Merge branch '3.5.x'

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+- package-ecosystem: "pip"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+- package-ecosystem: "pip"
+  directory: "/builder"
+  schedule:
+    interval: "weekly"
+- package-ecosystem: "pip"
+  directory: "/builder/osx"
+  schedule:
+    interval: "weekly"

.github/workflows/build_release.yml

@@ -2,12 +2,14 @@ name: Build binaries and source distribution
 
 on: [push, pull_request]
 
+env:
+  AUTOMATION_GITHUB_TOKEN: ${{ secrets.AUTOMATION_GITHUB_TOKEN }}
+
 jobs:
   build_windows:
     name: Build Windows binary
     runs-on: windows-latest
-    env:
-      AUTOMATION_GITHUB_TOKEN: ${{ secrets.AUTOMATION_GITHUB_TOKEN }}
+    timeout-minutes: 15
     steps:
     - uses: actions/checkout@v2
     - name: Set up Python 3.10 (64bit)
@@ -65,11 +67,11 @@ jobs:
   build_macos:
     name: Build macOS binary
     runs-on: macos-11
+    timeout-minutes: 15
     env:
       SIGNING_AUTH: ${{ secrets.SIGNING_AUTH }}
       NOTARIZATION_USER: ${{ secrets.NOTARIZATION_USER }}
       NOTARIZATION_PASS: ${{ secrets.NOTARIZATION_PASS }}
-      AUTOMATION_GITHUB_TOKEN: ${{ secrets.AUTOMATION_GITHUB_TOKEN }}
       # We need the official Python, because the GA ones only support newer macOS versions
       # The deployment target is picked up by the Python build tools automatically
       # If updated, make sure to also set LSMinimumSystemVersion in SABnzbd.spec
@@ -108,8 +110,8 @@ jobs:
         pip3 install --upgrade -r requirements.txt --no-binary sabyenc3
         
         pip3 uninstall cryptography -y
-        pip3 download cryptography --platform macosx_10_10_universal2 --only-binary :all: --no-deps --dest .
-        pip3 install cryptography --no-cache-dir --no-index --find-links .
+        pip3 download -r builder/osx/requirements.txt --platform macosx_10_10_universal2 --only-binary :all: --no-deps --dest .
+        pip3 install -r builder/osx/requirements.txt --no-cache-dir --no-index --find-links .
         
         PYINSTALLER_COMPILE_BOOTLOADER=1 pip3 install --upgrade -r builder/requirements.txt --no-binary pyinstaller
     - name: Import macOS codesign certificates

PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 1.0
 Name: SABnzbd
-Version: 3.5.0
-Summary: SABnzbd-3.5.0
+Version: 3.5.1
+Summary: SABnzbd-3.5.1
 Home-page: https://sabnzbd.org
 Author: The SABnzbd Team
 Author-email: team@sabnzbd.org

README.mkd

@@ -1,21 +1,30 @@
-Release Notes - SABnzbd 3.5.0
+Release Notes - SABnzbd 3.5.1
 =========================================================
 
+## Changes and bugfixes since 3.5.0
+- Prevent permissions errors on systems that do not support them.
+- Small changes in file assembly and Direct Unpack processing.
+- Changes to the transition from download to active post-processing.
+- Malformed NZB files could result in a crash.
+- Prevent crash in Direct Unpack for obfuscated posts.
+- RSS feeds with HTML-characters in the name resulted in crashes.
+- macOS: failed to start on older macOS versions.
+
 ## Changes since 3.4.2
 - Removed Python 3.6 support.
 - SOCKS5 proxy support for all outgoing connections.
 - Restored support for UUencoded jobs.
 - `Required` server option: in case of connection failures, the queue
   will be paused for a few minutes instead of skipping the server.
 - Added Special option to preserve paused state after a restart.
-- Show an estimated time-left indicator for repair and unpacking. 
+- Show an estimated time-left indicator for repair and unpacking.
 - Require TLS version 1.2 or higher for SSL news server connections.
 - Setting custom ciphers forces the maximum TLS version to 1.2.
 - Reduced memory usage during and after parsing `.nzb` files.
 - Handle multiple passwords stored in NZB-file.
 - macOS/Linux: `Permissions` are only applied if any are set.
 - macOS/Windows: updated to Python 3.10.2.
-- macOS: run native on M1 systems. However, included tools 
+- macOS: run native on M1 systems. However, included tools
   (`par2`, `unrar` and `7za`) still require Rosetta emulation.
 - Snap: updated to `core20` base and restore 7zip support.
 
@@ -33,8 +42,8 @@ Release Notes - SABnzbd 3.5.0
 - Windows: print low-level Windows error on `IOError`.
 
 ## Upgrade notices
-- The download statistics file `totals10.sab` is updated in 3.2.x 
-  version. If you downgrade to 3.1.x or lower, all detailed download 
+- The download statistics file `totals10.sab` is updated in 3.2.x
+  version. If you downgrade to 3.1.x or lower, detailed download
   statistics will be lost.
 
 ## Known problems and solutions

builder/osx/requirements.txt

@@ -0,0 +1,3 @@
+# Special requirements for macOS universal2 binary release
+# This way dependabot can auto-update them
+cryptography==36.0.1

builder/package.py

@@ -20,10 +20,14 @@
 import re
 import sys
 import os
+import tempfile
 import time
 import shutil
 import subprocess
 import tarfile
+import urllib.request
+import urllib.error
+import configobj
 import pkginfo
 import github
 
@@ -114,6 +118,62 @@ def patch_version_file(release_name):
         ver.write(version_file)
 
 
+def test_sab_binary(binary_path: str):
+    """Wrapper to have a simple start-up test for the binary"""
+    with tempfile.TemporaryDirectory() as config_dir:
+        sabnzbd_process = subprocess.Popen(
+            [binary_path, "--browser", "0", "--logging", "2", "--config", config_dir],
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+        )
+
+        # Wait for SAB to respond
+        base_url = "http://127.0.0.1:8080/"
+        for _ in range(10):
+            try:
+                urllib.request.urlopen(base_url, timeout=1).read()
+                break
+            except urllib.error.URLError:
+                time.sleep(1)
+        else:
+            raise urllib.error.URLError("Could not connect to SABnzbd")
+
+        # Open a number of API calls and pages, to see if we are really up
+        pages_to_test = [
+            "",
+            "wizard",
+            "config",
+            "config/server",
+            "config/categories",
+            "config/scheduling",
+            "config/rss",
+            "config/general",
+            "config/folders",
+            "config/switches",
+            "config/sorting",
+            "config/notify",
+            "config/special",
+            "api?mode=version",
+        ]
+        for url in pages_to_test:
+            print("Testing: %s%s" % (base_url, url))
+            if b"500 Internal Server Error" in urllib.request.urlopen(base_url + url, timeout=1).read():
+                raise RuntimeError("Crash in %s" % url)
+
+        # Parse API-key so we can do a graceful shutdown
+        sab_config = configobj.ConfigObj(os.path.join(config_dir, "sabnzbd.ini"))
+        urllib.request.urlopen(base_url + "shutdown/?apikey=" + sab_config["misc"]["api_key"], timeout=10)
+        sabnzbd_process.wait()
+
+        # Print logs for verification
+        with open(os.path.join(config_dir, "logs", "sabnzbd.log"), "r") as log_file:
+            print(log_file.read())
+
+        # So we have time to print the file before the directory is removed
+        time.sleep(1)
+
+
 if __name__ == "__main__":
     # Was any option supplied?
     if len(sys.argv) < 2:
@@ -226,11 +286,14 @@ def patch_version_file(release_name):
             )
 
         # Rename the folder
-        os.rename("dist/SABnzbd", RELEASE_NAME)
+        shutil.copytree("dist/SABnzbd", RELEASE_NAME)
 
         # Create the archive
         run_external_command(["win/7zip/7za.exe", "a", RELEASE_BINARY, RELEASE_NAME])
 
+        # Test the release, as the very last step to not mess with any release code
+        test_sab_binary("dist/SABnzbd/SABnzbd.exe")
+
     if "app" in sys.argv:
         # Must be run on macOS
         if sys.platform != "darwin":
@@ -296,50 +359,24 @@ def patch_version_file(release_name):
 
                 # Upload to Apple
                 print("Sending zip to Apple notarization service")
-                upload_process = run_external_command(
+                upload_result = run_external_command(
                     [
                         "xcrun",
-                        "altool",
-                        "--notarize-app",
-                        "-t",
-                        "osx",
-                        "-f",
+                        "notarytool",
+                        "submit",
                         notarization_zip,
-                        "--primary-bundle-id",
-                        "org.sabnzbd.sabnzbd",
-                        "-u",
+                        "--apple-id",
                         notarization_user,
-                        "-p",
+                        "--team-id",
+                        authority,
+                        "--password",
                         notarization_pass,
+                        "--wait",
                     ],
                 )
 
-                # Extract the notarization ID
-                m = re.match(".*RequestUUID = (.*?)\n", upload_process, re.S)
-                if not m:
-                    raise RuntimeError("No UUID created")
-                uuid = m.group(1)
-
-                print("Checking notarization of UUID: %s (every 30 seconds)" % uuid)
-                notarization_in_progress = True
-                while notarization_in_progress:
-                    time.sleep(30)
-                    check_status = run_external_command(
-                        [
-                            "xcrun",
-                            "altool",
-                            "--notarization-info",
-                            uuid,
-                            "-u",
-                            notarization_user,
-                            "-p",
-                            notarization_pass,
-                        ],
-                    )
-                    notarization_in_progress = "Status: in progress" in check_status
-
                 # Check if success
-                if "Status: success" not in check_status:
+                if "status: accepted" not in upload_result.lower():
                     raise RuntimeError("Failed to notarize..")
 
                 # Staple the notarization!
@@ -352,6 +389,9 @@ def patch_version_file(release_name):
         else:
             print("Signing skipped, missing SIGNING_AUTH.")
 
+        # Test the release, as the very last step to not mess with any release code
+        test_sab_binary("dist/SABnzbd.app/Contents/MacOS/SABnzbd")
+
     if "source" in sys.argv:
         # Prepare Source distribution package.
         # We assume the sources are freshly cloned from the repo

builder/requirements.txt

@@ -1,9 +1,18 @@
 # Basic build requirements
-pyinstaller>=4.8
-setuptools
-pkginfo
+# Note that not all sub-dependencies are listed, but only ones we know could cause trouble
+pyinstaller==4.8
+pyinstaller-hooks-contrib==2022.0
+altgraph==0.17.2
+wrapt==1.13.3
+setuptools==60.6.0
+pkginfo==1.8.2
+PyGithub==1.55
+charset-normalizer==2.0.11
 certifi
-pygithub
 
-# For the OSX build specific
-dmgbuild; sys_platform == 'darwin'
+# For the macOS build
+dmgbuild==1.5.2; sys_platform == 'darwin'
+mac-alias==2.2.0; sys_platform == 'darwin'
+macholib==1.15.2; sys_platform == 'darwin'
+ds-store==1.3.0; sys_platform == 'darwin'
+PyNaCl==1.5.0; sys_platform == 'darwin'