Merge branch 'debian_signed_file_columns' into 'master'

Add signed_file to Debian distributions

See merge request gitlab-org/gitlab!66470

app/models/concerns/packages/debian/distribution.rb

@@ -77,23 +77,16 @@ module Packages
 
         validates container_type, presence: true
         validates :file_store, presence: true
-
-        validates :file_signature, absence: true
-        validates :signing_keys, absence: true
+        validates :signed_file_store, presence: true
 
         scope :with_container, ->(subject) { where(container_type => subject) }
         scope :with_codename, ->(codename) { where(codename: codename) }
         scope :with_suite, ->(suite) { where(suite: suite) }
         scope :with_codename_or_suite, ->(codename_or_suite) { with_codename(codename_or_suite).or(with_suite(codename_or_suite)) }
 
-        attr_encrypted :signing_keys,
-                       mode: :per_attribute_iv,
-                       key: Settings.attr_encrypted_db_key_base_32,
-                       algorithm: 'aes-256-gcm',
-                       encode: false,
-                       encode_iv: false
-
         mount_file_store_uploader Packages::Debian::DistributionReleaseFileUploader
+        mount_uploader :signed_file, Packages::Debian::DistributionReleaseFileUploader
+        after_save :update_signed_file_store, if: :saved_change_to_signed_file?
 
         def component_names
           components.pluck(:name).sort
@@ -131,6 +124,12 @@ module Packages
 
           self.class.with_container(container).with_codename(suite).exists?
         end
+
+        def update_signed_file_store
+          # The signed_file.object_store is set during `uploader.store!`
+          # which happens after object is inserted/updated
+          self.update_column(:signed_file_store, signed_file.object_store)
+        end
       end
     end
   end

app/uploaders/packages/debian/distribution_release_file_uploader.rb

@@ -10,8 +10,13 @@ class Packages::Debian::DistributionReleaseFileUploader < GitlabUploader
   alias_method :upload, :model
 
   def filename
+    case mounted_as
+    when :signed_file
+      'InRelease'
+    else
       'Release'
     end
+  end
 
   def store_dir
     dynamic_segment

db/migrate/20210721125525_add_signed_file_to_packages_debian_project_distributions.rb

+# frozen_string_literal: true
+
+class AddSignedFileToPackagesDebianProjectDistributions < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+
+  # rubocop:disable Migration/AddLimitToTextColumns
+  # limit is added in 20210721125620_add_text_limit_to_packages_debian_project_distributions_signed_files
+  def change
+    add_column :packages_debian_project_distributions, :signed_file, :text
+    add_column :packages_debian_project_distributions, :signed_file_store, :integer, limit: 2, default: 1, null: false
+  end
+  # rubocop:enable Migration/AddLimitToTextColumns
+end

db/migrate/20210721125545_add_signed_file_to_packages_debian_group_distributions.rb

+# frozen_string_literal: true
+
+class AddSignedFileToPackagesDebianGroupDistributions < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+
+  # rubocop:disable Migration/AddLimitToTextColumns
+  # limit is added in 20210721125637_add_text_limit_to_packages_debian_group_distributions_signed_files
+  def change
+    add_column :packages_debian_group_distributions, :signed_file, :text
+    add_column :packages_debian_group_distributions, :signed_file_store, :integer, limit: 2, default: 1, null: false
+  end
+  # rubocop:enable Migration/AddLimitToTextColumns
+end

db/migrate/20210721125620_add_text_limit_to_packages_debian_project_distributions_signed_files.rb

+# frozen_string_literal: true
+
+class AddTextLimitToPackagesDebianProjectDistributionsSignedFiles < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+  disable_ddl_transaction!
+
+  def up
+    add_text_limit :packages_debian_project_distributions, :signed_file, 255
+  end
+
+  def down
+    remove_text_limit :packages_debian_project_distributions, :signed_file
+  end
+end

db/migrate/20210721125637_add_text_limit_to_packages_debian_group_distributions_signed_files.rb

+# frozen_string_literal: true
+
+class AddTextLimitToPackagesDebianGroupDistributionsSignedFiles < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+  disable_ddl_transaction!
+
+  def up
+    add_text_limit :packages_debian_group_distributions, :signed_file, 255
+  end
+
+  def down
+    remove_text_limit :packages_debian_group_distributions, :signed_file
+  end
+end

db/post_migrate/20210721125804_remove_signing_keys_from_packages_debian_project_distributions.rb

+# frozen_string_literal: true
+
+class RemoveSigningKeysFromPackagesDebianProjectDistributions < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+
+  def change
+    remove_column :packages_debian_project_distributions, :encrypted_signing_keys, :text
+    remove_column :packages_debian_project_distributions, :encrypted_signing_keys_iv, :text
+  end
+end

db/post_migrate/20210721125820_remove_signing_keys_from_packages_debian_group_distributions.rb

+# frozen_string_literal: true
+
+class RemoveSigningKeysFromPackagesDebianGroupDistributions < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+
+  def change
+    remove_column :packages_debian_group_distributions, :encrypted_signing_keys, :text
+    remove_column :packages_debian_group_distributions, :encrypted_signing_keys_iv, :text
+  end
+end

db/schema_migrations/20210721125525

+8ffb00b1a86fb1f9574b3811f88a65a1478f64cf59dc99a3324e04c4f4f0c7dd
\ No newline at end of file

db/schema_migrations/20210721125545

+8b43136ea6df74ad379537e28392c43770ecd8586eff8e830c52e65976f6978a
\ No newline at end of file

db/schema_migrations/20210721125620

+fa27f8e932f47946a67b2e739a978573e5f375ac0b1058ee79353e22d514755d
\ No newline at end of file

db/schema_migrations/20210721125637

+40f99f3c05290fe967cac6c1b90d913decacb491e1253fb166d4dd06363dd38b
\ No newline at end of file

db/schema_migrations/20210721125804

+5c6cc14f49d8fa9d0f0610eab731f93f874d6e9b5e3d49d5a127830241528488
\ No newline at end of file

db/schema_migrations/20210721125820

+7cba2fedb94fb5dc7fa5b796c6a93d2c5c8b57aee64b294e0c20dde07bf5253a
\ No newline at end of file

db/structure.sql

@@ -15866,17 +15866,16 @@ CREATE TABLE packages_debian_group_distributions (
     label text,
     version text,
     description text,
-    encrypted_signing_keys text,
-    encrypted_signing_keys_iv text,
     file text,
     file_signature text,
+    signed_file text,
+    signed_file_store smallint DEFAULT 1 NOT NULL,
+    CONSTRAINT check_0007e0bf61 CHECK ((char_length(signed_file) <= 255)),
     CONSTRAINT check_310ac457b8 CHECK ((char_length(description) <= 255)),
     CONSTRAINT check_3d6f87fc31 CHECK ((char_length(file_signature) <= 4096)),
     CONSTRAINT check_3fdadf4a0c CHECK ((char_length(version) <= 255)),
     CONSTRAINT check_590e18405a CHECK ((char_length(codename) <= 255)),
-    CONSTRAINT check_9b90bc0f07 CHECK ((char_length(encrypted_signing_keys_iv) <= 255)),
     CONSTRAINT check_b057cd840a CHECK ((char_length(origin) <= 255)),
-    CONSTRAINT check_b811ec1218 CHECK ((char_length(encrypted_signing_keys) <= 2048)),
     CONSTRAINT check_be5ed8d307 CHECK ((char_length(file) <= 255)),
     CONSTRAINT check_d3244bfc0b CHECK ((char_length(label) <= 255)),
     CONSTRAINT check_e7c928a24b CHECK ((char_length(suite) <= 255))
@@ -15992,20 +15991,19 @@ CREATE TABLE packages_debian_project_distributions (
     label text,
     version text,
     description text,
-    encrypted_signing_keys text,
-    encrypted_signing_keys_iv text,
     file text,
     file_signature text,
+    signed_file text,
+    signed_file_store smallint DEFAULT 1 NOT NULL,
     CONSTRAINT check_6177ccd4a6 CHECK ((char_length(origin) <= 255)),
     CONSTRAINT check_6f6b55a4c4 CHECK ((char_length(label) <= 255)),
     CONSTRAINT check_834dabadb6 CHECK ((char_length(codename) <= 255)),
     CONSTRAINT check_96965792c2 CHECK ((char_length(version) <= 255)),
+    CONSTRAINT check_9e5e22b7ff CHECK ((char_length(signed_file) <= 255)),
     CONSTRAINT check_a56ae58a17 CHECK ((char_length(suite) <= 255)),
     CONSTRAINT check_a5a2ac6af2 CHECK ((char_length(file_signature) <= 4096)),
     CONSTRAINT check_b93154339f CHECK ((char_length(description) <= 255)),
-    CONSTRAINT check_c25603a25b CHECK ((char_length(encrypted_signing_keys) <= 2048)),
-    CONSTRAINT check_cb4ac9599e CHECK ((char_length(file) <= 255)),
-    CONSTRAINT check_d488f8cce3 CHECK ((char_length(encrypted_signing_keys_iv) <= 255))
+    CONSTRAINT check_cb4ac9599e CHECK ((char_length(file) <= 255))
 );
 
 CREATE SEQUENCE packages_debian_project_distributions_id_seq

spec/support/shared_examples/models/packages/debian/distribution_shared_examples.rb

@@ -128,10 +128,6 @@ RSpec.shared_examples 'Debian Distribution' do |factory, container, can_freeze|
       it { is_expected.not_to allow_value(12.hours.to_i).for(:valid_time_duration_seconds) }
     end
 
-    describe '#signing_keys' do
-      it { is_expected.to validate_absence_of(:signing_keys) }
-    end
-
     describe '#file' do
       it { is_expected.not_to validate_presence_of(:file) }
     end
@@ -141,7 +137,15 @@ RSpec.shared_examples 'Debian Distribution' do |factory, container, can_freeze|
     end
 
     describe '#file_signature' do
-      it { is_expected.to validate_absence_of(:file_signature) }
+      it { is_expected.not_to validate_absence_of(:file_signature) }
+    end
+
+    describe '#signed_file' do
+      it { is_expected.not_to validate_presence_of(:signed_file) }
+    end
+
+    describe '#signed_file_store' do
+      it { is_expected.to validate_presence_of(:signed_file_store) }
     end
   end
 

spec/uploaders/packages/debian/distribution_release_file_uploader_spec.rb

@@ -47,6 +47,16 @@ RSpec.describe Packages::Debian::DistributionReleaseFileUploader do
           end
         end
       end
+
+      describe '#filename' do
+        it { expect(subject.filename).to eq('Release')}
+
+        context 'with signed_file' do
+          let(:uploader) { described_class.new(distribution, :signed_file) }
+
+          it { expect(subject.filename).to eq('InRelease')}
+        end
+      end
     end
   end
 end