Symlink support

- added some security checks so that symlinks can be supported
- also some code quality changes

lib/worker_multibuild.py

@@ -1,5 +1,5 @@
-from os import listdir
+from os import getcwd, listdir
-from os.path import exists, isfile, join, islink
+from os.path import exists, isfile, islink, join, realpath
 import requests
 import re
 from subprocess import Popen, PIPE
@@ -69,20 +69,29 @@ def list_jobs(directory=".buildbot"):
         flag = False
         for fname in files:
             filepath = join(directory, item, fname)
+            # must exist
             if not exists(filepath):
                 continue
-            if islink(filepath) or not isfile(filepath):
+            # must be a file
+            if not isfile(filepath):
+                flag = True
+                break
+            # symlink OK as long as it points to files within the repo
+            if islink(filepath) \
+                    and not realpath(filepath).startswith(getcwd()):
                 flag = True
                 break
         if flag:
             continue
-        if (exists(join(directory, item, 'Dockerfile')) and exists(join(directory, item, 'build.sh'))) or exists(join(directory, item, 'test.sh')):
+        if (exists(join(directory, item, 'Dockerfile'))
+                and exists(join(directory, item, 'build.sh'))) \
+                or exists(join(directory, item, 'test.sh')):
             results.append(item)
     return results
 
 
-def get_revision():
+def get_revision(branch):
-    proc = Popen(["git", "rev-parse", "HEAD"], stdout=PIPE)
+    proc = Popen(["git", "rev-parse", branch], stdout=PIPE)
     retval = proc.stdout.read().strip()
     retval = retval.decode('utf-8')
     return retval
@@ -90,7 +99,8 @@ def get_revision():
 
 def _get_dockerfile_contents(dockerfile):
     """
-    Read contents of a Dockerfile and add extra contents for the given os_codename
+    Read contents of a Dockerfile and add buildbot worker bootstrap
+    for a given os_codename
     """
     os_codename = 'bionic'
     res = ""
@@ -117,7 +127,8 @@ def _get_dockerfile_contents(dockerfile):
     return res + dockerfile_extra_contents[os_codename]
 
 
-def trigger_child_hooks(buildbotUrl: str, repository, branch, directory=".buildbot"):
+def trigger_child_hooks(buildbotUrl: str, repository, branch, revision,
+                        directory=".buildbot"):
     request_url = buildbotUrl + ty
     # List all jobs in the directory
     jobs = list_jobs(directory)
@@ -126,7 +137,7 @@ def trigger_child_hooks(buildbotUrl: str, repository, branch, directory=".buildb
         "X-Multibuild-Trigger": get_secret(),
         "Accept": "text/plain",
     }
-    revision = get_revision()
+    # revision = get_revision(branch)
 
     # Check if build.sh or test.sh exists in each of the jobs
     for job in jobs:
@@ -160,21 +171,24 @@ def trigger_child_hooks(buildbotUrl: str, repository, branch, directory=".buildb
             "project": "/".join(repository.split("/")[-2:]),
         }
 
-        retval = requests.post(request_url, headers=request_headers, json=request_data)
+        retval = requests.post(request_url, headers=request_headers,
-        print("Triggered job for {} on {}: {}".format(job, request_url, retval.text))
+                               json=request_data)
+        print("Triggered job for {} on {}: {}".format(job, request_url,
+                                                      retval.text))
 
 
 if __name__ == "__main__":
     # expect jobname, repository, branch, buildbotUrl from command line
     import sys
 
-    if len(sys.argv) == 4:
+    if len(sys.argv) == 5:
         buildbotUrl = sys.argv[1]
         repository = sys.argv[2]
         branch = sys.argv[3]
+        revision = sys.argv[4]
 
-        trigger_child_hooks(buildbotUrl, repository, branch)
+        trigger_child_hooks(buildbotUrl, repository, branch, revision)
     else:
         sys.exit(
-            "Usage: python3 multibuild.py <buildbotUrl> <repository> <branch>"
+            "Usage: python3 multibuild.py <buildbotUrl> <repository> <branch> <revision>"
         )

multibuild.py

@@ -32,33 +32,16 @@ def add_parent_step(build_factory):
     Add a step to the parent build factory that will trigger the child hooks
     """
 
-    build_factory.addStep(steps.ShellCommand(
-        name="Update APT cache",
-        command=["sudo", "apt", "update"]
-    ))
-
-    build_factory.addStep(steps.ShellCommand(
-        name="Install dependencies",
-        command=["sudo", "apt", "-y", "install", "python3-requests"]
-    ))
-
-    build_factory.addStep(
-        steps.FileDownload(
-            workerdest="worker_multibuild.py",
-            mastersrc="buildbot_multibuild/lib/worker_multibuild.py",
-            mode=0o444
-        )
-    )
-
     build_factory.addStep(
         steps.ShellCommand(
             name="Execute worker script",
             command=[
                 "python3",
-                'worker_multibuild.py',
+                '/usr/local/bin/worker_multibuild.py',
                 util.Property("buildboturl"),
                 util.Property('repository'),
-                util.Property('branch')
+                util.Property('branch'),
+                util.Property('revision')
             ],
         )
     )