From 790dfcc48b22e1a24a9c6cb6fba47da0ae7235c8 Mon Sep 17 00:00:00 2001
From: Adam Samalik <asamalik@redhat.com>
Date: Aug 15 2023 15:54:22 +0000
Subject: [PATCH 1/2] allow keeping both to and from tags after signing


Signed-off-by: Adam Samalik <asamalik@redhat.com>

---

diff --git a/robosignatory.toml b/robosignatory.toml
index 28c1a7b..06063f9 100644
--- a/robosignatory.toml
+++ b/robosignatory.toml
@@ -121,6 +121,7 @@ handlers = ["console"]
             file_signing_key = 'fedora-file-signing'
             keyid = 'xxxxxxxx'
             type = 'modular'
+            skip_untagging = false # (optional) Set if you want to keep the build in both "from" and "to"
 
     [consumer_config.ostree_refs]
         [consumer_config.ostree_refs."fedora-atomic/25/x86_64/docker-host"]
diff --git a/robosignatory/tag.py b/robosignatory/tag.py
index f65f22f..8fc1003 100644
--- a/robosignatory/tag.py
+++ b/robosignatory/tag.py
@@ -60,6 +60,13 @@ class TagSigner:
                     raise Exception('Invalid tag type detected: %s' % tag_type)
                 instance_obj['tags'][tag['from']]['type'] = tag_type
 
+                skip_untagging = tag.get('skip_untagging')
+                if skip_untagging is None:
+                    skip_untagging = False
+                elif not isinstance(skip_untagging, bool):
+                    raise Exception('The "skip_untagging" option must be bool')
+                instance_obj['tags'][tag['from']]['skip_untagging'] = skip_untagging
+
                 sidetags = tag.get('sidetags')
                 if not sidetags:
                     continue
@@ -236,7 +243,11 @@ class TagSigner:
             if tag == tag_to:
                 log.info('Non-gated, not moving')
             else:
-                instance['client'].tagBuild(tag_to, build_id, False, tag)
+                if tag_info['skip_untagging']:
+                    log.info('Keeping the original tag as well')
+                    instance['client'].tagBuild(tag_to, build_id, False, None)
+                else:
+                    instance['client'].tagBuild(tag_to, build_id, False, tag)
 
     def signwrite_module(self, build_nvr, build_id, tag_info, instance, koji_instance):
         log.info('Signing module build %s', build_nvr)

From 7705fbcd9a1ba418da522e741e8f9d4a589b024d Mon Sep 17 00:00:00 2001
From: Adam Samalik <asamalik@redhat.com>
Date: Aug 17 2023 11:19:51 +0000
Subject: [PATCH 2/2] add tests for skip_untagging


Signed-off-by: Adam Samalik <asamalik@redhat.com>

---

diff --git a/tests/test_tag.py b/tests/test_tag.py
index d002247..d196c91 100644
--- a/tests/test_tag.py
+++ b/tests/test_tag.py
@@ -70,6 +70,23 @@ TEST_CONFIG = {
                     'file_signing_key': 'file-sign-key',
                     'type': 'modular',
                 },
+                {
+                    'from': 'c9s-pending',
+                    'to': 'c9s-pending-signed',
+                    'key': 'fedora-30',
+                    'keyid': 'OU812I81B4U',
+                    'file_signing_key': 'file-sign-key',
+                    'skip_untagging': True
+                },
+                {
+                    'from': 'el9-modules-pending',
+                    'to': 'el9-modules-pending-signed',
+                    'key': 'fedora-30',
+                    'keyid': 'OU812I81B4U',
+                    'file_signing_key': 'file-sign-key',
+                    'type': 'modular',
+                    'skip_untagging': True
+                },
             ],
         },
     },
@@ -392,6 +409,50 @@ class TestTagSigner:
     @mock.patch('robosignatory.tag.utils', new_callable=MockUtils())
     @mark.parametrize(
         'type_',
+        ((None),
+         ('plain'),
+         ('modular')))
+    def test_skip_untagging(self, utils, caplog, type_):
+        """Test the skip_untagging option."""
+        caplog.set_level(logging.DEBUG)
+
+        body = self.test_msg['body']
+        build_nvr = '{name}-{version}-{release}'.format(**body)
+        from_tag = body['tag'] = 'c9s-pending'
+        build_id = body['build_id']
+        tag_conf = self.instance_obj['tags'][from_tag]
+        to_tag = tag_conf['to'] = 'c9s-pending-signed'
+        tagger = None
+        build_owner = None
+
+        if type_ == 'modular':
+            body['tag'] = from_tag = 'el9-modules-pending'
+            to_tag = 'el9-modules-pending-signed'
+            build_owner = TEST_CONFIG['koji_instances']['test']['mbs_user']
+
+            self.koji_client.listTagged.return_value = [
+                {'owner_name': build_owner, 'nvr': build_nvr, 'build_id': build_id}
+            ]
+
+        expected_log_msgs, expected_exc_ctx = self._get_expected_messages_and_exceptions(
+            None, None, build_owner, tag_conf, tagger
+        )
+
+        msg = Message(**self.test_msg)
+        with expected_exc_ctx:
+            self.tag_signer.consume(msg)
+
+        # Equivalent to caplog.messages but compatible with pytest < 3.7
+        logged_messages = [record.getMessage() for record in caplog.records]
+
+        for msg in expected_log_msgs:
+            assert msg in logged_messages
+
+        self.koji_client.tagBuild.assert_called_once_with(to_tag, build_id, False, None)
+
+    @mock.patch('robosignatory.tag.utils', new_callable=MockUtils())
+    @mark.parametrize(
+        'type_',
         (('plain'),
          ('modular'),))
     def test_file_signing_key(self, utils, caplog, type_):