vanagon 0.39.0 → 0.39.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ac97aec522601e6c06e6b246356b9fd2eef1a94d1548b501424224d4d51522c
-  data.tar.gz: 557d3080596d55cc84819bd59b5d30d566c66d3620cc3687ea8bb889c8f50118
+  metadata.gz: 0bbab09cfcd3f8a91841bb070ac6fbdd57b37ba5833e4992f3c2251df12c825a
+  data.tar.gz: 1a14dea7853f5e623ae1d8fbccf35f63d5fb63c2ab6b9c013ce50bc37a2ba791
 SHA512:
-  metadata.gz: 007b36851f55746bd042d54f1b4aa6ab2557b18f81f0d759730554080153b7cdbda44d8a16476f36f63556f906631eaca1bfa8de066c9c7b0bf4cc8da543e4e4
-  data.tar.gz: fe4fa81aeb5246f3892cee17cea50b9545fce5f8dda33f491f7b92ad6f58c624e09540d3476353b2eeef58518fd730e310288140bdf03181b8d7c3137e8d6f3b
+  metadata.gz: f167828ef7a0012965b349b670fa4c3b3712bdb6065ae0ced63acca1ec8b909b850ada729cf4151271c62781f4576e088b8f5289de12e94f3748c64f311fdb4a
+  data.tar.gz: 4ab66f44f2b4fabd72ab2fa42c00bd4f3756b4dc9681c1ba05d2715fdacf82092327f297986f3fe872cdf3e306195d1fa3ee66b1ba9e2c8cf575e61b8b5386ae

data/lib/vanagon/component/source/git.rb

@@ -60,6 +60,7 @@ class Vanagon
           # VANAGON-227 We need to be careful when guessing whether a https://github.com/...
           # URL is actually a true git repo. Make some rules around it based on the github API.
           # Decide that anything with a documented media_type is just an http url.
+          # We do this instead of talking to GitHub directly to avoid rate limiting.
           # See:
           # https://docs.github.com/en/repositories/working-with-files/using-files/downloading-source-code-archives
           # https://docs.github.com/en/rest/repos/contents?apiVersion=2022-11-28#download-a-repository-archive-tar
@@ -68,17 +69,13 @@ class Vanagon
             url_directory = url.to_s.delete_prefix(github_url_prefix)
             url_components = url_directory.split('/')
 
-            return :github_remote if url_directory.end_with?('.git')
-
             # Find cases of supported github media types.
             # [ owner, repo, media_type, ref ]
-            case url_components[2]
-            when 'archive'
-              :github_archive
-            when 'tarball'
-              :github_tarball
-            when 'zipball'
-              :github_zipball
+            path_types = ['archive', 'releases', 'tarball', 'zipball']
+            if path_types.include?(url_components[2]) ||
+               url_components[-1].end_with?('.tar.gz') ||
+               url_components[-1].end_with?('.zip')
+              :github_media
             else
               :github_remote
             end

data/lib/vanagon/component/source/http.rb

@@ -22,20 +22,19 @@ class Vanagon
             return false unless ['http', 'https'].include? uri.scheme
 
             Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https') do |http|
-              http.request(Net::HTTP::Head.new(uri)) do |response|
-                case response
-                when Net::HTTPRedirection
-                  # By parsing the location header, we get either an absolute
-                  # URI or a URI with a relative `path`. Adding it to `uri`
-                  # should correctly update the relative `path` or overwrite
-                  # the entire URI if it's absolute.
-                  location = URI.parse(response.header['location'])
-                  valid_url?(uri + location)
-                when Net::HTTPSuccess
-                  return true
-                else
-                  false
-                end
+              response = http.request(Net::HTTP::Head.new(uri))
+              case response
+              when Net::HTTPRedirection
+                # By parsing the location header, we get either an absolute
+                # URI or a URI with a relative `path`. Adding it to `uri`
+                # should correctly update the relative `path` or overwrite
+                # the entire URI if it's absolute.
+                location = URI.parse(response.header['location'])
+                valid_url?(uri + location)
+              when Net::HTTPSuccess
+                true
+              else
+                false
               end
             end
           end

data/lib/vanagon/component/source.rb

@@ -3,8 +3,11 @@ require 'vanagon/logger'
 require 'vanagon/component/source/http'
 require 'vanagon/component/source/git'
 require 'vanagon/component/source/local'
+require 'vanagon/errors'
 
 class Vanagon
+  class InvalidSource < Vanagon::Error
+  end
   class Component
     class Source
       SUPPORTED_PROTOCOLS = %w[file http https git].freeze
@@ -55,8 +58,8 @@ class Vanagon
           end
 
           # Unknown source type!
-          raise Vanagon::Error,
-            "Unknown file type: '#{uri}'; cannot continue"
+          raise Vanagon::InvalidSource,
+            "Source is invalid or of an unknown type: '#{uri}'; cannot continue"
         end
 
         def determine_source_type(uri)

data/lib/vanagon/component.rb

@@ -260,14 +260,21 @@ class Vanagon
           VanagonLogger.info %(Attempting to fetch from mirror URL "#{mirror}")
           @source = Vanagon::Component::Source.source(mirror, **options)
           return true if source.fetch
+        rescue Vanagon::InvalidSource
+          # This means that the URL was not a git repo or a valid downloadable file,
+          # which means either the URL is incorrect, or we don't have access to that
+          # resource. Return false, so that the pkg.url value can be used instead.
+          VanagonLogger.error %(Invalid source "#{mirror}")
         rescue SocketError
           # SocketError means that there was no DNS/name resolution
           # for whatever remote protocol the mirror tried to use.
           VanagonLogger.error %(Unable to resolve mirror URL "#{mirror}")
-        rescue RuntimeError
+        rescue StandardError
           # Source retrieval does not consistently return a meaningful
           # namespaced error message, which means we're brute-force rescuing
-          # RuntimeError. Not a good look, and we should fix this.
+          # StandardError. Also, we want to handle other unexpected things when
+          # we try reaching out to the URL, so that we can gracefully return
+          # false and fall back to fetching the pkg.url value instead.
           VanagonLogger.error %(Unable to retrieve mirror URL "#{mirror}")
         end
       end

data/spec/lib/vanagon/component/source/git_spec.rb

@@ -15,12 +15,27 @@ describe "Vanagon::Component::Source::Git" do
     let(:github_archive_uri) do
       'https://github.com/2ndQuadrant/pglogical/archive/a_file_name.tar.gz'
     end
+    let(:github_releases_uri) do
+      'https://github.com/libffi/libffi/releases/download/v3.4.3/libffi-3.4.3.tar.gz'
+    end
     let(:github_tarball_uri) do
       'https://github.com/Baeldung/kotlin-tutorials/tarball/main'
     end
     let(:github_zipball_uri) do
       'https://github.com/Baeldung/kotlin-tutorials/zipball/master'
     end
+    let(:github_actual_tarball_uri) do
+      'https://github.com/puppetlabs/puppet/archive/refs/tags/8.2.0.tar.gz'
+    end
+    let(:github_actual_tarball_with_unexpected_path_uri) do
+      'https://github.com/puppetlabs/puppet/something/refs/tags/8.2.0.tar.gz'
+    end
+    let(:github_actual_zipball_uri) do
+      'https://github.com/puppetlabs/puppet/archive/refs/tags/8.2.0.zip'
+    end
+    let(:github_actual_zipball_with_unexpected_path_uri) do
+      'https://github.com/puppetlabs/puppet/something/refs/tags/8.2.0.zip'
+    end
     let(:github_repo_uri) do
       'https://github.com/cameronmcnz/rock-paper-scissors'
     end
@@ -32,14 +47,34 @@ describe "Vanagon::Component::Source::Git" do
       expect(Vanagon::Component::Source::Git.valid_remote?(github_archive_uri)).to be false
     end
 
+    it "flags github releases uris as not valid repos" do
+      expect(Vanagon::Component::Source::Git.valid_remote?(github_releases_uri)).to be false
+    end
+
     it "flags github tarball uris as not valid repos" do
       expect(Vanagon::Component::Source::Git.valid_remote?(github_tarball_uri)).to be false
     end
 
+    it "flags github actual tarball uris as not valid repos" do
+      expect(Vanagon::Component::Source::Git.valid_remote?(github_actual_tarball_uri)).to be false
+    end
+
+    it "flags github actual tarball uris with an unexpected path as not valid repos" do
+      expect(Vanagon::Component::Source::Git.valid_remote?(github_actual_tarball_with_unexpected_path_uri)).to be false
+    end
+
     it "flags git zipball uris as not valid repos" do
       expect(Vanagon::Component::Source::Git.valid_remote?(github_zipball_uri)).to be false
     end
 
+    it "flags github actual tarball uris as not valid repos" do
+      expect(Vanagon::Component::Source::Git.valid_remote?(github_actual_zipball_uri)).to be false
+    end
+
+    it "flags github actual tarball uris with an unexpected path as not valid repos" do
+      expect(Vanagon::Component::Source::Git.valid_remote?(github_actual_zipball_with_unexpected_path_uri)).to be false
+    end
+
     it "identifies git generic uris as valid repos" do
       expect(Vanagon::Component::Source::Git.valid_remote?(github_repo_uri)).to be true
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vanagon
 version: !ruby/object:Gem::Version
-  version: 0.39.0
+  version: 0.39.2
 platform: ruby
 authors:
 - Puppet By Perforce
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-08 00:00:00.000000000 Z
+date: 2023-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: docopt