From ffc5b0b8e967527127af1df7c63a566786e08d3c Mon Sep 17 00:00:00 2001 From: Mike Fiedler Date: Mon, 6 Oct 2025 13:49:08 -0400 Subject: [PATCH 1/3] fix: disallow uppercase values in GitLab publishers The API and claims generated from GitLab will be desensitized when generating JWTs. Instead of updating the regular expression and using the same generic error message, create a custom validator with a custom message. Resolves #18797 Signed-off-by: Mike Fiedler --- tests/unit/oidc/forms/test_gitlab.py | 10 ++++++++++ warehouse/oidc/forms/gitlab.py | 14 ++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/tests/unit/oidc/forms/test_gitlab.py b/tests/unit/oidc/forms/test_gitlab.py index c6b494c06d11..f4c76179404a 100644 --- a/tests/unit/oidc/forms/test_gitlab.py +++ b/tests/unit/oidc/forms/test_gitlab.py @@ -152,6 +152,16 @@ def test_validate(self, data): }, {"project": "some", "namespace": "some", "workflow_filepath": None}, {"project": "some", "namespace": "some", "workflow_filepath": ""}, + { + "namespace": "some-owner", + "project": "CaseSensitive", + "workflow_filepath": "some-workflow.yml", + }, + { + "namespace": "CaseSensitive", + "project": "some-repo", + "workflow_filepath": "some-workflow.yml", + }, ], ) def test_validate_basic_invalid_fields(self, data): diff --git a/warehouse/oidc/forms/gitlab.py b/warehouse/oidc/forms/gitlab.py index 00b100cf5a51..2667d75092e6 100644 --- a/warehouse/oidc/forms/gitlab.py +++ b/warehouse/oidc/forms/gitlab.py @@ -22,6 +22,18 @@ def ends_with_atom_or_git(form: wtforms.Form, field: wtforms.Field) -> None: raise wtforms.validators.ValidationError(_("Name ends with .git or .atom")) +def _lowercase_only(form: wtforms.Form, field: wtforms.Field) -> None: + """ + GitLab API is case-insensitive for namespaces and projects. + Instead of changing the regular expressions to remove uppercase letters, + we add this additional validator to ensure that users only enter lowercase + characters, and provide a clear error message if they do not. + """ + field_value = typing.cast(str, field.data) + if field_value != field_value.lower(): + raise wtforms.validators.ValidationError(_("Value must be lowercase")) + + class GitLabPublisherBase(wtforms.Form): __params__ = ["namespace", "project", "workflow_filepath", "environment"] @@ -31,6 +43,7 @@ class GitLabPublisherBase(wtforms.Form): message=_("Specify GitLab namespace (username or group/subgroup)"), ), ends_with_atom_or_git, + _lowercase_only, wtforms.validators.Regexp( _VALID_GITLAB_NAMESPACE, message=_("Invalid GitLab username or group/subgroup name."), @@ -46,6 +59,7 @@ class GitLabPublisherBase(wtforms.Form): validators=[ wtforms.validators.InputRequired(message=_("Specify project name")), ends_with_atom_or_git, + _lowercase_only, wtforms.validators.Regexp( _VALID_GITLAB_PROJECT, message=_("Invalid project name") ), From ba889fd7d323186636f8e18c63c38cd9d00280ed Mon Sep 17 00:00:00 2001 From: Mike Fiedler Date: Mon, 6 Oct 2025 13:53:16 -0400 Subject: [PATCH 2/3] make translations Signed-off-by: Mike Fiedler --- warehouse/locale/messages.pot | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/warehouse/locale/messages.pot b/warehouse/locale/messages.pot index e396b50bed4e..5530083fe7d1 100644 --- a/warehouse/locale/messages.pot +++ b/warehouse/locale/messages.pot @@ -394,7 +394,7 @@ msgid "Select project" msgstr "" #: warehouse/manage/forms.py:507 warehouse/oidc/forms/_core.py:36 -#: warehouse/oidc/forms/gitlab.py:47 +#: warehouse/oidc/forms/gitlab.py:60 msgid "Specify project name" msgstr "" @@ -677,7 +677,7 @@ msgid "Expired invitation for '${username}' deleted." msgstr "" #: warehouse/oidc/forms/_core.py:38 warehouse/oidc/forms/_core.py:49 -#: warehouse/oidc/forms/gitlab.py:50 warehouse/oidc/forms/gitlab.py:54 +#: warehouse/oidc/forms/gitlab.py:64 warehouse/oidc/forms/gitlab.py:68 msgid "Invalid project name" msgstr "" @@ -827,27 +827,31 @@ msgstr "" msgid "Name ends with .git or .atom" msgstr "" -#: warehouse/oidc/forms/gitlab.py:31 +#: warehouse/oidc/forms/gitlab.py:34 +msgid "Value must be lowercase" +msgstr "" + +#: warehouse/oidc/forms/gitlab.py:43 msgid "Specify GitLab namespace (username or group/subgroup)" msgstr "" -#: warehouse/oidc/forms/gitlab.py:36 warehouse/oidc/forms/gitlab.py:40 +#: warehouse/oidc/forms/gitlab.py:49 warehouse/oidc/forms/gitlab.py:53 msgid "Invalid GitLab username or group/subgroup name." msgstr "" -#: warehouse/oidc/forms/gitlab.py:62 +#: warehouse/oidc/forms/gitlab.py:76 msgid "Specify top-level pipeline file path" msgstr "" -#: warehouse/oidc/forms/gitlab.py:71 +#: warehouse/oidc/forms/gitlab.py:85 msgid "Invalid environment name" msgstr "" -#: warehouse/oidc/forms/gitlab.py:86 +#: warehouse/oidc/forms/gitlab.py:100 msgid "Top-level pipeline file path must end with .yml or .yaml" msgstr "" -#: warehouse/oidc/forms/gitlab.py:90 +#: warehouse/oidc/forms/gitlab.py:104 msgid "Top-level pipeline file path cannot start or end with /" msgstr "" From 50cc6e4a589628992e33b6dae8aa87d9aac05cbd Mon Sep 17 00:00:00 2001 From: Mike Fiedler Date: Mon, 6 Oct 2025 14:09:00 -0400 Subject: [PATCH 3/3] docs: add a callout on lowercase Signed-off-by: Mike Fiedler --- docs/user/trusted-publishers/adding-a-publisher.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/user/trusted-publishers/adding-a-publisher.md b/docs/user/trusted-publishers/adding-a-publisher.md index 8f9643a0c24f..34498923df6c 100644 --- a/docs/user/trusted-publishers/adding-a-publisher.md +++ b/docs/user/trusted-publishers/adding-a-publisher.md @@ -117,6 +117,13 @@ each. **optionally** provide the name of a [GitLab CI/CD environment](https://docs.gitlab.com/ee/ci/environments/). + !!! note + + The repository's namepsace and name must be provided as lowercase. + For example, if your project is at `https://gitlab.com/NameSpace/SampleProject`, + you must enter `namespace` as the namespace and `sampleproject` as the + project name. + For example, if you have a project at `https://gitlab.com/namespace/sampleproject` with a top-level pipeline defined in `.gitlab-ci.yml` and a custom environment named `release`, then you'd do the following: