Release 2.13.8

fix: drop integrity check for javascript
It has been added to improve security, however, it changes over time for no reason ¯\_(ツ)_/¯ I guess either cdn was hacked or fuck js
2025-06-27 22:31:43 +00:00 · 2024-05-12 11:53:19 +03:00 · 2024-05-12 11:49:12 +03:00 · 2024-05-09 13:26:40 +03:00 · 2024-05-09 13:21:42 +03:00
13 changed files with 134 additions and 91 deletions
--- a/docs/faq.rst
+++ b/docs/faq.rst
@ -208,6 +208,18 @@ This command will prompt for new value of the PKGBUILD variable ``version``. You

   sudo -u ahriman ahriman patch-add ahriman version version.patch

+The command also supports arrays, but in this case you need to specify full array, e.g.
+
+.. code-block:: shell
+
+   sudo -u ahriman ahriman patch-add ahriman depends
+
+   Post new function or variable value below. Press Ctrl-D to finish:
+   (python python-aiohttp)
+   ^D
+
+will set depends PKGBUILD variable (exactly) to array ``["python", "python-aiohttp"]``.
+
 Alternatively you can create full-diff patches, which are calculated by using ``git diff`` from current PKGBUILD master branch:

 #.
--- a/package/archlinux/PKGBUILD
+++ b/package/archlinux/PKGBUILD
@ -1,7 +1,7 @@
 # Maintainer: Evgeniy Alekseev

 pkgname='ahriman'
-pkgver=2.13.6
+pkgver=2.13.8
 pkgrel=1
 pkgdesc="ArcH linux ReposItory MANager"
 arch=('any')
--- a/package/share/ahriman/templates/api.jinja2
+++ b/package/share/ahriman/templates/api.jinja2
@ -6,8 +6,8 @@

    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <!-- Embed elements Elements via Web Component -->
-    <script src="https://cdn.jsdelivr.net/npm/@stoplight/elements@7.13.7/web-components.min.js" integrity="sha384-aKMPitODat9Dqj3Mva9Rs9jS5Z3KPSW0sFlAOazuULJMFYhAfmORI5SlH9aWIst8" crossorigin="anonymous" type="application/javascript"></script>
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@stoplight/elements@7.13.7/styles.min.css" integrity="sha384-wPzTs1aFAoGq9gqp9NAs2YVTkFXcU2d6Bx11aKRFhVw2B7o1bCwaV9pGHTlUfD2+" crossorigin="anonymous" type="text/css">
+    <script src="https://cdn.jsdelivr.net/npm/@stoplight/elements@7.13.7/web-components.min.js" crossorigin="anonymous" type="application/javascript"></script>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@stoplight/elements@7.13.7/styles.min.css" crossorigin="anonymous" type="text/css">
 </head>
 <body>

--- a/package/share/ahriman/templates/utils/bootstrap-scripts.jinja2
+++ b/package/share/ahriman/templates/utils/bootstrap-scripts.jinja2
@ -1,21 +1,21 @@
-<script src="https://cdn.jsdelivr.net/npm/jquery@3.7.1/dist/jquery.min.js" integrity="sha384-1H217gwSVyLSIfaLxHbE7dRb3v4mYCKbpQvzx0cegeju1MVsGrX5xXxAvs/HgeFs" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/jquery@3.7.1/dist/jquery.min.js" crossorigin="anonymous" type="application/javascript"></script>

-<script src="https://cdn.jsdelivr.net/npm/moment@2.29.4/moment.min.js" integrity="sha384-4ZTAzTbfB8H7hkWtXbyNDzDvxirmBT7EmURIvfOJ3Foympc+OD9p+bZNNENaJXgW" crossorigin="anonymous" type="application/javascript"></script>
-<script src="https://cdn.jsdelivr.net/npm/daterangepicker@3.1.0/daterangepicker.min.js" integrity="sha384-Gn1XZMJEKL3ycoWq97jYAl+FP3vXQYE2ObBgzgcPMKOZdUZdF6ZuyUxbGC2bAnUT" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/moment@2.29.4/moment.min.js" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/daterangepicker@3.1.0/daterangepicker.min.js" crossorigin="anonymous" type="application/javascript"></script>

-<script src="https://cdn.jsdelivr.net/npm/tableexport.jquery.plugin@1.28.0/tableExport.min.js" integrity="sha384-1Rz4Kz/y1rSWw+ZsjTcxB684XgofbO8iizY+UFIzCwFeQ+QUyhBNWBMh/STOyomI" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/tableexport.jquery.plugin@1.28.0/tableExport.min.js" crossorigin="anonymous" type="application/javascript"></script>

-<script src="https://cdn.jsdelivr.net/npm/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.min.js" integrity="sha384-IazMVNyYoUNx6357fWJoqtHYUWWCNHIXxFVtbpVgvImQNWuRP2WbHPaIb3QF8j97" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.min.js" crossorigin="anonymous" type="application/javascript"></script>

-<script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/popper.min.js" integrity="sha384-I7E8VVD/ismYTF4hNIPjVp/Zjvgyol6VFvRkX/vR+Vc4jQkC+hVqc2pM8ODewa9r" crossorigin="anonymous" type="application/javascript"></script>
-<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.min.js" integrity="sha384-BBtl+eGJRgqQAUMxJ7pMwbEyER4l1g+O15P+16Ep7Q9Q+zqX6gSbd85u4mG4QzX+" crossorigin="anonymous" type="application/javascript"></script>
-<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/bootstrap-table.min.js" integrity="sha384-GVLHfbEvuGA/RFiQ3MK2ClEJkWYJXABg55t9LpoDPZFGIsSq8xhFlQydm5poV2jW" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/popper.min.js" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.min.js" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/bootstrap-table.min.js" crossorigin="anonymous" type="application/javascript"></script>

-<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/export/bootstrap-table-export.min.js" integrity="sha384-g9OAB1Moamcy8+l1Q/tajHlMf6NTkS79ehKLTYbA80aQRbRhFCjrSuezv+FE2Kwe" crossorigin="anonymous" type="application/javascript"></script>
-<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/resizable/bootstrap-table-resizable.js" integrity="sha384-wd8Vc6Febikdnsnk9vthRWRvMwffw246vhqiqNO3aSNe1maTEA07Vh3zAQiSyDji" crossorigin="anonymous" type="application/javascript"></script>
-<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/filter-control/bootstrap-table-filter-control.js" integrity="sha384-NIqcjpr/3eZI1iNzz7hgT5rgp70qFUzkZffeCgVva9gi80B5vqcm7gn+8QvlWxko" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/export/bootstrap-table-export.min.js" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/resizable/bootstrap-table-resizable.js" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/filter-control/bootstrap-table-filter-control.js" crossorigin="anonymous" type="application/javascript"></script>

-<script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.9.0/build/highlight.min.js" integrity="sha384-F/bZzf7p3Joyp5psL90p/p89AZJsndkSoGwRpXcZhleCWhd8SnRuoYo4d0yirjJp" crossorigin="anonymous" type="application/javascript"></script>
+<script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.9.0/build/highlight.min.js" crossorigin="anonymous" type="application/javascript"></script>

 <script>
    async function copyToClipboard(text, button) {
--- a/package/share/ahriman/templates/utils/style.jinja2
+++ b/package/share/ahriman/templates/utils/style.jinja2
@ -1,17 +1,17 @@
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" integrity="sha384-T3c6CoIi6uLrA9TneNEoa7RxnatzjcDSCmG1MXxSR1GAsXEV/Dwwykc2MPK8M2HN" crossorigin="anonymous" type="text/css">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.1/font/bootstrap-icons.css" integrity="sha384-4LISF5TTJX/fLmGSxO53rV4miRxdg84mZsxmO8Rx5jGtp/LbrixFETvWa5a6sESd" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.1/font/bootstrap-icons.css" crossorigin="anonymous" type="text/css">

-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/bootstrap-table.min.css" integrity="sha384-sN3NwxbjH33ZidqZnPmX+nQ5IF+LoiI7HvZSoZj5wGacmu0/q4RJfsN0xqN+LIa5" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/bootstrap-table.min.css" crossorigin="anonymous" type="text/css">

-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.css" integrity="sha384-1sLxvR8mXzjhvFY9f8mzXl97DNLepeZ0PnRiMMdm/rQsKjsrPZPJxYle2wwT2PMg" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.css" crossorigin="anonymous" type="text/css">

-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/filter-control/bootstrap-table-filter-control.css" integrity="sha384-4Glx18jZ0Un+yDG6KUpYJ/af8hkssJ02jRASuFv23gfCl0mTXaVMPI9cB4cn3GvE" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-table@1.22.1/dist/extensions/filter-control/bootstrap-table-filter-control.css" crossorigin="anonymous" type="text/css">

-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootswatch@5.3.2/dist/cosmo/bootstrap.min.css" integrity="sha384-RfV5VNj9uqyOdZbN0hFNmoq56291KK2Y4iKhoRAbcfBfjYlpasjxK6TefPjxiAiN" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootswatch@5.3.2/dist/cosmo/bootstrap.min.css" crossorigin="anonymous" type="text/css">

-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/daterangepicker@3.1.0/daterangepicker.css" integrity="sha384-zLkQsiLfAQqGeIJeKLC+rcCR1YoYaQFLCL7cLDUoKE1ajKJzySpjzWGfYS2vjSG+" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/daterangepicker@3.1.0/daterangepicker.css" crossorigin="anonymous" type="text/css">

-<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.9.0/build/styles/github.min.css" integrity="sha384-eFTL69TLRZTkNfYZOLM+G04821K1qZao/4QLJbet1pP4tcF+fdXq/9CdqAbWRl/L" crossorigin="anonymous" type="text/css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.9.0/build/styles/github.min.css" crossorigin="anonymous" type="text/css">

 <style>
    .pre-scrollable {
--- a/package/share/man/man1/ahriman.1
+++ b/package/share/man/man1/ahriman.1
@ -1,4 +1,4 @@
-.TH AHRIMAN "1" "2024\-05\-05" "ahriman" "Generated Python Manual"
+.TH AHRIMAN "1" "2024\-05\-12" "ahriman" "Generated Python Manual"
 .SH NAME
 ahriman
 .SH SYNOPSIS
--- a/src/ahriman/init.py
+++ b/src/ahriman/init.py
@ -17,4 +17,4 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
-__version__ = "2.13.6"
+__version__ = "2.13.8"
--- a/src/ahriman/application/handlers/patch.py
+++ b/src/ahriman/application/handlers/patch.py
@ -102,8 +102,9 @@ class Patch(Handler):
            patch = "".join(list(sys.stdin))
        else:
            patch = patch_path.read_text(encoding="utf8")
-        patch = patch.strip()  # remove spaces around the patch
-        return PkgbuildPatch(variable, patch)
+        # remove spaces around the patch and parse to correct type
+        parsed = PkgbuildPatch.parse(patch.strip())
+        return PkgbuildPatch(variable, parsed)

    @staticmethod
    def patch_set_create(application: Application, package_base: str, patch: PkgbuildPatch) -> None:
--- a/src/ahriman/core/util.py
+++ b/src/ahriman/core/util.py
@ -56,7 +56,6 @@ __all__ = [
    "srcinfo_property",
    "srcinfo_property_list",
    "trim_package",
-    "unquote",
    "utcnow",
    "walk",
 ]
@ -466,38 +465,6 @@ def trim_package(package_name: str) -> str:
    return package_name


-def unquote(source: str) -> str:
-    """
-    like :func:`shlex.quote()`, but opposite
-
-    Args:
-        source(str): source string to remove quotes
-
-    Returns:
-        str: string with quotes removed
-
-    Raises:
-        ValueError: if no closing quotation
-    """
-    def generator() -> Generator[str, None, None]:
-        token = None
-        for char in source:
-            if token is not None:
-                if char == token:
-                    token = None  # closed quote
-                else:
-                    yield char  # character inside quotes
-            elif char in ("'", "\""):
-                token = char  # first quote found
-            else:
-                yield char  # normal character
-
-        if token is not None:
-            raise ValueError("No closing quotation")
-
-    return "".join(generator())
-
-
 def utcnow() -> datetime.datetime:
    """
    get current time
--- a/src/ahriman/models/pkgbuild_patch.py
+++ b/src/ahriman/models/pkgbuild_patch.py
@ -21,9 +21,9 @@ import shlex

 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any, Self
+from typing import Any, Generator, Self

-from ahriman.core.util import dataclass_view, unquote
+from ahriman.core.util import dataclass_view


@dataclass(frozen=True)
@ -81,14 +81,57 @@ class PkgbuildPatch:
            Self: package properties
        """
        key, *value_parts = variable.split("=", maxsplit=1)
-
        raw_value = next(iter(value_parts), "")  # extract raw value
-        if raw_value.startswith("(") and raw_value.endswith(")"):
-            value: str | list[str] = shlex.split(raw_value[1:-1])  # arrays for poor
-        else:
-            value = unquote(raw_value)
+        return cls(key, cls.parse(raw_value))

-        return cls(key, value)
+    @staticmethod
+    def parse(source: str) -> str | list[str]:
+        """
+        parse string value to the PKGBUILD patch value. This method simply takes string, tries to identify it as array
+        or just string and return the respective value. Functions should be processed correctly, however, not guaranteed
+
+        Args:
+            source(str): source string to parse
+
+        Returns:
+            str | list[str]: parsed value either string or list of strings
+        """
+        if source.startswith("(") and source.endswith(")"):
+            return shlex.split(source[1:-1])  # arrays for poor
+        return PkgbuildPatch.unquote(source)
+
+    @staticmethod
+    def unquote(source: str) -> str:
+        """
+        like :func:`shlex.quote()`, but opposite
+
+        Args:
+            source(str): source string to remove quotes
+
+        Returns:
+            str: string with quotes removed
+
+        Raises:
+            ValueError: if no closing quotation
+        """
+
+        def generator() -> Generator[str, None, None]:
+            token = None
+            for char in source:
+                if token is not None:
+                    if char == token:
+                        token = None  # closed quote
+                    else:
+                        yield char  # character inside quotes
+                elif char in ("'", "\""):
+                    token = char  # first quote found
+                else:
+                    yield char  # normal character
+
+            if token is not None:
+                raise ValueError("No closing quotation")
+
+        return "".join(generator())

    def serialize(self) -> str:
        """
--- a/tests/ahriman/application/handlers/test_handler_patch.py
+++ b/tests/ahriman/application/handlers/test_handler_patch.py
@ -122,11 +122,10 @@ def test_patch_create_from_function(mocker: MockerFixture) -> None:
    """
    must create function patch from file
    """
-    path = Path("local")
    patch = PkgbuildPatch("version", "patch")
    read_mock = mocker.patch("pathlib.Path.read_text", return_value=patch.value)

-    assert Patch.patch_create_from_function(patch.key, path) == patch
+    assert Patch.patch_create_from_function(patch.key, Path("local")) == patch
    read_mock.assert_called_once_with(encoding="utf8")


@ -148,6 +147,15 @@ def test_patch_create_from_function_strip(mocker: MockerFixture) -> None:
    assert Patch.patch_create_from_function(patch.key, None) == patch


+def test_patch_create_from_function_array(mocker: MockerFixture) -> None:
+    """
+    must correctly read array variable
+    """
+    patch = PkgbuildPatch("version", ["array", "patch"])
+    mocker.patch("pathlib.Path.read_text", return_value=f"({" ".join(patch.value)})")
+    assert Patch.patch_create_from_function(patch.key, Path("local")) == patch
+
+
 def test_patch_set_list(application: Application, mocker: MockerFixture) -> None:
    """
    must list available patches for the command
--- a/tests/ahriman/core/test_util.py
+++ b/tests/ahriman/core/test_util.py
@ -12,7 +12,7 @@ from unittest.mock import call as MockCall
 from ahriman.core.exceptions import BuildError, CalledProcessError, OptionError, UnsafeRunError
 from ahriman.core.util import check_output, check_user, dataclass_view, enum_values, extract_user, filter_json, \
    full_version, minmax, package_like, parse_version, partition, pretty_datetime, pretty_size, safe_filename, \
-    srcinfo_property, srcinfo_property_list, trim_package, unquote, utcnow, walk
+    srcinfo_property, srcinfo_property_list, trim_package, utcnow, walk
 from ahriman.models.package import Package
 from ahriman.models.package_source import PackageSource
 from ahriman.models.repository_id import RepositoryId
@ -445,26 +445,6 @@ def test_trim_package() -> None:
    assert trim_package("package: a description") == "package"


-def test_unquote() -> None:
-    """
-    must remove quotation marks
-    """
-    for source in (
-        "abc",
-        "ab'c",
-        "ab\"c",
-    ):
-        assert unquote(shlex.quote(source)) == source
-
-
-def test_unquote_error() -> None:
-    """
-    must raise value error on invalid quotation
-    """
-    with pytest.raises(ValueError):
-        unquote("ab'c")
-
-
 def test_utcnow() -> None:
    """
    must generate correct timestamp
--- a/tests/ahriman/models/test_pkgbuild_patch.py
+++ b/tests/ahriman/models/test_pkgbuild_patch.py
@ -1,3 +1,6 @@
+import pytest
+import shlex
+
 from pathlib import Path
 from pytest_mock import MockerFixture
 from unittest.mock import MagicMock, call
@ -48,6 +51,35 @@ def test_from_env() -> None:
    assert PkgbuildPatch.from_env("KEY") == PkgbuildPatch("KEY", "")


+def test_parse() -> None:
+    """
+    must parse string correctly
+    """
+    assert PkgbuildPatch.parse("VALUE") == "VALUE"
+    assert PkgbuildPatch.parse("(ARRAY VALUE)") == ["ARRAY", "VALUE"]
+    assert PkgbuildPatch.parse("""("QU'OUTED" ARRAY VALUE)""") == ["QU'OUTED", "ARRAY", "VALUE"]
+
+
+def test_unquote() -> None:
+    """
+    must remove quotation marks
+    """
+    for source in (
+        "abc",
+        "ab'c",
+        "ab\"c",
+    ):
+        assert PkgbuildPatch.unquote(shlex.quote(source)) == source
+
+
+def test_unquote_error() -> None:
+    """
+    must raise value error on invalid quotation
+    """
+    with pytest.raises(ValueError):
+        PkgbuildPatch.unquote("ab'c")
+
+
 def test_serialize() -> None:
    """
    must correctly serialize string values
Author	SHA1	Message	Date
Evgenii Alekseev	bb4a0d75fc	Release 2.13.8	2024-05-12 11:53:19 +03:00
Evgenii Alekseev	bca0df41d1	fix: drop integrity check for javascript It has been added to improve security, however, it changes over time for no reason ¯\_(ツ)_/¯ I guess either cdn was hacked or fuck js	2024-05-12 11:49:12 +03:00
Evgenii Alekseev	07b77be6b8	Release 2.13.7	2024-05-09 13:26:40 +03:00
Evgenii Alekseev	2b33510ada	fix: parse array variable from command	2024-05-09 13:21:42 +03:00