build: update frontend dependencies

* use local devtools configs instead of global ones

* make docker image rootless

* add migration notes

* fix setup command

* fix regress jo

.github/scripts/setup.sh

@@ -44,7 +44,7 @@ pacman -Qdtq | pacman -Rscn --noconfirm -
 
 # initial setup command as root
 [[ -z $MINIMAL_INSTALL ]] && WEB_ARGS=("--web-port" "8080")
-ahriman -a x86_64 -r "github" service-setup --packager "ahriman bot <ahriman@example.com>" "${WEB_ARGS[@]}"
+sudo -u ahriman -- ahriman -a x86_64 -r "github" service-setup --packager "ahriman bot <ahriman@example.com>" "${WEB_ARGS[@]}"
 # enable services
 systemctl enable ahriman@x86_64-github.timer
 if [[ -z $MINIMAL_INSTALL ]]; then

.github/workflows/regress.yml

@@ -18,8 +18,8 @@ jobs:
         image: arcan1s/ahriman:edge
         env:
           AHRIMAN_PORT: 8080
-          AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman-web.sock
-        options: --privileged --entrypoint entrypoint-web
+          AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman-web.sock
+        options: --privileged --user root --entrypoint entrypoint-web
         ports:
           - 8080
         volumes:
@@ -31,8 +31,8 @@ jobs:
         AHRIMAN_DEBUG: y
         AHRIMAN_OUTPUT: console
         AHRIMAN_PORT: 8080
-        AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman-web.sock
-      options: --privileged
+        AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman-web.sock
+      options: --privileged --user root
       volumes:
         - repo:/var/lib/ahriman
 
@@ -40,7 +40,9 @@ jobs:
       - run: pacman -Sy
 
       - name: Init repository
-        run: entrypoint help
+        run: |
+          chown ahriman:ahriman /var/lib/ahriman
+          sudo -E -u ahriman -- entrypoint help
 
       - name: Print configuration
         run: |

README.md

@@ -31,7 +31,7 @@ For installation details kindly refer to the [documentation](https://ahriman.rea
 
 Every available option is described in the [documentation](https://ahriman.readthedocs.io/en/stable/configuration.html).
 
-The application provides reasonable defaults which allow to use it out-of-box; however additional steps (like configuring build toolchain and sudoers) are recommended and can be easily achieved by following install instructions.
+The application provides reasonable defaults which allow to use it out-of-box; however additional steps (like configuring build toolchain) are recommended and can be easily achieved by following install instructions.
 
 ## [FAQ](https://ahriman.readthedocs.io/en/stable/faq/index.html)
 

ahriman-core/package/bin/ahriman-archbuild

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+set -euo pipefail
+
+usage() {
+    local cmd="${0##*/}"
+    echo "Usage: $cmd [options] -- [archbuild args]"
+    echo "    -r <repository>    Repository name"
+    echo "    -a <architecture>  Repository architecture"
+    echo "    -c <directory>     Read devtools pacman configurations from this directory"
+    exit 1
+}
+
+repository=
+architecture=
+pacman_config_dir=
+
+while getopts ":r:a:c:" arg; do
+    case "$arg" in
+        r) repository="$OPTARG" ;;
+        a) architecture="$OPTARG" ;;
+        c) pacman_config_dir="$OPTARG" ;;
+        *) usage ;;
+    esac
+done
+
+if [[ -z $repository || -z $architecture ]]; then
+    usage
+fi
+
+source "/usr/share/devtools/lib/archroot.sh"
+check_root "SOURCE_DATE_EPOCH,SRCDEST,SRCPKGDEST,PKGDEST,LOGDEST,NPROC,MAKEFLAGS,PACKAGER,GNUPGHOME" "${BASH_SOURCE[0]}" "$@"
+
+# because devtools doesn't allow to read configuration from custom path
+# here is a workaround, which uses unshare to bind-mount directory with configuration files
+# for specific process
+if [[ -n $pacman_config_dir && -z ${AHRIMAN_ARCHBUILD_MOUNTED:-} ]]; then
+    export AHRIMAN_ARCHBUILD_MOUNTED=1
+    exec unshare --mount --propagation private bash -e -c '
+        mount --bind "$0" /usr/share/devtools/pacman.conf.d
+        exec "$@"
+    ' "$(readlink -f "$pacman_config_dir")" "${BASH_SOURCE[0]}" "$@"
+fi
+
+exec bash -c '
+    source "$1" "${@:2}"
+' "${repository}-${architecture}-build" "archbuild" "${@:$OPTIND}"

ahriman-core/package/share/ahriman/settings/ahriman.ini

@@ -1,6 +1,6 @@
 [settings]
 ; Relative path to directory with configuration files overrides. Overrides will be applied in alphabetic order.
-include = ahriman.ini.d
+include = ahriman.ini.d ${repository:root}/.config/ahriman/ahriman.ini.d
 ; Relative path to configuration used by logging package.
 logging = ahriman.ini.d/logging.ini
 ; Perform database migrations on the application start. Do not touch this option unless you know what you are doing.
@@ -34,18 +34,24 @@ retry_backoff = 1.0
 [build]
 ; List of additional flags passed to archbuild command.
 ;archbuild_flags =
+; Path to local directory with devtools configuration files, which will be bind-mounted for devtools.
+devtools_configs = ${repository:root}/.config/ahriman/pacman.conf.d
 ; Path to build command.
-;build_command =
+devtools_wrapper = ahriman-archbuild
 ; List of packages to be ignored during automatic updates.
 ;ignore_packages =
 ; Include debug packages.
 ;include_debug_packages = yes
+; List of additional flags passed to make via environment variable via makepkg command.
+;make_flags =
 ; List of additional flags passed to makechrootpkg command.
 ;makechrootpkg_flags =
-; Minimal age in seconds since the latest AUR package modification before automatic updates are allowed.
-;min_age = 0
 ; List of additional flags passed to makepkg command.
 makepkg_flags = --nocolor --ignorearch
+; Minimal age in seconds since the latest AUR package modification before automatic updates are allowed.
+;min_age = 0
+; Default packager identifier to be used for package builds
+;packager =
 ; List of paths to be used for implicit dependency scan. Regular expressions are supported.
 scan_paths = ^usr/lib(?!/cmake).*$
 ; List of enabled triggers in the order of calls.

ahriman-core/pyproject.toml

@@ -57,6 +57,7 @@ packages = [
 ]
 
 [tool.hatch.build.targets.wheel.shared-data]
+"package/bin" = "bin"
 "package/lib" = "lib"
 "package/share" = "share"
 

ahriman-core/src/ahriman/application/handlers/setup.py

@@ -18,19 +18,19 @@
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
 import argparse
+import multiprocessing
+import os
 
 from pathlib import Path
-from pwd import getpwuid
 from typing import ClassVar
 from urllib.parse import quote_plus as url_encode
 
 from ahriman.application.application import Application
 from ahriman.application.handlers.handler import Handler, SubParserAction
 from ahriman.core.configuration import Configuration
-from ahriman.core.exceptions import MissingArchitectureError
+from ahriman.core.exceptions import InitializeError, MissingArchitectureError
 from ahriman.core.utils import enum_values
 from ahriman.models.repository_id import RepositoryId
-from ahriman.models.repository_paths import RepositoryPaths
 from ahriman.models.sign_settings import SignSettings
 from ahriman.models.user import User
 
@@ -40,16 +40,12 @@ class Setup(Handler):
     setup handler
 
     Attributes:
-        ARCHBUILD_COMMAND_PATH(Path): (class attribute) default devtools command
         MIRRORLIST_PATH(Path): (class attribute) path to pacman default mirrorlist (used by multilib repository)
-        SUDOERS_DIR_PATH(Path): (class attribute) path to sudoers.d includes directory
     """
 
     ALLOW_MULTI_ARCHITECTURE_RUN = False  # conflicting io
 
-    ARCHBUILD_COMMAND_PATH: ClassVar[Path] = Path("/") / "usr" / "bin" / "archbuild"
     MIRRORLIST_PATH: ClassVar[Path] = Path("/") / "etc" / "pacman.d" / "mirrorlist"
-    SUDOERS_DIR_PATH: ClassVar[Path] = Path("/") / "etc" / "sudoers.d"
 
     @classmethod
     def run(cls, args: argparse.Namespace, repository_id: RepositoryId, configuration: Configuration, *,
@@ -67,21 +63,20 @@ class Setup(Handler):
         if args.architecture is None or args.repository is None:
             raise MissingArchitectureError(args.command)
 
-        Setup.configuration_create_ahriman(args, repository_id, configuration)
+        target_directory = Setup.configuration_create_directory(configuration)
+        Setup.configuration_create_ahriman(args, repository_id, configuration, target_directory)
         configuration.reload()
 
         application = Application(repository_id, configuration, report=report)
+        paths = application.repository.paths
 
-        # basically we create configuration here as root, but it is ok, because those files are only used for reading
-        Setup.configuration_create_makepkg(args.packager, args.makeflags_jobs, application.repository.paths)
-        Setup.executable_create(application.repository.paths, repository_id)
-        repository_server = f"file://{application.repository.paths.repository}" if args.server is None else args.server
-        Setup.configuration_create_devtools(
-            repository_id, args.from_configuration, args.mirror, args.multilib, repository_server)
-        Setup.configuration_create_sudo(application.repository.paths, repository_id)
+        repository_server = f"file://{paths.repository}" if args.server is None else args.server
+        target_directory = paths.ensure_exists(configuration.getpath("build", "devtools_configs"))
+        Setup.configuration_create_devtools(repository_id, args.from_configuration, target_directory, args.mirror,
+                                            args.multilib, repository_server)
 
         # finish initialization
-        with application.repository.paths.preserve_owner():
+        with paths.preserve_owner():
             application.repository.repo.init()
             # lazy database sync
             application.repository.pacman.handle  # pylint: disable=pointless-statement
@@ -99,7 +94,7 @@ class Setup(Handler):
         """
         parser = root.add_parser("service-setup", aliases=["init", "repo-init", "repo-setup", "setup"],
                                  help="initial service configuration",
-                                 description="create initial service configuration, requires root",
+                                 description="create initial service configuration as the repository owner",
                                  epilog="Create minimal configuration for the service according to provided options.")
         parser.add_argument("--build-as-user", help="force makepkg user to the specific one")
         parser.add_argument("--from-configuration", help="path to default devtools pacman configuration",
@@ -121,26 +116,12 @@ class Setup(Handler):
         parser.add_argument("--web-port", help="port of the web service", type=int)
         parser.add_argument("--web-unix-socket", help="path to unix socket used for interprocess communications",
                             type=Path)
-        parser.set_defaults(lock=None, quiet=True, report=False, unsafe=True)
+        parser.set_defaults(lock=None, quiet=True, report=False)
         return parser
 
-    @staticmethod
-    def build_command(root: Path, repository_id: RepositoryId) -> Path:
-        """
-        generate build command name
-
-        Args:
-            root(Path): root directory for the build command (must be root of the repository)
-            repository_id(RepositoryId): repository unique identifier
-
-        Returns:
-            Path: valid devtools command name
-        """
-        return root / f"{repository_id.name}-{repository_id.architecture}-build"
-
     @staticmethod
     def configuration_create_ahriman(args: argparse.Namespace, repository_id: RepositoryId,
-                                     root: Configuration) -> None:
+                                     root: Configuration, target_directory: Path) -> None:
         """
         create service specific configuration
 
@@ -148,13 +129,16 @@ class Setup(Handler):
             args(argparse.Namespace): command line args
             repository_id(RepositoryId): repository unique identifier
             root(Configuration): root configuration instance
+            target_directory(Path): path to directory where configuration files will be written
         """
         configuration = Configuration()
 
-        section = Configuration.section_name("build", repository_id.name, repository_id.architecture)
-        build_command = Setup.build_command(root.repository_paths.root, repository_id)
-        configuration.set_option(section, "build_command", str(build_command))
         configuration.set_option("repository", "name", repository_id.name)  # backward compatibility for docker
+
+        section = Configuration.section_name("build", repository_id.name, repository_id.architecture)
+        configuration.set_option(section, "packager", args.packager)
+        if args.makeflags_jobs:
+            configuration.set_option(section, "make_flags", f"-j{multiprocessing.cpu_count()}")
         if args.build_as_user is not None:
             configuration.set_option(section, "makechrootpkg_flags", f"-U {args.build_as_user}")
 
@@ -183,14 +167,13 @@ class Setup(Handler):
         if args.generate_salt:
             configuration.set_option("auth", "salt", User.generate_password(20))
 
-        (root.include / "00-setup-overrides.ini").unlink(missing_ok=True)  # remove old-style configuration
-        target = root.include / f"00-setup-overrides-{repository_id.id}.ini"
+        target = target_directory / f"00-setup-overrides-{repository_id.id}.ini"
         with target.open("w", encoding="utf8") as ahriman_configuration:
             configuration.write(ahriman_configuration)
 
     @staticmethod
-    def configuration_create_devtools(repository_id: RepositoryId, source: Path, mirror: str | None,
-                                      multilib: bool, repository_server: str) -> None:
+    def configuration_create_devtools(repository_id: RepositoryId, source: Path, target_directory: Path,
+                                      mirror: str | None, multilib: bool, repository_server: str) -> None:
         """
         create configuration for devtools based on ``source`` configuration
 
@@ -200,6 +183,7 @@ class Setup(Handler):
         Args:
             repository_id(RepositoryId): repository unique identifier
             source(Path): path to source configuration file
+            target_directory(Path): path to directory where configuration files will be written
             mirror(str | None): link to package server mirror
             multilib(bool): add or do not multilib repository to the configuration
             repository_server(str): url of the repository
@@ -234,54 +218,32 @@ class Setup(Handler):
         configuration.set_option(repository_id.name, "SigLevel", "Never")  # we don't care
         configuration.set_option(repository_id.name, "Server", repository_server)
 
-        target = source.parent / f"{repository_id.name}-{repository_id.architecture}.conf"
+        target = target_directory / f"{repository_id.name}-{repository_id.architecture}.conf"
         with target.open("w", encoding="utf8") as devtools_configuration:
             configuration.write(devtools_configuration)
 
     @staticmethod
-    def configuration_create_makepkg(packager: str, makeflags_jobs: bool, paths: RepositoryPaths) -> None:
+    def configuration_create_directory(root: Configuration) -> Path:
         """
-        create configuration for makepkg
+        create directory for includes
 
         Args:
-            packager(str): packager identifier (e.g. name, email)
-            makeflags_jobs(bool): set MAKEFLAGS variable to number of cores
-            paths(RepositoryPaths): repository paths instance
+            root(Configuration): root configuration instance
+
+        Returns:
+            Path: path to first writable directory
+
+        Raises:
+            InitializeError: if no writable directories have been found
         """
+        for include_path in root.include:
+            try:
+                directory = root.repository_paths.ensure_exists(include_path)
+                if os.access(directory, os.W_OK | os.X_OK):
+                    return directory
+            except OSError:
+                continue
 
-        content = f"PACKAGER='{packager}'\n"
-        if makeflags_jobs:
-            content += "MAKEFLAGS=\"-j$(nproc)\"\n"
-
-        uid, _ = paths.root_owner
-        home_dir = Path(getpwuid(uid).pw_dir)
-        (home_dir / ".makepkg.conf").write_text(content, encoding="utf8")
-
-    @staticmethod
-    def configuration_create_sudo(paths: RepositoryPaths, repository_id: RepositoryId) -> None:
-        """
-        create configuration to run build command with sudo without password
-
-        Args:
-            paths(RepositoryPaths): repository paths instance
-            repository_id(RepositoryId): repository unique identifier
-        """
-        command = Setup.build_command(paths.root, repository_id)
-        sudoers_file = Setup.build_command(Setup.SUDOERS_DIR_PATH, repository_id)
-        sudoers_file.write_text(f"ahriman ALL=(ALL) NOPASSWD:SETENV: {command} *\n", encoding="utf8")
-        sudoers_file.chmod(0o400)  # security!
-
-    @staticmethod
-    def executable_create(paths: RepositoryPaths, repository_id: RepositoryId) -> None:
-        """
-        create executable for the service
-
-        Args:
-            paths(RepositoryPaths): repository paths instance
-            repository_id(RepositoryId): repository unique identifier
-        """
-        command = Setup.build_command(paths.root, repository_id)
-        command.unlink(missing_ok=True)
-        command.symlink_to(Setup.ARCHBUILD_COMMAND_PATH)
+        raise InitializeError("No writable include directory found")
 
     arguments = [_set_service_setup_parser]

ahriman-core/src/ahriman/core/build_tools/package_version.py

@@ -56,7 +56,7 @@ class PackageVersion(LazyLogging):
 
         _, repository_id = configuration.check_loaded()
         paths = configuration.repository_paths
-        task = Task(self.package, configuration, repository_id.architecture, paths)
+        task = Task(self.package, configuration, repository_id, paths)
 
         try:
             # create fresh chroot environment, fetch sources and - automagically - update PKGBUILD

ahriman-core/src/ahriman/core/build_tools/task.py

@@ -27,6 +27,7 @@ from ahriman.core.log import LazyLogging
 from ahriman.core.utils import check_output, package_like
 from ahriman.models.package import Package
 from ahriman.models.pkgbuild_patch import PkgbuildPatch
+from ahriman.models.repository_id import RepositoryId
 from ahriman.models.repository_paths import RepositoryPaths
 
 
@@ -36,33 +37,40 @@ class Task(LazyLogging):
 
     Attributes:
         archbuild_flags(list[str]): command flags for archbuild command
-        architecture(str): repository architecture
-        build_command(str): build command
+        build_command(list[str]): build command
+        devtools_configs(Path): path to local directory with devtools configuration files
         include_debug_packages(bool): whether to include debug packages or not
+        make_flags(str): MAKEFLAGS variable for makepkg command
         makechrootpkg_flags(list[str]): command flags for makechrootpkg command
         makepkg_flags(list[str]): command flags for makepkg command
         package(Package): package definitions
         paths(RepositoryPaths): repository paths instance
+        repository_id(RepositoryId): repository unique identifier
         uid(int): uid of the repository owner user
     """
 
-    def __init__(self, package: Package, configuration: Configuration, architecture: str,
+    def __init__(self, package: Package, configuration: Configuration, repository_id: RepositoryId,
                  paths: RepositoryPaths) -> None:
         """
         Args:
             package(Package): package definitions
             configuration(Configuration): configuration instance
-            architecture(str): repository architecture
+            repository_id(RepositoryId): repository unique identifier
             paths(RepositoryPaths): repository paths instance
         """
         self.package = package
         self.paths = paths
         self.uid, _ = paths.root_owner
-        self.architecture = architecture
+        self.repository_id = repository_id
 
         self.archbuild_flags = configuration.getlist("build", "archbuild_flags", fallback=[])
-        self.build_command = configuration.get("build", "build_command")
+        self.build_command = configuration.getlist("build", "devtools_wrapper")
+        self.devtools_configs = configuration.getpath("build", "devtools_configs")
+        self._legacy_build_command = configuration.getlist("build", "build_command", fallback=[])
         self.include_debug_packages = configuration.getboolean("build", "include_debug_packages", fallback=True)
+        # even though this option is declared as list, there is no need to read it as list,
+        # because it will be converted back to the string anyway
+        self.make_flags = configuration.get("build", "make_flags", fallback=None)
         self.makepkg_flags = configuration.getlist("build", "makepkg_flags", fallback=[])
         self.makechrootpkg_flags = configuration.getlist("build", "makechrootpkg_flags", fallback=[])
 
@@ -108,12 +116,21 @@ class Task(LazyLogging):
         Returns:
             list[Path]: paths of produced packages
         """
-        command = [self.build_command, "-r", str(self.paths.chroot)]
-        command.extend(self.archbuild_flags)
-        command.extend(["--", "-D", str(self.paths.archive)] + self.makechrootpkg_flags)
-        command.extend(["--"] + self.makepkg_flags)
+        command = self._legacy_build_command[:]
+        if not command:
+            command = self.build_command + [
+                "-r", self.repository_id.name,
+                "-a", self.repository_id.architecture,
+                "-c", str(self.devtools_configs),
+                "--",
+            ]
+
+        command.extend(["-r", str(self.paths.chroot)] + self.archbuild_flags)  # archbuild flags
+        command.extend(["--", "-D", str(self.paths.archive)] + self.makechrootpkg_flags)  # makechrootpkg flags
+        command.extend(["--"] + self.makepkg_flags)  # makepkg flags
         if dry_run:
             command.extend(["--nobuild"])
+
         self.logger.info("using %s for %s", command, self.package.base)
 
         environment: dict[str, str] = {
@@ -121,6 +138,8 @@ class Task(LazyLogging):
             for key, value in kwargs.items()
             if value is not None
         }
+        if self.make_flags is not None:
+            environment["MAKEFLAGS"] = self.make_flags
         self.logger.info("using environment variables %s", environment)
 
         source_files = list(sources_dir.iterdir())
@@ -156,7 +175,7 @@ class Task(LazyLogging):
             return last_commit_sha
 
         # load fresh package
-        loaded_package = Package.from_build(sources_dir, self.architecture, None)
+        loaded_package = Package.from_build(sources_dir, self.repository_id.architecture, None)
         if (pkgrel := loaded_package.next_pkgrel(local_version)) is not None:
             self.logger.info("package %s is the same as in repo, bumping pkgrel to %s", self.package.base, pkgrel)
             patch = PkgbuildPatch("pkgrel", pkgrel)

ahriman-core/src/ahriman/core/configuration/configuration.py

@@ -109,14 +109,14 @@ class Configuration(configparser.RawConfigParser):
         return repository_id.architecture
 
     @property
-    def include(self) -> Path:
+    def include(self) -> list[Path]:
         """
         get full path to include directory
 
         Returns:
-            Path: path to directory with configuration includes
+            list[Path]: paths to directories with configuration includes
         """
-        return self.getpath("settings", "include")
+        return self.getpathlist("settings", "include")
 
     @property
     def logging_path(self) -> Path:
@@ -325,25 +325,26 @@ class Configuration(configparser.RawConfigParser):
             section, key = name.rsplit(":", maxsplit=1)
             self.set_option(section, key, value)
 
-    def load_includes(self, path: Path | None = None) -> None:
+    def load_includes(self) -> None:
         """
         load configuration includes from specified path
-
-        Args:
-            path(Path | None, optional): path to directory with include files. If none set, the default path will be
-                used (Default value = None)
         """
         self.includes = []  # reset state
 
         try:
-            path = path or self.include
+            include_directories = self.include
+        except (configparser.NoOptionError, configparser.NoSectionError):
+            return
+
+        for path in include_directories:  # pylint: disable=not-an-iterable
+            if not path.is_dir():
+                continue
+
             for include in sorted(path.glob("*.ini")):
                 if include == self.logging_path:
                     continue  # we don't want to load logging explicitly
                 self.read(include)
                 self.includes.append(include)
-        except (FileNotFoundError, configparser.NoOptionError, configparser.NoSectionError):
-            pass
 
     def merge_sections(self, repository_id: RepositoryId) -> None:
         """
@@ -403,6 +404,7 @@ class Configuration(configparser.RawConfigParser):
         # create another instance and copy values from there
         instance = self.from_path(path, repository_id)
         self.copy_from(instance)
+        self.includes = instance.includes
 
     def set_option(self, section: str, option: str, value: str) -> None:
         """

ahriman-core/src/ahriman/core/configuration/schema.py

@@ -40,10 +40,13 @@ CONFIGURATION_SCHEMA: ConfigurationSchema = {
                 "required": True,
             },
             "include": {
-                "type": "path",
-                "coerce": "absolute_path",
-                "path_exists": True,
-                "path_type": "dir",
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "path",
+                    "coerce": "absolute_path",
+                    "path_type": "dir",
+                },
             },
             "logging": {
                 "type": "path",
@@ -190,8 +193,27 @@ CONFIGURATION_SCHEMA: ConfigurationSchema = {
                 },
             },
             "build_command": {
-                "type": "string",
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
+            },
+            "devtools_configs": {
+                "type": "path",
+                "coerce": "absolute_path",
                 "required": True,
+                "path_exists": True,
+                "path_type": "dir",
+            },
+            "devtools_wrapper": {
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
                 "empty": False,
             },
             "ignore_packages": {
@@ -206,6 +228,14 @@ CONFIGURATION_SCHEMA: ConfigurationSchema = {
                 "type": "boolean",
                 "coerce": "boolean",
             },
+            "make_flags": {
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
+            },
             "makechrootpkg_flags": {
                 "type": "list",
                 "coerce": "list",
@@ -214,18 +244,22 @@ CONFIGURATION_SCHEMA: ConfigurationSchema = {
                     "empty": False,
                 },
             },
+            "makepkg_flags": {
+                "type": "list",
+                "coerce": "list",
+                "schema": {
+                    "type": "string",
+                    "empty": False,
+                },
+            },
             "min_age": {
                 "type": "integer",
                 "coerce": "integer",
                 "min": 0,
             },
-            "makepkg_flags": {
-                "type": "list",
-                "coerce": "list",
-                "schema": {
-                    "type": "string",
-                    "empty": False,
-                },
+            "packager": {
+                "type": "string",
+                "empty": False,
             },
             "scan_paths": {
                 "type": "list",

ahriman-core/src/ahriman/core/configuration/validator.py

@@ -190,5 +190,5 @@ class Validator(RootValidator):
             {"type": "string"}
         """
         fn = getattr(value, f"is_{constraint}")
-        if not fn():
+        if value.exists() and not fn():
             self._error(field, f"Path {value} must be type of {constraint}")

ahriman-core/src/ahriman/core/log/journal_handler.py

@@ -21,6 +21,8 @@
 from logging import NullHandler
 from typing import Any
 
+from ahriman.core.module_loader import optional_module
+
 
 __all__ = ["JournalHandler"]
 
@@ -40,7 +42,5 @@ class _JournalHandler(NullHandler):
         del args, kwargs
 
 
-try:
-    from systemd.journal import JournalHandler  # type: ignore[import-untyped]
-except ImportError:
-    JournalHandler = _JournalHandler
+systemd_journal = optional_module("systemd.journal")
+JournalHandler = systemd_journal.JournalHandler if systemd_journal else _JournalHandler

ahriman-core/src/ahriman/core/log/log_loader.py

@@ -26,6 +26,7 @@ from typing import ClassVar, Literal
 from ahriman.core.configuration import Configuration
 from ahriman.core.log.http_log_handler import HttpLogHandler
 from ahriman.core.log.log_context import LogContext
+from ahriman.core.module_loader import optional_module
 from ahriman.models.log_handler import LogHandler
 from ahriman.models.repository_id import RepositoryId
 
@@ -65,14 +66,11 @@ class LogLoader:
         if selected is not None:
             return selected
 
-        try:
-            from systemd.journal import JournalHandler  # type: ignore[import-untyped]
-            del JournalHandler
+        if optional_module("systemd.journal"):
             return LogHandler.Journald  # journald import was found
-        except ImportError:
-            if LogLoader.DEFAULT_SYSLOG_DEVICE.exists():
-                return LogHandler.Syslog
-            return LogHandler.Console
+        if LogLoader.DEFAULT_SYSLOG_DEVICE.exists():
+            return LogHandler.Syslog
+        return LogHandler.Console
 
     @staticmethod
     def load(repository_id: RepositoryId, configuration: Configuration, handler: LogHandler, *,

ahriman-core/src/ahriman/core/module_loader.py

@@ -26,8 +26,7 @@ from pkgutil import ModuleInfo, walk_packages
 from types import ModuleType
 from typing import Any, TypeGuard, TypeVar
 
-
-__all__ = ["implementations"]
+__all__ = ["implementations", "optional_module"]
 
 
 T = TypeVar("T")
@@ -74,3 +73,19 @@ def implementations(root_module: ModuleType, base_class: type[T]) -> Iterator[ty
 
             for _, attribute in inspect.getmembers(module, is_base_class):
                 yield attribute
+
+
+def optional_module(module_name: str) -> ModuleType | None:
+    """
+    import an optional module
+
+    Args:
+        module_name(str): fully qualified module name
+
+    Returns:
+        ModuleType | None: imported module or ``None`` when it cannot be imported
+    """
+    try:
+        return import_module(module_name)
+    except ImportError:
+        return None

ahriman-core/src/ahriman/core/repository/executor.py

@@ -73,7 +73,8 @@ class Executor(PackageInfo, Cleaner):
         """
         self.reporter.set_building(package.base)
 
-        task = Task(package, self.configuration, self.repository_id.architecture, self.paths)
+        default_packager = self.configuration.get("build", "packager", fallback=None)
+        task = Task(package, self.configuration, self.repository_id, self.paths)
         patches = self.reporter.package_patches_get(package.base, None)
         commit_sha = task.init(path, patches, local_version)
 
@@ -86,7 +87,7 @@ class Executor(PackageInfo, Cleaner):
                     shutil.copy(artifact, path)
                 built.append(path / artifact.name)
         else:
-            built = task.build(path, PACKAGER=packager)
+            built = task.build(path, PACKAGER=packager or default_packager)
 
         package.with_packages(built)
         for src in built:

ahriman-core/src/ahriman/models/repository_paths.py

@@ -103,7 +103,7 @@ class RepositoryPaths(LazyLogging):
         Returns:
             Path: path to directory in which build process is run
         """
-        uid, _ = owner(self.root)
+        uid, _ = self.root_owner
         return self.chroot / f"{self.repository_id.name}-{self.repository_id.architecture}" / getpwuid(uid).pw_name
 
     @property
@@ -127,6 +127,16 @@ class RepositoryPaths(LazyLogging):
         # for the chroot directory devtools will create own tree, and we don't have to specify architecture here
         return self.root / "chroot" / self.repository_id.name
 
+    @property
+    def configs(self) -> Path:
+        """
+        get directory for local configuration files
+
+        Returns:
+            Path: full path to local configuration directory
+        """
+        return self.root / ".config" / "ahriman"
+
     @property
     def packages(self) -> Path:
         """
@@ -323,6 +333,7 @@ class RepositoryPaths(LazyLogging):
             self.archive,
             self.cache,
             self.chroot,
+            self.configs,
             self.packages,
             self.pacman,
             self.repository,

ahriman-core/tests/ahriman/application/handlers/test_handler_setup.py

@@ -1,4 +1,6 @@
 import argparse
+import multiprocessing
+import os
 import pytest
 
 from pathlib import Path
@@ -10,9 +12,8 @@ from urllib.parse import quote_plus as url_encode
 from ahriman.application.handlers.setup import Setup
 from ahriman.core.configuration import Configuration
 from ahriman.core.database import SQLite
-from ahriman.core.exceptions import MissingArchitectureError
+from ahriman.core.exceptions import InitializeError, MissingArchitectureError
 from ahriman.core.repository import Repository
-from ahriman.models.repository_id import RepositoryId
 from ahriman.models.repository_paths import RepositoryPaths
 from ahriman.models.sign_settings import SignSettings
 
@@ -50,25 +51,29 @@ def test_run(args: argparse.Namespace, configuration: Configuration, repository:
     must run command
     """
     args = _default_args(args)
+    local = Path("local")
     mocker.patch("ahriman.core.database.SQLite.load", return_value=database)
     mocker.patch("ahriman.core.repository.Repository.load", return_value=repository)
+    mkdir_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_directory",
+                              return_value=local)
     ahriman_configuration_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_ahriman")
     devtools_configuration_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_devtools")
-    makepkg_configuration_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_makepkg")
-    sudo_configuration_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_sudo")
-    executable_mock = mocker.patch("ahriman.application.handlers.setup.Setup.executable_create")
     init_mock = mocker.patch("ahriman.core.alpm.repo.Repo.init")
     owner_guard_mock = mocker.patch("ahriman.models.repository_paths.RepositoryPaths.preserve_owner")
 
     _, repository_id = configuration.check_loaded()
     Setup.run(args, repository_id, configuration, report=False)
     owner_guard_mock.assert_called_once_with()
-    ahriman_configuration_mock.assert_called_once_with(args, repository_id, configuration)
+    mkdir_mock.assert_called_once_with(configuration)
+    ahriman_configuration_mock.assert_called_once_with(args, repository_id, configuration, local)
     devtools_configuration_mock.assert_called_once_with(
-        repository_id, args.from_configuration, args.mirror, args.multilib, f"file://{repository_paths.repository}")
-    makepkg_configuration_mock.assert_called_once_with(args.packager, args.makeflags_jobs, repository_paths)
-    sudo_configuration_mock.assert_called_once_with(repository_paths, repository_id)
-    executable_mock.assert_called_once_with(repository_paths, repository_id)
+        repository_id,
+        args.from_configuration,
+        configuration.getpath("build", "devtools_configs"),
+        args.mirror,
+        args.multilib,
+        f"file://{repository_paths.repository}",
+    )
     init_mock.assert_called_once_with()
 
 
@@ -101,31 +106,23 @@ def test_run_with_server(args: argparse.Namespace, configuration: Configuration,
     mocker.patch("ahriman.core.database.SQLite.load", return_value=database)
     mocker.patch("ahriman.core.repository.Repository.load", return_value=repository)
     mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_ahriman")
-    mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_makepkg")
-    mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_sudo")
-    mocker.patch("ahriman.application.handlers.setup.Setup.executable_create")
     mocker.patch("ahriman.core.alpm.repo.Repo.init")
     devtools_configuration_mock = mocker.patch("ahriman.application.handlers.setup.Setup.configuration_create_devtools")
 
     _, repository_id = configuration.check_loaded()
     Setup.run(args, repository_id, configuration, report=False)
     devtools_configuration_mock.assert_called_once_with(
-        repository_id, args.from_configuration, args.mirror, args.multilib, "server")
+        repository_id,
+        args.from_configuration,
+        configuration.getpath("build", "devtools_configs"),
+        args.mirror,
+        args.multilib,
+        "server",
+    )
 
 
-def test_build_command(repository_id: RepositoryId) -> None:
-    """
-    must generate correct build command name
-    """
-    path = Path("local")
-
-    build_command = Setup.build_command(path, repository_id)
-    assert build_command.name == f"{repository_id.name}-{repository_id.architecture}-build"
-    assert build_command.parent == path
-
-
-def test_configuration_create_ahriman(args: argparse.Namespace, configuration: Configuration,
-                                      repository_paths: RepositoryPaths, mocker: MockerFixture) -> None:
+def test_configuration_create_ahriman(args: argparse.Namespace, configuration: Configuration, tmp_path: Path,
+                                      mocker: MockerFixture) -> None:
     """
     must create configuration for the service
     """
@@ -133,23 +130,23 @@ def test_configuration_create_ahriman(args: argparse.Namespace, configuration: C
     mocker.patch("pathlib.Path.open")
     set_option_mock = mocker.patch("ahriman.core.configuration.Configuration.set_option")
     write_mock = mocker.patch("ahriman.core.configuration.Configuration.write")
-    remove_mock = mocker.patch("pathlib.Path.unlink", autospec=True)
     _, repository_id = configuration.check_loaded()
-    command = Setup.build_command(repository_paths.root, repository_id)
 
-    Setup.configuration_create_ahriman(args, repository_id, configuration)
+    Setup.configuration_create_ahriman(args, repository_id, configuration, tmp_path)
     set_option_mock.assert_has_calls([
-        MockCall(Configuration.section_name("build", repository_id.name, repository_id.architecture), "build_command",
-                 str(command)),
         MockCall("repository", "name", repository_id.name),
+        MockCall(Configuration.section_name("build", repository_id.name, repository_id.architecture),
+                 "packager", args.packager),
+        MockCall(Configuration.section_name("build", repository_id.name, repository_id.architecture),
+                 "make_flags", f"-j{multiprocessing.cpu_count()}"),
         MockCall(Configuration.section_name("build", repository_id.name, repository_id.architecture),
                  "makechrootpkg_flags", f"-U {args.build_as_user}"),
-        MockCall(Configuration.section_name(
-            "alpm", repository_id.name, repository_id.architecture), "mirror", args.mirror),
-        MockCall(Configuration.section_name("sign", repository_id.name, repository_id.architecture), "target",
-                 " ".join([target.name.lower() for target in args.sign_target])),
-        MockCall(Configuration.section_name("sign", repository_id.name, repository_id.architecture), "key",
-                 args.sign_key),
+        MockCall(Configuration.section_name("alpm", repository_id.name, repository_id.architecture),
+                 "mirror", args.mirror),
+        MockCall(Configuration.section_name("sign", repository_id.name, repository_id.architecture),
+                 "target", " ".join([target.name.lower() for target in args.sign_target])),
+        MockCall(Configuration.section_name("sign", repository_id.name, repository_id.architecture),
+                 "key", args.sign_key),
         MockCall("web", "port", str(args.web_port)),
         MockCall("status", "address", f"http://127.0.0.1:{str(args.web_port)}"),
         MockCall("web", "unix_socket", str(args.web_unix_socket)),
@@ -157,11 +154,10 @@ def test_configuration_create_ahriman(args: argparse.Namespace, configuration: C
         MockCall("auth", "salt", pytest.helpers.anyvar(str, strict=True)),
     ])
     write_mock.assert_called_once_with(pytest.helpers.anyvar(int))
-    remove_mock.assert_called_once_with(configuration.include / "00-setup-overrides.ini", missing_ok=True)
 
 
 def test_configuration_create_ahriman_no_multilib(args: argparse.Namespace, configuration: Configuration,
-                                                  mocker: MockerFixture) -> None:
+                                                  tmp_path: Path, mocker: MockerFixture) -> None:
     """
     must create configuration for the service without multilib repository
     """
@@ -172,14 +168,14 @@ def test_configuration_create_ahriman_no_multilib(args: argparse.Namespace, conf
     set_option_mock = mocker.patch("ahriman.core.configuration.Configuration.set_option")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_ahriman(args, repository_id, configuration)
+    Setup.configuration_create_ahriman(args, repository_id, configuration, tmp_path)
     set_option_mock.assert_has_calls([
         MockCall(Configuration.section_name("alpm", repository_id.name, repository_id.architecture), "mirror",
                  args.mirror),
     ])  # non-strict check called intentionally
 
 
-def test_configuration_create_devtools(args: argparse.Namespace, configuration: Configuration,
+def test_configuration_create_devtools(args: argparse.Namespace, configuration: Configuration, tmp_path: Path,
                                        mocker: MockerFixture) -> None:
     """
     must create configuration for the devtools
@@ -191,12 +187,12 @@ def test_configuration_create_devtools(args: argparse.Namespace, configuration:
     write_mock = mocker.patch("ahriman.core.configuration.Configuration.write")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_devtools(repository_id, args.from_configuration, None, args.multilib, "server")
+    Setup.configuration_create_devtools(repository_id, args.from_configuration, tmp_path, None, args.multilib, "server")
     add_section_mock.assert_has_calls([MockCall("multilib"), MockCall(repository_id.name)])
     write_mock.assert_called_once_with(pytest.helpers.anyvar(int))
 
 
-def test_configuration_create_devtools_mirror(args: argparse.Namespace, configuration: Configuration,
+def test_configuration_create_devtools_mirror(args: argparse.Namespace, configuration: Configuration, tmp_path: Path,
                                               mocker: MockerFixture) -> None:
     """
     must create configuration for the devtools with mirror set explicitly
@@ -216,14 +212,21 @@ def test_configuration_create_devtools_mirror(args: argparse.Namespace, configur
     set_option_mock = mocker.patch("ahriman.core.configuration.Configuration.set_option")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_devtools(repository_id, args.from_configuration, args.mirror, args.multilib, "server")
+    Setup.configuration_create_devtools(
+        repository_id,
+        args.from_configuration,
+        tmp_path,
+        args.mirror,
+        args.multilib,
+        "server",
+    )
     get_mock.assert_has_calls([MockCall("core", "Include", fallback=None), MockCall("extra", "Include", fallback=None)])
     remove_option_mock.assert_called_once_with("core", "Include")
     set_option_mock.assert_has_calls([MockCall("core", "Server", args.mirror)])  # non-strict check called intentionally
 
 
 def test_configuration_create_devtools_no_multilib(args: argparse.Namespace, configuration: Configuration,
-                                                   mocker: MockerFixture) -> None:
+                                                   tmp_path: Path, mocker: MockerFixture) -> None:
     """
     must create configuration for the devtools without multilib
     """
@@ -233,50 +236,31 @@ def test_configuration_create_devtools_no_multilib(args: argparse.Namespace, con
     write_mock = mocker.patch("ahriman.core.configuration.Configuration.write")
 
     _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_devtools(repository_id, args.from_configuration, args.mirror, False, "server")
+    Setup.configuration_create_devtools(repository_id, args.from_configuration, tmp_path, args.mirror, False, "server")
     write_mock.assert_called_once_with(pytest.helpers.anyvar(int))
 
 
-def test_configuration_create_makepkg(args: argparse.Namespace, repository_paths: RepositoryPaths,
-                                      passwd: Any, mocker: MockerFixture) -> None:
+def test_configuration_create_directory(configuration: Configuration, mocker: MockerFixture) -> None:
     """
-    must create makepkg configuration
+    must create writable directory for includes
     """
-    args = _default_args(args)
-    mocker.patch("ahriman.application.handlers.setup.getpwuid", return_value=passwd)
-    write_text_mock = mocker.patch("pathlib.Path.write_text", autospec=True)
+    configuration.set_option("settings", "include", f"/path1 /path2 /path3")
+    mkdir_mock = mocker.patch("ahriman.models.repository_paths.RepositoryPaths.ensure_exists",
+                              side_effect=[OSError, "/path2", "/path3"])
+    access_mock = mocker.patch("os.access", side_effect=[False, True])
 
-    Setup.configuration_create_makepkg(args.packager, args.makeflags_jobs, repository_paths)
-    write_text_mock.assert_called_once_with(
-        Path("home") / ".makepkg.conf", pytest.helpers.anyvar(str, True), encoding="utf8")
+    assert Setup.configuration_create_directory(configuration) == "/path3"
+    mkdir_mock.assert_has_calls([MockCall(Path("/path1")), MockCall(Path("/path2")), MockCall(Path("/path3"))])
+    access_mock.assert_has_calls([MockCall("/path2", os.W_OK | os.X_OK), MockCall("/path3", os.W_OK | os.X_OK)])
 
 
-def test_configuration_create_sudo(configuration: Configuration, repository_paths: RepositoryPaths,
-                                   mocker: MockerFixture) -> None:
+def test_configuration_create_directory_no_writable(configuration: Configuration, mocker: MockerFixture) -> None:
     """
-    must create sudo configuration
+    must raise InitializeError if no writable directories found
     """
-    chmod_text_mock = mocker.patch("pathlib.Path.chmod")
-    write_text_mock = mocker.patch("pathlib.Path.write_text")
-
-    _, repository_id = configuration.check_loaded()
-    Setup.configuration_create_sudo(repository_paths, repository_id)
-    chmod_text_mock.assert_called_once_with(0o400)
-    write_text_mock.assert_called_once_with(pytest.helpers.anyvar(str, True), encoding="utf8")
-
-
-def test_executable_create(configuration: Configuration, repository_paths: RepositoryPaths,
-                           mocker: MockerFixture) -> None:
-    """
-    must create executable
-    """
-    symlink_mock = mocker.patch("pathlib.Path.symlink_to")
-    unlink_mock = mocker.patch("pathlib.Path.unlink")
-
-    _, repository_id = configuration.check_loaded()
-    Setup.executable_create(repository_paths, repository_id)
-    symlink_mock.assert_called_once_with(Setup.ARCHBUILD_COMMAND_PATH)
-    unlink_mock.assert_called_once_with(missing_ok=True)
+    mocker.patch("ahriman.models.repository_paths.RepositoryPaths.ensure_exists", side_effect=OSError)
+    with pytest.raises(InitializeError):
+        Setup.configuration_create_directory(configuration)
 
 
 def test_disallow_multi_architecture_run() -> None:

ahriman-core/tests/ahriman/application/handlers/test_handler_validate.py

@@ -63,7 +63,7 @@ def test_run_default(args: argparse.Namespace, configuration: Configuration) ->
 
     default = Configuration.from_path(Configuration.SYSTEM_CONFIGURATION_PATH, repository_id)
     # copy autogenerated values
-    for section, key in (("build", "build_command"), ("repository", "root")):
+    for section, key in (("repository", "root"), ("build", "devtools_configs")):
         value = configuration.get(section, key)
         default.set_option(section, key, value)
 

ahriman-core/tests/ahriman/application/test_ahriman.py

@@ -1488,7 +1488,7 @@ def test_subparsers_service_run_option_repository(parser: argparse.ArgumentParse
 
 def test_subparsers_service_setup(parser: argparse.ArgumentParser) -> None:
     """
-    service-setup command must imply lock, quiet, report and unsafe
+    service-setup command must imply lock, quiet and report
     """
     args = parser.parse_args(["-a", "x86_64", "-r", "repo", "service-setup",
                               "--packager", "ahriman bot <ahriman@example.com>"])
@@ -1497,7 +1497,6 @@ def test_subparsers_service_setup(parser: argparse.ArgumentParser) -> None:
     assert args.quiet
     assert not args.report
     assert args.repository == "repo"
-    assert args.unsafe
 
 
 def test_subparsers_service_setup_option_from_configuration(parser: argparse.ArgumentParser) -> None:

ahriman-core/tests/ahriman/core/build_tools/test_task.py

@@ -53,8 +53,11 @@ def test_build(task_ahriman: Task, mocker: MockerFixture) -> None:
 
     assert task_ahriman.build(local) == [task_ahriman.package.base]
     check_output_mock.assert_called_once_with(
-        "extra-x86_64-build",
-        "-r", str(task_ahriman.paths.chroot),
+        "ahriman-archbuild",
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
+        "--", "-r", str(task_ahriman.paths.chroot),
         "--", "-D", str(task_ahriman.paths.archive),
         "--", "--skippgpcheck",
         exception=pytest.helpers.anyvar(int),
@@ -79,8 +82,11 @@ def test_build_environment(task_ahriman: Task, mocker: MockerFixture) -> None:
 
     task_ahriman.build(local, **environment, empty=None)
     check_output_mock.assert_called_once_with(
-        "extra-x86_64-build",
-        "-r", str(task_ahriman.paths.chroot),
+        "ahriman-archbuild",
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
+        "--", "-r", str(task_ahriman.paths.chroot),
         "--", "-D", str(task_ahriman.paths.archive),
         "--", "--skippgpcheck",
         exception=pytest.helpers.anyvar(int),
@@ -91,6 +97,33 @@ def test_build_environment(task_ahriman: Task, mocker: MockerFixture) -> None:
     )
 
 
+def test_build_makeflags(task_ahriman: Task, mocker: MockerFixture) -> None:
+    """
+    must build package with MAKEFLAGS variable if set
+    """
+    local = Path("local")
+    mocker.patch("pathlib.Path.iterdir", return_value=["file"])
+    mocker.patch("ahriman.core.build_tools.task.Task._package_archives", return_value=[task_ahriman.package.base])
+    check_output_mock = mocker.patch("ahriman.core.build_tools.task.check_output")
+    task_ahriman.make_flags = "-j1"
+
+    task_ahriman.build(local)
+    check_output_mock.assert_called_once_with(
+        "ahriman-archbuild",
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
+        "--", "-r", str(task_ahriman.paths.chroot),
+        "--", "-D", str(task_ahriman.paths.archive),
+        "--", "--skippgpcheck",
+        exception=pytest.helpers.anyvar(int),
+        cwd=local,
+        logger=task_ahriman.logger,
+        user=task_ahriman.uid,
+        environment={"MAKEFLAGS": "-j1"},
+    )
+
+
 def test_build_dry_run(task_ahriman: Task, mocker: MockerFixture) -> None:
     """
     must run devtools in dry-run mode
@@ -100,13 +133,40 @@ def test_build_dry_run(task_ahriman: Task, mocker: MockerFixture) -> None:
     mocker.patch("ahriman.core.build_tools.task.Task._package_archives", return_value=[task_ahriman.package.base])
     check_output_mock = mocker.patch("ahriman.core.build_tools.task.check_output")
 
-    assert task_ahriman.build(local, dry_run=True) == [task_ahriman.package.base]
+    task_ahriman.build(local, dry_run=True)
+    check_output_mock.assert_called_once_with(
+        "ahriman-archbuild",
+        "-r", task_ahriman.repository_id.name,
+        "-a", task_ahriman.repository_id.architecture,
+        "-c", str(task_ahriman.devtools_configs),
+        "--", "-r", str(task_ahriman.paths.chroot),
+        "--", "-D", str(task_ahriman.paths.archive),
+        "--", "--skippgpcheck",
+        "--nobuild",
+        exception=pytest.helpers.anyvar(int),
+        cwd=local,
+        logger=task_ahriman.logger,
+        user=task_ahriman.uid,
+        environment={},
+    )
+
+
+def test_build_legacy_subcommand(task_ahriman: Task, mocker: MockerFixture) -> None:
+    """
+    must build package by using legacy subcommand if set
+    """
+    local = Path("local")
+    mocker.patch("pathlib.Path.iterdir", return_value=["file"])
+    mocker.patch("ahriman.core.build_tools.task.Task._package_archives", return_value=[task_ahriman.package.base])
+    check_output_mock = mocker.patch("ahriman.core.build_tools.task.check_output")
+    task_ahriman._legacy_build_command = ["extra-x86_64-build"]
+
+    task_ahriman.build(local)
     check_output_mock.assert_called_once_with(
         "extra-x86_64-build",
         "-r", str(task_ahriman.paths.chroot),
         "--", "-D", str(task_ahriman.paths.archive),
         "--", "--skippgpcheck",
-        "--nobuild",
         exception=pytest.helpers.anyvar(int),
         cwd=local,
         logger=task_ahriman.logger,

ahriman-core/tests/ahriman/core/configuration/test_configuration.py

@@ -374,17 +374,16 @@ def test_load_environment(configuration: Configuration) -> None:
     assert configuration.get("section:identifier", "key") == "value2"
 
 
-def test_load_includes(mocker: MockerFixture) -> None:
+def test_load_includes(configuration: Configuration, mocker: MockerFixture) -> None:
     """
     must load includes
     """
     mocker.patch.object(Configuration, "logging_path", Path("logging"))
     read_mock = mocker.patch("ahriman.core.configuration.Configuration.read")
     glob_mock = mocker.patch("pathlib.Path.glob", autospec=True, return_value=[Path("include"), Path("logging")])
-    configuration = Configuration()
 
-    configuration.load_includes(Path("path"))
-    glob_mock.assert_called_once_with(Path("path"), "*.ini")
+    configuration.load_includes()
+    glob_mock.assert_called_once_with(configuration.path.absolute().parent, "*.ini")
     read_mock.assert_called_once_with(Path("include"))
     assert configuration.includes == [Path("include")]
 
@@ -415,17 +414,6 @@ def test_load_includes_no_section() -> None:
     configuration.load_includes()
 
 
-def test_load_includes_default_path(mocker: MockerFixture) -> None:
-    """
-    must load includes from default path
-    """
-    mocker.patch.object(Configuration, "include", Path("path"))
-    glob_mock = mocker.patch("pathlib.Path.glob", autospec=True, return_value=[])
-
-    Configuration().load_includes()
-    glob_mock.assert_called_once_with(Path("path"), "*.ini")
-
-
 def test_merge_sections_missing(configuration: Configuration) -> None:
     """
     must merge create section if not exists

ahriman-core/tests/ahriman/core/configuration/test_validator.py

@@ -134,6 +134,10 @@ def test_validate_path_type(validator: Validator, mocker: MockerFixture) -> None
     """
     error_mock = mocker.patch("ahriman.core.configuration.validator.Validator._error")
 
+    validator._validate_path_type("file", "field", Path("42"))
+
+    mocker.patch("pathlib.Path.exists", return_value=True)
+
     mocker.patch("pathlib.Path.is_file", return_value=True)
     validator._validate_path_type("file", "field", Path("1"))
 

ahriman-core/tests/ahriman/core/conftest.py

@@ -76,4 +76,5 @@ def task_ahriman(package_ahriman: Package, configuration: Configuration, reposit
     Returns:
         Task: built task test instance
     """
-    return Task(package_ahriman, configuration, "x86_64", repository_paths)
+    _, repository_id = configuration.check_loaded()
+    return Task(package_ahriman, configuration, repository_id, repository_paths)

ahriman-core/tests/ahriman/core/test_module_loader.py

@@ -2,7 +2,7 @@ import ahriman.web.views
 
 from pathlib import Path
 
-from ahriman.core.module_loader import _modules, implementations
+from ahriman.core.module_loader import _modules, implementations, optional_module
 from ahriman.web.views.base import BaseView
 
 
@@ -23,3 +23,17 @@ def test_implementations() -> None:
     assert routes
     assert all(isinstance(view, type) for view in routes)
     assert all(issubclass(view, BaseView) for view in routes)
+
+
+def test_optional_module() -> None:
+    """
+    must import an available module
+    """
+    assert optional_module("ahriman.web.views") is ahriman.web.views
+
+
+def test_optional_module_fallback() -> None:
+    """
+    must return none when the module cannot be imported
+    """
+    assert optional_module("missing_ahriman_module") is None

ahriman-web/src/ahriman/core/auth/helpers.py

@@ -17,18 +17,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
-try:
-    import aiohttp_security
-except ImportError:
-    aiohttp_security = None  # type: ignore[assignment]
-
-try:
-    import aiohttp_session
-except ImportError:
-    aiohttp_session = None  # type: ignore[assignment]
-
 from typing import Any
 
+from ahriman.core.module_loader import optional_module
+
 
 __all__ = [
     "authorized_userid",
@@ -39,6 +31,10 @@ __all__ = [
 ]
 
 
+aiohttp_security = optional_module("aiohttp_security")
+aiohttp_session = optional_module("aiohttp_session")
+
+
 async def authorized_userid(*args: Any, **kwargs: Any) -> Any:
     """
     handle aiohttp security methods
@@ -50,7 +46,7 @@ async def authorized_userid(*args: Any, **kwargs: Any) -> Any:
     Returns:
         Any: ``None`` in case if no aiohttp_security module found and function call otherwise
     """
-    if aiohttp_security is not None:
+    if aiohttp_security:
         return await aiohttp_security.authorized_userid(*args, **kwargs)  # pylint: disable=no-value-for-parameter
     return None
 
@@ -66,7 +62,7 @@ async def check_authorized(*args: Any, **kwargs: Any) -> Any:
     Returns:
         Any: ``None`` in case if no aiohttp_security module found and function call otherwise
     """
-    if aiohttp_security is not None:
+    if aiohttp_security:
         return await aiohttp_security.check_authorized(*args, **kwargs)  # pylint: disable=no-value-for-parameter
     return None
 
@@ -82,7 +78,7 @@ async def forget(*args: Any, **kwargs: Any) -> Any:
     Returns:
         Any: ``None`` in case if no aiohttp_security module found and function call otherwise
     """
-    if aiohttp_security is not None:
+    if aiohttp_security:
         return await aiohttp_security.forget(*args, **kwargs)  # pylint: disable=no-value-for-parameter
     return None
 
@@ -98,7 +94,7 @@ async def get_session(*args: Any, **kwargs: Any) -> Any:
     Returns:
         Any: empty dictionary in case if no aiohttp_session module found and function call otherwise
     """
-    if aiohttp_session is not None:
+    if aiohttp_session:
         return await aiohttp_session.get_session(*args, **kwargs)
     return {}
 
@@ -114,6 +110,6 @@ async def remember(*args: Any, **kwargs: Any) -> Any:
     Returns:
         Any: ``None`` in case if no aiohttp_security module found and function call otherwise
     """
-    if aiohttp_security is not None:
+    if aiohttp_security:
         return await aiohttp_security.remember(*args, **kwargs)  # pylint: disable=no-value-for-parameter
     return None

ahriman-web/src/ahriman/web/apispec/__init__.py

@@ -17,15 +17,20 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
-try:
-    import aiohttp_apispec  # type: ignore[import-untyped]
+from ahriman.core.module_loader import optional_module
 
-    from marshmallow import Schema, fields
-except ImportError:
+
+aiohttp_apispec = optional_module("aiohttp_apispec")
+marshmallow = optional_module("marshmallow")
+
+
+if aiohttp_apispec and marshmallow:
+    Schema = marshmallow.Schema
+    fields = marshmallow.fields
+else:
     from unittest.mock import Mock
 
     Schema = Mock  # type: ignore[misc]
-    aiohttp_apispec = None
     fields = Mock()
 
 

ahriman-web/src/ahriman/web/apispec/decorators.py

@@ -115,7 +115,7 @@ def apidocs(*,
     authorization_required = permission != UserAccess.Unauthorized
 
     def wrapper(handler: Callable[..., Any]) -> Callable[..., Any]:
-        if aiohttp_apispec is None:
+        if not aiohttp_apispec:
             return handler  # apispec is disabled
 
         responses = _response_schema(

ahriman-web/src/ahriman/web/apispec/info.py

@@ -100,20 +100,17 @@ def _servers(application: Application) -> list[dict[str, Any]]:
     }]
 
 
-def setup_apispec(application: Application) -> Any:
+def setup_apispec(application: Application) -> None:
     """
     setup swagger api specification
 
     Args:
         application(Application): web application instance
-
-    Returns:
-        Any: created specification instance if module is available
     """
     if aiohttp_apispec is None:
-        return None
+        return
 
-    return aiohttp_apispec.setup_aiohttp_apispec(
+    aiohttp_apispec.setup_aiohttp_apispec(
         application,
         url="/api-docs/swagger.json",
         openapi_version="3.0.2",

ahriman-web/src/ahriman/web/middlewares/metrics_handler.py

@@ -17,14 +17,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
-try:
-    import aiohttp_openmetrics
-except ImportError:
-    aiohttp_openmetrics = None  # type: ignore[assignment]
-
 from aiohttp.typedefs import Middleware
 from aiohttp.web import HTTPNotFound, Request, Response, StreamResponse, middleware
 
+from ahriman.core.module_loader import optional_module
 from ahriman.web.middlewares import HandlerType
 
 
@@ -34,6 +30,9 @@ __all__ = [
 ]
 
 
+aiohttp_openmetrics = optional_module("aiohttp_openmetrics")
+
+
 async def metrics(request: Request) -> Response:
     """
     handler for returning metrics
@@ -47,7 +46,7 @@ async def metrics(request: Request) -> Response:
     Raises:
         HTTPNotFound: endpoint is disabled
     """
-    if aiohttp_openmetrics is None:
+    if not aiohttp_openmetrics:
         raise HTTPNotFound
     return await aiohttp_openmetrics.metrics(request)
 
@@ -59,7 +58,7 @@ def metrics_handler() -> Middleware:
     Returns:
         Middleware: middleware function to handle server metrics
     """
-    if aiohttp_openmetrics is not None:
+    if aiohttp_openmetrics:
         return aiohttp_openmetrics.metrics_middleware
 
     @middleware

ahriman-web/src/ahriman/web/server_info.py

@@ -60,7 +60,7 @@ async def server_info(view: BaseView) -> dict[str, Any]:
             "username": await authorized_userid(view.request),
         },
         "autorefresh_intervals": sorted(autorefresh_intervals, key=comparator),
-        "docs_enabled": aiohttp_apispec is not None,
+        "docs_enabled": bool(aiohttp_apispec),
         "index_url": view.configuration.get("web", "index_url", fallback=None),
         "repositories": [
             {

ahriman-web/src/ahriman/web/views/api/docs.py

@@ -50,7 +50,7 @@ class DocsView(BaseView):
             list[str]: list of routes defined for the view. By default, it tries to read :attr:`ROUTES` option if set
             and returns empty list otherwise
         """
-        if aiohttp_apispec is None:
+        if not aiohttp_apispec:
             return []
         return cls.ROUTES
 

ahriman-web/src/ahriman/web/views/api/swagger.py

@@ -51,7 +51,7 @@ class SwaggerView(BaseView):
             list[str]: list of routes defined for the view. By default, it tries to read :attr:`ROUTES` option if set
             and returns empty list otherwise
         """
-        if aiohttp_apispec is None:
+        if not aiohttp_apispec:
             return []
         return cls.ROUTES
 

ahriman-web/src/ahriman/web/views/v1/user/login.py

@@ -22,6 +22,7 @@ from secrets import token_urlsafe
 from typing import ClassVar
 
 from ahriman.core.auth.helpers import get_session, remember
+from ahriman.core.module_loader import optional_module
 from ahriman.models.user_access import UserAccess
 from ahriman.web.apispec.decorators import apidocs
 from ahriman.web.schemas import LoginSchema, OAuth2Schema
@@ -62,14 +63,12 @@ class LoginView(BaseView):
             HTTPMethodNotAllowed: in case if method is used, but OAuth is disabled
             HTTPUnauthorized: if case of authorization error
         """
-        try:
-            from ahriman.core.auth.oauth import OAuth
-        except ImportError:
-            # no aioauth library found
+        oauth = optional_module("ahriman.core.auth.oauth")
+        if not oauth:
             raise HTTPMethodNotAllowed(self.request.method, ["POST"])
 
         oauth_provider = self.validator
-        if not isinstance(oauth_provider, OAuth):
+        if not isinstance(oauth_provider, oauth.OAuth):
             raise HTTPMethodNotAllowed(self.request.method, ["POST"])
 
         session = await get_session(self.request)

ahriman-web/tests/ahriman/web/apispec/test_info.py

@@ -48,7 +48,8 @@ def test_setup_apispec(application: Application, mocker: MockerFixture) -> None:
     must set api specification
     """
     apispec_mock = mocker.patch("aiohttp_apispec.setup_aiohttp_apispec")
-    assert setup_apispec(application)
+
+    setup_apispec(application)
     apispec_mock.assert_called_once_with(
         application,
         url="/api-docs/swagger.json",

ahriman-web/tests/ahriman/web/views/v1/user/test_view_v1_user_login.py

@@ -37,7 +37,7 @@ async def test_get_import_error(client_with_auth: TestClient, mocker: MockerFixt
     """
     must return 405 on import error
     """
-    pytest.helpers.import_error("ahriman.core.auth.oauth", ["OAuth"], mocker)
+    mocker.patch("ahriman.web.views.v1.user.login.optional_module", return_value=None)
     response = await client_with_auth.get("/api/v1/login")
     assert response.status == 405
 

archlinux/PKGBUILD

@@ -12,7 +12,8 @@ depends=('devtools>=1:1.0.0' 'git' 'pyalpm' 'python-bcrypt' 'python-filelock' 'p
 makedepends=('npm' 'python-build' 'python-hatchling' 'python-installer' 'python-wheel')
 source=("https://github.com/arcan1s/ahriman/releases/download/$pkgver/$pkgbase-$pkgver.tar.gz"
         "$pkgbase.sysusers"
-        "$pkgbase.tmpfiles")
+        "$pkgbase.tmpfiles"
+        "sudoers.conf")
 
 build() {
     cd "$pkgbase-$pkgver"
@@ -59,6 +60,8 @@ package_ahriman-core() {
 
     install -Dm644 "$srcdir/$pkgbase.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgbase.conf"
     install -Dm644 "$srcdir/$pkgbase.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgbase.conf"
+
+    install -Dm440 "$srcdir/sudoers.conf" "$pkgdir/etc/sudoers.d/$pkgname"
 }
 
 package_ahriman-triggers() {

archlinux/sudoers.conf

@@ -0,0 +1,2 @@
+Defaults!/usr/bin/ahriman-archbuild env_keep += "SOURCE_DATE_EPOCH SRCDEST SRCPKGDEST PKGDEST LOGDEST NPROC MAKEFLAGS PACKAGER GNUPGHOME"
+ahriman ALL= NOPASSWD:NOSETENV: /usr/bin/ahriman-archbuild *

docker/01-docker.ini

@@ -0,0 +1,2 @@
+[web]
+host = $AHRIMAN_HOST

docker/Dockerfile

@@ -8,7 +8,7 @@ ARG BUILD_DATE
 RUN useradd -m -d "/home/build" -s "/usr/bin/nologin" build
 
 ## extract container creation date and set mirror for this timestamp, set PKGEXT and refresh database next
-RUN echo "Server = https://archive.archlinux.org/repos/${BUILD_DATE//-/\/}/\$repo/os/\$arch" > "/etc/pacman.d/mirrorlist" && \
+RUN echo "Server = https://archive.archlinux.org/repos/${BUILD_DATE//-//}/\$repo/os/\$arch" > "/etc/pacman.d/mirrorlist" && \
     pacman -Syyuu --noconfirm
 ## setup package cache
 RUN runuser -u build -- mkdir "/tmp/pkg" && \
@@ -80,7 +80,6 @@ FROM archlinux:base AS ahriman
 # image configuration
 ENV AHRIMAN_ARCHITECTURE="x86_64"
 ENV AHRIMAN_DEBUG=""
-ENV AHRIMAN_FORCE_ROOT=""
 ENV AHRIMAN_HOST="0.0.0.0"
 ENV AHRIMAN_MULTILIB="yes"
 ENV AHRIMAN_OUTPUT=""
@@ -91,7 +90,6 @@ ENV AHRIMAN_POSTSETUP_COMMAND=""
 ENV AHRIMAN_PRESETUP_COMMAND=""
 ENV AHRIMAN_REPOSITORY="aur"
 ENV AHRIMAN_REPOSITORY_SERVER=""
-ENV AHRIMAN_REPOSITORY_ROOT="/var/lib/ahriman/ahriman"
 ENV AHRIMAN_UNIX_SOCKET=""
 ENV AHRIMAN_USER="ahriman"
 ENV AHRIMAN_VALIDATE_CONFIGURATION="yes"
@@ -135,11 +133,15 @@ RUN find "/var/cache/pacman/pkg" "/var/lib/pacman/sync" -type "f,l" -delete && \
 VOLUME ["/var/lib/ahriman"]
 
 # minimal runtime ahriman setup
+RUN systemd-machine-id-setup
+COPY "docker/01-docker.ini" "/etc/ahriman.ini.d/01-docker.ini"
 ## FIXME since 1.0.4 devtools requires dbus to be run, which doesn't work now in container
 COPY "docker/systemd-nspawn.sh" "/usr/local/bin/systemd-nspawn"
 ## entrypoint setup
 COPY "docker/entrypoint.sh" "/usr/local/bin/entrypoint"
 COPY "docker/entrypoint-web.sh" "/usr/local/bin/entrypoint-web"
+
+USER ahriman
 ENTRYPOINT ["entrypoint"]
 # default command
 CMD ["repo-update", "--refresh"]

docker/entrypoint-web.sh

@@ -2,4 +2,9 @@
 # Special workaround for running web service in github actions, must not be usually used in real environment,
 # consider running web command explicitly instead
 
-exec entrypoint web "$@"
+if (( EUID == 0 )); then
+    chown ahriman:ahriman /var/lib/ahriman
+    exec sudo -E -u ahriman -- entrypoint web "$@"
+fi
+
+exec entrypoint web "$@"

docker/entrypoint.sh

@@ -3,30 +3,15 @@
 set -e
 [ -n "$AHRIMAN_DEBUG" ] && set -x
 
-# configuration tune
-cat <<EOF > "/etc/ahriman.ini.d/01-docker.ini"
-[repository]
-root = $AHRIMAN_REPOSITORY_ROOT
-
-[web]
-host = $AHRIMAN_HOST
-
-EOF
-
 AHRIMAN_DEFAULT_ARGS=("--architecture" "$AHRIMAN_ARCHITECTURE")
 AHRIMAN_DEFAULT_ARGS+=("--repository" "$AHRIMAN_REPOSITORY")
 if [ -n "$AHRIMAN_OUTPUT" ]; then
     AHRIMAN_DEFAULT_ARGS+=("--log-handler" "$AHRIMAN_OUTPUT")
 fi
 
-# create repository root inside the [[mounted]] directory and set correct ownership
-[ -d "$AHRIMAN_REPOSITORY_ROOT" ] || mkdir "$AHRIMAN_REPOSITORY_ROOT"
-chown "$AHRIMAN_USER":"$AHRIMAN_USER" "$AHRIMAN_REPOSITORY_ROOT"
-
 # create .gnupg directory which is required for keys
 AHRIMAN_GNUPG_HOME="$(getent passwd "$AHRIMAN_USER" | cut -d : -f 6)/.gnupg"
 [ -d "$AHRIMAN_GNUPG_HOME" ] || mkdir -m700 "$AHRIMAN_GNUPG_HOME"
-chown "$AHRIMAN_USER":"$AHRIMAN_USER" "$AHRIMAN_GNUPG_HOME"
 
 # run built-in setup command
 AHRIMAN_SETUP_ARGS=("--build-as-user" "$AHRIMAN_USER")
@@ -54,19 +39,7 @@ ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" service-setup "${AHRIMAN_SETUP_ARGS[@]}"
 # validate configuration if set
 [ -n "$AHRIMAN_VALIDATE_CONFIGURATION" ] && ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" service-config-validate --exit-code
 
-# create machine-id which is required by build tools
-systemd-machine-id-setup &> /dev/null
-
 # special workaround to emulate /bin/bash entrypoint if first argument starts with /
 [[ "$1" =~ ^/.* ]] && exec "$@"
 
-# if AHRIMAN_FORCE_ROOT is set or command is unsafe we can run without sudo
-# otherwise we prepend executable by sudo command
-if [ -n "$AHRIMAN_FORCE_ROOT" ]; then
-    AHRIMAN_EXECUTABLE=("ahriman")
-elif ahriman help-commands-unsafe -- "$@" &> /dev/null; then
-    AHRIMAN_EXECUTABLE=("sudo" "-E" "-u" "$AHRIMAN_USER" "--" "ahriman")
-else
-    AHRIMAN_EXECUTABLE=("ahriman")
-fi
-exec "${AHRIMAN_EXECUTABLE[@]}" "${AHRIMAN_DEFAULT_ARGS[@]}" "$@"
+exec ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" "$@"

docs/architecture.rst

@@ -116,7 +116,7 @@ Filesystem tree
 
 The application supports two types of trees, one is for the legacy configuration (when there were no explicit repository name configuration available) and another one is the new-style tree. This document describes only new-style tree in order to avoid deprecated structures.
 
-Having default root as ``/var/lib/ahriman`` (differs from container though), the directory structure is the following:
+Having default root as ``/var/lib/ahriman``, the directory structure is the following:
 
 .. code-block::
 

docs/configuration.rst

@@ -82,7 +82,7 @@ Base configuration settings.
 
 * ``apply_migrations`` - perform database migrations on the application start, boolean, optional, default ``yes``. Useful if you are using git version. Note, however, that this option must be changed only if you know what to do and going to handle migrations manually.
 * ``database`` - path to the application SQLite database, string, required.
-* ``include`` - path to directory with configuration files overrides, string, optional. Files will be read in alphabetical order.
+* ``include`` - path to directories with configuration files overrides, space separated list of strings, optional. Files will be read in alphabetical order.
 * ``logging`` - path to logging configuration, string, required. Check ``logging.ini`` for reference.
 
 ``alpm:*`` groups
@@ -131,12 +131,15 @@ Authorized users are stored inside internal database, if any of external provide
 Build related configuration. Group name can refer to architecture, e.g. ``build:x86_64`` can be used for x86_64 architecture specific settings.
 
 * ``archbuild_flags`` - additional flags passed to ``archbuild`` command, space separated list of strings, optional.
-* ``build_command`` - default build command, string, required.
+* ``devtools_configs`` - path to devtools configuration directory, string, required.
+* ``devtools_wrapper`` - path to devtools wrapper, space separated list of strings, required.
 * ``ignore_packages`` - list packages to ignore during a regular update (manual update will still work), space separated list of strings, optional.
 * ``include_debug_packages`` - distribute debug packages, boolean, optional, default ``yes``.
-* ``makepkg_flags`` - additional flags passed to ``makepkg`` command, space separated list of strings, optional.
+* ``make_flags`` - additional flags passed to ``make`` command via environment variable, space separated list of strings, optional.
 * ``makechrootpkg_flags`` - additional flags passed to ``makechrootpkg`` command, space separated list of strings, optional.
+* ``makepkg_flags`` - additional flags passed to ``makepkg`` command, space separated list of strings, optional.
 * ``min_age`` - minimal age in seconds since the latest AUR package modification before automatic updates are allowed, integer, optional, default ``0``.
+* ``packager`` - default packager identifier in form ``Name Surname <mail@example.com>``, string, optional.
 * ``scan_paths`` - paths to be used for implicit dependencies scan, space separated list of strings, optional. If any of those paths is matched against the path, it will be added to the allowed list.
 * ``triggers`` - list of ``ahriman.core.triggers.Trigger`` class implementation (e.g. ``ahriman.core.report.ReportTrigger ahriman.core.upload.UploadTrigger``) which will be loaded and run at the end of processing, space separated list of strings, optional. You can also specify triggers by their paths, e.g. ``/usr/lib/python3.10/site-packages/ahriman/core/report/report.py.ReportTrigger``. Triggers are run in the order of definition.
 * ``triggers_known`` - optional list of ``ahriman.core.triggers.Trigger`` class implementations which are not run automatically and used only for trigger discovery and configuration validation.

docs/faq/docker.rst

@@ -22,6 +22,12 @@ In order to make data available outside of container, you would need to mount lo
 
    docker run --privileged -v /path/to/local/repo:/var/lib/ahriman -v /path/to/overrides/overrides.ini:/etc/ahriman.ini.d/10-overrides.ini arcan1s/ahriman:latest
 
+The volume must have correct rights, e.g.:
+
+.. code-block:: shell
+
+   chown 643:643 /path/to/local/repo
+
 The action can be specified during run, e.g.:
 
 .. code-block:: shell
@@ -59,19 +65,17 @@ The following environment variables are supported:
 
 * ``AHRIMAN_ARCHITECTURE`` - architecture of the repository, default is ``x86_64``.
 * ``AHRIMAN_DEBUG`` - if set all commands will be logged to console.
-* ``AHRIMAN_FORCE_ROOT`` - force run ahriman as root instead of guessing by subcommand.
 * ``AHRIMAN_HOST`` - host for the web interface, default is ``0.0.0.0``.
 * ``AHRIMAN_MULTILIB`` - if set (default) multilib repository will be used, disabled otherwise.
 * ``AHRIMAN_OUTPUT`` - controls logging handler, e.g. ``syslog``, ``console``. The name must be found in logging configuration. Note that if ``syslog`` handler is used you will need to mount ``/dev/log`` inside container because it is not available there.
 * ``AHRIMAN_PACKAGER`` - packager name from which packages will be built, default is ``ahriman bot <ahriman@example.com>``.
 * ``AHRIMAN_PACMAN_MIRROR`` - override pacman mirror server if set.
 * ``AHRIMAN_PORT`` - HTTP server port if any, default is empty.
-* ``AHRIMAN_POSTSETUP_COMMAND`` - if set, the command which will be called (as root) after the setup command, but before any other actions.
-* ``AHRIMAN_PRESETUP_COMMAND`` - if set, the command which will be called (as root) right before the setup command.
+* ``AHRIMAN_POSTSETUP_COMMAND`` - if set, the command which will be called after the setup command, but before any other actions.
+* ``AHRIMAN_PRESETUP_COMMAND`` - if set, the command which will be called right before the setup command.
 * ``AHRIMAN_REPOSITORY`` - repository name, default is ``aur``.
 * ``AHRIMAN_REPOSITORY_SERVER`` - optional override for the repository URL. Useful if you would like to download packages from remote instead of local filesystem.
-* ``AHRIMAN_REPOSITORY_ROOT`` - repository root. Because of filesystem rights it is required to override default repository root. By default, it uses ``ahriman`` directory inside ahriman's home, which can be passed as mount volume.
-* ``AHRIMAN_UNIX_SOCKET`` - full path to unix socket which is used by web server, default is empty. Note that more likely you would like to put it inside ``AHRIMAN_REPOSITORY_ROOT`` directory (e.g. ``/var/lib/ahriman/ahriman/ahriman-web.sock``) or to ``/run/ahriman``.
+* ``AHRIMAN_UNIX_SOCKET`` - full path to unix socket which is used by web server, default is empty. Note that more likely you would like to put it inside repository root directory (e.g. ``/var/lib/ahriman/ahriman-web.sock``) or to ``/run/ahriman``.
 * ``AHRIMAN_USER`` - ahriman user, usually must not be overwritten, default is ``ahriman``.
 * ``AHRIMAN_VALIDATE_CONFIGURATION`` - if set (default) validate service configuration.
 
@@ -99,7 +103,7 @@ For that you would need to have web container instance running forever; it can b
 
 .. code-block:: shell
 
-   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 Note about ``AHRIMAN_PORT`` environment variable which is required in order to enable web service. An additional port bind by ``-p 8080:8080`` is required to pass docker port outside of container.
 
@@ -109,7 +113,7 @@ If you are using ``AHRIMAN_UNIX_SOCKET`` variable, for every next container run
 
 .. code-block:: shell
 
-   docker run --privileged -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 Otherwise, you would need to pass ``AHRIMAN_PORT`` and mount container network to the host system (``--net=host``), e.g.:
 
@@ -128,7 +132,7 @@ In order to create configuration for additional repositories, the ``AHRIMAN_POST
 
 .. code-block:: shell
 
-   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman/ahriman-web.sock -e AHRIMAN_POSTSETUP_COMMAND="ahriman --architecture x86_64 --repository aur-v2 service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'" -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
+   docker run --privileged -p 8080:8080 -e AHRIMAN_PORT=8080 -e AHRIMAN_UNIX_SOCKET=/var/lib/ahriman/ahriman-web.sock -e AHRIMAN_POSTSETUP_COMMAND="ahriman --architecture x86_64 --repository aur-v2 service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'" -v /path/to/local/repo:/var/lib/ahriman arcan1s/ahriman:latest
 
 The command above will also create configuration for the repository named ``aur-v2``.
 

docs/faq/non-x86_64-setup.rst

@@ -55,6 +55,13 @@ There are two possible ways to achieve same setup, by using docker container. Th
 
       FROM arcan1s/ahriman:latest
 
+#.
+   Switch to ``root`` user:
+
+   .. code-block:: dockerfile
+
+      USER root
+
 #.
    Init pacman keys. This command is required in order to populate distribution keys:
 
@@ -78,12 +85,16 @@ There are two possible ways to achieve same setup, by using docker container. Th
 
       FROM arcan1s/ahriman:latest
 
+      USER root
+
       RUN pacman-key --init
 
       RUN pacman --noconfirm -Sy wget
       RUN wget https://pool.mirror.archlinux32.org/i686/extra/devtools-20221208-1.2-any.pkg.tar.zst && pacman --noconfirm -U devtools-20221208-1.2-any.pkg.tar.zst
       RUN wget https://pool.mirror.archlinux32.org/i686/core/archlinux32-keyring-20230705-1.0-any.pkg.tar.zst && pacman --noconfirm -U archlinux32-keyring-20230705-1.0-any.pkg.tar.zst
 
+      USER ahriman
+
 #.
    After that you can build you own container, e.g.:
 

docs/migrations/2.22.0.rst

@@ -0,0 +1,54 @@
+To 2.22.0
+---------
+
+This release stores newly generated configuration files in the repository root and changes the docker image to run as the ``ahriman`` user. Existing system-wide configuration files remain supported, so regular installations do not require manual intervention. Docker installations require data migration.
+
+Regular installation
+^^^^^^^^^^^^^^^^^^^^
+
+Newly generated ahriman and devtools configuration files are stored below ``/var/lib/ahriman/.config/ahriman`` instead of system-wide configuration directories. Existing configurations continue to work without any changes.
+
+However, it is recommended to migrate to the new configuration schema by doing the following steps:
+
+#.
+   Stop all ahriman services.
+
+#.
+   Remove the old generated configuration files. For example, for repository ``aur`` and architecture ``x86_64``:
+
+   .. code-block:: shell
+
+      sudo rm /etc/ahriman.ini.d/00-setup-overrides-x86_64-aur.ini
+      sudo rm /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
+
+   Repeat this step for every configured repository. Do not remove manually maintained configuration overrides.
+
+#.
+   Run setup command (i.e. ``ahriman service-setup``) again with the same arguments as used before as the ``ahriman`` user.
+
+#.
+   Start the services again.
+
+Docker installation
+^^^^^^^^^^^^^^^^^^^
+
+The repository root inside the Docker image has changed from ``/var/lib/ahriman/ahriman`` to ``/var/lib/ahriman``. Existing repository contents must therefore be moved one directory level up, and the volume must be owned by the ``ahriman`` user.
+
+#.
+   Stop all containers using the repository volume and create a backup.
+
+#.
+   Run a one-off container which mounts the existing volume. Replace ``VOLUME`` with the named volume or bind mount used by the installation:
+
+   .. code-block:: shell
+
+      docker run --rm --user root --entrypoint bash \
+          --volume VOLUME:/var/lib/ahriman \
+          arcan1s/ahriman:latest \
+          -c 'find /var/lib/ahriman/ahriman -mindepth 1 -maxdepth 1 -exec mv -t /var/lib/ahriman -- {} + && rmdir /var/lib/ahriman/ahriman && chown ahriman:ahriman /var/lib/ahriman'
+
+#.
+   Update custom configuration and container arguments which refer to ``/var/lib/ahriman/ahriman``. The new path is ``/var/lib/ahriman``.
+
+#.
+   Start the containers again.

docs/migrations/index.rst

@@ -12,3 +12,4 @@ Upgrades to breakpoints
    2.9.0
    2.12.0
    2.16.0
+   2.22.0

docs/setup.rst

@@ -10,65 +10,32 @@ Initial setup
 
    .. code-block:: shell
 
-      sudo ahriman -a x86_64 -r aur service-setup ...
+      sudo -u ahriman -- ahriman -a x86_64 -r aur service-setup \
+          --packager "ahriman bot <ahriman@example.com>" ...
 
    .. admonition:: Details
       :collapsible: closed
 
-      ``service-setup`` literally does the following steps:
+      ``service-setup`` does the following steps:
 
       #.
-         Create ``/var/lib/ahriman/.makepkg.conf`` with ``makepkg.conf`` overrides if required (at least you might want to set ``PACKAGER``):
-
-         .. code-block:: shell
-
-            echo 'PACKAGER="ahriman bot <ahriman@example.com>"' | sudo -u ahriman tee -a /var/lib/ahriman/.makepkg.conf
+         Create a repository-specific ahriman configuration below
+         ``/var/lib/ahriman/.config/ahriman/ahriman.ini.d``. This configuration stores the
+         packager identity, ``MAKEFLAGS`` and other options supplied on the command line.
 
       #.
-         Configure build tools (it is required for correct dependency management system):
+         Generate the devtools pacman configuration in
+         ``/var/lib/ahriman/.config/ahriman/pacman.conf.d``. The file is based on the
+         configuration selected by ``--from-configuration`` and contains the requested mirror,
+         multilib settings and the ahriman repository path.
 
       #.
-         Create build command (you can choose any name for command, basically it should be ``{name}-{arch}-build``):
+         Create the repository directories, initialize the package repository and synchronize
+         its pacman database.
 
-         .. code-block:: shell
-
-            ln -s /usr/bin/archbuild /usr/local/bin/aur-x86_64-build
-
-      #. 
-         Create configuration file (same as previous ``{name}.conf``):
-
-         .. code-block:: shell
-
-            cp /usr/share/devtools/pacman.conf.d/{extra,aur}.conf
-
-      #. 
-         Change configuration file, add your own repository, add multilib repository etc:
-
-         .. code-block:: shell
-
-            echo '[multilib]' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-            echo 'Include = /etc/pacman.d/mirrorlist' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-
-            echo '[aur]' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-            echo 'SigLevel = Optional TrustAll' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-            echo 'Server = file:///var/lib/ahriman/repository/$repo/$arch' | tee -a /usr/share/devtools/pacman.conf.d/aur-x86_64.conf
-
-      #. 
-         Set ``build_command`` option to point to your command:
-
-         .. code-block:: shell
-
-            echo '[build]' | tee -a /etc/ahriman.ini.d/build.ini
-            echo 'build_command = aur-x86_64-build' | tee -a /etc/ahriman.ini.d/build.ini
-
-      #.
-         Configure ``/etc/sudoers.d/ahriman`` to allow running command without a password:
-
-         .. code-block:: shell
-
-            echo 'Cmnd_Alias CARCHBUILD_CMD = /usr/local/bin/aur-x86_64-build *' | tee -a /etc/sudoers.d/ahriman
-            echo 'ahriman ALL=(ALL) NOPASSWD:SETENV: CARCHBUILD_CMD' | tee -a /etc/sudoers.d/ahriman
-            chmod 400 /etc/sudoers.d/ahriman
+      Both configuration locations are below the repository root and must be writable by the
+      user running ahriman. Existing system-wide overrides remain supported; see
+      :doc:`the 2.22.0 migration guide <migrations/2.22.0>` when upgrading.
 
    This command supports several arguments, kindly refer to its help message.
 
@@ -77,14 +44,14 @@ Initial setup
 
    .. code-block:: shell
 
-       systemctl enable --now ahriman@x86_64-aur.timer
+       sudo systemctl enable --now ahriman@x86_64-aur.timer
 
 #. 
    Start and enable status page:
 
    .. code-block:: shell
 
-       systemctl enable --now ahriman-web
+       sudo systemctl enable --now ahriman-web
 
 #. 
    Add packages by using ``ahriman package-add {package}`` command:

frontend/package.json

@@ -2,9 +2,9 @@
     "dependencies": {
         "@emotion/react": ">=11.14.0 <11.15.0",
         "@emotion/styled": ">=11.14.0 <11.15.0",
-        "@mui/icons-material": ">=9.2.0 <9.3.0",
-        "@mui/material": ">=9.2.0 <9.3.0",
-        "@mui/x-data-grid": ">=9.10.0 <9.11.0",
+        "@mui/icons-material": ">=9.3.0 <9.4.0",
+        "@mui/material": ">=9.3.0 <9.4.0",
+        "@mui/x-data-grid": ">=9.11.0 <9.12.0",
         "@tanstack/react-query": ">=5.101.0 <5.102.0",
         "chart.js": ">=4.5.0 <4.6.0",
         "react": ">=19.2.0 <19.3.0",
@@ -26,8 +26,8 @@
         "eslint-plugin-react-refresh": ">=0.5.0 <0.6.0",
         "eslint-plugin-simple-import-sort": ">=14.0.0 <14.1.0",
         "typescript": ">=6.0.0 <6.1.0",
-        "typescript-eslint": ">=8.64.0 <8.65.0",
-        "vite": ">=8.1.0 <8.2.0"
+        "typescript-eslint": ">=8.67.0 <8.68.0",
+        "vite": ">=8.2.0 <8.3.0"
     },
     "name": "ahriman",
     "private": true,

frontend/vite.config.ts

@@ -19,7 +19,7 @@ export default defineConfig({
     build: {
         chunkSizeWarningLimit: 10000,
         emptyOutDir: false,
-        outDir: path.resolve(__dirname, "../ahriman-web/package/share/ahriman/templates"),
+        outDir: path.resolve(import.meta.dirname, "../ahriman-web/package/share/ahriman/templates"),
         rolldownOptions: {
             output: {
                 assetFileNames: "static/[name].[ext]",

recipes/check/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf
@@ -57,7 +80,7 @@ services:
       AHRIMAN_DEBUG: yes
       AHRIMAN_OUTPUT: console
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     volumes:
       - type: volume

recipes/daemon/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -12,8 +29,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     command: repo-daemon
 

recipes/distributed-manual/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/distributed/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf
@@ -62,7 +85,7 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
       AHRIMAN_REPOSITORY_SERVER: http://frontend/repo/$$repo/$$arch
 

recipes/i686/Dockerfile

@@ -2,8 +2,12 @@ FROM arcan1s/ahriman:edge
 
 ENV ARCH32_KEYRING_VERSION="20231126-1.0"
 
+USER root
+
 RUN pacman-key --init
 
 RUN pacman -Sy --noconfirm wget && \
     wget -nv https://pool.mirror.archlinux32.org/i686/core/archlinux32-keyring-${ARCH32_KEYRING_VERSION}-any.pkg.tar.zst && \
     pacman -U --noconfirm archlinux32-keyring-${ARCH32_KEYRING_VERSION}-any.pkg.tar.zst
+
+USER ahriman

recipes/i686/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: ahriman-i686
     build: .
@@ -12,9 +29,9 @@ services:
       AHRIMAN_PACMAN_MIRROR: https://de.mirror.archlinux32.org/$$arch/$$repo
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: makepkg
@@ -30,8 +47,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -45,6 +64,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/index/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -16,8 +33,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     command: repo-report
 

recipes/multirepo/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,10 +25,10 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_PRESETUP_COMMAND: ahriman --architecture x86_64 --repository another-demo service-setup --build-as-user ahriman --packager 'ahriman bot <ahriman@example.com>'
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -23,8 +40,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -38,6 +57,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/oauth/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -9,9 +26,9 @@ services:
       AHRIMAN_OAUTH_CLIENT_SECRET: ${AHRIMAN_OAUTH_CLIENT_SECRET}
       AHRIMAN_OUTPUT: console
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: sudo -u ahriman ahriman user-add ${AHRIMAN_OAUTH_USER} -R full -p ""
+      AHRIMAN_POSTSETUP_COMMAND: ahriman user-add ${AHRIMAN_OAUTH_USER} -R full -p ""
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -21,8 +38,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -36,6 +55,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/pam/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -10,7 +27,7 @@ services:
       AHRIMAN_PORT: 8080
       AHRIMAN_PRESETUP_COMMAND: useradd -d / -G wheel -M demo; (cat /run/secrets/password; echo; cat /run/secrets/password) | passwd demo
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

recipes/pull/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -16,8 +33,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
   frontend:
     image: nginx

recipes/sign/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -6,7 +23,7 @@ services:
     environment:
       AHRIMAN_DEBUG: yes
       AHRIMAN_OUTPUT: console
-      AHRIMAN_POSTSETUP_COMMAND: sudo -u ahriman gpg --import /run/secrets/key
+      AHRIMAN_POSTSETUP_COMMAND: gpg --import /run/secrets/key
       AHRIMAN_REPOSITORY: ahriman-demo
 
     configs:
@@ -19,8 +36,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     command: repo-daemon
 

recipes/web/compose.yml

@@ -1,4 +1,21 @@
 services:
+  volume-init:
+    image: arcan1s/ahriman:edge
+    user: root
+
+    entrypoint: [
+      "chown",
+    ]
+    command: [
+      "ahriman:ahriman",
+      "/var/lib/ahriman",
+    ]
+
+    volumes:
+      - type: volume
+        source: repository
+        target: /var/lib/ahriman
+
   backend:
     image: arcan1s/ahriman:edge
     privileged: true
@@ -8,9 +25,9 @@ services:
       AHRIMAN_OUTPUT: console
       AHRIMAN_PASSWORD: ${AHRIMAN_PASSWORD}
       AHRIMAN_PORT: 8080
-      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | sudo -u ahriman ahriman user-add demo -R full
+      AHRIMAN_POSTSETUP_COMMAND: (cat /run/secrets/password; echo; cat /run/secrets/password) | ahriman user-add demo -R full
       AHRIMAN_REPOSITORY: ahriman-demo
-      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman/ahriman.sock
+      AHRIMAN_UNIX_SOCKET: /var/lib/ahriman/ahriman.sock
 
     configs:
       - source: service
@@ -22,8 +39,10 @@ services:
       - type: volume
         source: repository
         target: /var/lib/ahriman
-        volume:
-          nocopy: true
+
+    depends_on:
+      volume-init:
+        condition: service_completed_successfully
 
     healthcheck:
       test: curl --fail --silent --output /dev/null http://backend:8080/api/v1/info
@@ -37,6 +56,10 @@ services:
     ports:
       - 8080:80
 
+    depends_on:
+      backend:
+        condition: service_healthy
+
     configs:
       - source: nginx
         target: /etc/nginx/conf.d/default.conf

tests/testresources/core/ahriman.ini

@@ -23,7 +23,8 @@ allow_read_only = no
 
 [build]
 archbuild_flags =
-build_command = extra-x86_64-build
+devtools_configs = .
+devtools_wrapper = ahriman-archbuild
 ignore_packages =
 makechrootpkg_flags =
 makepkg_flags = --skippgpcheck

tools/pylint_plugins/import_order/__init__.py

@@ -93,6 +93,21 @@ class ImportOrder(BaseRawFileChecker):
         )
     )
 
+    @staticmethod
+    def import_context(statement: nodes.Import | nodes.ImportFrom) -> tuple[nodes.NodeNG, str]:
+        """
+        extract the lexical block containing an import
+
+        Args:
+            statement(nodes.Import | nodes.ImportFrom): import node
+
+        Returns:
+            tuple[nodes.NodeNG, str]: parent node and its branch containing the import
+        """
+        parent = statement.parent
+        field, _ = parent.locate_child(statement)
+        return parent, field
+
     @staticmethod
     def imports(source: Iterable[Any], start_lineno: int = 0) -> Iterable[nodes.Import | nodes.ImportFrom]:
         """
@@ -192,7 +207,12 @@ class ImportOrder(BaseRawFileChecker):
             node(nodes.Module): module node to check
         """
         root_module, *_ = node.qname().split(".")
-        self.check_imports(self.imports(node.values()), root_module)
+        contexts: dict[tuple[nodes.NodeNG, str], list[nodes.Import | nodes.ImportFrom]] = {}
+        for statement in self.imports(node.values()):
+            contexts.setdefault(self.import_context(statement), []).append(statement)
+
+        for imports in contexts.values():
+            self.check_imports(imports, root_module)
 
 
 def register(linter: PyLinter) -> None:

tools/pytest_plugins/ahriman_fixtures/__init__.py

@@ -117,36 +117,12 @@ def get_package_status_extended(package: Package) -> dict[str, Any]:
     return {"status": BuildStatus().view(), "package": package.view()}
 
 
-def import_error(package: str, components: list[str], mocker: MockerFixture) -> MagicMock:
-    """
-    mock import error
-
-    Args:
-        package(str): package name to import
-        components(list[str]): component to import if any (e.g. from ... import ...)
-        mocker(MockerFixture): mocker object
-
-    Returns:
-        MagicMock: mocked object
-    """
-    import builtins
-    _import = builtins.__import__
-
-    # pylint: disable=redefined-builtin
-    def test_import(name: str, globals: Any, locals: Any, from_list: list[str], level: Any):
-        if name == package and (not components or any(component in from_list for component in components)):
-            raise ImportError
-        return _import(name, globals, locals, from_list, level)
-
-    return mocker.patch.object(builtins, "__import__", test_import)
-
-
 @pytest.hookimpl(trylast=True)
 def pytest_configure() -> None:
     """
     register helpers after pytest-helpers-namespace has initialized
     """
-    for helper in (anyvar, get_package_status, get_package_status_extended, import_error):
+    for helper in (anyvar, get_package_status, get_package_status_extended):
         pytest.helpers.register(helper)
 
 

tox.toml

@@ -2,7 +2,6 @@ env_list = [
     "check",
     "tests",
 ]
-isolated_build = true
 requires = [
     "tox-uv",
 ]
@@ -33,6 +32,17 @@ bandit = [
     "--configfile",
     ".bandit.toml",
 ]
+coverage_report = [
+    "--show-missing",
+    "--skip-covered",
+    "--fail-under=100",
+]
+coverage_run = [
+    "--source",
+    "ahriman",
+    "-m",
+    "pytest",
+]
 manpage = [
     "--author",
     "{[project]name} team",
@@ -110,6 +120,7 @@ dependency_groups = [
 ]
 deps = [
     { replace = "ref", of = ["project", "extras"], extend = true },
+    "pip",
 ]
 pip_pre = true
 set_env.CFLAGS = "-Wno-unterminated-string-initialization"
@@ -255,6 +266,7 @@ description = "Build frontend HTML and JS"
 allowlist_externals = [
     "npm",
 ]
+skip_install = true
 commands = [
     { replace = "ref", of = ["commands", "npm_install"], extend = true },
     [
@@ -274,15 +286,12 @@ deps = [
     { replace = "ref", of = ["project", "extras"], extend = true },
 ]
 pip_pre = true
-recreate = true
 commands = [
     [
         "sphinx-build",
         "--builder",
         "html",
         "--fail-on-warning",
-        "--jobs",
-        "1",
         "--write-all",
         "docs",
         "{envtmpdir}/html",
@@ -352,10 +361,7 @@ commands = [
     [
         "coverage",
         "run",
-        "--source",
-        "ahriman",
-        "-m",
-        "pytest",
+        { replace = "ref", of = ["flags", "coverage_run"], extend = true },
         { replace = "posargs", default = [
             "tests/test_tests.py",
             "ahriman-core/tests",
@@ -366,9 +372,7 @@ commands = [
     [
         "coverage",
         "report",
-        "--show-missing",
-        "--skip-covered",
-        "--fail-under=100",
+        { replace = "ref", of = ["flags", "coverage_report"], extend = true },
     ],
 ]