69 apt proxy repo (#1)

* alan-turing-institute#69 add apt proxy repo support --------- Co-authored-by: Jim Madge <[email protected]> Co-authored-by: Julien Baudon <[email protected]>
Jbaudon · Nov 19, 2024 · 0bb93e5 · 0bb93e5
1 parent 917342f
commit 0bb93e5
Show file tree

Hide file tree

Showing 11 changed files with 249 additions and 24 deletions.
diff --git a/.all-contributorsrc b/.all-contributorsrc
@@ -0,0 +1,64 @@
+{
+  "projectName": "nexus-allowlist",
+  "projectOwner": "The contributors",
+  "repoType": "github",
+  "repoHost": "https://github.com",
+  "files": [
+    "README.md"
+  ],
+  "imageSize": 100,
+  "commit": true,
+  "commitConvention": "none",
+  "contributors": [
+    {
+      "login": "JimMadge",
+      "name": "Jim Madge",
+      "avatar_url": "https://avatars.githubusercontent.com/u/23616154?v=4",
+      "profile": "https://github.com/JimMadge",
+      "contributions": [
+        "bug",
+        "code",
+        "doc",
+        "ideas",
+        "infra",
+        "review",
+        "test"
+      ]
+    },
+    {
+      "login": "craddm",
+      "name": "Matt Craddock",
+      "avatar_url": "https://avatars.githubusercontent.com/u/5796417?v=4",
+      "profile": "https://github.com/craddm",
+      "contributions": [
+        "bug",
+        "code",
+        "infra"
+      ]
+    },
+    {
+      "login": "jemrobinson",
+      "name": "James Robinson",
+      "avatar_url": "https://avatars.githubusercontent.com/u/3502751?v=4",
+      "profile": "https://github.com/jemrobinson",
+      "contributions": [
+        "bug",
+        "code",
+        "review"
+      ]
+    },
+    {
+      "login": "Jbaudon",
+      "name": "Jbaudon",
+      "avatar_url": "https://avatars.githubusercontent.com/u/81579455?v=4",
+      "profile": "https://github.com/Jbaudon",
+      "contributions": [
+        "code",
+        "doc",
+        "ideas"
+      ]
+    }
+  ],
+  "contributorsPerLine": 7,
+  "linkToUsage": false
+}
diff --git a/README.md b/README.md
@@ -1,4 +1,7 @@
 # Nexus Allowlist
+<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
+[![All Contributors](https://img.shields.io/badge/all_contributors-4-orange.svg?style=flat-square)](#contributors-)
+<!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 A package for configuring [Sonatype Nexus Repository Manager OSS](https://github.com/sonatype/nexus-public) to only allow selected packages to be installed from proxy repositories.
 
@@ -23,7 +26,7 @@ Check and, if you would like, change the following environment variables for the
 | NEXUS_PATH             | [Context path](https://help.sonatype.com/en/configuring-the-runtime-environment.html#changing-the-context-path) of Nexus OSS. Only used if the Nexus is hosted behind a reverse proxy with a URL like `https://your_url.domain/nexus/`. If not defined, the base URI remains `/`.                                                                                                                              |
 | ENTR_FALLBACK          | If defined, don't use `entr` to check for allowlist updates (this will be less reactive but we have found `entr` to not work in some situations) |
 
-Example allowlist files are included in the repository for [PyPI](allowlists/pypi.allowlist) and [CRAN](allowlists/cran.allowlist).
+Example allowlist files are included in the repository for [PyPI](allowlists/pypi.allowlist), [CRAN](allowlists/cran.allowlist) and [APT](allowlists/apt.allowlist).
 The PyPI allowlist includes numpy, pandas, matplotlib and their dependencies.
 The CRAN allowlist includes cli and data.table
 You can add more packages by writing the package names, one per line, in the allowlist files.
@@ -92,3 +95,44 @@ For example,
 
 - `install.packages("data.table")` should succeed
 - `install.packages("ggplot2")` should fail
+
+#### APT
+
+You can edit '/etc/apt/sources.list' to use the Nexus APT proxy.
+
+For example
+
+```
+deb http://localhost:8080/repository/apt-proxy bookworm main
+```
+
+You should now only be able to install packages from the allowlist.
+For example,
+
+- `sudo apt install libcurl4-openssl-dev` should succeed
+- `sudo apt install tcpdump` should fail
+
+## Contributors ✨
+
+Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
+
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+<table>
+  <tbody>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/JimMadge"><img src="https://avatars.githubusercontent.com/u/23616154?v=4?s=100" width="100px;" alt="Jim Madge"/><br /><sub><b>Jim Madge</b></sub></a><br /><a href="https://github.com/The contributors/nexus-allowlist/issues?q=author%3AJimMadge" title="Bug reports">🐛</a> <a href="https://github.com/The contributors/nexus-allowlist/commits?author=JimMadge" title="Code">💻</a> <a href="https://github.com/The contributors/nexus-allowlist/commits?author=JimMadge" title="Documentation">📖</a> <a href="#ideas-JimMadge" title="Ideas, Planning, & Feedback">🤔</a> <a href="#infra-JimMadge" title="Infrastructure (Hosting, Build-Tools, etc)">🚇</a> <a href="https://github.com/The contributors/nexus-allowlist/pulls?q=is%3Apr+reviewed-by%3AJimMadge" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/The contributors/nexus-allowlist/commits?author=JimMadge" title="Tests">⚠️</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/craddm"><img src="https://avatars.githubusercontent.com/u/5796417?v=4?s=100" width="100px;" alt="Matt Craddock"/><br /><sub><b>Matt Craddock</b></sub></a><br /><a href="https://github.com/The contributors/nexus-allowlist/issues?q=author%3Acraddm" title="Bug reports">🐛</a> <a href="https://github.com/The contributors/nexus-allowlist/commits?author=craddm" title="Code">💻</a> <a href="#infra-craddm" title="Infrastructure (Hosting, Build-Tools, etc)">🚇</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/jemrobinson"><img src="https://avatars.githubusercontent.com/u/3502751?v=4?s=100" width="100px;" alt="James Robinson"/><br /><sub><b>James Robinson</b></sub></a><br /><a href="https://github.com/The contributors/nexus-allowlist/issues?q=author%3Ajemrobinson" title="Bug reports">🐛</a> <a href="https://github.com/The contributors/nexus-allowlist/commits?author=jemrobinson" title="Code">💻</a> <a href="https://github.com/The contributors/nexus-allowlist/pulls?q=is%3Apr+reviewed-by%3Ajemrobinson" title="Reviewed Pull Requests">👀</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Jbaudon"><img src="https://avatars.githubusercontent.com/u/81579455?v=4?s=100" width="100px;" alt="Jbaudon"/><br /><sub><b>Jbaudon</b></sub></a><br /><a href="https://github.com/The contributors/nexus-allowlist/commits?author=Jbaudon" title="Code">💻</a> <a href="https://github.com/The contributors/nexus-allowlist/commits?author=Jbaudon" title="Documentation">📖</a> <a href="#ideas-Jbaudon" title="Ideas, Planning, & Feedback">🤔</a></td>
+    </tr>
+  </tbody>
+</table>
+
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
+
+<!-- ALL-CONTRIBUTORS-LIST:END -->
+
+This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome!
diff --git a/allowlists/apt.allowlist b/allowlists/apt.allowlist
@@ -0,0 +1,13 @@
+r-recommended
+r-cran-matrixmodels
+libcurl4-openssl-dev
+libv8-dev
+libxml2-dev
+cmake
+libfontconfig1-dev
+libharfbuzz-dev
+libfribidi-dev
+libfreetype6-dev
+libpng-dev
+libtiff5-dev
+libjpeg-dev
diff --git a/entrypoint.sh b/entrypoint.sh
@@ -4,6 +4,7 @@ export NEXUS_DATA_DIR=/nexus-data
 export ALLOWLIST_DIR=/allowlists
 export PYPI_ALLOWLIST="$ALLOWLIST_DIR"/pypi.allowlist
 export CRAN_ALLOWLIST="$ALLOWLIST_DIR"/cran.allowlist
+export APT_ALLOWLIST="$ALLOWLIST_DIR"/apt.allowlist
 
 timestamp() {
     date -Is
@@ -37,7 +38,7 @@ nexus-allowlist --version
 if [ -f "$NEXUS_DATA_DIR/admin.password" ]; then
     echo "$(timestamp) Initial password file present, running initial configuration"
     nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" change-initial-password --path "$NEXUS_DATA_DIR"
-    nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" initial-configuration --packages "$NEXUS_PACKAGES" --pypi-package-file "$ALLOWLIST_DIR/pypi.allowlist" --cran-package-file "$ALLOWLIST_DIR/cran.allowlist"
+    nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" initial-configuration --packages "$NEXUS_PACKAGES" --pypi-package-file "$PYPI_ALLOWLIST" --cran-package-file "$CRAN_ALLOWLIST" --apt-package-file "$APT_ALLOWLIST"
 else
     echo "$(timestamp) No initial password file found, skipping initial configuration"
 fi
@@ -51,19 +52,19 @@ fi
 if [ -n "$ENTR_FALLBACK" ]; then
     echo "$(timestamp) Using fallback file monitoring"
     # Run allowlist configuration now
-    nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" update-allowlists --packages "$NEXUS_PACKAGES" --pypi-package-file "$PYPI_ALLOWLIST" --cran-package-file "$CRAN_ALLOWLIST"
+    nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" update-allowlists --packages "$NEXUS_PACKAGES" --pypi-package-file "$PYPI_ALLOWLIST" --cran-package-file "$CRAN_ALLOWLIST" --apt-package-file "$APT_ALLOWLIST"
     # Periodically check for modification of allowlist files and run configuration again when they are
     hash=$(hashes)
     while true; do
         new_hash=$(hashes)
         if [ "$hash" != "$new_hash" ]; then
-            nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" update-allowlists --packages "$NEXUS_PACKAGES" --pypi-package-file "$PYPI_ALLOWLIST" --cran-package-file "$CRAN_ALLOWLIST"
+            nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" update-allowlists --packages "$NEXUS_PACKAGES" --pypi-package-file "$PYPI_ALLOWLIST" --cran-package-file "$CRAN_ALLOWLIST" --apt-package-file "$APT_ALLOWLIST"
             hash=$new_hash
         fi
         sleep 5
     done
 else
     echo "$(timestamp) Using entr for file monitoring"
     # Run allowlist configuration now, and again whenever allowlist files are modified
-    find "$ALLOWLIST_DIR"/*.allowlist | entr -n nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" update-allowlists --packages "$NEXUS_PACKAGES" --pypi-package-file "$PYPI_ALLOWLIST" --cran-package-file "$CRAN_ALLOWLIST"
+    find "$ALLOWLIST_DIR"/*.allowlist | entr -n nexus-allowlist --admin-password "$NEXUS_ADMIN_PASSWORD" --nexus-host "$NEXUS_HOST" --nexus-path "$NEXUS_PATH" --nexus-port "$NEXUS_PORT" update-allowlists --packages "$NEXUS_PACKAGES" --pypi-package-file "$PYPI_ALLOWLIST" --cran-package-file "$CRAN_ALLOWLIST" --apt-package-file "$APT_ALLOWLIST"
 fi
diff --git a/integration_tests/Dockerfile b/integration_tests/Dockerfile
@@ -4,3 +4,4 @@ RUN apk add --no-cache --update python3 py3-pip R
 RUN mkdir -p /root/.config/pip
 COPY pip.conf /root/.config/pip/pip.conf
 COPY Rprofile /root/.Rprofile
+COPY sources.list /etc/apt/sources.list
diff --git a/integration_tests/sources.list b/integration_tests/sources.list
@@ -0,0 +1 @@
+deb http://localhost:8080/repository/apt-proxy bookworm main
diff --git a/nexus_allowlist/__about__.py b/nexus_allowlist/__about__.py
@@ -1 +1 @@
-__version__ = "v0.11.0"
+__version__ = "v0.12.0"
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		deb http://localhost:8080/repository/apt-proxy bookworm main