Signed-off-by: Andrew Lee (李健秋) <ajqlee@debian.org>

We wish to use only the Apertis CI pipeline workflow to build source
packages from Apertis GitLab and then submit them to OBS.

For packages where Apertis is the upstream the simplest approach is to
set them up as native packages to avoid having to generate orig tarballs
and manage changes on top of them.

Signed-off-by: Andrew Lee (李健秋) <andrew.lee@collabora.co.uk>

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Newer hotdoc (0.10) introduced several breaking changes which cause the
documentation to be misbuilt, so let's explicitly depend on the old version.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

dh_apparmor setup debian package to reload AppArmor profiles on package
installation.

Fixes: https://phabricator.apertis.org/T5294



Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>

Signed-off-by: Simon McVittie <smcv@collabora.com>

Snapshots from build-snapshot have UNRELEASED in their changelogs,
so they are exempt from this check. The symbols file should be updated
while releasing the package.

Very similar to D3832.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6838

Debian Policy §8 requires packaging shared libraries like this.

In addition, move the libnewportiface.so symlink (the implementation
of -lnewportiface) to the -dev package: it is not needed at runtime.

Because libnewportiface0 and newport-dev both contain files that were
previously in the newport package, they need Breaks and Replaces on
older newport packages.

Signed-off-by: Simon McVittie <smcv@collabora.com>
Differential Revision: https://phabricator.apertis.org/D6837

Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6836

These are not strictly redundant because they apply to all object
paths, but we only expect legitimate clients of Newport to communicate
with the exported object paths below /org/apertis/Newport, so we no
longer need these rules.

Apertis: https://phabricator.apertis.org/T3995


Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6835

Ideally, we would want to allow arbitrary processes to be Newport's
client (meaning Newport can receive their method calls, and send
signals that they will receive), but not let Newport be a client of
arbitrary services (which would open up privilege escalation via
services like systemd --user if Newport gets compromised). However,
this isn't currently possible, because AppArmor D-Bus mediation
doesn't know about message types.

The closest we can currently get to this is to match by object path,
allowing Newport to receive method calls and emit signals on the
object paths that in practice only Newport will use.

We also allow unconfined tests and developer processes to call
arbitrary methods on us: they are unconfined, so they could call
those methods anyway by temporarily transitioning to a profile that
is already allowed to talk to us. This automatically allows one
requested reply per method call, without needing an explicit rule
in the AppArmor profile. However, we make this one asymmetric, so
that we don't allow Newport to send messages (in particular method
calls) to unconfined processes (in particular systemd --user).

We previously avoided looking at the message payload because we wanted
to avoid access controls that would not have been possible under kdbus,
but the kdbus project appears to be dead, and it isn't clear that its
symmetrical access-control model (A can talk to B iff B can talk to A)
was particularly realistic in practice due to issues like the ones we
have here.

Apertis: https://phabricator.apertis.org/T3995


Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6834

Newport is just a client on the system bus, not a service, so it
only needs to be allowed to communicate with connmand.

This partially reverts 6e26b93f "apparmor: stop using -strict
abstractions" (D5300), which was a broader than necessary response
to an automated test not being able to ping Newport on the
session bus.

Apertis: https://phabricator.apertis.org/T3995


Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6833

Now that T3988 has enabled Journal logging for everything that
includes <abstractions/base>, we don't need to enable it individually
everywhere.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6832

The majority of the chaiwala-base abstraction is designed for
graphical programs (or agents from app-bundles), and not really
suitable or necessary for platform services.

Apertis: https://phabricator.apertis.org/T3999


Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6831

* Libraries move to multiarch directories
* Installed-tests do not move because we already override --libexecdir
* autoreconf is run automatically and no longer needs a dependency

Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6830

dh_systemd isn't used unless we use either "dh $@ --with systemd" or
debhelper compat level 10, which we don't. It's also mainly useful for
system services, but Newport is a session service.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6829

We need to bump the version number to do this transition correctly,
so introduce a dummy changelog entry for that purpose.

Apertis: https://phabricator.apertis.org/T3142


Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6828

Signed-off-by: Simon McVittie <smcv@collabora.com>

Differential Revision: https://phabricator.apertis.org/D6827

Newport should also be able to download in the proxy
configured system also.

Reviewed-by: Frédéric Dalleau <frederic.dalleau@collabora.com>
Signed-off-by: Rohan Madgula <Rohan.Madgula@in.bosch.com>
Differential Revision: https://phabricator.apertis.org/D6341

Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Signed-off-by: Justin Kim <justin.kim@collabora.com>
Differential Revision: https://phabricator.apertis.org/D6825

Madgula Rohan authored 8 years ago and Simon McVittie committed 7 years ago

[smcv: Adjust commit message]

Signed-off-by: Rohan Madgula <Rohan.Madgula@in.bosch.com>
Reviewed-by: Simon McVittie <smcv@collabora.com>
Signed-off-by: Simon McVittie <smcv@collabora.com>
Differential Revision: https://phabricator.apertis.org/D6531

Madgula Rohan authored 8 years ago and Simon McVittie committed 7 years ago

Instead of relying on third party servers, host a local
server to handle downloads.

Apertis: https://phabricator.apertis.org/T2832


[smcv: Use soup_uri_new_with_base()]

Signed-off-by: Rohan Madgula <Rohan.Madgula@in.bosch.com>
Reviewed-by: Simon McVittie <smcv@collabora.com>
Signed-off-by: Simon McVittie <smcv@collabora.com>
Differential Revision: https://phabricator.apertis.org/D6489

Signed-off-by: Simon McVittie <smcv@collabora.com>

This was a combined development package for what are now
canterbury-gdbus-0 and canterbury-0, of which Newport currently only
uses the stable SDK-API in canterbury-0.

Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Emanuele Aina <emanuele.aina@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D6589

When Newport is launched by Canterbury on SDK images, this seems to be
what it gets. Allow both ways.

Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Emanuele Aina <emanuele.aina@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D6221

As newport is on demand service, No need to start it
explicitly using GTestDbus.

Apertis: https://phabricator.apertis.org/T3833



Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Signed-off-by: Rohan Madgula <Rohan.Madgula@in.bosch.com>
Differential Revision: https://phabricator.apertis.org/D6472

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>
Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D6122

It is used for compiling gschemas after install

Signed-off-by: Frédéric Dalleau <frederic.dalleau@collabora.com>
Reviewed-by: Sjoerd Simons <sjoerd.simons@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D6121

Fix typo while making the test names prettier and less redundant.

Signed-off-by: Emanuele Aina <emanuele.aina@collabora.com>
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D5868

Looks like the upstream version was still using an old version scheme.

Signed-off-by: Guillaume Desmottes <guillaume.desmottes@collabora.co.uk>

Differential Revision: https://phabricator.apertis.org/D5306

It's preventing apertis-tests/dbus/check-dbus-services to ping the
services (T3122).

Signed-off-by: Guillaume Desmottes <guillaume.desmottes@collabora.co.uk>
Reviewed-by: André Magalhães <andre.magalhaes@collabora.co.uk>
Differential Revision: https://phabricator.apertis.org/D5300

Needed so Newport can be D-Bus activated.

Signed-off-by: Guillaume Desmottes <guillaume.desmottes@collabora.co.uk>
Apertis: https://phabricator.apertis.org/T3091