't have YunoHost, please consult [the guide](https://yunohost.org/#/in
 
 Online editor providing collaborative editing in real-time
 
-**Shipped version:** 1.8.14~ynh1
+**Shipped version:** 1.8.14~ynh2
 
 **Demo:** https://video.etherpad.com
 
@@ -62,7 +62,6 @@ You can also find a configuration file for Etherpad at this path `/var/www/ether
 ## Documentation and resources
 
 * Official app website: http://etherpad.org
-* Official user documentation: https://yunohost.org/en/app_etherpad_mypads
 * Official admin documentation: http://etherpad.org/doc/v1.8.14
 * Upstream app code repository: https://github.com/ether/etherpad-lite
 * YunoHost documentation for this app: https://yunohost.org/app_etherpad_mypads

README_fr.md

@@ -13,7 +13,7 @@ Si vous n'avez pas YunoHost, regardez [ici](https://yunohost.org/#/install) pour
 
 Éditeur en ligne fournissant l'édition collaborative en temps réel
 
-**Version incluse :** 1.8.14~ynh1
+**Version incluse :** 1.8.14~ynh2
 
 **Démo :** https://video.etherpad.com
 
@@ -59,7 +59,6 @@ Vous pouvez accéder à deux panneaux d'administration différents, pour Etherpa
 ## Documentations et ressources
 
 * Site officiel de l'app : http://etherpad.org
-* Documentation officielle utilisateur : https://yunohost.org/en/app_etherpad_mypads
 * Documentation officielle de l'admin : http://etherpad.org/doc/v1.8.14
 * Dépôt de code officiel de l'app : https://github.com/ether/etherpad-lite
 * Documentation YunoHost pour cette app : https://yunohost.org/app_etherpad_mypads

conf/app.src

@@ -3,4 +3,3 @@ SOURCE_SUM=5404035675fb5ee9349d42927895bb3933590823612ebe31ca4cc523afdac49e
 SOURCE_SUM_PRG=sha256sum
 ARCH_FORMAT=tar.gz
 SOURCE_IN_SUBDIR=true
-SOURCE_FILENAME=

conf/systemd.service

@@ -14,5 +14,35 @@ StandardOutput=append:/var/log/__APP__/etherpad.log
 StandardError=inherit
 Restart=always
 
+# Sandboxing options to harden security
+# Depending on specificities of your service/app, you may need to tweak these 
+# .. but this should be a good baseline
+# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+DevicePolicy=closed
+ProtectSystem=full
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+LockPersonality=yes
+SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
+
+# Denying access to capabilities that should not be relevant for webapps
+# Doc: https://man7.org/linux/man-pages/man7/capabilities.7.html
+CapabilityBoundingSet=~CAP_RAWIO CAP_MKNOD
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_TIME CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_LEASE CAP_LINUX_IMMUTABLE CAP_IPC_LOCK
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_WAKE_ALARM
+CapabilityBoundingSet=~CAP_SYS_TTY_CONFIG
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE
+CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_BROADCAST CAP_NET_RAW
+CapabilityBoundingSet=~CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYSLOG 
+
 [Install]
 WantedBy=multi-user.target

manifest.json

@@ -6,14 +6,13 @@
 		"en": "Online editor providing collaborative editing in real-time",
 		"fr": "Éditeur en ligne fournissant l'édition collaborative en temps réel"
 	},
-	"version": "1.8.14~ynh1",
+	"version": "1.8.14~ynh2",
 	"url": "http://etherpad.org",
 	"upstream": {
         "license": "Apache-2.0",
         "website": "http://etherpad.org",
         "demo": "https://video.etherpad.com",
         "admindoc": "http://etherpad.org/doc/v1.8.14",
-        "userdoc": "https://yunohost.org/en/app_etherpad_mypads",
         "code": "https://github.com/ether/etherpad-lite"
     },
 	"license": "Apache-2.0",
@@ -37,8 +36,7 @@
 		"install" : [
 			{
 				"name": "domain",
-				"type": "domain",
-				"example": "sub.domain.org"
+				"type": "domain"
 			},
 			{
 				"name": "path",
@@ -48,13 +46,11 @@
 			},
 			{
 				"name": "admin",
-				"type": "user",
-				"example": "john"
+				"type": "user"
 			},
 			{
 				"name": "password",
-				"type": "password",
-				"example": "Choose a password"
+				"type": "password"
 			},
 			{
 				"name": "language",

scripts/_common.sh

@@ -4,8 +4,6 @@
 # COMMON VARIABLES
 #=================================================
 
-#!/bin/bash
-
 # Dependencies for AbiWord
 abiword_app_depencencies="abiword"
 

scripts/change_url

@@ -6,6 +6,10 @@
 # IMPORT GENERIC HELPERS
 #=================================================
 
+if [ ${PACKAGE_CHECK_EXEC:-0} -eq 1 ]; then
+	sleep 60
+fi
+
 source _common.sh
 source /usr/share/yunohost/helpers
 

scripts/install

@@ -32,7 +32,7 @@ ynh_abort_if_errors
 domain=$YNH_APP_ARG_DOMAIN
 path_url=$YNH_APP_ARG_PATH
 admin=$YNH_APP_ARG_ADMIN
-ynh_print_OFF; password=$YNH_APP_ARG_PASSWORD; ynh_print_ON
+password=$YNH_APP_ARG_PASSWORD
 language=$YNH_APP_ARG_LANGUAGE
 is_public=$YNH_APP_ARG_IS_PUBLIC
 export=$YNH_APP_ARG_EXPORT
@@ -46,12 +46,10 @@ app=$YNH_APP_INSTANCE_NAME
 #=================================================
 ynh_script_progression --message="Validating installation parameters..."
 
-ynh_print_OFF
 if [ "${#password}" -lt 8 ] || [ "${#password}" -gt 30 ]
 then
 	ynh_die --message="The password must be between 8 and 30 characters."
 fi
-ynh_print_ON
 
 final_path=/var/www/$app
 test ! -e "$final_path" || ynh_die --message="This path already contains a folder"
@@ -67,7 +65,7 @@ ynh_script_progression --message="Storing installation settings..." --weight=3
 ynh_app_setting_set --app=$app --key=domain --value=$domain
 ynh_app_setting_set --app=$app --key=path --value=$path_url
 ynh_app_setting_set --app=$app --key=admin --value=$admin
-ynh_print_OFF; ynh_app_setting_set --app=$app --key=password --value=$password; ynh_print_ON
+ynh_app_setting_set --app=$app --key=password --value=$password
 ynh_app_setting_set --app=$app --key=language --value=$language
 ynh_app_setting_set --app=$app --key=export --value=$export
 ynh_app_setting_set --app=$app --key=mypads --value=$mypads
@@ -300,11 +298,11 @@ ynh_add_fail2ban_config --logpath="/var/log/nginx/$domain-access.log" --failrege
 ynh_script_progression --message="Configuring permissions..." --weight=2
 
 if [ $is_public -eq 1 ]; then
-	ynh_permission_update --permission="main" --add="visitors"	
+	ynh_permission_update --permission="main" --add="visitors"
 fi
 
 # Only the admin can access the admin panel of the app (if the app has an admin panel)
-ynh_permission_create --permission="admin" --url="/admin" --allowed=$admin
+ynh_permission_create --permission="admin" --url="/admin" --allowed=$admin --auth_header=false
 
 #=================================================
 # RELOAD NGINX
@@ -344,7 +342,6 @@ else
 	Informations="You can access the admin panel by accessing https://$domain${path_url%/}/admin."
 fi
 
-ynh_print_OFF
 echo "$Informations
 You can also find a config file for Etherpad at this path /var/www/etherpad_mypads/settings.json.
 
@@ -354,7 +351,6 @@ You can also find some specific actions for this app by using the experimental a
 If you are facing an issue or want to improve this app, please open a new issue in this project: https://github.com/YunoHost-Apps/etherpad_mypads_ynh" > mail_to_send
 
 ynh_send_readme_to_admin --app_message="mail_to_send" --recipients="$admin" --type=install
-ynh_print_ON
 
 #=================================================
 # END OF SCRIPT

scripts/restore

@@ -35,15 +35,13 @@ db_name=$(ynh_app_setting_get --app=$app --key=db_name)
 export=$(ynh_app_setting_get --app=$app --key=export)
 mypads=$(ynh_app_setting_get --app=$app --key=mypads)
 admin=$(ynh_app_setting_get --app=$app --key=admin)
-ynh_print_OFF; password=$(ynh_app_setting_get --app=$app --key=password); ynh_print_ON
+password=$(ynh_app_setting_get --app=$app --key=password)
 
 #=================================================
 # CHECK IF THE APP CAN BE RESTORED
 #=================================================
 ynh_script_progression --message="Validating restoration parameters..."
 
-ynh_webpath_available --domain=$domain --path_url=$path_url \
-	|| ynh_die --message="Path not available: ${domain}${path_url}"
 test ! -d $final_path \
 	|| ynh_die --message="There is already a directory: $final_path "
 
@@ -193,14 +191,12 @@ else
 	Informations="You can access to the admin panel, by accessing https://$domain${path_url%/}/admin."
 fi
 
-ynh_print_OFF
 echo "$Informations
 You can also find a config file for Etherpad at this path /var/www/etherpad_mypads/settings.json.
 
 If you are facing an issue or want to improve this app, please open a new issue in this project: https://github.com/YunoHost-Apps/etherpad_mypads_ynh" > mail_to_send
 
 ynh_send_readme_to_admin --app_message="mail_to_send" --recipients="$admin" --type=restore
-ynh_print_ON
 
 #=================================================
 # END OF SCRIPT

scripts/upgrade

@@ -27,7 +27,7 @@ export=$(ynh_app_setting_get --app=$app --key=export)
 db_name=$(ynh_app_setting_get --app=$app --key=db_name)
 db_user=$db_name
 db_pwd=$(ynh_app_setting_get --app=$app --key=mysqlpwd)
-ynh_print_OFF; password=$(ynh_app_setting_get --app=$app --key=password); ynh_print_ON
+password=$(ynh_app_setting_get --app=$app --key=password)
 mypads=$(ynh_app_setting_get --app=$app --key=mypads)
 useldap=$(ynh_app_setting_get --app=$app --key=useldap)
 overwrite_settings=$(ynh_app_setting_get --app=$app --key=overwrite_settings)
@@ -135,6 +135,10 @@ fi
 if ! ynh_permission_exists --permission="admin"; then
   # Create the required permissions
   ynh_permission_create --permission="admin" --url="/admin" --allowed=$admin
+else
+  # Make sure the admin panel is not exposed to the SSO's authentication headers
+  # AFAIK there is no helper to check if that flag is up or not, so let's force it.
+  ynh_permission_url --permission="admin" --auth_header=false
 fi
 
 #=================================================