Merge ~alexmurray/ubuntu-security-tools:umt-testflinger-private-ppas-support into ubuntu-security-tools:master

[Alex Murray]

Add easier support for using private PPAs via --repo so can just use say --repo ppa:ubuntu-esm/esm-infra-security-staging and umt will do the right thing to lookup and import the associated PPA signing key onto the target device as well as lookup the archive subscription URL and use this with appropriate credentials for the current user.

diff --git a/build-tools/umt b/build-tools/umt
index 1d96399..6acf21f 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -3029,7 +3029,7 @@ def cmd_testflinger():
     parser.add_argument("-T", "--template", dest="template", default=None,
                         help="A testflinger job template to use - this allows to specify extra commands etc")
     parser.add_argument("--repo", dest="repo", default=None,
-                        metavar="Anything suitable for `add-apt-repository REPO` (ie. 'ppa:ubuntu-security-proposed/ppa' or 'https://USER:[e-mail]/ubuntu-security/ppa/ubuntu' etc)",
+                        metavar="Anything suitable for `add-apt-repository REPO` (ie. 'ppa:ubuntu-security-proposed/ppa' - will automatically try and fetch credentials for private PPAs)",
                         help="Add REPO to test machine to test new binaries from it rather than using yantok")
     parser.add_argument("-j", "--jump-host-path", dest="jump_host_path", default=default_jump_host_path,
                         help="A jump host scp path to temporarily store debs to be loaded on test machine (default " + default_jump_host_path + ")")
@@ -3076,6 +3076,7 @@ def run_testflinger_tests(opt, args, details, queues, image):
         print("Running testflinger test for %s with image %s on queues %s" % (details["package"],
                                                                               image,
                                                                               ', '.join(queues)))
+        signing_key = None
         tempdir = None
         # get the list of binary packages
         local_binaries = glob.glob('./../binary/*.deb')
@@ -3105,6 +3106,19 @@ def run_testflinger_tests(opt, args, details, queues, image):
             runcmd(["scp"] + local_binaries + [server + ":" + tempdir],
                    debug=opt.debug, dry_run=opt.dry_run, okrc=[0])
             tempurl = opt.jump_host_url + tempdir.replace(path, "/")
+        else:
+            # lookup signing key for repo if is a ppa
+            if opt.repo.startswith("ppa:"):
+                repo = opt.repo.split(":")[1]
+                team_name, ppa_name = repo.split("/")
+                lp = lpl_common.connect()
+                lp_team = lp.people[team_name]
+                lp_ppa = lp_team.getPPAByName(name=ppa_name)
+                signing_key = lp_ppa.signing_key_fingerprint
+                if lp_ppa.private:
+                    # use full authenticated URL with credentials
+                    archive_url = lp.people[lp.me.name].getArchiveSubscriptionURL(archive=lp_ppa)
+                    opt.repo = archive_url
 
         if opt.template is not None:
             with open(opt.template, 'r') as f:
@@ -3137,8 +3151,13 @@ def run_testflinger_tests(opt, args, details, queues, image):
             cmds.append("rm %s" % " ".join(binaries))
             cmds.append("ssh $DEVICE_IP sudo dpkg -i %s" % " ".join(binaries))
         else:
+            if signing_key is not None:
+                cmds.append("echo_time Importing PPA sigining key...")
+                # TODO: apt-key is deprecated so this should be replaced with something better
+                cmds.append("ssh $DEVICE_IP sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys %s" % signing_key)
             cmds.append("echo_time Adding apt repository %s..." % opt.repo)
             cmds.append("ssh $DEVICE_IP sudo add-apt-repository --yes %s" % opt.repo)
+            cmds.append("ssh $DEVICE_IP sudo apt-get update")
             cmds.append("echo_time Installing %s..." % details["package"])
             cmds.append("ssh $DEVICE_IP sudo apt-get install %s" % " ".join(apt_binaries))
         # we can't just reboot since this will close the ssh connection