From 242d6f1465c1c84272420db34fe4f1df09c38fdc Mon Sep 17 00:00:00 2001 From: Ralph Bean Date: May 02 2017 15:17:05 +0000 Subject: Allow a configurable set of base modules. Do this, instead of hard-coding the name "base-runtime". Signed-off-by: Ralph Bean --- diff --git a/fedmsg.d/example-config.py b/fedmsg.d/example-config.py index a82ddd5..5ae880f 100644 --- a/fedmsg.d/example-config.py +++ b/fedmsg.d/example-config.py @@ -6,6 +6,7 @@ config = { 'robosignatory.enabled.atomicsigner': True, 'robosignatory.pdc_url': 'https://pdc.fedoraproject.org/rest_api/v1', 'robosignatory.module_prefixes': ['module-'], + 'robosignatory.base_module_names': ['base-runtime'], 'robosignatory.signing': { # This should be the name of an entrypoint plugin that provides diff --git a/robosignatory/tagconsumer.py b/robosignatory/tagconsumer.py index 2348713..e80c89d 100644 --- a/robosignatory/tagconsumer.py +++ b/robosignatory/tagconsumer.py @@ -29,6 +29,8 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): self.module_prefixes = \ tuple(self.config['robosignatory.module_prefixes']) + self.valid_base_module_names = \ + tuple(self.config['robosignatory.base_module_names']) self.pdc_client = PDCClient( server=self.config['robosignatory.pdc_url'], develop=True) @@ -114,9 +116,9 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): self.sign_modular_rpms(build_nvr, build_id, tag, koji_instance) - def verify_base_runtime_tag(self, tag): + def verify_base_module_tag(self, tag): """ - Verifies that the base-runtime tag is valid. Sets the tag['stream'] + Verifies that the base module tag is valid. Sets the tag['stream'] and tag['verified']. """ query = {} @@ -124,8 +126,11 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): query["active"] = True retval = self.pdc_client.unreleasedvariants(page_size=-1, **query) - if (not retval or len(retval) != 1 - or retval[0]["variant_name"] != "base-runtime"): + if not retval or len(retval) != 1: + tag["verified"] = False + return tag + + if retval[0]["variant_name"] not in self.valid_base_module_names: tag["verified"] = False return tag @@ -133,10 +138,10 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): tag["stream"] = retval[0]["variant_version"] return tag - def get_base_runtime_tag(self, session, info, parent_tags=None): + def get_base_module_tag(self, session, info, parent_tags=None): """ Recursively traverse the inheritance hiearchy of tags in Koji to find - out the base-runtime tag. + out the base module tag. """ # Handle only tags with modular prefix. @@ -168,11 +173,11 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): build_tag_id = target["build_tag"] build_tag_info = session.getTag(build_tag_id) - # Store the dest_tag as a possible tag with base-runtime. - base_runtime_tag = {"id": target["dest_tag"], - "name": target["dest_tag_name"], - "verified": False, - "stream": None} + # Store the dest_tag as a possible base tag (we don't know yet). + base_module_tag = {"id": target["dest_tag"], + "name": target["dest_tag_name"], + "verified": False, + "stream": None} # Get the inheritance data and filter out tags from parent_tags set. # Following those tags would bring us back to the already seen target. @@ -190,28 +195,28 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): # Get tag info for the parent_tag. info = session.getTag(parent_tag_id) if info is None: - return base_runtime_tag + return base_module_tag # Try to recursively find all the parents of this parent tag. - maybe_tag = self.get_base_runtime_tag(session, info, parent_tags) + maybe_tag = self.get_base_module_tag(session, info, parent_tags) if not maybe_tag: continue - # Verify that the found tag is really valid base-runtime tag. - maybe_tag = self.verify_base_runtime_tag(maybe_tag) + # Verify that the found tag is really a valid base module tag. + maybe_tag = self.verify_base_module_tag(maybe_tag) if maybe_tag['verified']: # In case we have already found valid tag in the previous subtree # and right now we have another one, compare that their streams # are matching. - if (base_runtime_tag['verified'] - and maybe_tag['stream'] != base_runtime_tag['stream']): - log.info("Multiple base-runtime streams found in " + if (base_module_tag['verified'] + and maybe_tag['stream'] != base_module_tag['stream']): + log.warn("Multiple base module streams found in " "inheritance tree.") return None else: - base_runtime_tag = maybe_tag + base_module_tag = maybe_tag - return base_runtime_tag + return base_module_tag def sign_modular_rpms(self, build_nvr, build_id, tag, koji_instance): # Skip the -build tag. @@ -228,13 +233,17 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): log.info("Koji tag %s not known, skipping" % tag) return - # Try to find out if the current tag is base-runtime before traversing + # Try to find out if the current tag is a base module before traversing # the tag inheritance tree. - maybe_tag = {"id": info["id"], "name": info['name'], "verified": False, - "stream": None} - maybe_tag = self.verify_base_runtime_tag(maybe_tag) + maybe_tag = { + "id": info["id"], + "name": info['name'], + "verified": False, + "stream": None, + } + maybe_tag = self.verify_base_module_tag(maybe_tag) if maybe_tag["verified"]: - base_runtime_tag = maybe_tag + base_module_tag = maybe_tag else: # build tag inherits from the main tag, so when we are evaluating # which tag is the right one to check when examining tag inheritance @@ -242,26 +251,26 @@ class TagSignerConsumer(fedmsg.consumers.FedmsgConsumer): # Therefore we have to track the set of parent tags. parent_tags = set([info['id']]) - # Resulting base-runtime tag according to which we will use the right key. - base_runtime_tag = self.get_base_runtime_tag( + # Resulting base module tag according to which we will use the right key. + base_module_tag = self.get_base_module_tag( session, info, parent_tags=parent_tags) - if not base_runtime_tag: - log.info("No base-runtime tag found in inheritance tree for " + if not base_module_tag: + log.info("No base module tag found in inheritance tree for " "%s, skipping" % tag) return - if not base_runtime_tag["verified"]: - log.info("No verified base-runtime tag found in inheritance tree for " - "%s, skipping. Found tag: %r" % (tag, base_runtime_tag)) + if not base_module_tag["verified"]: + log.info("No verified base module tag found in inheritance tree for " + "%s, skipping. Found tag: %r" % (tag, base_module_tag)) return - if base_runtime_tag["stream"] not in instance['module_streams']: - log.info("Base-runtime stream %s not allowed for " - "auto-sign" % base_runtime_tag["stream"]) + if base_module_tag["stream"] not in instance['module_streams']: + log.info("Base module stream %s not allowed for " + "auto-sign" % base_module_tag["stream"]) return - stream_info = instance['module_streams'][base_runtime_tag["stream"]] + stream_info = instance['module_streams'][base_module_tag["stream"]] # We are not moving to any tag after signing. stream_info["to"] = tag