qvm_template.py 57 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469
  1. #
  2. # The Qubes OS Project, https://www.qubes-os.org/
  3. #
  4. # Copyright (C) 2019 WillyPillow <wp@nerde.pw>
  5. #
  6. # This program is free software; you can redistribute it and/or modify
  7. # it under the terms of the GNU Lesser General Public License as published by
  8. # the Free Software Foundation; either version 2.1 of the License, or
  9. # (at your option) any later version.
  10. #
  11. # This program is distributed in the hope that it will be useful,
  12. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. # GNU Lesser General Public License for more details.
  15. #
  16. # You should have received a copy of the GNU Lesser General Public License along
  17. # with this program; if not, write to the Free Software Foundation, Inc.,
  18. # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19. '''Tool for managing VM templates.'''
  20. import argparse
  21. import collections
  22. import datetime
  23. import enum
  24. import fcntl
  25. import fnmatch
  26. import functools
  27. import itertools
  28. import json
  29. import operator
  30. import os
  31. import re
  32. import shutil
  33. import subprocess
  34. import sys
  35. import tempfile
  36. import time
  37. import typing
  38. import tqdm
  39. import xdg.BaseDirectory
  40. import rpm
  41. import qubesadmin
  42. import qubesadmin.tools
  43. import qubesadmin.tools.qvm_kill
  44. import qubesadmin.tools.qvm_remove
  45. PATH_PREFIX = '/var/lib/qubes/vm-templates'
  46. TEMP_DIR = '/var/tmp'
  47. PACKAGE_NAME_PREFIX = 'qubes-template-'
  48. CACHE_DIR = os.path.join(xdg.BaseDirectory.xdg_cache_home, 'qvm-template')
  49. UNVERIFIED_SUFFIX = '.unverified'
  50. LOCK_FILE = '/var/tmp/qvm-template.lck'
  51. DATE_FMT = '%Y-%m-%d %H:%M:%S'
  52. UPDATEVM = str('global UpdateVM')
  53. class AlreadyRunning(Exception):
  54. """Another qvm-template is already running"""
  55. class SignatureVerificationError(Exception):
  56. """Package signature is invalid or missing"""
  57. def qubes_release() -> str:
  58. """Return the Qubes release."""
  59. if os.path.exists('/usr/share/qubes/marker-vm'):
  60. with open('/usr/share/qubes/marker-vm', 'r') as fd:
  61. # Get last line (in the format `x.x`)
  62. return fd.readlines()[-1].strip()
  63. with open('/etc/os-release', 'r') as fd:
  64. for line in fd:
  65. line = line.strip()
  66. if not line or line[0] == '#':
  67. continue
  68. key, val = line.split('=', 1)
  69. if key != 'VERSION_ID':
  70. continue
  71. val = val.strip('\'"') # strip possible quotes
  72. return val
  73. # Return default value instead of throwing so that it works on CI
  74. return '4.1'
  75. def get_parser() -> argparse.ArgumentParser:
  76. """Generate argument parser for the application."""
  77. formatter = argparse.ArgumentDefaultsHelpFormatter
  78. parser_main = argparse.ArgumentParser(description='Qubes Template Manager',
  79. formatter_class=formatter)
  80. subparsers = parser_main.add_subparsers(dest='operation',
  81. description='Command to run.')
  82. def parser_add_command(cmd, help_str):
  83. return subparsers.add_parser(
  84. cmd,
  85. formatter_class=formatter,
  86. help=help_str,
  87. description=help_str)
  88. parser_main.add_argument('--repo-files', action='append',
  89. default=['/etc/qubes/repo-templates/qubes-templates.repo'],
  90. help=('Specify files containing DNF repository configuration.'
  91. ' Can be used more than once.'))
  92. parser_main.add_argument('--keyring',
  93. default='/etc/qubes/repo-templates/keys',
  94. help='Specify directory containing RPM public keys.')
  95. parser_main.add_argument('--updatevm', default=UPDATEVM,
  96. help=('Specify VM to download updates from.'
  97. ' (Set to empty string to specify the current VM.)'))
  98. parser_main.add_argument('--enablerepo', action='append', default=[],
  99. metavar='REPOID',
  100. help=('Enable additional repositories by an id or a glob.'
  101. ' Can be used more than once.'))
  102. parser_main.add_argument('--disablerepo', action='append', default=[],
  103. metavar='REPOID',
  104. help=('Disable certain repositories by an id or a glob.'
  105. ' Can be used more than once.'))
  106. parser_main.add_argument('--repoid', action='append', default=[],
  107. help=('Enable just specific repositories by an id or a glob.'
  108. ' Can be used more than once.'))
  109. parser_main.add_argument('--releasever', default=qubes_release(),
  110. help='Override Qubes release version.')
  111. parser_main.add_argument('--refresh', action='store_true',
  112. help='Set repository metadata as expired before running the command.')
  113. parser_main.add_argument('--cachedir', default=CACHE_DIR,
  114. help='Specify cache directory.')
  115. parser_main.add_argument('--keep-cache', default=False,
  116. help='Keep downloaded packages in cache dir')
  117. parser_main.add_argument('--yes', action='store_true',
  118. help='Assume "yes" to questions.')
  119. parser_main.add_argument('--quiet', action='store_true',
  120. help='Decrease verbosity.')
  121. # qvm-template {install,reinstall,downgrade,upgrade}
  122. parser_install = parser_add_command('install',
  123. help_str='Install template packages.')
  124. parser_install.add_argument('--pool',
  125. help='Specify storage pool to store created templates in.')
  126. parser_reinstall = parser_add_command('reinstall',
  127. help_str='Reinstall template packages.')
  128. parser_downgrade = parser_add_command('downgrade',
  129. help_str='Downgrade template packages.')
  130. parser_upgrade = parser_add_command('upgrade',
  131. help_str='Upgrade template packages.')
  132. for parser_x in [parser_install, parser_reinstall,
  133. parser_downgrade, parser_upgrade]:
  134. parser_x.add_argument('--nogpgcheck', action='store_true',
  135. help='Disable signature checks.')
  136. parser_x.add_argument('--allow-pv', action='store_true',
  137. help='Allow templates that set virt_mode to pv.')
  138. parser_x.add_argument('templates', nargs='*', metavar='TEMPLATESPEC')
  139. # qvm-template download
  140. parser_download = parser_add_command('download',
  141. help_str='Download template packages.')
  142. for parser_x in [parser_install, parser_reinstall,
  143. parser_downgrade, parser_upgrade, parser_download]:
  144. parser_x.add_argument('--downloaddir', default='.',
  145. help='Specify download directory.')
  146. parser_x.add_argument('--retries', default=5, type=int,
  147. help='Specify maximum number of retries for downloads.')
  148. parser_download.add_argument('templates', nargs='*',
  149. metavar='TEMPLATESPEC')
  150. # qvm-template {list,info}
  151. parser_list = parser_add_command('list',
  152. help_str='List templates.')
  153. parser_info = parser_add_command('info',
  154. help_str='Display details about templates.')
  155. for parser_x in [parser_list, parser_info]:
  156. parser_x.add_argument('--all', action='store_true',
  157. help='Show all templates (default).')
  158. parser_x.add_argument('--installed', action='store_true',
  159. help='Show installed templates.')
  160. parser_x.add_argument('--available', action='store_true',
  161. help='Show available templates.')
  162. parser_x.add_argument('--extras', action='store_true',
  163. help=('Show extras (e.g., ones that exist'
  164. ' locally but not in repos) templates.'))
  165. parser_x.add_argument('--upgrades', action='store_true',
  166. help='Show available upgrades.')
  167. readable = parser_x.add_mutually_exclusive_group()
  168. readable.add_argument('--machine-readable', action='store_true',
  169. help='Enable machine-readable output.')
  170. readable.add_argument('--machine-readable-json', action='store_true',
  171. help='Enable machine-readable output (JSON).')
  172. parser_x.add_argument('templates', nargs='*', metavar='TEMPLATESPEC')
  173. # qvm-template search
  174. parser_search = parser_add_command('search',
  175. help_str='Search template details for the given string.')
  176. parser_search.add_argument('--all', action='store_true',
  177. help=('Search also in the template description and URL. In addition,'
  178. ' the criterion are evaluated with OR instead of AND.'))
  179. parser_search.add_argument('templates', nargs='*', metavar='PATTERN')
  180. # qvm-template remove
  181. parser_remove = parser_add_command('remove',
  182. help_str='Remove installed templates.')
  183. parser_remove.add_argument('--disassoc', action='store_true',
  184. help=('Also disassociate VMs from the templates to be removed.'
  185. ' This creates a dummy template for the VMs to link with.'))
  186. parser_remove.add_argument('templates', nargs='*', metavar='TEMPLATE')
  187. # qvm-template purge
  188. parser_purge = parser_add_command('purge',
  189. help_str='Remove installed templates and associated VMs.')
  190. parser_purge.add_argument('templates', nargs='*', metavar='TEMPLATE')
  191. # qvm-template clean
  192. parser_clean = parser_add_command('clean',
  193. help_str='Remove locally cached packages.')
  194. _ = parser_clean # unused
  195. # qvm-template repolist
  196. parser_repolist = parser_add_command('repolist',
  197. help_str='Show configured repositories.')
  198. repolim = parser_repolist.add_mutually_exclusive_group()
  199. repolim.add_argument('--all', action='store_true',
  200. help='Show all repos.')
  201. repolim.add_argument('--enabled', action='store_true',
  202. help='Show only enabled repos (default).')
  203. repolim.add_argument('--disabled', action='store_true',
  204. help='Show only disabled repos.')
  205. parser_repolist.add_argument('repos', nargs='*', metavar='REPOS')
  206. return parser_main
  207. parser = get_parser()
  208. class TemplateState(enum.Enum):
  209. """Enum representing the state of a template."""
  210. INSTALLED = 'installed'
  211. AVAILABLE = 'available'
  212. EXTRA = 'extra'
  213. UPGRADABLE = 'upgradable'
  214. def title(self) -> str:
  215. """Return a long description of the state. Can be used as headings."""
  216. #pylint: disable=invalid-name
  217. TEMPLATE_TITLES = {
  218. TemplateState.INSTALLED: 'Installed Templates',
  219. TemplateState.AVAILABLE: 'Available Templates',
  220. TemplateState.EXTRA: 'Extra Templates',
  221. TemplateState.UPGRADABLE: 'Available Upgrades'
  222. }
  223. return TEMPLATE_TITLES[self]
  224. class VersionSelector(enum.Enum):
  225. """Enum representing how the candidate template version is chosen."""
  226. LATEST = enum.auto()
  227. """Install latest version."""
  228. REINSTALL = enum.auto()
  229. """Reinstall current version."""
  230. LATEST_LOWER = enum.auto()
  231. """Downgrade to the highest version that is lower than the current one."""
  232. LATEST_HIGHER = enum.auto()
  233. """Upgrade to the highest version that is higher than the current one."""
  234. class Template(typing.NamedTuple):
  235. """Details of a template."""
  236. name: str
  237. epoch: str
  238. version: str
  239. release: str
  240. reponame: str
  241. dlsize: int
  242. buildtime: datetime.datetime
  243. licence: str
  244. url: str
  245. summary: str
  246. description: str
  247. class DlEntry(typing.NamedTuple):
  248. """Information about a template to be downloaded."""
  249. evr: typing.Tuple[str, str, str]
  250. reponame: str
  251. dlsize: int
  252. def build_version_str(evr: typing.Tuple[str, str, str]) -> str:
  253. """Return version string described by ``evr``, which is in (epoch, version,
  254. release) format."""
  255. return '%s:%s-%s' % evr
  256. def is_match_spec(name: str, epoch: str, version: str, release: str, spec: str
  257. ) -> typing.Tuple[bool, float]:
  258. """Check whether (name, epoch, version, release) matches the spec string.
  259. For the algorithm, refer to section "NEVRA Matching" in the DNF
  260. documentation.
  261. Note that currently ``arch`` is ignored as the templates should be of
  262. ``noarch``.
  263. :return: A tuple. The first element indicates whether there is a match; the
  264. second element represents the priority of the match (lower is better)
  265. """
  266. if epoch != '0':
  267. targets = [
  268. f'{name}-{epoch}:{version}-{release}',
  269. f'{name}',
  270. f'{name}-{epoch}:{version}'
  271. ]
  272. else:
  273. targets = [
  274. f'{name}-{epoch}:{version}-{release}',
  275. f'{name}-{version}-{release}',
  276. f'{name}',
  277. f'{name}-{epoch}:{version}',
  278. f'{name}-{version}'
  279. ]
  280. for prio, target in enumerate(targets):
  281. if fnmatch.fnmatch(target, spec):
  282. return True, prio
  283. return False, float('inf')
  284. def query_local(vm: qubesadmin.vm.QubesVM) -> Template:
  285. """Return Template object associated with ``vm``.
  286. Requires the VM to be managed by qvm-template.
  287. """
  288. return Template(
  289. vm.features['template-name'],
  290. vm.features['template-epoch'],
  291. vm.features['template-version'],
  292. vm.features['template-release'],
  293. vm.features['template-reponame'],
  294. vm.get_disk_utilization(),
  295. datetime.datetime.strptime(vm.features['template-buildtime'], DATE_FMT),
  296. vm.features['template-license'],
  297. vm.features['template-url'],
  298. vm.features['template-summary'],
  299. vm.features['template-description'].replace('|', '\n'))
  300. def query_local_evr(vm: qubesadmin.vm.QubesVM) -> typing.Tuple[str, str, str]:
  301. """Return the (epoch, version, release) of ``vm``.
  302. Requires the VM to be managed by qvm-template.
  303. """
  304. return (
  305. vm.features['template-epoch'],
  306. vm.features['template-version'],
  307. vm.features['template-release'])
  308. def is_managed_template(vm: qubesadmin.vm.QubesVM) -> bool:
  309. """Return whether the VM is managed by qvm-template."""
  310. return vm.features.get('template-name', None) == vm.name
  311. def get_managed_template_vm(app: qubesadmin.app.QubesBase, name: str
  312. ) -> qubesadmin.vm.QubesVM:
  313. """Return the QubesVM object associated with the given name if it exists
  314. and is managed by qvm-template, otherwise raise a parser error."""
  315. if name not in app.domains:
  316. parser.error("Template '%s' not already installed." % name)
  317. vm = app.domains[name]
  318. if not is_managed_template(vm):
  319. parser.error("Template '%s' is not managed by qvm-template." % name)
  320. return vm
  321. def confirm_action(msg: str, affected: typing.List[str]) -> None:
  322. """Confirm user action."""
  323. print(msg)
  324. for name in affected:
  325. print(' ' + name)
  326. confirm = ''
  327. while confirm != 'y':
  328. confirm = input('Are you sure? [y/N] ').lower()
  329. if confirm == 'n':
  330. print('Operation cancelled.')
  331. sys.exit(1)
  332. def qrexec_popen(
  333. args: argparse.Namespace,
  334. app: qubesadmin.app.QubesBase,
  335. service: str,
  336. stdout: typing.Union[int, typing.IO] = subprocess.PIPE,
  337. filter_esc: bool = True) -> subprocess.Popen:
  338. """Return ``Popen`` object that communicates with the given qrexec call in
  339. ``args.updatevm``.
  340. Note that this falls back to invoking ``/etc/qubes-rpc/*`` directly if
  341. ``args.updatevm`` is empty string.
  342. :param args: Arguments received by the application. ``args.updatevm`` is
  343. used
  344. :param app: Qubes application object
  345. :param service: The qrexec call to invoke
  346. :param stdout: Where the process stdout points to. This is passed directly
  347. to ``subprocess.Popen``. Defaults to ``subprocess.PIPE``
  348. Note that stderr is always set to ``subprocess.PIPE``
  349. :param filter_esc: Whether to filter out escape sequences from
  350. stdout/stderr. Defaults to True
  351. :returns: ``Popen`` object that communicates with the given qrexec call
  352. """
  353. if args.updatevm:
  354. return app.domains[args.updatevm].run_service(
  355. service,
  356. filter_esc=filter_esc,
  357. stdout=stdout)
  358. return subprocess.Popen([
  359. '/etc/qubes-rpc/%s' % service,
  360. ],
  361. stdin=subprocess.PIPE,
  362. stdout=stdout,
  363. stderr=subprocess.PIPE)
  364. def qrexec_payload(args: argparse.Namespace, app: qubesadmin.app.QubesBase,
  365. spec: str, refresh: bool) -> str:
  366. """Return payload string for the ``qubes.Template*`` qrexec calls.
  367. :param args: Arguments received by the application. Specifically,
  368. ``args.{enablerepo,disablerepo,repoid,releasever,repo_files}`` are used
  369. :param app: Qubes application object
  370. :param spec: Package spec to query (refer to ``<package-name-spec>`` in the
  371. DNF documentation)
  372. :param refresh: Whether to force refresh repo metadata
  373. :return: Payload string
  374. :raises: Parser error if spec equals ``---`` or input contains ``\\n``
  375. """
  376. _ = app # unused
  377. if spec == '---':
  378. parser.error("Malformed template name: argument should not be '---'.")
  379. def check_newline(string, name):
  380. if '\n' in string:
  381. parser.error(f"Malformed {name}:" +
  382. " argument should not contain '\\n'.")
  383. payload = ''
  384. for repo in args.enablerepo:
  385. check_newline(repo, '--enablerepo')
  386. payload += '--enablerepo=%s\n' % repo
  387. for repo in args.disablerepo:
  388. check_newline(repo, '--disablerepo')
  389. payload += '--disablerepo=%s\n' % repo
  390. for repo in args.repoid:
  391. check_newline(repo, '--repoid')
  392. payload += '--repoid=%s\n' % repo
  393. if refresh:
  394. payload += '--refresh\n'
  395. check_newline(args.releasever, '--releasever')
  396. payload += '--releasever=%s\n' % args.releasever
  397. check_newline(spec, 'template name')
  398. payload += spec + '\n'
  399. payload += '---\n'
  400. for path in args.repo_files:
  401. with open(path, 'r') as fd:
  402. payload += fd.read() + '\n'
  403. return payload
  404. def qrexec_repoquery(
  405. args: argparse.Namespace,
  406. app: qubesadmin.app.QubesBase,
  407. spec: str = '*',
  408. refresh: bool = False) -> typing.List[Template]:
  409. """Query template information from repositories.
  410. :param args: Arguments received by the application. Specifically,
  411. ``args.{enablerepo,disablerepo,repoid,releasever,repo_files,updatevm}``
  412. are used
  413. :param app: Qubes application object
  414. :param spec: Package spec to query (refer to ``<package-name-spec>`` in the
  415. DNF documentation). Defaults to ``*``
  416. :param refresh: Whether to force refresh repo metadata. Defaults to False
  417. :raises ConnectionError: if the qrexec call fails
  418. :return: List of ``Template`` objects representing the result of the query
  419. """
  420. payload = qrexec_payload(args, app, spec, refresh)
  421. proc = qrexec_popen(args, app, 'qubes.TemplateSearch')
  422. stdout, stderr = proc.communicate(payload.encode('UTF-8'))
  423. stdout = stdout.decode('ASCII')
  424. if proc.wait() != 0:
  425. for line in stderr.decode('ASCII').rstrip().split('\n'):
  426. print('[Qrexec] %s' % line, file=sys.stderr)
  427. raise ConnectionError("qrexec call 'qubes.TemplateSearch' failed.")
  428. name_re = re.compile(r'^[A-Za-z0-9._+-]*$')
  429. evr_re = re.compile(r'^[A-Za-z0-9._+~]*$')
  430. date_re = re.compile(r'^\d+-\d+-\d+ \d+:\d+$')
  431. licence_re = re.compile(r'^[A-Za-z0-9._+()-]*$')
  432. result = []
  433. # FIXME: This breaks when \n is the first character of the description
  434. for line in stdout.split('|\n'):
  435. # Note that there's an empty entry at the end as .strip() is not used.
  436. # This is because if .strip() is used, the .split() will not work.
  437. if line == '':
  438. continue
  439. entry = line.split('|')
  440. try:
  441. # If there is an incorrect number of entries, raise an error
  442. # Unpack manually instead of stuffing into `Template` right away
  443. # so that it's easier to mutate stuff.
  444. name, epoch, version, release, reponame, dlsize, \
  445. buildtime, licence, url, summary, description = entry
  446. # Ignore packages that are not templates
  447. if not name.startswith(PACKAGE_NAME_PREFIX):
  448. continue
  449. name = name[len(PACKAGE_NAME_PREFIX):]
  450. # Check that the values make sense
  451. if not re.fullmatch(name_re, name):
  452. raise ValueError
  453. for val in [epoch, version, release]:
  454. if not re.fullmatch(evr_re, val):
  455. raise ValueError
  456. if not re.fullmatch(name_re, reponame):
  457. raise ValueError
  458. dlsize = int(dlsize)
  459. # First verify that the date does not look weird, then parse it
  460. if not re.fullmatch(date_re, buildtime):
  461. raise ValueError
  462. buildtime = datetime.datetime.strptime(buildtime, '%Y-%m-%d %H:%M')
  463. # XXX: Perhaps whitelist licenses directly?
  464. if not re.fullmatch(licence_re, licence):
  465. raise ValueError
  466. # Check name actually matches spec
  467. if not is_match_spec(PACKAGE_NAME_PREFIX + name,
  468. epoch, version, release, spec)[0]:
  469. continue
  470. result.append(Template(name, epoch, version, release, reponame,
  471. dlsize, buildtime, licence, url, summary, description))
  472. except (TypeError, ValueError):
  473. raise ConnectionError(("qrexec call 'qubes.TemplateSearch' failed:"
  474. " unexpected data format."))
  475. return result
  476. def qrexec_download(
  477. args: argparse.Namespace,
  478. app: qubesadmin.app.QubesBase,
  479. spec: str,
  480. path: str,
  481. dlsize: typing.Optional[int] = None,
  482. refresh: bool = False) -> None:
  483. """Download a template from repositories.
  484. :param args: Arguments received by the application. Specifically,
  485. ``args.{enablerepo,disablerepo,repoid,releasever,repo_files,updatevm,
  486. quiet}`` are used
  487. :param app: Qubes application object
  488. :param spec: Package spec to query (refer to ``<package-name-spec>`` in the
  489. DNF documentation)
  490. :param path: Path to place the downloaded template
  491. :param dlsize: Size of template to be downloaded. Used for the progress
  492. bar. Optional
  493. :param refresh: Whether to force refresh repo metadata. Defaults to False
  494. :raises ConnectionError: if the qrexec call fails
  495. """
  496. with open(path, 'wb') as fd:
  497. payload = qrexec_payload(args, app, spec, refresh)
  498. # Don't filter ESCs for binary files
  499. proc = qrexec_popen(args, app, 'qubes.TemplateDownload',
  500. stdout=fd, filter_esc=False)
  501. proc.stdin.write(payload.encode('UTF-8'))
  502. proc.stdin.close()
  503. with tqdm.tqdm(desc=spec, total=dlsize, unit_scale=True,
  504. unit_divisor=1000, unit='B', disable=args.quiet) as pbar:
  505. last = 0
  506. while proc.poll() is None:
  507. cur = fd.tell()
  508. pbar.update(cur - last)
  509. last = cur
  510. time.sleep(0.1)
  511. if proc.wait() != 0:
  512. raise ConnectionError(
  513. "qrexec call 'qubes.TemplateDownload' failed.")
  514. def get_keys(key_dir: str) -> typing.List[str]:
  515. """List gpg keys"""
  516. keys = []
  517. for name in os.listdir(key_dir):
  518. path = os.path.join(key_dir, name)
  519. if os.path.isfile(path):
  520. keys.append(path)
  521. return keys
  522. def verify_rpm(
  523. path: str,
  524. keys: typing.List[str],
  525. nogpgcheck: bool = False
  526. ) -> rpm.hdr:
  527. """Verify the digest and signature of a RPM package and return the package
  528. header.
  529. Note that verifying RPMs this way is prone to TOCTOU. This is okay for
  530. local files, but may create problems if multiple instances of
  531. **qvm-template** are downloading the same file, so a lock is needed in that
  532. case.
  533. :param path: Location of the RPM package
  534. :param nogpgcheck: Whether to allow invalid GPG signatures
  535. :return: RPM package header. If verification fails, raises an exception.
  536. """
  537. if not nogpgcheck:
  538. with tempfile.TemporaryDirectory() as rpmdb_dir:
  539. for key in keys:
  540. subprocess.check_call(
  541. ['rpmkeys', '--dbpath=' + rpmdb_dir, '--import', key])
  542. try:
  543. output = subprocess.check_output(
  544. ['rpmkeys', '--dbpath=' + rpmdb_dir, '--checksig', path])
  545. except subprocess.CalledProcessError as e:
  546. raise SignatureVerificationError(
  547. 'Signature verification failed: {}'.format(
  548. e.output.decode()))
  549. if not output.endswith(b': digests signatures OK\n'):
  550. raise SignatureVerificationError(
  551. 'Signature verification failed: {}'.format(output.decode()))
  552. with open(path, 'rb') as fd:
  553. tset = rpm.TransactionSet()
  554. tset.setVSFlags(rpm.RPMVSF_MASK_NOSIGNATURES)
  555. hdr = tset.hdrFromFdno(fd)
  556. return hdr
  557. def extract_rpm(name: str, path: str, target: str) -> bool:
  558. """Extract a template RPM package.
  559. :param name: Name of the template
  560. :param path: Location of the RPM package
  561. :param target: Target path to extract to
  562. :return: Whether the extraction succeeded
  563. """
  564. rpm2cpio = subprocess.Popen(['rpm2cpio', path], stdout=subprocess.PIPE)
  565. # `-D` is GNUism
  566. cpio = subprocess.Popen([
  567. 'cpio',
  568. '-idm',
  569. '-D',
  570. target,
  571. '.%s/%s/*' % (PATH_PREFIX, name)
  572. ], stdin=rpm2cpio.stdout, stdout=subprocess.DEVNULL)
  573. return rpm2cpio.wait() == 0 and cpio.wait() == 0
  574. def get_dl_list(
  575. args: argparse.Namespace,
  576. app: qubesadmin.app.QubesBase,
  577. version_selector: VersionSelector = VersionSelector.LATEST
  578. ) -> typing.Dict[str, DlEntry]:
  579. """Return list of templates that needs to be downloaded.
  580. :param args: Arguments received by the application.
  581. :param app: Qubes application object
  582. :param version_selector: Specify algorithm to select the candidate version
  583. of a package. Defaults to ``VersionSelector.LATEST``
  584. :return: Dictionary that maps to ``DlEntry`` the names of templates that
  585. needs to be downloaded
  586. """
  587. full_candid: typing.Dict[str, DlEntry] = {}
  588. for template in args.templates:
  589. # This will be merged into `full_candid` later.
  590. # It is separated so that we can check whether it is empty.
  591. candid: typing.Dict[str, DlEntry] = {}
  592. # Skip local RPMs
  593. if template.endswith('.rpm'):
  594. continue
  595. query_res = qrexec_repoquery(args, app, PACKAGE_NAME_PREFIX + template)
  596. # We only select one package for each distinct package name
  597. for entry in query_res:
  598. ver = (entry.epoch, entry.version, entry.release)
  599. insert = False
  600. if version_selector == VersionSelector.LATEST:
  601. if entry.name not in candid \
  602. or rpm.labelCompare(candid[entry.name][0], ver) < 0:
  603. insert = True
  604. elif version_selector == VersionSelector.REINSTALL:
  605. vm = get_managed_template_vm(app, entry.name)
  606. cur_ver = query_local_evr(vm)
  607. if rpm.labelCompare(ver, cur_ver) == 0:
  608. insert = True
  609. elif version_selector in [VersionSelector.LATEST_LOWER,
  610. VersionSelector.LATEST_HIGHER]:
  611. vm = get_managed_template_vm(app, entry.name)
  612. cur_ver = query_local_evr(vm)
  613. cmp_res = -1 \
  614. if version_selector == VersionSelector.LATEST_LOWER \
  615. else 1
  616. if rpm.labelCompare(ver, cur_ver) == cmp_res:
  617. if entry.name not in candid \
  618. or rpm.labelCompare(candid[entry.name][0], ver) < 0:
  619. insert = True
  620. if insert:
  621. candid[entry.name] = DlEntry(ver, entry.reponame, entry.dlsize)
  622. # XXX: As it's possible to include version information in `template`,
  623. # perhaps the messages can be improved
  624. if len(candid) == 0:
  625. if version_selector == VersionSelector.LATEST:
  626. parser.error('Template \'%s\' not found.' % template)
  627. elif version_selector == VersionSelector.REINSTALL:
  628. parser.error('Same version of template \'%s\' not found.' \
  629. % template)
  630. # Copy behavior of DNF and do nothing if version not found
  631. elif version_selector == VersionSelector.LATEST_LOWER:
  632. print(("Template '%s' of lowest version"
  633. " already installed, skipping..." % template),
  634. file=sys.stderr)
  635. elif version_selector == VersionSelector.LATEST_HIGHER:
  636. print(("Template '%s' of highest version"
  637. " already installed, skipping..." % template),
  638. file=sys.stderr)
  639. # Merge & choose the template with the highest version
  640. for name, dlentry in candid.items():
  641. if name not in full_candid \
  642. or rpm.labelCompare(full_candid[name].evr, dlentry.evr) < 0:
  643. full_candid[name] = dlentry
  644. return full_candid
  645. def download(
  646. args: argparse.Namespace,
  647. app: qubesadmin.app.QubesBase,
  648. path_override: typing.Optional[str] = None,
  649. dl_list: typing.Optional[typing.Dict[str, DlEntry]] = None,
  650. suffix: str = '',
  651. version_selector: VersionSelector = VersionSelector.LATEST) -> None:
  652. """Command that downloads template packages.
  653. :param args: Arguments received by the application.
  654. :param app: Qubes application object
  655. :param path_override: Override path to store downloads. If not set or set
  656. to None, ``args.downloaddir`` is used. Optional
  657. :param dl_list: Override list of templates to download. If not set or set
  658. to None, ``get_dl_list`` is called, which generates the list from
  659. ``args``. Optional
  660. :param suffix: Suffix to add to the file name of downloaded packages. This
  661. is useful if you want to distinguish between verified and unverified
  662. packages. Defaults to an empty string
  663. :param version_selector: Specify algorithm to select the candidate version
  664. of a package. Defaults to ``VersionSelector.LATEST``
  665. """
  666. if dl_list is None:
  667. dl_list = get_dl_list(args, app, version_selector=version_selector)
  668. path = path_override if path_override is not None else args.downloaddir
  669. for name, entry in dl_list.items():
  670. version_str = build_version_str(entry.evr)
  671. spec = PACKAGE_NAME_PREFIX + name + '-' + version_str
  672. target = os.path.join(path, '%s.rpm' % spec)
  673. target_suffix = target + suffix
  674. if os.path.exists(target_suffix):
  675. print('\'%s\' already exists, skipping...' % target,
  676. file=sys.stderr)
  677. elif os.path.exists(target):
  678. print('\'%s\' already exists, skipping...' % target,
  679. file=sys.stderr)
  680. os.rename(target, target_suffix)
  681. else:
  682. print('Downloading \'%s\'...' % spec, file=sys.stderr)
  683. done = False
  684. for attempt in range(args.retries):
  685. try:
  686. qrexec_download(args, app, spec, target_suffix,
  687. entry.dlsize)
  688. done = True
  689. break
  690. except ConnectionError:
  691. os.remove(target_suffix)
  692. if attempt + 1 < args.retries:
  693. print('\'%s\' download failed, retrying...' % spec,
  694. file=sys.stderr)
  695. except:
  696. # Also remove file if interrupted by other means
  697. os.remove(target_suffix)
  698. raise
  699. if not done:
  700. print('Error: \'%s\' download failed.' % spec, file=sys.stderr)
  701. sys.exit(1)
  702. def locked(func):
  703. """Execute given function under a lock in *LOCK_FILE*"""
  704. @functools.wraps(func)
  705. def wrapper(*args, **kwargs):
  706. with open(LOCK_FILE, 'w') as lock:
  707. try:
  708. fcntl.flock(lock.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
  709. except OSError:
  710. raise AlreadyRunning(
  711. ('cannot get lock on %s. '
  712. 'Perhaps another instance of qvm-template is running?')
  713. % LOCK_FILE)
  714. try:
  715. return func(*args, **kwargs)
  716. finally:
  717. os.remove(LOCK_FILE)
  718. return wrapper
  719. @locked
  720. def install(
  721. args: argparse.Namespace,
  722. app: qubesadmin.app.QubesBase,
  723. version_selector: VersionSelector = VersionSelector.LATEST,
  724. override_existing: bool = False) -> None:
  725. """Command that installs template packages.
  726. This command creates a lock file to ensure that two instances are not
  727. running at the same time.
  728. :param args: Arguments received by the application.
  729. :param app: Qubes application object
  730. :param version_selector: Specify algorithm to select the candidate version
  731. of a package. Defaults to ``VersionSelector.LATEST``
  732. :param override_existing: Whether to override existing packages. Used for
  733. reinstall, upgrade, and downgrade operations
  734. """
  735. keys = get_keys(args.keyring)
  736. unverified_rpm_list = [] # rpmfile, reponame
  737. verified_rpm_list = []
  738. def verify(rpmfile, reponame, dl_dir=None):
  739. """Verify package signature and version, remove "unverified"
  740. suffix, and parse package header."""
  741. if dl_dir:
  742. path = os.path.join(
  743. dl_dir, os.path.basename(rpmfile) + UNVERIFIED_SUFFIX)
  744. else:
  745. path = rpmfile
  746. package_hdr = verify_rpm(path, keys, args.nogpgcheck)
  747. if not package_hdr:
  748. parser.error('Package \'%s\' verification failed.' % rpmfile)
  749. package_name = package_hdr[rpm.RPMTAG_NAME]
  750. if not package_name.startswith(PACKAGE_NAME_PREFIX):
  751. parser.error(
  752. 'Illegal package name for package \'%s\'.' % rpmfile)
  753. # Remove prefix to get the real template name
  754. name = package_name[len(PACKAGE_NAME_PREFIX):]
  755. if path != rpmfile:
  756. os.rename(path, rpmfile)
  757. # Check if already installed
  758. if not override_existing and name in app.domains:
  759. print(('Template \'%s\' already installed, skipping...'
  760. ' (You may want to use the'
  761. ' {reinstall,upgrade,downgrade}'
  762. ' operations.)') % name, file=sys.stderr)
  763. return
  764. # Check if version is really what we want
  765. if override_existing:
  766. vm = get_managed_template_vm(app, name)
  767. pkg_evr = (
  768. str(package_hdr[rpm.RPMTAG_EPOCHNUM]),
  769. package_hdr[rpm.RPMTAG_VERSION],
  770. package_hdr[rpm.RPMTAG_RELEASE])
  771. vm_evr = query_local_evr(vm)
  772. cmp_res = rpm.labelCompare(pkg_evr, vm_evr)
  773. if version_selector == VersionSelector.REINSTALL \
  774. and cmp_res != 0:
  775. parser.error(
  776. 'Same version of template \'%s\' not found.' \
  777. % name)
  778. elif version_selector == VersionSelector.LATEST_LOWER \
  779. and cmp_res != -1:
  780. print(("Template '%s' of lower version"
  781. " already installed, skipping..." % name),
  782. file=sys.stderr)
  783. return
  784. elif version_selector == VersionSelector.LATEST_HIGHER \
  785. and cmp_res != 1:
  786. print(("Template '%s' of higher version"
  787. " already installed, skipping..." % name),
  788. file=sys.stderr)
  789. return
  790. verified_rpm_list.append((rpmfile, reponame, name, package_hdr))
  791. # Process local templates
  792. for template in args.templates:
  793. if template.endswith('.rpm'):
  794. if not os.path.exists(template):
  795. parser.error('RPM file \'%s\' not found.' % template)
  796. unverified_rpm_list.append((template, '@commandline'))
  797. # First verify local RPMs and extract header
  798. for rpmfile, reponame in unverified_rpm_list:
  799. verify(rpmfile, reponame)
  800. unverified_rpm_list = []
  801. os.makedirs(args.cachedir, exist_ok=True)
  802. # Get list of templates to download
  803. dl_list = get_dl_list(args, app, version_selector=version_selector)
  804. dl_list_copy = dl_list.copy()
  805. for name, entry in dl_list.items():
  806. # Should be ensured by checks in repoquery
  807. assert entry.reponame != '@commandline'
  808. # Verify that the templates to be downloaded are not yet installed
  809. # Note that we *still* have to do this again in verify() for
  810. # already-downloaded templates
  811. if not override_existing and name in app.domains:
  812. print(('Template \'%s\' already installed, skipping...'
  813. ' (You may want to use the'
  814. ' {reinstall,upgrade,downgrade}'
  815. ' operations.)') % name, file=sys.stderr)
  816. del dl_list_copy[name]
  817. else:
  818. # XXX: Perhaps this is better returned by download()
  819. version_str = build_version_str(entry.evr)
  820. target_file = \
  821. '%s%s-%s.rpm' % (PACKAGE_NAME_PREFIX, name, version_str)
  822. unverified_rpm_list.append(
  823. (os.path.join(args.cachedir, target_file), entry.reponame))
  824. dl_list = dl_list_copy
  825. # Ask the user for confirmation before we actually download stuff
  826. if override_existing and not args.yes:
  827. override_tpls = []
  828. # Local templates, already verified
  829. for _, _, name, _ in verified_rpm_list:
  830. override_tpls.append(name)
  831. # Templates not yet downloaded
  832. for name in dl_list:
  833. override_tpls.append(name)
  834. confirm_action(
  835. 'This will override changes made in the following VMs:',
  836. override_tpls)
  837. with tempfile.TemporaryDirectory(dir=args.cachedir) as dl_dir:
  838. download(args, app, path_override=dl_dir,
  839. dl_list=dl_list, suffix=UNVERIFIED_SUFFIX,
  840. version_selector=version_selector)
  841. # Verify downloaded templates
  842. for rpmfile, reponame in unverified_rpm_list:
  843. verify(rpmfile, reponame, dl_dir=dl_dir)
  844. unverified_rpm_list = []
  845. # Unpack and install
  846. for rpmfile, reponame, name, package_hdr in verified_rpm_list:
  847. with tempfile.TemporaryDirectory(dir=TEMP_DIR) as target:
  848. print('Installing template \'%s\'...' % name, file=sys.stderr)
  849. if not extract_rpm(name, rpmfile, target):
  850. raise Exception(
  851. 'Failed to extract {} template'.format(name))
  852. cmdline = [
  853. 'qvm-template-postprocess',
  854. '--really',
  855. '--no-installed-by-rpm',
  856. ]
  857. if args.allow_pv:
  858. cmdline.append('--allow-pv')
  859. if not override_existing and args.pool:
  860. cmdline += ['--pool', args.pool]
  861. subprocess.check_call(cmdline + [
  862. 'post-install',
  863. name,
  864. target + PATH_PREFIX + '/' + name])
  865. app.domains.refresh_cache(force=True)
  866. tpl = app.domains[name]
  867. tpl.features['template-name'] = name
  868. tpl.features['template-epoch'] = \
  869. package_hdr[rpm.RPMTAG_EPOCHNUM]
  870. tpl.features['template-version'] = \
  871. package_hdr[rpm.RPMTAG_VERSION]
  872. tpl.features['template-release'] = \
  873. package_hdr[rpm.RPMTAG_RELEASE]
  874. tpl.features['template-reponame'] = reponame
  875. tpl.features['template-buildtime'] = \
  876. datetime.datetime.fromtimestamp(
  877. int(package_hdr[rpm.RPMTAG_BUILDTIME]),
  878. tz=datetime.timezone.utc) \
  879. .strftime(DATE_FMT)
  880. tpl.features['template-installtime'] = \
  881. datetime.datetime.now(
  882. tz=datetime.timezone.utc).strftime(DATE_FMT)
  883. tpl.features['template-license'] = \
  884. package_hdr[rpm.RPMTAG_LICENSE]
  885. tpl.features['template-url'] = \
  886. package_hdr[rpm.RPMTAG_URL]
  887. tpl.features['template-summary'] = \
  888. package_hdr[rpm.RPMTAG_SUMMARY]
  889. tpl.features['template-description'] = \
  890. package_hdr[rpm.RPMTAG_DESCRIPTION].replace('\n', '|')
  891. if rpmfile.startswith(args.cachedir) and not args.keep_cache:
  892. os.remove(rpmfile)
  893. def list_templates(args: argparse.Namespace,
  894. app: qubesadmin.app.QubesBase, operation: str) -> None:
  895. """Command that lists templates.
  896. :param args: Arguments received by the application.
  897. :param app: Qubes application object
  898. :param operation: If set to ``list``, display a listing similar to ``dnf
  899. list``. If set to ``info``, display detailed template information
  900. similar to ``dnf info``. Otherwise, an ``AssertionError`` is raised.
  901. """
  902. tpl_list = []
  903. def append_list(data, status, install_time=None):
  904. _ = install_time # unused
  905. version_str = build_version_str(
  906. (data.epoch, data.version, data.release))
  907. tpl_list.append((status, data.name, version_str, data.reponame))
  908. def append_info(data, status, install_time=None):
  909. tpl_list.append((status, data, install_time))
  910. def list_to_human_output(tpls):
  911. outputs = []
  912. for status, grp in itertools.groupby(tpls, lambda x: x[0]):
  913. def convert(row):
  914. return row[1:]
  915. outputs.append((status, list(map(convert, grp))))
  916. return outputs
  917. def list_to_machine_output(tpls):
  918. outputs = {}
  919. for status, grp in itertools.groupby(tpls, lambda x: x[0]):
  920. def convert(row):
  921. _, name, evr, reponame = row
  922. return {'name': name, 'evr': evr, 'reponame': reponame}
  923. outputs[status.value] = list(map(convert, grp))
  924. return outputs
  925. def info_to_human_output(tpls):
  926. outputs = []
  927. for status, grp in itertools.groupby(tpls, lambda x: x[0]):
  928. output = []
  929. for _, data, install_time in grp:
  930. output.append(('Name', ':', data.name))
  931. output.append(('Epoch', ':', data.epoch))
  932. output.append(('Version', ':', data.version))
  933. output.append(('Release', ':', data.release))
  934. output.append(('Size', ':',
  935. qubesadmin.utils.size_to_human(data.dlsize)))
  936. output.append(('Repository', ':', data.reponame))
  937. output.append(('Buildtime', ':', str(data.buildtime)))
  938. if install_time:
  939. output.append(('Install time', ':', str(install_time)))
  940. output.append(('URL', ':', data.url))
  941. output.append(('License', ':', data.licence))
  942. output.append(('Summary', ':', data.summary))
  943. # Only show "Description" for the first line
  944. title = 'Description'
  945. for line in data.description.splitlines():
  946. output.append((title, ':', line))
  947. title = ''
  948. output.append((' ', ' ', ' ')) # empty line
  949. outputs.append((status, output))
  950. return outputs
  951. def info_to_machine_output(tpls, replace_newline=True):
  952. outputs = {}
  953. for status, grp in itertools.groupby(tpls, lambda x: x[0]):
  954. output = []
  955. for _, data, install_time in grp:
  956. name, epoch, version, release, reponame, dlsize, \
  957. buildtime, licence, url, summary, description = data
  958. dlsize = str(dlsize)
  959. buildtime = buildtime.strftime(DATE_FMT)
  960. install_time = install_time if install_time else ''
  961. if replace_newline:
  962. description = description.replace('\n', '|')
  963. output.append({
  964. 'name': name,
  965. 'epoch': epoch,
  966. 'version': version,
  967. 'release': release,
  968. 'reponame': reponame,
  969. 'size': dlsize,
  970. 'buildtime': buildtime,
  971. 'installtime': install_time,
  972. 'license': licence,
  973. 'url': url,
  974. 'summary': summary,
  975. 'description': description})
  976. outputs[status.value] = output
  977. return outputs
  978. if operation == 'list':
  979. append = append_list
  980. elif operation == 'info':
  981. append = append_info
  982. else:
  983. assert False and 'Unknown operation'
  984. def append_vm(vm, status):
  985. append(query_local(vm), status, vm.features['template-installtime'])
  986. def check_append(name, evr):
  987. return not args.templates or \
  988. any(is_match_spec(name, *evr, spec)[0]
  989. for spec in args.templates)
  990. if not (args.installed or args.available or args.extras or args.upgrades):
  991. args.all = True
  992. if args.all or args.available or args.extras or args.upgrades:
  993. if args.templates:
  994. query_res_set: typing.Set[Template] = set()
  995. for spec in args.templates:
  996. query_res_set |= set(qrexec_repoquery(args, app, spec))
  997. query_res = list(query_res_set)
  998. else:
  999. query_res = qrexec_repoquery(args, app)
  1000. if args.installed or args.all:
  1001. for vm in app.domains:
  1002. if is_managed_template(vm) and \
  1003. check_append(vm.name, query_local_evr(vm)):
  1004. append_vm(vm, TemplateState.INSTALLED)
  1005. if args.available or args.all:
  1006. # Spec should already be checked by repoquery
  1007. for data in query_res:
  1008. append(data, TemplateState.AVAILABLE)
  1009. if args.extras:
  1010. remote = set()
  1011. for data in query_res:
  1012. remote.add(data.name)
  1013. for vm in app.domains:
  1014. if is_managed_template(vm) and vm.name not in remote and \
  1015. check_append(vm.name, query_local_evr(vm)):
  1016. append_vm(vm, TemplateState.EXTRA)
  1017. if args.upgrades:
  1018. local = {}
  1019. for vm in app.domains:
  1020. if is_managed_template(vm):
  1021. local[vm.name] = query_local_evr(vm)
  1022. # Spec should already be checked by repoquery
  1023. for entry in query_res:
  1024. evr = (entry.epoch, entry.version, entry.release)
  1025. if entry.name in local:
  1026. if rpm.labelCompare(local[entry.name], evr) < 0:
  1027. append(entry, TemplateState.UPGRADABLE)
  1028. if len(tpl_list) == 0:
  1029. parser.error('No matching templates to list')
  1030. if args.machine_readable:
  1031. if operation == 'info':
  1032. tpl_list_dict = info_to_machine_output(tpl_list)
  1033. elif operation == 'list':
  1034. tpl_list_dict = list_to_machine_output(tpl_list)
  1035. for status, grp in tpl_list_dict.items():
  1036. for line in grp:
  1037. print('|'.join([status] + list(line.values())))
  1038. elif args.machine_readable_json:
  1039. if operation == 'info':
  1040. tpl_list_dict = \
  1041. info_to_machine_output(tpl_list, replace_newline=False)
  1042. elif operation == 'list':
  1043. tpl_list_dict = list_to_machine_output(tpl_list)
  1044. print(json.dumps(tpl_list_dict))
  1045. else:
  1046. if operation == 'info':
  1047. tpl_list = info_to_human_output(tpl_list)
  1048. elif operation == 'list':
  1049. tpl_list = list_to_human_output(tpl_list)
  1050. for status, grp in tpl_list:
  1051. print(status.title())
  1052. qubesadmin.tools.print_table(grp)
  1053. def search(args: argparse.Namespace, app: qubesadmin.app.QubesBase) -> None:
  1054. """Command that searches template details for given patterns.
  1055. :param args: Arguments received by the application.
  1056. :param app: Qubes application object
  1057. """
  1058. # Search in both installed and available templates
  1059. query_res = qrexec_repoquery(args, app)
  1060. for vm in app.domains:
  1061. if is_managed_template(vm):
  1062. query_res.append(query_local(vm))
  1063. # Get latest version for each template
  1064. query_res_tmp = []
  1065. for _, grp in itertools.groupby(sorted(query_res), lambda x: x[0]):
  1066. def compare(lhs, rhs):
  1067. return lhs if rpm.labelCompare(lhs[1:4], rhs[1:4]) > 0 else rhs
  1068. query_res_tmp.append(functools.reduce(compare, grp))
  1069. query_res = query_res_tmp
  1070. #pylint: disable=invalid-name
  1071. WEIGHT_NAME_EXACT = 1 << 4
  1072. WEIGHT_NAME = 1 << 3
  1073. WEIGHT_SUMMARY = 1 << 2
  1074. WEIGHT_DESCRIPTION = 1 << 1
  1075. WEIGHT_URL = 1 << 0
  1076. WEIGHT_TO_FIELD = [
  1077. (WEIGHT_NAME_EXACT, 'Name'),
  1078. (WEIGHT_NAME, 'Name'),
  1079. (WEIGHT_SUMMARY, 'Summary'),
  1080. (WEIGHT_DESCRIPTION, 'Description'),
  1081. (WEIGHT_URL, 'URL')]
  1082. search_res_by_idx: \
  1083. typing.Dict[int, typing.List[typing.Tuple[int, str, bool]]] = \
  1084. collections.defaultdict(list)
  1085. for keyword in args.templates:
  1086. for idx, entry in enumerate(query_res):
  1087. needle_types = \
  1088. [(entry.name, WEIGHT_NAME), (entry.summary, WEIGHT_SUMMARY)]
  1089. if args.all:
  1090. needle_types += [(entry.description, WEIGHT_DESCRIPTION),
  1091. (entry.url, WEIGHT_URL)]
  1092. for key, weight in needle_types:
  1093. if fnmatch.fnmatch(key, '*' + keyword + '*'):
  1094. exact = keyword == key
  1095. if exact and weight == WEIGHT_NAME:
  1096. weight = WEIGHT_NAME_EXACT
  1097. search_res_by_idx[idx].append((weight, keyword, exact))
  1098. if not args.all:
  1099. keywords = set(args.templates)
  1100. idxs = list(search_res_by_idx.keys())
  1101. for idx in idxs:
  1102. if keywords != set(x[1] for x in search_res_by_idx[idx]):
  1103. del search_res_by_idx[idx]
  1104. def key_func(x):
  1105. # ORDER BY weight DESC, list_of_needles ASC, name ASC
  1106. idx, needles = x
  1107. weight = sum(t[0] for t in needles)
  1108. name = query_res[idx][0]
  1109. return (-weight, needles, name)
  1110. search_res = sorted(search_res_by_idx.items(), key=key_func)
  1111. def gen_header(needles):
  1112. fields = []
  1113. weight_types = set(x[0] for x in needles)
  1114. for weight, field in WEIGHT_TO_FIELD:
  1115. if weight in weight_types:
  1116. fields.append(field)
  1117. exact = all(x[-1] for x in needles)
  1118. match = 'Exactly Matched' if exact else 'Matched'
  1119. keywords = sorted(list(set(x[1] for x in needles)))
  1120. return ' & '.join(fields) + ' ' + match + ': ' + ', '.join(keywords)
  1121. last_header = ''
  1122. for idx, needles in search_res:
  1123. # Print headers
  1124. cur_header = gen_header(needles)
  1125. if last_header != cur_header:
  1126. last_header = cur_header
  1127. # XXX: The style is different from that of DNF
  1128. print('===', cur_header, '===')
  1129. print(query_res[idx].name, ':', query_res[idx].summary)
  1130. def remove(
  1131. args: argparse.Namespace,
  1132. app: qubesadmin.app.QubesBase,
  1133. disassoc: bool = False,
  1134. purge: bool = False,
  1135. dummy: str = 'dummy'
  1136. ) -> None:
  1137. """Command that remove templates.
  1138. :param args: Arguments received by the application.
  1139. :param app: Qubes application object
  1140. :param disassoc: Whether to disassociate VMs from the templates
  1141. :param purge: Whether to remove VMs based on the templates
  1142. :param dummy: Name of dummy VM if disassoc is used
  1143. """
  1144. # NOTE: While QubesArgumentParser provide similar functionality
  1145. # it does not seem to work as a parent parser
  1146. for tpl in args.templates:
  1147. if tpl not in app.domains:
  1148. parser.error("no such domain: '%s'" % tpl)
  1149. remove_list = args.templates
  1150. if purge:
  1151. # Not disassociating first may result in dependency ordering issues
  1152. disassoc = True
  1153. # Remove recursively via BFS
  1154. remove_set = set(remove_list) # visited
  1155. idx = 0
  1156. while idx < len(remove_list):
  1157. tpl = remove_list[idx]
  1158. idx += 1
  1159. vm = app.domains[tpl]
  1160. for holder, prop in qubesadmin.utils.vm_dependencies(app, vm):
  1161. if holder is not None and holder.name not in remove_set:
  1162. remove_list.append(holder.name)
  1163. remove_set.add(holder.name)
  1164. if not args.yes:
  1165. repeat = 3 if purge else 1
  1166. for _ in range(repeat):
  1167. confirm_action(
  1168. 'This will completely remove the selected VM(s)...',
  1169. remove_list)
  1170. if disassoc:
  1171. # Remove the dummy afterwards if we're purging
  1172. remove_dummy = purge
  1173. # Create dummy template; handle name collisions
  1174. orig_dummy = dummy
  1175. cnt = 1
  1176. while dummy in app.domains \
  1177. and app.domains[dummy].features.get(
  1178. 'template-dummy', '0') == '0':
  1179. dummy = '%s-%d' % (orig_dummy, cnt)
  1180. cnt += 1
  1181. if dummy not in app.domains:
  1182. dummy_vm = app.add_new_vm('TemplateVM', dummy, 'red')
  1183. dummy_vm.features['template-dummy'] = 1
  1184. else:
  1185. dummy_vm = app.domains[dummy]
  1186. for tpl in remove_list:
  1187. vm = app.domains[tpl]
  1188. for holder, prop in qubesadmin.utils.vm_dependencies(app, vm):
  1189. if holder:
  1190. setattr(holder, prop, dummy_vm)
  1191. holder.template = dummy_vm
  1192. print("Property '%s' of '%s' set to '%s'." % (
  1193. prop, holder.name, dummy), file=sys.stderr)
  1194. else:
  1195. print("Global property '%s' set to ''." % prop,
  1196. file=sys.stderr)
  1197. setattr(app, prop, '')
  1198. if remove_dummy:
  1199. remove_list.append(dummy)
  1200. if disassoc or purge:
  1201. qubesadmin.tools.qvm_kill.main(['--'] + remove_list, app)
  1202. qubesadmin.tools.qvm_remove.main(['--force', '--'] + remove_list, app)
  1203. def clean(args: argparse.Namespace, app: qubesadmin.app.QubesBase) -> None:
  1204. """Command that cleans the local package cache.
  1205. :param args: Arguments received by the application.
  1206. :param app: Qubes application object
  1207. """
  1208. # TODO: More fine-grained options?
  1209. _ = app # unused
  1210. shutil.rmtree(args.cachedir)
  1211. def repolist(args: argparse.Namespace, app: qubesadmin.app.QubesBase) -> None:
  1212. """Command that lists configured repositories.
  1213. :param args: Arguments received by the application.
  1214. :param app: Qubes application object
  1215. """
  1216. _ = app # unused
  1217. # python-dnf is not packaged on Debian
  1218. # As this is not an "essential operation", the module is imported here
  1219. # instead of top-level so that other operations still work.
  1220. try:
  1221. import dnf
  1222. except ModuleNotFoundError:
  1223. print("Error: Python module 'dnf' not found.", file=sys.stderr)
  1224. sys.exit(1)
  1225. if not args.all and not args.disabled:
  1226. args.enabled = True
  1227. with tempfile.TemporaryDirectory(dir=TEMP_DIR) as reposdir:
  1228. for idx, path in enumerate(args.repo_files):
  1229. src = os.path.abspath(path)
  1230. # Use index as file name in case of collisions
  1231. dst = os.path.join(reposdir, '%d.repo' % idx)
  1232. os.symlink(src, dst)
  1233. conf = dnf.conf.Conf()
  1234. conf.substitutions['releasever'] = args.releasever
  1235. conf.reposdir = reposdir
  1236. base = dnf.Base(conf)
  1237. base.read_all_repos()
  1238. if args.repoid:
  1239. base.repos.get_matching('*').disable()
  1240. for repo in args.repoid:
  1241. base.repos.get_matching(repo).enable()
  1242. else:
  1243. for repo in args.enablerepo:
  1244. base.repos.get_matching(repo).enable()
  1245. for repo in args.disablerepo:
  1246. base.repos.get_matching(repo).disable()
  1247. repos: typing.List[dnf.repo.Repo]
  1248. if args.repos:
  1249. repos = []
  1250. for repo in args.repos:
  1251. repos += list(base.repos.get_matching(repo))
  1252. repos = list(set(repos))
  1253. repos.sort(key=operator.attrgetter('id'))
  1254. else:
  1255. repos = list(base.repos.values())
  1256. repos.sort(key=operator.attrgetter('id'))
  1257. table = []
  1258. for repo in repos:
  1259. if args.all or (args.enabled == repo.enabled):
  1260. state = 'enabled' if repo.enabled else 'disabled'
  1261. table.append((repo.id, repo.name, state))
  1262. qubesadmin.tools.print_table(table)
  1263. def main(args: typing.Optional[typing.Sequence[str]] = None,
  1264. app: typing.Optional[qubesadmin.app.QubesBase] = None) -> int:
  1265. """Main routine of **qvm-template**.
  1266. :param args: Override arguments received by the application. Optional
  1267. :param app: Override Qubes application object. Optional
  1268. :return: Return code of the application
  1269. """
  1270. p_args = parser.parse_args(args)
  1271. if not p_args.operation:
  1272. parser.error('An operation needs to be specified.')
  1273. # If the user specified other repo files...
  1274. if len(p_args.repo_files) > 1:
  1275. # ...remove the default entry
  1276. p_args.repo_files.pop(0)
  1277. if app is None:
  1278. app = qubesadmin.Qubes()
  1279. if p_args.updatevm is UPDATEVM:
  1280. p_args.updatevm = app.updatevm
  1281. if p_args.refresh:
  1282. qrexec_repoquery(p_args, app, refresh=True)
  1283. if p_args.operation == 'download':
  1284. download(p_args, app)
  1285. elif p_args.operation == 'install':
  1286. install(p_args, app)
  1287. elif p_args.operation == 'reinstall':
  1288. install(p_args, app, version_selector=VersionSelector.REINSTALL,
  1289. override_existing=True)
  1290. elif p_args.operation == 'downgrade':
  1291. install(p_args, app, version_selector=VersionSelector.LATEST_LOWER,
  1292. override_existing=True)
  1293. elif p_args.operation == 'upgrade':
  1294. install(p_args, app, version_selector=VersionSelector.LATEST_HIGHER,
  1295. override_existing=True)
  1296. elif p_args.operation == 'list':
  1297. list_templates(p_args, app, 'list')
  1298. elif p_args.operation == 'info':
  1299. list_templates(p_args, app, 'info')
  1300. elif p_args.operation == 'search':
  1301. search(p_args, app)
  1302. elif p_args.operation == 'remove':
  1303. remove(p_args, app, disassoc=p_args.disassoc)
  1304. elif p_args.operation == 'purge':
  1305. remove(p_args, app, purge=True)
  1306. elif p_args.operation == 'clean':
  1307. clean(p_args, app)
  1308. elif p_args.operation == 'repolist':
  1309. repolist(p_args, app)
  1310. else:
  1311. parser.error('Operation \'%s\' not supported.' % p_args.operation)
  1312. return 0
  1313. if __name__ == '__main__':
  1314. sys.exit(main())