6 Commits

Include renames

Author	SHA1	Message	Date
flan	ea00bd0685	Repoint forge references from git.onetick.ninja to git.arch.fyi	2026-08-03 20:03:16 +00:00
flan	4ced730d65	Make Gitea canonical; derive the changelog URL from the remote instead of hard-coding GitHub	2026-07-13 17:21:30 +00:00
flan	8a82bde531	noqa placement: ruff anchors S607 to the args list, not the call	2026-07-13 16:53:59 +00:00
flan	0e9e22da18	Annotate the two remaining static-analysis findings in alert_source.py ... subprocess is called in list form with only literal arguments -- nothing user-supplied reaches the command line -- and the partial `git` path is moot in a module that only ever runs as root inside middlewared. Deliberately NOT tagged: this changes no behaviour, and cutting a release for two noqa comments would raise an update alert on every user's box. main sits one commit ahead of v0.5.1 until the next real change -- which is exactly the restraint the alert's docs-only rule exists to encode.	2026-07-13 16:53:08 +00:00
flan	bf6d37e621	v0.5.1: the update alert could have broken middlewared at startup ... middlewared's alert.load() imports every file in alert/source/ with NO try/except: def load(self): for module in load_modules(.../alert/source): for cls in load_classes(module, AlertSource, (ThreadedAlertSource,)): ... and it runs during setup. A module that raises on import therefore takes middlewared's startup down with it -- exactly the class of failure this project exists to avoid. apply.sh now COMPILES the substituted alert source and refuses to write it if it does not parse. An uninstalled alert is a missing convenience; a broken one is a broken box. @PATCH_DIR@ is also substituted with repr() rather than raw, so a repository path containing a quote or backslash yields a valid Python literal instead of a syntax error in the installed module. The alert source no longer mutates sys.path. It loaded tools/release_notes.py via sys.path.insert(0, ...), which shadows the stdlib for that interpreter -- and ThreadedAlertSource runs in middlewared's thread pool, so mutating sys.path is a race. It now loads by file path with importlib. New tests guard every import-time failure mode: the module compiles, apply.sh compiles before writing, awkward paths (quotes, backslashes) still produce valid modules, nothing but imports/constants/classes runs at module scope, every AlertClass name ends in "AlertClass" (AlertClassMeta raises NameError otherwise), the alert text placeholders match the args passed, and no git command that writes to .git is ever used. 152 tests, ruff and shellcheck -S style clean.	2026-07-13 16:52:23 +00:00
flan	4e0814028c	v0.5.0: TrueNAS alert when an update is available ... Raises a real alert in the TrueNAS UI bell -- not a log line nobody reads. On by default, checked once a day. install.sh --no-update-alerts turns it off. It does not nag --------------- A release whose CHANGELOG contains only a "### Docs" section changed no code and raises nothing. Anything else raises INFO; a "### Security" section raises WARNING. The CHANGELOG's own section headings are the signal, and a security fix anywhere in the range escalates the whole span -- a docs-only release sitting on top of a security fix still reports as security rather than hiding it. Why an AlertSource and not midclt ---------------------------------- TrueNAS cannot raise an alert from the CLI. midclt exposes only alert.dismiss, alert.list, alert.list_categories, alert.list_policies and alert.restore -- alert CREATION is internal to middlewared, and none of its ~60 one-shot classes is generic enough to reuse. Registering an AlertSource is the only way. It is also the least invasive thing this patch does. The providers and nested modules both APPEND CODE TO STOCK middleware files; the alert source ADDS ONE FILE and modifies none. It is the native mechanism -- the same one every built-in TrueNAS alert uses -- and TrueNAS polls it itself, so there is no cron job and no systemd timer. - Fail-safe: every error path returns None; it cannot take middlewared down. - Read-only: `git ls-remote` plus an HTTPS fetch of the CHANGELOG. It never writes to .git, so it cannot leave root-owned objects behind the way a `git fetch` from middlewared (running as root) would. - Removed by uninstall.sh (mw_patch.revert_all). - It only tells you; it never updates anything. Verified against the real repo and remote, with middlewared stubbed: on v0.4.1, only a README-only v0.4.2 available -> NO ALERT on v0.4.0, v0.4.1 fixed real bugs -> INFO on v0.3.2, v0.3.3 was the password fix -> SECURITY / WARNING 139 tests, ruff and shellcheck -S style clean.	2026-07-13 16:45:26 +00:00