Merge lp:~mardy/ubuntuone-credentials/lp1376445-migration into lp:ubuntuone-credentials/rtm-14.09

[David Barth]

Upgrades the ACL of U1 accounts registered in the Online Accounts database.
Add dependencies on sqlite3 and account-plugin-tools for migration script.

This branch upgrades the ACL of u1 accounts registered in the Online Accounts database. This avoids the bug where older accounts are removed by the u1 code to force their re-creation.

This is an old merge proposal, but I feel this would solve the problem in a more consistent way for users upgrading from old to newer releases.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:163
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-ci/6/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-14.09-armhf-ci/3
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-14.09-armhf-ci/3/artifact/work/output/*zip*/output.zip

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-rtm-14.09-ci/6/rebuild

review: Approve (continuous-integration)

[dobey (dobey)]

This will break multi-arch support in the packages, as this "script" is a compiled binary and not actually an architecture-independent script.

From dh_migrations man page:

       debian/package.migrations
           List the files and migration scripts to install into each package.
           The format is a set of lines, where each line lists a script file
           to install into into usr/share/session-migration/scripts in the
           package build directory.

           The name of the files (or directories) to install should be given
           relative to the current directory.

I'm also not confident that this will even work. If I understand how the ACL works, this program won't work, as it will be running unconfined, and unconfined will not yet be in the ACL. So when it tries to access the identity info, the request will be denied, meaning it won't be able to add anything to the ACL. And if this does actually work when the program is not in the ACL, and signon-apparmor-extension is installed, would it not be better to just integrate this into the normal code flow, rather than as an external migration script?

review: Disapprove

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:165
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-ci/7/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-14.09-armhf-ci/4
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-14.09-armhf-ci/4/artifact/work/output/*zip*/output.zip

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-rtm-14.09-ci/7/rebuild

review: Approve (continuous-integration)

[dobey (dobey)]

Please add dependencies on sqlite3 and account-plugin-tools to the libubuntuoneauth-2.0-0 package in debian/control.

Also, please submit an MP with these same changes to trunk, so we can land this in Vivid as well.

review: Needs Fixing

[dobey (dobey)]

review: Approve

[dobey (dobey)]

review: Needs Fixing

[dobey (dobey)]

replaced by https://code.launchpad.net/~dbarth/ubuntuone-credentials/acl-updater-script/+merge/252346

review: Disapprove

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:167
http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-ci/8/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-14.09-armhf-ci/5
        deb: http://jenkins.qa.ubuntu.com/job/ubuntuone-credentials-rtm-14.09-14.09-armhf-ci/5/artifact/work/output/*zip*/output.zip

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntuone-credentials-rtm-14.09-ci/8/rebuild

review: Approve (continuous-integration)

Unmerged revisions

=== added directory 'acl-updater'
=== added file 'acl-updater/acl-updater'
--- acl-updater/acl-updater	1970-01-01 00:00:00 +0000
+++ acl-updater/acl-updater	2015-03-09 15:09:06 +0000
@@ -0,0 +1,29 @@
+#!/bin/sh
+#
+
+export LC_ALL=C
+SIGNON_DB="$HOME/.config/signond/signon.db"
+
+ACCOUNT_ID=`account-console list | grep -i ubuntuone | grep -o '[0-9]\+'`
+if [ -z $ACCOUNT_ID ]; then
+	echo "no U1 account found; exiting"
+	exit 1
+fi
+CREDS_ID=`account-console show $ACCOUNT_ID | grep CredentialsId | grep -o '[0-9]\+'`
+if [ -z $CREDS_ID ]; then
+	echo "no U1 account found; exiting"
+	exit 1
+fi
+
+echo "Upgrading ACL for U1 account (id:$CREDS_ID)"
+
+# ensure the 'unconfined' element exists in the table
+UNCONFINED=`sqlite3 $SIGNON_DB 'select id from TOKENS where token="unconfined"'`
+if [ -z $UNCONFINED ]; then
+	sqlite3 $SIGNON_DB 'insert or ignore into TOKENS(token) values ("unconfined")'
+fi
+
+# add the ACL to protect the U1 account
+sqlite3 $SIGNON_DB "insert or ignore into ACL (identity_id, token_id) values ($CREDS_ID, (select id from TOKENS where token='unconfined'))"
+
+echo "done"

=== modified file 'debian/control'
--- debian/control	2014-08-20 14:33:41 +0000
+++ debian/control	2015-03-09 15:09:06 +0000
@@ -4,6 +4,7 @@
 Build-Depends:
  cmake,
  debhelper (>= 9),
+ dh-migrations,
  libaccounts-qt5-dev,
  liboauth-dev,
  libsignon-qt5-dev,
@@ -70,7 +71,9 @@
  multiarch-support,
  ${misc:Pre-Depends},
 Depends:
+ account-plugin-tools,
  signon-plugin-password,
+ sqlite3,
  ubuntuone-credentials-common (= ${source:Version}),
  ${misc:Depends},
  ${shlibs:Depends},

=== added file 'debian/libubuntuoneauth-2.0-0.migrations'
--- debian/libubuntuoneauth-2.0-0.migrations	1970-01-01 00:00:00 +0000
+++ debian/libubuntuoneauth-2.0-0.migrations	2015-03-09 15:09:06 +0000
@@ -0,0 +1,1 @@
+obj-*/acl-updater/acl-updater

=== modified file 'debian/rules'
--- debian/rules	2014-07-24 14:12:32 +0000
+++ debian/rules	2015-03-09 15:09:06 +0000
@@ -7,7 +7,7 @@
 
 
 %:
-	dh $@ --buildsystem cmake --fail-missing
+	dh $@ --buildsystem cmake --fail-missing --with migrations
 
 override_dh_auto_configure:
 	dh_auto_configure -- -DLIB_SUFFIX=/$(DEB_HOST_MULTIARCH)