FS#12902 - Check availability of package in binary repos before accepting the upload

Attached to Project: AUR web interface
Opened by Greg (dolby) - Friday, 23 January 2009, 09:10 GMT
Last edited by Lukas Fleischer (lfleischer) - Monday, 21 February 2011, 09:50 GMT
Task Type Feature Request
Category Backend
Status Closed
Assigned To Lukas Fleischer (lfleischer)
Architecture All
Severity Medium
Priority Normal
Reported Version 1.5.4
Due in Version 1.8.0
Due Date Undecided
Percent Complete 100%
Votes 6
Private No

Details

It would be very useful and would save time from TUs, if when a user uploaded a script, the upload was not allowed if a package with the same name exists in binary repositories.
This task depends upon

Closed by  Lukas Fleischer (lfleischer)
Monday, 21 February 2011, 09:50 GMT
Reason for closing:  Implemented
Additional comments about closing:  Fixed in 1.8.0.
Comment by Gavin Bisesi (Daenyth) - Friday, 04 December 2009, 15:42 GMT
One problem occured to me with this, which is that if we call to pacman to check on this, it slows things down and might open up DoS potential by rapid submission. If we don't use pacman, then we need some other database to store the names in, and we'd be duplicating the data and have to keep it in sync.

As a TU, I'd find this somewhat useful, but most of the package duplication is from people uploading "foopkg-nonbroken" type pkgnames.
Comment by Laszlo Papp (djszapi) - Tuesday, 15 December 2009, 04:20 GMT
I think it's worth find the best way to communicate with the official database, directly or indirectly.

If this interface could be established, more facilities could be improved, like dependency showing from the official repositories, e.g.
Comment by Lukas Fleischer (lfleischer) - Thursday, 04 November 2010, 16:13 GMT
This one just caught my eyes, as it would probably be a better alternative to aurdupes [1]. So let's revive this request!

At a first glance I'd say it's quite easy to read package databases directly using PHP. Since we use Archive_Tar anyways, this could be implemented in about 10 lines of PHP using Archive_Tar's listContent() function. Only thing that we need to think about is how package databases are kept in sync. Maybe a cron job? I'll see if I can implement a patch quickly and will send it to aur-dev.

[1] https://aur.archlinux.org/packages.php?ID=40869
Comment by Loui Chang (louipc) - Saturday, 18 December 2010, 16:57 GMT
Actually I don't know if it would be a good idea to read the pacman database directly any more.
It would probably be best to access the DB via libalpm.
Comment by Pierre Schmitz (Pierre) - Saturday, 18 December 2010, 17:33 GMT
You could just read the content of the db files into the mysql database. I have already written scripts which do this:

https://projects.archlinux.de/www.archlinux.de.git/tree/cronjobs/Package.php
https://projects.archlinux.de/www.archlinux.de.git/tree/cronjobs/PackageDB.php

and here the cron that updates the mysql db incrementally:
https://projects.archlinux.de/www.archlinux.de.git/tree/cronjobs/UpdatePKGDB.php

There is a lot of stuff you wont need for the AUR so this can be stripped down. (e.g. depends etc.)
Comment by Lukas Fleischer (lfleischer) - Tuesday, 28 December 2010, 07:22 GMT
Loui: Using libalpm would be the best way to go but afaik there's no libalpm wrapper for PHP yet, is there? So we'd have to either write a libalpm PHP extension or a libalpm PHP implementation. Wouldn't that be kinda overkill?
Comment by Loui Chang (louipc) - Saturday, 05 February 2011, 00:05 GMT
I was thinking more that the program that updates a blacklist would access libalpm.
Not sure if you'd want to build that directly into the AUR web code. Hey, whatever works though!
Comment by Lukas Fleischer (lfleischer) - Friday, 11 February 2011, 14:43 GMT
  • Field changed: Due in Version (Undecided → 1.8.0)
I just merged the "pkg-blacklist" branch into master and pushed that. It includes the "package name blacklist" patch [1] and aurblup [2] (AUR blacklist updater) which together can be used to prevent users from uploading packages available in the binary repos.

[1] http://projects.archlinux.org/aur.git/commit/?id=b69f548065e78d14afcdc91548d73539762f8d93
[2] http://projects.archlinux.org/aur.git/commit/?id=400d7845e4c959660edf4cbeb1a390c6590cc4fc

Loading...