From d6ff89e0e94b3ba58ad06e2b7801c37ce4da48f7 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Mon, 31 Jul 2017 16:01:12 +0200 Subject: [PATCH] Adjust the koji configuration to block building from forks on dist-git This commit benefits from the work done in: https://pagure.io/koji/pull-request/421 allowing to block building from specific subtrees of the host, in this case it allows us to block building from forks while still allowing building from the main repositories. This commit also re-structure a little how the allowed_scms key is written based on the structure used in the pull-request linked above making it easier to review the values of this configuration key. Signed-off-by: Pierre-Yves Chibon --- roles/koji_builder/templates/kojid.conf | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/roles/koji_builder/templates/kojid.conf b/roles/koji_builder/templates/kojid.conf index fa4a362..d20a8a9 100644 --- a/roles/koji_builder/templates/kojid.conf +++ b/roles/koji_builder/templates/kojid.conf @@ -60,10 +60,29 @@ pkgurl=http://kojipkgs.stg.fedoraproject.org/packages {% if env == 'staging' %} ; A space-separated list of hostname:repository pairs that kojid is authorized to checkout from (no quotes) -allowed_scms=pkgs.stg.fedoraproject.org:/docker/*:false pkgs.stg.fedoraproject.org:/rpms/*:false:fedpkg,sources pkgs.stg.fedoraproject.org:/*:false:fedpkg,sources pkgs.fedoraproject.org:/rpms/*:false:fedpkg,sources pkgs.fedoraproject.org:/*:false:fedpkg,sources pagure.io:/fedora-kickstarts.git:false src.fedoraproject.org:/*:false:fedpkg,sources +allowed_scms= + !src.stg.fedoraproject.org:/pagure/fork/* + !src.stg.fedoraproject.org:/pagure/forks/* + !pkgs.stg.fedoraproject.org:/pagure/fork/* + !pkgs.stg.fedoraproject.org:/pagure/forks/* + pkgs.stg.fedoraproject.org:/docker/*:false + pkgs.stg.fedoraproject.org:/rpms/*:false:fedpkg,sources + pkgs.stg.fedoraproject.org:/*:false:fedpkg,sources + pkgs.fedoraproject.org:/rpms/*:false:fedpkg,sources + pkgs.fedoraproject.org:/*:false:fedpkg,sources + pagure.io:/fedora-kickstarts.git:false + src.fedoraproject.org:/*:false:fedpkg,sources {% else %} ; A space-separated list of hostname:repository pairs that kojid is authorized to checkout from (no quotes) -allowed_scms=pkgs.fedoraproject.org:/*:false:fedpkg,sources pagure.io:/fedora-kickstarts.git:false src.fedoraproject.org:/*:false:fedpkg,sources pagure.io:/fork/*/fedora-kickstarts.git:false +allowed_scms= + !src.fedoraproject.org:/pagure/fork/* + !src.fedoraproject.org:/pagure/forks/* + !pkgs.fedoraproject.org:/pagure/fork/* + !pkgs.fedoraproject.org:/pagure/forks/* + pkgs.fedoraproject.org:/*:false:fedpkg,sources + pagure.io:/fedora-kickstarts.git:false + pagure.io:/fork/*/fedora-kickstarts.git:false + src.fedoraproject.org:/*:false:fedpkg,sources {% endif %} ; allow tasks to continue to completion if a sibling fails -- 2.9.4