2 GoCheese -- Python private package repository and caching proxy
3 Copyright (C) 2019-2021 Sergey Matveev <stargrave@stargrave.org>
4 2019-2021 Elena Balakhonova <balakhonova_e@riseup.net>
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, version 3 of the License.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
36 "go.cypherpunks.ru/recfile"
39 var NormalizationRe = regexp.MustCompilePOSIX("[-_.]+")
41 func serveUpload(w http.ResponseWriter, r *http.Request) {
43 username, password, ok := r.BasicAuth()
45 log.Println(r.RemoteAddr, "unauthenticated", username)
46 http.Error(w, "unauthenticated", http.StatusUnauthorized)
50 auther, ok := Passwords[username]
52 if !ok || !auther.Auth(password) {
53 log.Println(r.RemoteAddr, "unauthenticated", username)
54 http.Error(w, "unauthenticated", http.StatusUnauthorized)
60 if err = r.ParseMultipartForm(1 << 20); err != nil {
61 http.Error(w, err.Error(), http.StatusBadRequest)
64 pkgNames, exists := r.MultipartForm.Value["name"]
65 if !exists || len(pkgNames) != 1 {
66 http.Error(w, "single name is expected in request", http.StatusBadRequest)
69 pkgName := strings.ToLower(NormalizationRe.ReplaceAllString(pkgNames[0], "-"))
70 dirPath := filepath.Join(*Root, pkgName)
71 gpgSigsExpected := make(map[string]struct{})
72 now := time.Now().UTC()
74 var digestSHA256Expected []byte
75 if digestSHA256ExpectedHex, exists := r.MultipartForm.Value["sha256_digest"]; exists {
76 digestSHA256Expected, err = hex.DecodeString(digestSHA256ExpectedHex[0])
78 http.Error(w, "bad sha256_digest: "+err.Error(), http.StatusBadRequest)
82 var digestBLAKE2b256Expected []byte
83 if digestBLAKE2b256ExpectedHex, exists := r.MultipartForm.Value["blake2_256_digest"]; exists {
84 digestBLAKE2b256Expected, err = hex.DecodeString(digestBLAKE2b256ExpectedHex[0])
86 http.Error(w, "bad blake2_256_digest: "+err.Error(), http.StatusBadRequest)
91 // Checking is it internal package
92 if _, err = os.Stat(filepath.Join(dirPath, InternalFlag)); err != nil {
93 log.Println(r.RemoteAddr, "non-internal package", pkgName)
94 http.Error(w, "unknown internal package", http.StatusUnauthorized)
98 for _, file := range r.MultipartForm.File["content"] {
99 filename := file.Filename
100 gpgSigsExpected[filename+GPGSigExt] = struct{}{}
101 log.Println(r.RemoteAddr, "put", filename, "by", username)
102 path := filepath.Join(dirPath, filename)
103 if _, err = os.Stat(path); err == nil {
104 log.Println(r.RemoteAddr, filename, "already exists")
105 http.Error(w, "already exists", http.StatusBadRequest)
108 if !mkdirForPkg(w, r, pkgName) {
111 src, err := file.Open()
114 log.Println("error", r.RemoteAddr, filename, err)
115 http.Error(w, err.Error(), http.StatusInternalServerError)
118 dst, err := TempFile(dirPath)
120 log.Println("error", r.RemoteAddr, filename, err)
121 http.Error(w, err.Error(), http.StatusInternalServerError)
124 dstBuf := bufio.NewWriter(dst)
125 hasherSHA256 := sha256.New()
126 hasherBLAKE2b256 := blake2b256New()
127 wr := io.MultiWriter(hasherSHA256, hasherBLAKE2b256, dst)
128 if _, err = io.Copy(wr, src); err != nil {
129 log.Println("error", r.RemoteAddr, filename, err)
130 os.Remove(dst.Name())
132 http.Error(w, err.Error(), http.StatusInternalServerError)
135 if err = dstBuf.Flush(); err != nil {
136 log.Println("error", r.RemoteAddr, filename, err)
137 os.Remove(dst.Name())
139 http.Error(w, err.Error(), http.StatusInternalServerError)
143 if err = dst.Sync(); err != nil {
144 log.Println("error", r.RemoteAddr, filename, err)
145 os.Remove(dst.Name())
147 http.Error(w, err.Error(), http.StatusInternalServerError)
153 digestSHA256 := hasherSHA256.Sum(nil)
154 digestBLAKE2b256 := hasherBLAKE2b256.Sum(nil)
155 if digestSHA256Expected != nil {
156 if bytes.Compare(digestSHA256Expected, digestSHA256) == 0 {
157 log.Println(r.RemoteAddr, filename, "good SHA256 checksum received")
159 log.Println(r.RemoteAddr, filename, "bad SHA256 checksum received")
160 http.Error(w, "bad sha256 checksum", http.StatusBadRequest)
161 os.Remove(dst.Name())
165 if digestBLAKE2b256Expected != nil {
166 if bytes.Compare(digestBLAKE2b256Expected, digestBLAKE2b256) == 0 {
167 log.Println(r.RemoteAddr, filename, "good BLAKE2b-256 checksum received")
169 log.Println(r.RemoteAddr, filename, "bad BLAKE2b-256 checksum received")
170 http.Error(w, "bad blake2_256 checksum", http.StatusBadRequest)
171 os.Remove(dst.Name())
176 if err = os.Rename(dst.Name(), path); err != nil {
177 log.Println("error", r.RemoteAddr, path, err)
178 http.Error(w, err.Error(), http.StatusInternalServerError)
181 if err = DirSync(dirPath); err != nil {
182 log.Println("error", r.RemoteAddr, dirPath, err)
183 http.Error(w, err.Error(), http.StatusInternalServerError)
186 if err = WriteFileSync(dirPath, path+"."+HashAlgoSHA256, digestSHA256, now); err != nil {
187 log.Println("error", r.RemoteAddr, path+"."+HashAlgoSHA256, err)
188 http.Error(w, err.Error(), http.StatusInternalServerError)
191 if err = WriteFileSync(dirPath, path+"."+HashAlgoBLAKE2b256, digestBLAKE2b256, now); err != nil {
192 log.Println("error", r.RemoteAddr, path+"."+HashAlgoBLAKE2b256, err)
193 http.Error(w, err.Error(), http.StatusInternalServerError)
197 for _, file := range r.MultipartForm.File["gpg_signature"] {
198 filename := file.Filename
199 if _, exists := gpgSigsExpected[filename]; !exists {
200 log.Println(r.RemoteAddr, filename, "unexpected GPG signature filename")
201 http.Error(w, "unexpected GPG signature filename", http.StatusBadRequest)
204 delete(gpgSigsExpected, filename)
205 log.Println(r.RemoteAddr, "put", filename, "by", username)
206 path := filepath.Join(dirPath, filename)
207 if _, err = os.Stat(path); err == nil {
208 log.Println(r.RemoteAddr, filename, "already exists")
209 http.Error(w, "already exists", http.StatusBadRequest)
212 src, err := file.Open()
214 log.Println("error", r.RemoteAddr, filename, err)
215 http.Error(w, err.Error(), http.StatusInternalServerError)
218 sig, err := ioutil.ReadAll(src)
221 log.Println("error", r.RemoteAddr, filename, err)
222 http.Error(w, err.Error(), http.StatusInternalServerError)
225 if err = WriteFileSync(dirPath, path, sig, now); err != nil {
226 log.Println("error", r.RemoteAddr, path, err)
227 http.Error(w, err.Error(), http.StatusInternalServerError)
233 wr := recfile.NewWriter(&buf)
234 for formField, recField := range map[string]string{
235 "name": MetadataFieldName,
236 "version": MetadataFieldVersion,
237 "platform": MetadataFieldPlatform,
238 "supported_platform": MetadataFieldSupportedPlatform,
239 "summary": MetadataFieldSummary,
240 "description": MetadataFieldDescription,
241 "description_content_type": MetadataFieldDescriptionContentType,
242 "keywords": MetadataFieldKeywords,
243 "home_page": MetadataFieldHomePage,
244 "author": MetadataFieldAuthor,
245 "author_email": MetadataFieldAuthorEmail,
246 "maintainer": MetadataFieldMaintainer,
247 "maintainer_email": MetadataFieldMaintainerEmail,
248 "license": MetadataFieldLicense,
249 "classifiers": MetadataFieldClassifier,
250 "requires_dist": MetadataFieldRequiresDist,
251 "requires_python": MetadataFieldRequiresPython,
252 "requires_external": MetadataFieldRequiresExternal,
253 "project_url": MetadataFieldProjectURL,
254 "provides_extra": MetadataFieldProvidesExtra,
256 if vs, exists := r.MultipartForm.Value[formField]; exists {
257 for _, v := range vs {
258 lines := strings.Split(v, "\n")
260 _, err = wr.WriteFieldMultiline(
261 metadataFieldToRecField(recField),
265 _, err = wr.WriteFields(recfile.Field{
266 Name: metadataFieldToRecField(recField),
276 path := filepath.Join(dirPath, MetadataFile)
277 if err = WriteFileSync(dirPath, path, buf.Bytes(), now); err != nil {
278 log.Println("error", r.RemoteAddr, path, err)
279 http.Error(w, err.Error(), http.StatusInternalServerError)