Add latest changes from gitlab-org/gitlab@master

14 files changed, 187 insertions, 28 deletions

diff --git a/app/finders/merge_requests_finder.rb b/app/finders/merge_requests_finder.rb
index 978550aedaf..87c190bdc45 100644
--- a/app/finders/merge_requests_finder.rb
+++ b/app/finders/merge_requests_finder.rb
@@ -84,7 +84,7 @@ class MergeRequestsFinder < IssuableFinder
   def by_commit(items)
     return items unless params[:commit_sha].presence
 
-    items.by_commit_sha(params[:commit_sha])
+    items.by_related_commit_sha(params[:commit_sha])
   end
 
   def source_branch
diff --git a/app/graphql/mutations/concerns/mutations/authorizes_project.rb b/app/graphql/mutations/concerns/mutations/authorizes_project.rb
deleted file mode 100644
index 87341525d6c..00000000000
--- a/app/graphql/mutations/concerns/mutations/authorizes_project.rb
+++ /dev/null
@@ -1,17 +0,0 @@
-# frozen_string_literal: true
-
-module Mutations
-  module AuthorizesProject
-    include ResolvesProject
-
-    def authorized_find_project!(full_path:)
-      authorized_find!(full_path: full_path)
-    end
-
-    private
-
-    def find_object(full_path:)
-      resolve_project(full_path: full_path)
-    end
-  end
-end
diff --git a/app/graphql/mutations/concerns/mutations/finds_project.rb b/app/graphql/mutations/concerns/mutations/finds_project.rb
new file mode 100644
index 00000000000..577f9dc90f8
--- /dev/null
+++ b/app/graphql/mutations/concerns/mutations/finds_project.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Mutations
+  module FindsProject
+    private
+
+    def find_object(full_path)
+      Project.find_by_full_path(full_path)
+    end
+  end
+end
diff --git a/app/graphql/types/project_type.rb b/app/graphql/types/project_type.rb
index a7d9548610e..195da01f41f 100644
--- a/app/graphql/types/project_type.rb
+++ b/app/graphql/types/project_type.rb
@@ -315,9 +315,6 @@ module Types
           description: 'Pipeline analytics',
           resolver: Resolvers::ProjectPipelineStatisticsResolver
 
-    field :total_pipeline_duration, GraphQL::INT_TYPE, null: true,
-          description: 'Total pipeline duration for all of the pipelines in a project'
-
     def label(title:)
       BatchLoader::GraphQL.for(title).batch(key: project) do |titles, loader, args|
         LabelsFinder
@@ -362,10 +359,6 @@ module Types
       project.container_repositories.size
     end
 
-    def total_pipeline_duration
-      object.all_pipelines.total_duration
-    end
-
     private
 
     def project
diff --git a/app/models/concerns/packages/debian/distribution.rb b/app/models/concerns/packages/debian/distribution.rb
new file mode 100644
index 00000000000..2420f10f38a
--- /dev/null
+++ b/app/models/concerns/packages/debian/distribution.rb
@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module Packages
+  module Debian
+    module Distribution
+      extend ActiveSupport::Concern
+
+      included do
+        include FileStoreMounter
+
+        def self.container_foreign_key
+          "#{container_type}_id".to_sym
+        end
+
+        alias_attribute :container, container_type
+        alias_attribute :container_id, "#{container_type}_id"
+
+        belongs_to container_type
+        belongs_to :creator, class_name: 'User'
+
+        validates :codename,
+          presence: true,
+          uniqueness: { scope: [container_foreign_key] },
+          format: { with: Gitlab::Regex.debian_distribution_regex }
+
+        validates :suite,
+          allow_nil: true,
+          format: { with: Gitlab::Regex.debian_distribution_regex }
+        validates :suite,
+          uniqueness: { scope: [container_foreign_key] },
+          if: :suite
+
+        validate :unique_codename_and_suite
+
+        validates :origin,
+          allow_nil: true,
+          format: { with: Gitlab::Regex.debian_distribution_regex }
+
+        validates :label,
+          allow_nil: true,
+          format: { with: Gitlab::Regex.debian_distribution_regex }
+
+        validates :version,
+          allow_nil: true,
+          format: { with: Gitlab::Regex.debian_version_regex }
+
+        # The Valid-Until field is a security measure to prevent malicious attackers to
+        # serve an outdated repository, with vulnerable packages
+        # (keeping in mind that most Debian repository are not using TLS but use GPG
+        # signatures instead).
+        # A minimum of 24 hours is simply to avoid generating indices too often
+        # (which generates load).
+        # Official Debian repositories are generated 4 times a day, and valid for 7 days.
+        # Full ref: https://wiki.debian.org/DebianRepository/Format#Date.2C_Valid-Until
+        validates :valid_time_duration_seconds,
+          allow_nil: true,
+          numericality: { greater_than_or_equal_to: 24.hours.to_i }
+
+        validates container_type, presence: true
+        validates :file_store, presence: true
+
+        validates :file_signature, absence: true
+        validates :signing_keys, absence: true
+
+        scope :with_container, ->(subject) { where(container_type => subject) }
+        scope :with_codename, ->(codename) { where(codename: codename) }
+        scope :with_suite, ->(suite) { where(suite: suite) }
+
+        attr_encrypted :signing_keys,
+                       mode: :per_attribute_iv,
+                       key: Settings.attr_encrypted_db_key_base_truncated,
+                       algorithm: 'aes-256-gcm',
+                       encode: false,
+                       encode_iv: false
+
+        mount_file_store_uploader Packages::Debian::DistributionReleaseFileUploader
+
+        def needs_update?
+          !file.exists? || time_duration_expired?
+        end
+
+        private
+
+        def time_duration_expired?
+          return false unless valid_time_duration_seconds.present?
+
+          updated_at + valid_time_duration_seconds.seconds + 6.hours < Time.current
+        end
+
+        def unique_codename_and_suite
+          errors.add(:codename, _('has already been taken as Suite')) if codename_exists_as_suite?
+          errors.add(:suite, _('has already been taken as Codename')) if suite_exists_as_codename?
+        end
+
+        def codename_exists_as_suite?
+          return false unless codename.present?
+
+          self.class.with_container(container).with_suite(codename).exists?
+        end
+
+        def suite_exists_as_codename?
+          return false unless suite.present?
+
+          self.class.with_container(container).with_codename(suite).exists?
+        end
+      end
+    end
+  end
+end
diff --git a/app/models/group.rb b/app/models/group.rb
index 739135e82dd..903d0154969 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -75,6 +75,9 @@ class Group < Namespace
   has_many :dependency_proxy_blobs, class_name: 'DependencyProxy::Blob'
   has_many :dependency_proxy_manifests, class_name: 'DependencyProxy::Manifest'
 
+  # debian_distributions must be destroyed by ruby code in order to properly remove carrierwave uploads
+  has_many :debian_distributions, class_name: 'Packages::Debian::GroupDistribution', dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
+
   accepts_nested_attributes_for :variables, allow_destroy: true
 
   validate :visibility_level_allowed_by_projects
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index db066184e91..3918498f694 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -261,6 +261,19 @@ class MergeRequest < ApplicationRecord
   scope :by_merge_commit_sha, -> (sha) do
     where(merge_commit_sha: sha)
   end
+  scope :by_squash_commit_sha, -> (sha) do
+    where(squash_commit_sha: sha)
+  end
+  scope :by_related_commit_sha, -> (sha) do
+    from_union(
+      [
+        by_commit_sha(sha),
+        by_squash_commit_sha(sha),
+        by_merge_commit_sha(sha)
+      ],
+      remove_duplicates: false
+    )
+  end
   scope :by_cherry_pick_sha, -> (sha) do
     joins(:notes).where(notes: { commit_id: sha })
   end
diff --git a/app/models/packages/debian/group_distribution.rb b/app/models/packages/debian/group_distribution.rb
new file mode 100644
index 00000000000..eea7acacc96
--- /dev/null
+++ b/app/models/packages/debian/group_distribution.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class Packages::Debian::GroupDistribution < ApplicationRecord
+  def self.container_type
+    :group
+  end
+
+  include Packages::Debian::Distribution
+end
diff --git a/app/models/packages/debian/project_distribution.rb b/app/models/packages/debian/project_distribution.rb
new file mode 100644
index 00000000000..a73c12d172d
--- /dev/null
+++ b/app/models/packages/debian/project_distribution.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class Packages::Debian::ProjectDistribution < ApplicationRecord
+  def self.container_type
+    :project
+  end
+
+  include Packages::Debian::Distribution
+end
diff --git a/app/models/project.rb b/app/models/project.rb
index 74f37d7e67c..fdb16640cb4 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -200,6 +200,8 @@ class Project < ApplicationRecord
   # Packages
   has_many :packages, class_name: 'Packages::Package'
   has_many :package_files, through: :packages, class_name: 'Packages::PackageFile'
+  # debian_distributions must be destroyed by ruby code in order to properly remove carrierwave uploads
+  has_many :debian_distributions, class_name: 'Packages::Debian::ProjectDistribution', dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
 
   has_one :import_state, autosave: true, class_name: 'ProjectImportState', inverse_of: :project
   has_one :import_export_upload, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
diff --git a/app/services/merge_requests/close_service.rb b/app/services/merge_requests/close_service.rb
index ab0e7e4ad06..f83b14c7269 100644
--- a/app/services/merge_requests/close_service.rb
+++ b/app/services/merge_requests/close_service.rb
@@ -18,7 +18,7 @@ module MergeRequests
         notification_service.async.close_mr(merge_request, current_user)
         todo_service.close_merge_request(merge_request, current_user)
         execute_hooks(merge_request, 'close')
-        invalidate_cache_counts(merge_request, users: merge_request.assignees)
+        invalidate_cache_counts(merge_request, users: merge_request.assignees | merge_request.reviewers)
         merge_request.update_project_counter_caches
         cleanup_environments(merge_request)
         abort_auto_merge(merge_request, 'merge request was closed')
diff --git a/app/services/merge_requests/post_merge_service.rb b/app/services/merge_requests/post_merge_service.rb
index 17afb04ac11..f04ec3c3e80 100644
--- a/app/services/merge_requests/post_merge_service.rb
+++ b/app/services/merge_requests/post_merge_service.rb
@@ -18,7 +18,7 @@ module MergeRequests
       merge_request_activity_counter.track_merge_mr_action(user: current_user)
       notification_service.merge_mr(merge_request, current_user)
       execute_hooks(merge_request, 'merge')
-      invalidate_cache_counts(merge_request, users: merge_request.assignees)
+      invalidate_cache_counts(merge_request, users: merge_request.assignees | merge_request.reviewers)
       merge_request.update_project_counter_caches
       delete_non_latest_diffs(merge_request)
       cancel_review_app_jobs!(merge_request)
diff --git a/app/services/merge_requests/reopen_service.rb b/app/services/merge_requests/reopen_service.rb
index fde50bd959f..35c50d63da0 100644
--- a/app/services/merge_requests/reopen_service.rb
+++ b/app/services/merge_requests/reopen_service.rb
@@ -13,7 +13,7 @@ module MergeRequests
         execute_hooks(merge_request, 'reopen')
         merge_request.reload_diff(current_user)
         merge_request.mark_as_unchecked
-        invalidate_cache_counts(merge_request, users: merge_request.assignees)
+        invalidate_cache_counts(merge_request, users: merge_request.assignees | merge_request.reviewers)
         merge_request.update_project_counter_caches
         merge_request.cache_merge_request_closes_issues!(current_user)
         merge_request.cleanup_schedule&.destroy
diff --git a/app/uploaders/packages/debian/distribution_release_file_uploader.rb b/app/uploaders/packages/debian/distribution_release_file_uploader.rb
new file mode 100644
index 00000000000..9a30aac6396
--- /dev/null
+++ b/app/uploaders/packages/debian/distribution_release_file_uploader.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+class Packages::Debian::DistributionReleaseFileUploader < GitlabUploader
+  extend Workhorse::UploadPath
+  include ObjectStorage::Concern
+
+  storage_options Gitlab.config.packages
+
+  after :store, :schedule_background_upload
+
+  alias_method :upload, :model
+
+  def filename
+    'Release'
+  end
+
+  def store_dir
+    dynamic_segment
+  end
+
+  private
+
+  def dynamic_segment
+    raise ObjectNotReadyError, 'Package model not ready' unless model.id
+
+    Gitlab::HashedPath.new("debian_#{model.class.container_type}_distribution", model.id, root_hash: model.container_id)
+  end
+end