Actually, setting HOME to the target user is the behavior of the Debian
sudo config anyway.

The rsync run happens during unchecked to make sure queue/accepted
only contains complete uploads.

Before Debian LTS started to use the security archive, all uploads that
would trigger buildds would be sourceful uploads to a policy queue. So
new packages entering the build queues and pushing the public mirrors
would likely not happen in the same cron.unchecked run.

With Debian LTS, uploads would go to both the build queues and trigger a
public mirror push. If the mirror push takes more than three minutes,
cron.buildd would however not notify w-b of changes.

This patch moves the w-b notification right behind the update of the
build queues and before the mirror push to avoid the problem. Ideally
we would not rely on anything happening within the last three minutes
though.

With "wheezy" being used for Debian LTS, the archive needs to be
published not only when policy queue uploads are accepted, but also
when direct uploads to "wheezy" arrive.

The same applies to uploads to "jessie-kfreebsd".

This patch removes the old implementation of generate-packages-sources
that used apt-ftparchive instead of the metadata in the Postgres
database.

Signed-off-by: NAnsgar Burchardt <ansgar@debian.org>

bsd-mailx no longer allows passing options to sendmail since the last
security update (8.1.2-0.20111106cvs-1+deb7u1). These are now
understood as additional recipient addresses and cause errors.

Reference: https://www.debian.org/security/2014/dsa-3104

Reference: <http://bugs.debian.org/706929>

The security archive now has oldstable (squeeze) and stable (wheezy).
Update the suite lists accordingly.

The new testing (jessie) suite is not working yet and shouldn't be added
to obsolete parts of the configuration (such as old-style build queues).

Signed-off-by: NMark Hymers <mhy@debian.org>

This saves one run for uploads that are automatically accepted from the
policy queues (eg. buildd uploads for an already accepted source).

The directories will not be created by dak export / dak export-suite if
they have no files to put there.

Otherwise outdated symlinks will be kept around for a while after
dak new-security-install was run until cron.unchecked does some real
work again.

This avoids triggering the taint check in spawn().

config/debian-security/cron.unchecked: just run process-policy to see if there were files to process

apt-ftparchive appends '.src' on its own when generating Sources.

First set of updates for multiarchive changes.

Signed-off-by: NAnsgar Burchardt <ansgar@debian.org>

minimal change to correctly publish auto-accepted security stuff even without an extra dsa OR a simultaneous event in the unchecked queue
Signed-off-by: NJoerg Jaspert <joerg@debian.org>

We don't want process-upload and generate-packages-sources2 or similar
combinations running at the same time. So just create a lock around such
sections.

Signed-off-by: NJoerg Jaspert <joerg@debian.org>

Signed-off-by: NJoerg Jaspert <joerg@debian.org>

they are now using dak manage-build-queue
also adjust the way the trigger gets generated
Signed-off-by: NJoerg Jaspert <joerg@debian.org>

Signed-off-by: NJoerg Jaspert <joerg@debian.org>

Signed-off-by: NJoerg Jaspert <joerg@debian.org>
Signed-off-by: NJoerg Jaspert <joerg@debian.org>