The conan package presenter will now only read conan packages

🤔 What does this MR do?

When uploading a conan package to the Conan package registry, conan CLI will send a request to the XXX/digest url endpoint. This endpoint will in turn use the conan package presenter.

This presenter has a serious flaw. It has to get a Packages::Package from a package name and version and it does so without specifying a package type. So if a package of a different type (let's say nuget) but with the exact same package name and version exists within the project, it could be selected and the presenter will go 💥 while trying to read package_file.conan_metadatum

This MR adds two fixes:

  • It uses the .conan scope on Package::Packages to ensure that the presenter only deals with conan packages. This properly fixes the ~bug
  • In addition, it renames the .with_conan_file_metadata scope to .preload_conan_file_metadata to clarify what the scope is doing: it's eager loading conan_file_metadatum and not filtering it. Also, we used preload to follow the same approach we are using in Packages::Package scopes.

Screenshots

The below shell execution assumes that there is already an existing package named sandbox with version 0.0.1.

Uploading a conan package with the faulty presenter:

$ conan upload sandbox/0.0.1@gitlab-org+gitlab-test/beta --all --remote=gitlab_local
Uploading to remote 'gitlab_local':
Uploading sandbox/0.0.1@gitlab-org+gitlab-test/beta to remote 'gitlab_local'             
ERROR: sandbox/0.0.1@gitlab-org+gitlab-test/beta: Upload recipe to 'gitlab_local' failed: {"message":"500 Internal Server Error"}. [Remote: gitlab_local]

ERROR: Errors uploading some packages

💥

Uploading a conan package with this MR

$ conan upload sandbox/0.0.1@gitlab-org+gitlab-test/beta --all --remote=gitlab_local
Uploading to remote 'gitlab_local':
Uploading sandbox/0.0.1@gitlab-org+gitlab-test/beta to remote 'gitlab_local'             
Uploaded conanfile.py -> sandbox/0.0.1@gitlab-org+gitlab-test/beta [1.73k]               
Uploaded conanmanifest.txt -> sandbox/0.0.1@gitlab-org+gitlab-test/beta [0.06k]          
Uploaded conan recipe 'sandbox/0.0.1@gitlab-org+gitlab-test/beta' to 'gitlab_local': http://gitlab.local:8000/api/v4/packages/conan
Uploading package 1/1: 103f6067a947f366ef91fc1b7da351c588d1827f to 'gitlab_local'        
Compressing conan_package.tgz completed [2 files]                                        
Uploaded conan_package.tgz -> sandbox/0.0.1@gitlab-org+gitlab-test/beta:103f [2.08k]     
Uploaded conaninfo.txt -> sandbox/0.0.1@gitlab-org+gitlab-test/beta:103f [0.43k]         
Uploaded conanmanifest.txt -> sandbox/0.0.1@gitlab-org+gitlab-test/beta:103f [0.15k]     

🎉

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team

Related to #225860 (closed)

Edited by Mayra Cabrera

Merge request reports

Loading