Merge ~twom/launchpad:oci-buildbehaviour into launchpad:master

[Tom Wardill]

Add OCIRecipeBuildBehaviour

Add a buildbehaviour to drive OCI image builds.
Use mixin tests where sensible, override for places where the OCI methods differ.

[Colin Watson (cjwatson)]

review: Needs Fixing

[Colin Watson (cjwatson)]

review: Needs Fixing

[Colin Watson (cjwatson)]

review: Needs Fixing

[Colin Watson (cjwatson)]

review: Approve

[Colin Watson (cjwatson)]

review: Approve

diff --git a/database/schema/security.cfg b/database/schema/security.cfg
index 306d206..d0832c1 100644
--- a/database/schema/security.cfg
+++ b/database/schema/security.cfg
@@ -995,6 +995,7 @@ public.livefsbuild                            = SELECT, UPDATE
 public.livefsfile                             = SELECT
 public.ocifile                                = SELECT
 public.ociproject                             = SELECT
+public.ociprojectname                         = SELECT
 public.ocirecipe                              = SELECT
 public.ocirecipebuild                         = SELECT, UPDATE
 public.openididentifier                       = SELECT
diff --git a/lib/lp/buildmaster/model/buildfarmjobbehaviour.py b/lib/lp/buildmaster/model/buildfarmjobbehaviour.py
index 2f3515a..4b28693 100644
--- a/lib/lp/buildmaster/model/buildfarmjobbehaviour.py
+++ b/lib/lp/buildmaster/model/buildfarmjobbehaviour.py
@@ -301,6 +301,22 @@ class BuildFarmJobBehaviourBase:
         transaction.commit()
 
     @defer.inlineCallbacks
+    def _downloadFiles(self, filemap, upload_path, logger):
+        filenames_to_download = []
+        for filename, sha1 in filemap.items():
+            logger.info("Grabbing file: %s (%s)" % (
+                filename, self._slave.getURL(sha1)))
+            out_file_name = os.path.join(upload_path, filename)
+            # If the evaluated output file name is not within our
+            # upload path, then we don't try to copy this or any
+            # subsequent files.
+            if not os.path.realpath(out_file_name).startswith(upload_path):
+                raise BuildDaemonError(
+                    "Build returned a file named %r." % filename)
+            filenames_to_download.append((sha1, out_file_name))
+        yield self._slave.getFiles(filenames_to_download, logger=logger)
+
+    @defer.inlineCallbacks
     def handleSuccess(self, slave_status, logger):
         """Handle a package that built successfully.
 
@@ -337,19 +353,7 @@ class BuildFarmJobBehaviourBase:
             grab_dir, str(build.archive.id), build.distribution.name)
         os.makedirs(upload_path)
 
-        filenames_to_download = []
-        for filename, sha1 in filemap.items():
-            logger.info("Grabbing file: %s (%s)" % (
-                filename, self._slave.getURL(sha1)))
-            out_file_name = os.path.join(upload_path, filename)
-            # If the evaluated output file name is not within our
-            # upload path, then we don't try to copy this or any
-            # subsequent files.
-            if not os.path.realpath(out_file_name).startswith(upload_path):
-                raise BuildDaemonError(
-                    "Build returned a file named %r." % filename)
-            filenames_to_download.append((sha1, out_file_name))
-        yield self._slave.getFiles(filenames_to_download, logger=logger)
+        yield self._downloadFiles(filemap, upload_path, logger)
 
         transaction.commit()
 
diff --git a/lib/lp/buildmaster/tests/mock_slaves.py b/lib/lp/buildmaster/tests/mock_slaves.py
index a19a85d..32633ea 100644
--- a/lib/lp/buildmaster/tests/mock_slaves.py
+++ b/lib/lp/buildmaster/tests/mock_slaves.py
@@ -194,7 +194,8 @@ class WaitingSlave(OkSlave):
 
         # By default, the slave only has a buildlog, but callsites
         # can update this list as needed.
-        self.valid_file_hashes = ['buildlog']
+        self.valid_files = {'buildlog': ''}
+        self._got_file_record = []
 
     def status(self):
         self.call_log.append('status')
@@ -208,12 +209,17 @@ class WaitingSlave(OkSlave):
 
     def getFile(self, hash, file_to_write):
         self.call_log.append('getFile')
-        if hash in self.valid_file_hashes:
-            content = "This is a %s" % hash
+        if hash in self.valid_files:
             if isinstance(file_to_write, types.StringTypes):
                 file_to_write = open(file_to_write, 'wb')
+            if not self.valid_files[hash]:
+                content = b"This is a %s" % hash
+            else:
+                with open(self.valid_files[hash], 'rb') as source:
+                    content = source.read()
             file_to_write.write(content)
             file_to_write.close()
+            self._got_file_record.append(hash)
         return defer.succeed(None)
 
 
diff --git a/lib/lp/buildmaster/tests/snapbuildproxy.py b/lib/lp/buildmaster/tests/snapbuildproxy.py
 new file mode 100644
index 0000000..21d973e
--- /dev/null
+++ b/lib/lp/buildmaster/tests/snapbuildproxy.py
@@ -0,0 +1,123 @@
+# Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Fixtures for dealing with the build time 'snap' HTTP proxy."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+
+from datetime import datetime
+import json
+from textwrap import dedent
+import uuid
+
+import fixtures
+from six.moves.urllib_parse import urlsplit
+from testtools.matchers import (
+    Equals,
+    HasLength,
+    MatchesStructure,
+    )
+from twisted.internet import (
+    defer,
+    endpoints,
+    reactor,
+    )
+from twisted.python.compat import nativeString
+from twisted.web import (
+    resource,
+    server,
+    )
+
+from lp.services.config import config
+
+
+class ProxyAuthAPITokensResource(resource.Resource):
+    """A test tokens resource for the proxy authentication API."""
+
+    isLeaf = True
+
+    def __init__(self):
+        resource.Resource.__init__(self)
+        self.requests = []
+
+    def render_POST(self, request):
+        content = request.content.read()
+        self.requests.append({
+            "method": request.method,
+            "uri": request.uri,
+            "headers": dict(request.requestHeaders.getAllRawHeaders()),
+            "content": content,
+            })
+        username = json.loads(content)["username"]
+        return json.dumps({
+            "username": username,
+            "secret": uuid.uuid4().hex,
+            "timestamp": datetime.utcnow().isoformat(),
+            })
+
+
+class InProcessProxyAuthAPIFixture(fixtures.Fixture):
+    """A fixture that pretends to be the proxy authentication API.
+
+    Users of this fixture must call the `start` method, which returns a
+    `Deferred`, and arrange for that to get back to the reactor.  This is
+    necessary because the basic fixture API does not allow `setUp` to return
+    anything.  For example:
+
+        class TestSomething(TestCase):
+
+            run_tests_with = AsynchronousDeferredRunTest.make_factory(
+                timeout=10)
+
+            @defer.inlineCallbacks
+            def setUp(self):
+                super(TestSomething, self).setUp()
+                yield self.useFixture(InProcessProxyAuthAPIFixture()).start()
+    """
+
+    @defer.inlineCallbacks
+    def start(self):
+        root = resource.Resource()
+        self.tokens = ProxyAuthAPITokensResource()
+        root.putChild("tokens", self.tokens)
+        endpoint = endpoints.serverFromString(reactor, nativeString("tcp:0"))
+        site = server.Site(self.tokens)
+        self.addCleanup(site.stopFactory)
+        port = yield endpoint.listen(site)
+        self.addCleanup(port.stopListening)
+        config.push("in-process-proxy-auth-api-fixture", dedent("""
+            [snappy]
+            builder_proxy_auth_api_admin_secret: admin-secret
+            builder_proxy_auth_api_endpoint: http://%s:%s/tokens
+            """) %
+            (port.getHost().host, port.getHost().port))
+        self.addCleanup(config.pop, "in-process-proxy-auth-api-fixture")
+
+
+class ProxyURLMatcher(MatchesStructure):
+    """Check that a string is a valid url for a snap build proxy."""
+
+    def __init__(self, job, now):
+        super(ProxyURLMatcher, self).__init__(
+            scheme=Equals("http"),
+            username=Equals("{}-{}".format(
+                job.build.build_cookie, int(now))),
+            password=HasLength(32),
+            hostname=Equals(config.snappy.builder_proxy_host),
+            port=Equals(config.snappy.builder_proxy_port),
+            path=Equals(""))
+
+    def match(self, matchee):
+        super(ProxyURLMatcher, self).match(urlsplit(matchee))
+
+
+class RevocationEndpointMatcher(Equals):
+    """Check that a string is a valid endpoint for proxy token revocation."""
+
+    def __init__(self, job, now):
+        super(RevocationEndpointMatcher, self).__init__(
+            "{}/{}-{}".format(
+                config.snappy.builder_proxy_auth_api_endpoint,
+                job.build.build_cookie, int(now)))
diff --git a/lib/lp/buildmaster/tests/test_buildfarmjobbehaviour.py b/lib/lp/buildmaster/tests/test_buildfarmjobbehaviour.py
index 697ff52..5046d8c 100644
--- a/lib/lp/buildmaster/tests/test_buildfarmjobbehaviour.py
+++ b/lib/lp/buildmaster/tests/test_buildfarmjobbehaviour.py
@@ -337,7 +337,7 @@ class TestHandleStatusMixin:
         self.builder = self.factory.makeBuilder()
         self.build.buildqueue_record.markAsBuilding(self.builder)
         self.slave = WaitingSlave('BuildStatus.OK')
-        self.slave.valid_file_hashes.append('test_file_hash')
+        self.slave.valid_files['test_file_hash'] = ''
         self.interactor = BuilderInteractor()
         self.behaviour = self.interactor.getBuildBehaviour(
             self.build.buildqueue_record, self.builder, self.slave)
diff --git a/lib/lp/oci/configure.zcml b/lib/lp/oci/configure.zcml
index b86afcb..a01178a 100644
--- a/lib/lp/oci/configure.zcml
+++ b/lib/lp/oci/configure.zcml
@@ -63,4 +63,10 @@
         <allow interface="lp.buildmaster.interfaces.buildfarmjob.ISpecificBuildFarmJobSource" />
     </securedutility>
 
+    <adapter
+        for="lp.oci.interfaces.ocirecipebuild.IOCIRecipeBuild"
+        provides="lp.buildmaster.interfaces.buildfarmjobbehaviour.IBuildFarmJobBehaviour"
+        factory="lp.oci.model.ocirecipebuildbehaviour.OCIRecipeBuildBehaviour"
+        permission="zope.Public" />
+
 </configure>
diff --git a/lib/lp/oci/interfaces/ocirecipebuild.py b/lib/lp/oci/interfaces/ocirecipebuild.py
index 30c3835..a41e2c8 100644
--- a/lib/lp/oci/interfaces/ocirecipebuild.py
+++ b/lib/lp/oci/interfaces/ocirecipebuild.py
@@ -27,6 +27,7 @@ from lp.oci.interfaces.ocirecipe import IOCIRecipe
 from lp.services.database.constants import DEFAULT
 from lp.services.fields import PublicPersonChoice
 from lp.services.librarian.interfaces import ILibraryFileAlias
+from lp.soyuz.interfaces.distroarchseries import IDistroArchSeries
 
 
 class IOCIRecipeBuildEdit(Interface):
@@ -82,6 +83,11 @@ class IOCIRecipeBuildView(IPackageBuild):
         :return: The corresponding `ILibraryFileAlias`.
         """
 
+    distro_arch_series = Reference(
+        IDistroArchSeries,
+        title=_("The series and architecture for which to build."),
+        required=True, readonly=True)
+
 
 class IOCIRecipeBuildAdmin(Interface):
     # XXX twom 2020-02-10 This will probably need rescore() implementing
diff --git a/lib/lp/oci/model/ocirecipebuild.py b/lib/lp/oci/model/ocirecipebuild.py
index c010817..12688cd 100644
--- a/lib/lp/oci/model/ocirecipebuild.py
+++ b/lib/lp/oci/model/ocirecipebuild.py
@@ -44,7 +44,9 @@ from lp.oci.interfaces.ocirecipebuild import (
     IOCIRecipeBuild,
     IOCIRecipeBuildSet,
     )
+from lp.registry.interfaces.pocket import PackagePublishingPocket
 from lp.registry.model.person import Person
+from lp.services.config import config
 from lp.services.database.bulk import load_related
 from lp.services.database.constants import DEFAULT
 from lp.services.database.decoratedresultset import DecoratedResultSet
@@ -128,10 +130,16 @@ class OCIRecipeBuild(PackageBuildMixin, Storm):
     build_farm_job_id = Int(name='build_farm_job', allow_none=False)
     build_farm_job = Reference(build_farm_job_id, 'BuildFarmJob.id')
 
-    # Stub attributes to match the IPackageBuild interface that we
-    # are not using in this implementation at this time.
-    pocket = None
-    distro_series = None
+    # We only care about the pocket from a building environment POV,
+    # it is not a target, nor referenced in the final build.
+    pocket = PackagePublishingPocket.UPDATES
+
+    @property
+    def distro_series(self):
+        # XXX twom 2020-02-14 - This really needs to be set elsewhere,
+        # as this may not be an LTS release and ties the OCI target to
+        # a completely unrelated process.
+        return self.distribution.currentseries
 
     def __init__(self, build_farm_job, requester, recipe,
                  processor, virtualized, date_created):
@@ -257,6 +265,19 @@ class OCIRecipeBuild(PackageBuildMixin, Storm):
         # pillar isn't just a distribution
         return self.recipe.oci_project.distribution
 
+    @property
+    def distro_arch_series(self):
+        return self.distribution.currentseries.getDistroArchSeriesByProcessor(
+            self.processor)
+
+    def notify(self, extra_info=None):
+        """See `IPackageBuild`."""
+        if not config.builddmaster.send_build_notification:
+            return
+        if self.status == BuildStatus.FULLYBUILT:
+            return
+        # XXX twom 2019-12-11 This should send mail
+
 
 @implementer(IOCIRecipeBuildSet)
 class OCIRecipeBuildSet(SpecificBuildFarmJobSourceMixin):
diff --git a/lib/lp/oci/model/ocirecipebuildbehaviour.py b/lib/lp/oci/model/ocirecipebuildbehaviour.py
 new file mode 100644
index 0000000..f0debfa
--- /dev/null
+++ b/lib/lp/oci/model/ocirecipebuildbehaviour.py
@@ -0,0 +1,182 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""An `IBuildFarmJobBehaviour` for `OCIRecipeBuild`.
+
+Dispatches OCI image build jobs to build-farm slaves.
+"""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'OCIRecipeBuildBehaviour',
+    ]
+
+
+import json
+import os
+
+from twisted.internet import defer
+from zope.interface import implementer
+
+from lp.app.errors import NotFoundError
+from lp.buildmaster.enums import BuildBaseImageType
+from lp.buildmaster.interfaces.builder import (
+    BuildDaemonError,
+    CannotBuild,
+    )
+from lp.buildmaster.interfaces.buildfarmjobbehaviour import (
+    IBuildFarmJobBehaviour,
+    )
+from lp.buildmaster.model.buildfarmjobbehaviour import (
+    BuildFarmJobBehaviourBase,
+    )
+from lp.registry.interfaces.series import SeriesStatus
+from lp.services.librarian.utils import copy_and_close
+from lp.snappy.model.snapbuildbehaviour import SnapProxyMixin
+from lp.soyuz.adapters.archivedependencies import (
+    get_sources_list_for_building,
+    )
+
+
+@implementer(IBuildFarmJobBehaviour)
+class OCIRecipeBuildBehaviour(SnapProxyMixin, BuildFarmJobBehaviourBase):
+
+    builder_type = "oci"
+    image_types = [BuildBaseImageType.LXD, BuildBaseImageType.CHROOT]
+
+    def getLogFileName(self):
+        series = self.build.distro_series
+
+        # Examples:
+        #   buildlog_oci_ubuntu_wily_amd64_name_FULLYBUILT.txt
+        return 'buildlog_oci_%s_%s_%s_%s_%s' % (
+            series.distribution.name, series.name,
+            self.build.processor.name, self.build.recipe.name,
+            self.build.status.name)
+
+    def verifyBuildRequest(self, logger):
+        """Assert some pre-build checks.
+
+        The build request is checked:
+         * Virtualized builds can't build on a non-virtual builder
+         * Ensure that we have a chroot
+        """
+        build = self.build
+        if build.virtualized and not self._builder.virtualized:
+            raise AssertionError(
+                "Attempt to build virtual item on a non-virtual builder.")
+
+        chroot = build.distro_arch_series.getChroot(pocket=build.pocket)
+        if chroot is None:
+            raise CannotBuild(
+                "Missing chroot for %s" % build.distro_arch_series.displayname)
+
+    @defer.inlineCallbacks
+    def extraBuildArgs(self, logger=None):
+        """
+        Return the extra arguments required by the slave for the given build.
+        """
+        build = self.build
+        args = yield super(OCIRecipeBuildBehaviour, self).extraBuildArgs(
+            logger=logger)
+        yield self.addProxyArgs(args)
+        # XXX twom 2020-02-17 This may need to be more complex, and involve
+        # distribution name.
+        args["name"] = build.recipe.name
+        args["archives"], args["trusted_keys"] = (
+            yield get_sources_list_for_building(
+                build, build.distro_arch_series, None,
+                tools_source=None, tools_fingerprint=None,
+                logger=logger))
+
+        args['build_file'] = build.recipe.build_file
+
+        if build.recipe.git_ref is not None:
+            args["git_repository"] = (
+                build.recipe.git_repository.git_https_url)
+        else:
+            raise CannotBuild(
+                "Source repository for ~%s/%s has been deleted." %
+                (build.recipe.owner.name, build.recipe.name))
+
+        if build.recipe.git_path != "HEAD":
+            args["git_path"] = build.recipe.git_ref.name
+
+        defer.returnValue(args)
+
+    def _ensureFilePath(self, file_name, file_path, upload_path):
+        # If the evaluated output file name is not within our
+        # upload path, then we don't try to copy this or any
+        # subsequent files.
+        if not os.path.normpath(file_path).startswith(upload_path + '/'):
+            raise BuildDaemonError(
+                "Build returned a file named '%s'." % file_name)
+
+    @defer.inlineCallbacks
+    def _fetchIntermediaryFile(self, name, filemap, upload_path):
+        file_hash = filemap[name]
+        file_path = os.path.join(upload_path, name)
+        self._ensureFilePath(name, file_path, upload_path)
+        yield self._slave.getFile(file_hash, file_path)
+
+        with open(file_path, 'r') as file_fp:
+            contents = json.load(file_fp)
+        defer.returnValue(contents)
+
+    def _extractLayerFiles(self, upload_path, section, config, digests, files):
+        # These are different sets of ids, in the same order
+        # layer_id is the filename, diff_id is the internal (docker) id
+        for diff_id in config['rootfs']['diff_ids']:
+            for digests_section in digests:
+                layer_id = digests_section[diff_id]['layer_id']
+                # This is in the form '<id>/layer.tar', we only need the first
+                layer_filename = "{}.tar.gz".format(layer_id.split('/')[0])
+                digest = digests_section[diff_id]['digest']
+                try:
+                    _, librarian_file, _ = self.build.getLayerFileByDigest(
+                        digest)
+                except NotFoundError:
+                    files.add(layer_filename)
+                    continue
+                layer_path = os.path.join(upload_path, layer_filename)
+                librarian_file.open()
+                copy_and_close(librarian_file, open(layer_path, 'wb'))
+
+    def _convertToRetrievableFile(self, upload_path, file_name, filemap):
+        file_path = os.path.join(upload_path, file_name)
+        self._ensureFilePath(file_name, file_path, upload_path)
+        return (filemap[file_name], file_path)
+
+    @defer.inlineCallbacks
+    def _downloadFiles(self, filemap, upload_path, logger):
+        """Download required artifact files."""
+        # We don't want to download all of the files that have been created,
+        # just the ones that are mentioned in the manifest and config.
+
+        manifest = yield self._fetchIntermediaryFile(
+            'manifest.json', filemap, upload_path)
+        digests = yield self._fetchIntermediaryFile(
+            'digests.json', filemap, upload_path)
+
+        files = set()
+        for section in manifest:
+            config = yield self._fetchIntermediaryFile(
+                section['Config'], filemap, upload_path)
+            self._extractLayerFiles(
+                upload_path, section, config, digests, files)
+
+        files_to_download = [
+            self._convertToRetrievableFile(upload_path, filename, filemap)
+            for filename in files]
+        yield self._slave.getFiles(files_to_download, logger=logger)
+
+    def verifySuccessfulBuild(self):
+        """See `IBuildFarmJobBehaviour`."""
+        # The implementation in BuildFarmJobBehaviourBase checks whether the
+        # target suite is modifiable in the target archive.  However, an
+        # `OCIRecipeBuild` does not use an archive in this manner.
+        # We do, however, refuse to build for
+        # obsolete series.
+        assert self.build.distro_series.status != SeriesStatus.OBSOLETE
diff --git a/lib/lp/oci/tests/test_ocirecipebuild.py b/lib/lp/oci/tests/test_ocirecipebuild.py
index b768e1d..60aaf93 100644
--- a/lib/lp/oci/tests/test_ocirecipebuild.py
+++ b/lib/lp/oci/tests/test_ocirecipebuild.py
@@ -16,11 +16,13 @@ from lp.app.errors import NotFoundError
 from lp.buildmaster.enums import BuildStatus
 from lp.buildmaster.interfaces.buildqueue import IBuildQueue
 from lp.buildmaster.interfaces.packagebuild import IPackageBuild
+from lp.buildmaster.interfaces.processor import IProcessorSet
 from lp.oci.interfaces.ocirecipebuild import (
     IOCIRecipeBuild,
     IOCIRecipeBuildSet,
     )
 from lp.oci.model.ocirecipebuild import OCIRecipeBuildSet
+from lp.registry.interfaces.series import SeriesStatus
 from lp.services.propertycache import clear_property_cache
 from lp.testing import (
     admin_logged_in,
@@ -148,8 +150,16 @@ class TestOCIRecipeBuildSet(TestCaseWithFactory):
 
     def test_new(self):
         requester = self.factory.makePerson()
-        recipe = self.factory.makeOCIRecipe()
+        distribution = self.factory.makeDistribution()
+        distroseries = self.factory.makeDistroSeries(
+            distribution=distribution, status=SeriesStatus.CURRENT)
+        processor = getUtility(IProcessorSet).getByName("386")
+        distro_arch_series = self.factory.makeDistroArchSeries(
+            distroseries=distroseries, architecturetag="i386",
+            processor=processor)
         distro_arch_series = self.factory.makeDistroArchSeries()
+        oci_project = self.factory.makeOCIProject(pillar=distribution)
+        recipe = self.factory.makeOCIRecipe(oci_project=oci_project)
         target = getUtility(IOCIRecipeBuildSet).new(
             requester, recipe, distro_arch_series)
         with admin_logged_in():
diff --git a/lib/lp/oci/tests/test_ocirecipebuildbehaviour.py b/lib/lp/oci/tests/test_ocirecipebuildbehaviour.py
 new file mode 100644
index 0000000..e9ac224
--- /dev/null
+++ b/lib/lp/oci/tests/test_ocirecipebuildbehaviour.py
@@ -0,0 +1,604 @@
+# Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Tests for `OCIRecipeBuildBehaviour`."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+
+import base64
+from datetime import datetime
+import json
+import os
+import shutil
+import tempfile
+import time
+import uuid
+
+import fixtures
+from six.moves.urllib_parse import urlsplit
+from testtools import ExpectedException
+from testtools.matchers import (
+    AfterPreprocessing,
+    ContainsDict,
+    Equals,
+    Is,
+    IsInstance,
+    MatchesDict,
+    MatchesListwise,
+    StartsWith,
+    )
+from testtools.twistedsupport import (
+    AsynchronousDeferredRunTestForBrokenTwisted,
+    )
+from twisted.internet import defer
+from twisted.trial.unittest import TestCase as TrialTestCase
+from zope.component import getUtility
+from zope.security.proxy import removeSecurityProxy
+
+from lp.buildmaster.enums import (
+    BuildBaseImageType,
+    BuildStatus,
+    )
+from lp.buildmaster.interactor import BuilderInteractor
+from lp.buildmaster.interfaces.builder import (
+    BuildDaemonError,
+    CannotBuild,
+    )
+from lp.buildmaster.interfaces.buildfarmjobbehaviour import (
+    IBuildFarmJobBehaviour,
+    )
+from lp.buildmaster.interfaces.processor import IProcessorSet
+from lp.buildmaster.tests.mock_slaves import (
+    MockBuilder,
+    OkSlave,
+    SlaveTestHelpers,
+    WaitingSlave,
+    )
+from lp.buildmaster.tests.snapbuildproxy import (
+    InProcessProxyAuthAPIFixture,
+    ProxyURLMatcher,
+    RevocationEndpointMatcher,
+    )
+from lp.buildmaster.tests.test_buildfarmjobbehaviour import (
+    TestGetUploadMethodsMixin,
+    )
+from lp.oci.model.ocirecipebuildbehaviour import OCIRecipeBuildBehaviour
+from lp.registry.interfaces.series import SeriesStatus
+from lp.services.config import config
+from lp.services.log.logger import DevNullLogger
+from lp.services.webapp import canonical_url
+from lp.soyuz.adapters.archivedependencies import (
+    get_sources_list_for_building,
+    )
+from lp.testing import TestCaseWithFactory
+from lp.testing.dbuser import dbuser
+from lp.testing.factory import LaunchpadObjectFactory
+from lp.testing.fakemethod import FakeMethod
+from lp.testing.layers import LaunchpadZopelessLayer
+from lp.testing.mail_helpers import pop_notifications
+
+
+class MakeOCIBuildMixin:
+
+    def makeBuild(self):
+        build = self.factory.makeOCIRecipeBuild()
+        self.factory.makeDistroSeries(
+            distribution=build.recipe.oci_project.distribution,
+            status=SeriesStatus.CURRENT)
+        build.queueBuild()
+        return build
+
+    def makeUnmodifiableBuild(self):
+        build = self.factory.makeOCIRecipeBuild()
+        build.distro_arch_series = 'failed'
+        build.queueBuild()
+        return build
+
+    def makeJob(self, git_ref, recipe=None):
+        """Create a sample `IOCIRecipeBuildBehaviour`."""
+        if recipe is None:
+            build = self.factory.makeOCIRecipeBuild()
+        else:
+            build = self.factory.makeOCIRecipeBuild(recipe=recipe)
+        build.recipe.git_ref = git_ref
+
+        job = IBuildFarmJobBehaviour(build)
+        builder = MockBuilder()
+        builder.processor = job.build.processor
+        slave = self.useFixture(SlaveTestHelpers()).getClientSlave()
+        job.setBuilder(builder, slave)
+        self.addCleanup(slave.pool.closeCachedConnections)
+
+        # Taken from test_archivedependencies.py
+        for component_name in ("main", "universe"):
+            self.factory.makeComponentSelection(
+                build.distro_arch_series.distroseries, component_name)
+
+        return job
+
+
+class TestOCIBuildBehaviour(TestCaseWithFactory):
+
+    layer = LaunchpadZopelessLayer
+
+    def test_provides_interface(self):
+        # OCIRecipeBuildBehaviour provides IBuildFarmJobBehaviour.
+        job = OCIRecipeBuildBehaviour(self.factory.makeOCIRecipeBuild())
+        self.assertProvides(job, IBuildFarmJobBehaviour)
+
+    def test_adapts_IOCIRecipeBuild(self):
+        # IBuildFarmJobBehaviour adapts an IOCIRecipeBuild.
+        build = self.factory.makeOCIRecipeBuild()
+        job = IBuildFarmJobBehaviour(build)
+        self.assertProvides(job, IBuildFarmJobBehaviour)
+
+
+class TestAsyncOCIRecipeBuildBehaviour(MakeOCIBuildMixin, TestCaseWithFactory):
+
+    run_tests_with = AsynchronousDeferredRunTestForBrokenTwisted.make_factory(
+        timeout=10)
+    layer = LaunchpadZopelessLayer
+
+    @defer.inlineCallbacks
+    def setUp(self):
+        super(TestAsyncOCIRecipeBuildBehaviour, self).setUp()
+        build_username = 'OCIBUILD-1'
+        self.token = {'secret': uuid.uuid4().get_hex(),
+                      'username': build_username,
+                      'timestamp': datetime.utcnow().isoformat()}
+        self.proxy_url = ("http://{username}:{password}"
+                          "@{host}:{port}".format(
+                            username=self.token['username'],
+                            password=self.token['secret'],
+                            host=config.snappy.builder_proxy_host,
+                            port=config.snappy.builder_proxy_port))
+        self.proxy_api = self.useFixture(InProcessProxyAuthAPIFixture())
+        yield self.proxy_api.start()
+        self.now = time.time()
+        self.useFixture(fixtures.MockPatch(
+            "time.time", return_value=self.now))
+
+    @defer.inlineCallbacks
+    def test_composeBuildRequest(self):
+        [ref] = self.factory.makeGitRefs()
+        job = self.makeJob(git_ref=ref)
+        lfa = self.factory.makeLibraryFileAlias(db_only=True)
+        job.build.distro_arch_series.addOrUpdateChroot(lfa)
+        build_request = yield job.composeBuildRequest(None)
+        self.assertThat(build_request, MatchesListwise([
+            Equals('oci'),
+            Equals(job.build.distro_arch_series),
+            Equals(job.build.pocket),
+            Equals({}),
+            IsInstance(dict),
+            ]))
+
+    @defer.inlineCallbacks
+    def test_requestProxyToken_unconfigured(self):
+        self.pushConfig("snappy", builder_proxy_auth_api_admin_secret=None)
+        [ref] = self.factory.makeGitRefs()
+        job = self.makeJob(git_ref=ref)
+        expected_exception_msg = (
+            "builder_proxy_auth_api_admin_secret is not configured.")
+        with ExpectedException(CannotBuild, expected_exception_msg):
+            yield job.extraBuildArgs()
+
+    @defer.inlineCallbacks
+    def test_requestProxyToken(self):
+        [ref] = self.factory.makeGitRefs()
+        job = self.makeJob(git_ref=ref)
+        yield job.extraBuildArgs()
+        self.assertThat(self.proxy_api.tokens.requests, MatchesListwise([
+            MatchesDict({
+                "method": Equals("POST"),
+                "uri": Equals(urlsplit(
+                    config.snappy.builder_proxy_auth_api_endpoint).path),
+                "headers": ContainsDict({
+                    b"Authorization": MatchesListwise([
+                        Equals(b"Basic " + base64.b64encode(
+                            b"admin-launchpad.test:admin-secret"))]),
+                    b"Content-Type": MatchesListwise([
+                        Equals(b"application/json; charset=UTF-8"),
+                        ]),
+                    }),
+                "content": AfterPreprocessing(json.loads, MatchesDict({
+                    "username": StartsWith(job.build.build_cookie + "-"),
+                    })),
+                }),
+            ]))
+
+    @defer.inlineCallbacks
+    def test_extraBuildArgs_git(self):
+        # extraBuildArgs returns appropriate arguments if asked to build a
+        # job for a Git branch.
+        [ref] = self.factory.makeGitRefs()
+        job = self.makeJob(git_ref=ref)
+        expected_archives, expected_trusted_keys = (
+            yield get_sources_list_for_building(
+                job.build, job.build.distro_arch_series, None))
+        for archive_line in expected_archives:
+            self.assertIn('universe', archive_line)
+        with dbuser(config.builddmaster.dbuser):
+            args = yield job.extraBuildArgs()
+        self.assertThat(args, MatchesDict({
+            "archive_private": Is(False),
+            "archives": Equals(expected_archives),
+            "arch_tag": Equals("i386"),
+            "build_file": Equals(job.build.recipe.build_file),
+            "build_url": Equals(canonical_url(job.build)),
+            "fast_cleanup": Is(True),
+            "git_repository": Equals(ref.repository.git_https_url),
+            "git_path": Equals(ref.name),
+            "name": Equals(job.build.recipe.name),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
+            "series": Equals(job.build.distro_arch_series.distroseries.name),
+            "trusted_keys": Equals(expected_trusted_keys),
+            }))
+
+    @defer.inlineCallbacks
+    def test_extraBuildArgs_git_HEAD(self):
+        # extraBuildArgs returns appropriate arguments if asked to build a
+        # job for the default branch in a Launchpad-hosted Git repository.
+        [ref] = self.factory.makeGitRefs()
+        removeSecurityProxy(ref.repository)._default_branch = ref.path
+        job = self.makeJob(git_ref=ref.repository.getRefByPath("HEAD"))
+        expected_archives, expected_trusted_keys = (
+            yield get_sources_list_for_building(
+                job.build, job.build.distro_arch_series, None))
+        for archive_line in expected_archives:
+            self.assertIn('universe', archive_line)
+        with dbuser(config.builddmaster.dbuser):
+            args = yield job.extraBuildArgs()
+        self.assertThat(args, MatchesDict({
+            "archive_private": Is(False),
+            "archives": Equals(expected_archives),
+            "arch_tag": Equals("i386"),
+            "build_file": Equals(job.build.recipe.build_file),
+            "build_url": Equals(canonical_url(job.build)),
+            "fast_cleanup": Is(True),
+            "git_repository": Equals(ref.repository.git_https_url),
+            "name": Equals(job.build.recipe.name),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
+            "series": Equals(job.build.distro_arch_series.distroseries.name),
+            "trusted_keys": Equals(expected_trusted_keys),
+            }))
+
+    @defer.inlineCallbacks
+    def test_composeBuildRequest_proxy_url_set(self):
+        [ref] = self.factory.makeGitRefs()
+        job = self.makeJob(git_ref=ref)
+        build_request = yield job.composeBuildRequest(None)
+        self.assertThat(
+            build_request[4]["proxy_url"], ProxyURLMatcher(job, self.now))
+
+    @defer.inlineCallbacks
+    def test_composeBuildRequest_git_ref_deleted(self):
+        # If the source Git reference has been deleted, composeBuildRequest
+        # raises CannotBuild.
+        repository = self.factory.makeGitRepository()
+        [ref] = self.factory.makeGitRefs(repository=repository)
+        owner = self.factory.makePerson(name="oci-owner")
+
+        distribution = self.factory.makeDistribution()
+        distroseries = self.factory.makeDistroSeries(
+            distribution=distribution, status=SeriesStatus.CURRENT)
+        processor = getUtility(IProcessorSet).getByName("386")
+        self.factory.makeDistroArchSeries(
+            distroseries=distroseries, architecturetag="i386",
+            processor=processor)
+
+        oci_project = self.factory.makeOCIProject(
+            pillar=distribution, registrant=owner)
+        recipe = self.factory.makeOCIRecipe(
+            oci_project=oci_project, registrant=owner, owner=owner,
+            git_ref=ref)
+        job = self.makeJob(ref, recipe=recipe)
+        repository.removeRefs([ref.path])
+        self.assertIsNone(job.build.recipe.git_ref)
+        expected_exception_msg = ("Source repository for "
+                                  "~oci-owner/{} has been deleted.".format(
+                                      recipe.name))
+        with ExpectedException(CannotBuild, expected_exception_msg):
+            yield job.composeBuildRequest(None)
+
+    @defer.inlineCallbacks
+    def test_dispatchBuildToSlave_prefers_lxd(self):
+        self.pushConfig("snappy", builder_proxy_host=None)
+        [ref] = self.factory.makeGitRefs()
+        job = self.makeJob(git_ref=ref)
+        builder = MockBuilder()
+        builder.processor = job.build.processor
+        slave = OkSlave()
+        job.setBuilder(builder, slave)
+        chroot_lfa = self.factory.makeLibraryFileAlias(db_only=True)
+        job.build.distro_arch_series.addOrUpdateChroot(
+            chroot_lfa, image_type=BuildBaseImageType.CHROOT)
+        lxd_lfa = self.factory.makeLibraryFileAlias(db_only=True)
+        job.build.distro_arch_series.addOrUpdateChroot(
+            lxd_lfa, image_type=BuildBaseImageType.LXD)
+        yield job.dispatchBuildToSlave(DevNullLogger())
+        self.assertEqual(
+            ('ensurepresent', lxd_lfa.http_url, '', ''), slave.call_log[0])
+
+    @defer.inlineCallbacks
+    def test_dispatchBuildToSlave_falls_back_to_chroot(self):
+        self.pushConfig("snappy", builder_proxy_host=None)
+        [ref] = self.factory.makeGitRefs()
+        job = self.makeJob(git_ref=ref)
+        builder = MockBuilder()
+        builder.processor = job.build.processor
+        slave = OkSlave()
+        job.setBuilder(builder, slave)
+        chroot_lfa = self.factory.makeLibraryFileAlias(db_only=True)
+        job.build.distro_arch_series.addOrUpdateChroot(
+            chroot_lfa, image_type=BuildBaseImageType.CHROOT)
+        yield job.dispatchBuildToSlave(DevNullLogger())
+        self.assertEqual(
+            ('ensurepresent', chroot_lfa.http_url, '', ''), slave.call_log[0])
+
+
+class TestHandleStatusForOCIRecipeBuild(MakeOCIBuildMixin, TrialTestCase,
+                                        fixtures.TestWithFixtures):
+    # This is mostly copied from TestHandleStatusMixin, however
+    # we can't use all of those tests, due to the way OCIRecipeBuildBehaviour
+    # parses the file contents, rather than just retrieving all that are
+    # available. There's also some differences in the filemap handling, as
+    # we need a much more complex filemap here.
+
+    layer = LaunchpadZopelessLayer
+
+    def pushConfig(self, section, **kwargs):
+        """Push some key-value pairs into a section of the config.
+
+        The config values will be restored during test tearDown.
+        """
+        # Taken from lp/testing.py as we're using TrialTestCase,
+        # not lp.testing.TestCase, as we need to handle the deferred
+        # correctly.
+        name = self.factory.getUniqueString()
+        body = '\n'.join("%s: %s" % (k, v) for k, v in kwargs.iteritems())
+        config.push(name, "\n[%s]\n%s\n" % (section, body))
+        self.addCleanup(config.pop, name)
+
+    def _createTestFile(self, name, content, hash):
+        path = os.path.join(self.test_files_dir, name)
+        with open(path, 'wb') as fp:
+            fp.write(content)
+        self.slave.valid_files[hash] = path
+
+    def setUp(self):
+        super(TestHandleStatusForOCIRecipeBuild, self).setUp()
+        self.factory = LaunchpadObjectFactory()
+        self.build = self.makeBuild()
+        # For the moment, we require a builder for the build so that
+        # handleStatus_OK can get a reference to the slave.
+        self.builder = self.factory.makeBuilder()
+        self.build.buildqueue_record.markAsBuilding(self.builder)
+        self.slave = WaitingSlave('BuildStatus.OK')
+        self.slave.valid_files['test_file_hash'] = ''
+        self.interactor = BuilderInteractor()
+        self.behaviour = self.interactor.getBuildBehaviour(
+            self.build.buildqueue_record, self.builder, self.slave)
+
+        # We overwrite the buildmaster root to use a temp directory.
+        tempdir = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, tempdir)
+        self.upload_root = tempdir
+        self.pushConfig('builddmaster', root=self.upload_root)
+
+        # We stub out our build's getUploaderCommand() method so
+        # we can check whether it was called as well as
+        # verifySuccessfulUpload().
+        removeSecurityProxy(self.build).verifySuccessfulUpload = FakeMethod(
+            result=True)
+
+        digests = [{
+            "diff_id_1": {
+                "digest": "digest_1",
+                "source": "test/base_1",
+                "layer_id": "layer_1"
+            },
+            "diff_id_2": {
+                "digest": "digest_2",
+                "source": "",
+                "layer_id": "layer_2"
+            }
+        }]
+
+        self.test_files_dir = tempfile.mkdtemp()
+        self._createTestFile('buildlog', '', 'buildlog')
+        self._createTestFile(
+            'manifest.json',
+            '[{"Config": "config_file_1.json", '
+            '"Layers": ["layer_1/layer.tar", "layer_2/layer.tar"]}]',
+            'manifest_hash')
+        self._createTestFile(
+            'digests.json',
+            json.dumps(digests),
+            'digests_hash')
+        self._createTestFile(
+            'config_file_1.json',
+            '{"rootfs": {"diff_ids": ["diff_id_1", "diff_id_2"]}}',
+            'config_1_hash')
+        self._createTestFile(
+            'layer_2.tar.gz',
+            '',
+            'layer_2_hash'
+        )
+
+        self.filemap = {
+            'manifest.json': 'manifest_hash',
+            'digests.json': 'digests_hash',
+            'config_file_1.json': 'config_1_hash',
+            'layer_1.tar.gz': 'layer_1_hash',
+            'layer_2.tar.gz': 'layer_2_hash'
+        }
+        self.factory.makeOCIFile(
+            build=self.build, layer_file_digest=u'digest_1',
+            content="retrieved from librarian")
+
+    def assertResultCount(self, count, result):
+        self.assertEqual(
+            1, len(os.listdir(os.path.join(self.upload_root, result))))
+
+    @defer.inlineCallbacks
+    def test_handleStatus_OK_normal_image(self):
+        with dbuser(config.builddmaster.dbuser):
+            yield self.behaviour.handleStatus(
+                self.build.buildqueue_record, 'OK',
+                {'filemap': self.filemap})
+        self.assertEqual(
+            ['buildlog', 'manifest_hash', 'digests_hash', 'config_1_hash',
+             'layer_2_hash'],
+            self.slave._got_file_record)
+        # This hash should not appear as it is already in the librarian
+        self.assertNotIn('layer_1_hash', self.slave._got_file_record)
+        self.assertEqual(BuildStatus.UPLOADING, self.build.status)
+        self.assertResultCount(1, "incoming")
+
+        # layer_1 should have been retrieved from the librarian
+        layer_1_path = os.path.join(
+            self.upload_root,
+            "incoming",
+            self.behaviour.getUploadDirLeaf(self.build.build_cookie),
+            str(self.build.archive.id),
+            self.build.distribution.name,
+            "layer_1.tar.gz"
+        )
+        with open(layer_1_path, 'rb') as layer_1_fp:
+            contents = layer_1_fp.read()
+            self.assertEqual(contents, b'retrieved from librarian')
+
+    @defer.inlineCallbacks
+    def test_handleStatus_OK_absolute_filepath(self):
+
+        self._createTestFile(
+            'manifest.json',
+            '[{"Config": "/notvalid/config_file_1.json", '
+            '"Layers": ["layer_1/layer.tar", "layer_2/layer.tar"]}]',
+            'manifest_hash')
+
+        self.filemap['/notvalid/config_file_1.json'] = 'config_1_hash'
+
+        # A filemap that tries to write to files outside of the upload
+        # directory will not be collected.
+        with ExpectedException(
+                BuildDaemonError,
+                "Build returned a file named "
+                "'/notvalid/config_file_1.json'."):
+            with dbuser(config.builddmaster.dbuser):
+                yield self.behaviour.handleStatus(
+                    self.build.buildqueue_record, 'OK',
+                    {'filemap': self.filemap})
+
+    @defer.inlineCallbacks
+    def test_handleStatus_OK_relative_filepath(self):
+
+        self._createTestFile(
+            'manifest.json',
+            '[{"Config": "../config_file_1.json", '
+            '"Layers": ["layer_1/layer.tar", "layer_2/layer.tar"]}]',
+            'manifest_hash')
+
+        self.filemap['../config_file_1.json'] = 'config_1_hash'
+        # A filemap that tries to write to files outside of
+        # the upload directory will not be collected.
+        with ExpectedException(
+                BuildDaemonError,
+                "Build returned a file named '../config_file_1.json'."):
+            with dbuser(config.builddmaster.dbuser):
+                yield self.behaviour.handleStatus(
+                    self.build.buildqueue_record, 'OK',
+                    {'filemap': self.filemap})
+
+    @defer.inlineCallbacks
+    def test_handleStatus_OK_sets_build_log(self):
+        # The build log is set during handleStatus.
+        self.assertEqual(None, self.build.log)
+        with dbuser(config.builddmaster.dbuser):
+            yield self.behaviour.handleStatus(
+                self.build.buildqueue_record, 'OK',
+                {'filemap': self.filemap})
+        self.assertNotEqual(None, self.build.log)
+
+    @defer.inlineCallbacks
+    def test_handleStatus_ABORTED_cancels_cancelling(self):
+        with dbuser(config.builddmaster.dbuser):
+            self.build.updateStatus(BuildStatus.CANCELLING)
+            yield self.behaviour.handleStatus(
+                self.build.buildqueue_record, "ABORTED", {})
+        self.assertEqual(0, len(pop_notifications()), "Notifications received")
+        self.assertEqual(BuildStatus.CANCELLED, self.build.status)
+
+    @defer.inlineCallbacks
+    def test_handleStatus_ABORTED_illegal_when_building(self):
+        self.builder.vm_host = "fake_vm_host"
+        self.behaviour = self.interactor.getBuildBehaviour(
+            self.build.buildqueue_record, self.builder, self.slave)
+        with dbuser(config.builddmaster.dbuser):
+            self.build.updateStatus(BuildStatus.BUILDING)
+            with ExpectedException(
+                    BuildDaemonError,
+                    "Build returned unexpected status: u'ABORTED'"):
+                yield self.behaviour.handleStatus(
+                    self.build.buildqueue_record, "ABORTED", {})
+
+    @defer.inlineCallbacks
+    def test_handleStatus_ABORTED_cancelling_sets_build_log(self):
+        # If a build is intentionally cancelled, the build log is set.
+        self.assertEqual(None, self.build.log)
+        with dbuser(config.builddmaster.dbuser):
+            self.build.updateStatus(BuildStatus.CANCELLING)
+            yield self.behaviour.handleStatus(
+                self.build.buildqueue_record, "ABORTED", {})
+        self.assertNotEqual(None, self.build.log)
+
+    @defer.inlineCallbacks
+    def test_date_finished_set(self):
+        # The date finished is updated during handleStatus_OK.
+        self.assertEqual(None, self.build.date_finished)
+        with dbuser(config.builddmaster.dbuser):
+            yield self.behaviour.handleStatus(
+                self.build.buildqueue_record, 'OK',
+                {'filemap': self.filemap})
+        self.assertNotEqual(None, self.build.date_finished)
+
+    @defer.inlineCallbacks
+    def test_givenback_collection(self):
+        with ExpectedException(
+                BuildDaemonError,
+                "Build returned unexpected status: u'GIVENBACK'"):
+            with dbuser(config.builddmaster.dbuser):
+                yield self.behaviour.handleStatus(
+                    self.build.buildqueue_record, "GIVENBACK", {})
+
+    @defer.inlineCallbacks
+    def test_builderfail_collection(self):
+        with ExpectedException(
+                BuildDaemonError,
+                "Build returned unexpected status: u'BUILDERFAIL'"):
+            with dbuser(config.builddmaster.dbuser):
+                yield self.behaviour.handleStatus(
+                    self.build.buildqueue_record, "BUILDERFAIL", {})
+
+    @defer.inlineCallbacks
+    def test_invalid_status_collection(self):
+        with ExpectedException(
+                BuildDaemonError,
+                "Build returned unexpected status: u'BORKED'"):
+            with dbuser(config.builddmaster.dbuser):
+                yield self.behaviour.handleStatus(
+                    self.build.buildqueue_record, "BORKED", {})
+
+
+class TestGetUploadMethodsForOCIRecipeBuild(
+    MakeOCIBuildMixin, TestGetUploadMethodsMixin, TrialTestCase):
+    """IPackageBuild.getUpload-related methods work with OCI recipe builds."""
+
+    def setUp(self):
+        super(TestGetUploadMethodsForOCIRecipeBuild, self).__init__(self)
+        self.factory = LaunchpadObjectFactory()
diff --git a/lib/lp/snappy/model/snapbuildbehaviour.py b/lib/lp/snappy/model/snapbuildbehaviour.py
index cda3cff..cbcba1d 100644
--- a/lib/lp/snappy/model/snapbuildbehaviour.py
+++ b/lib/lp/snappy/model/snapbuildbehaviour.py
@@ -11,6 +11,7 @@ from __future__ import absolute_import, print_function, unicode_literals
 __metaclass__ = type
 __all__ = [
     'SnapBuildBehaviour',
+    'SnapProxyMixin',
     ]
 
 import base64
@@ -61,9 +62,58 @@ def format_as_rfc3339(timestamp):
     return timestamp.replace(microsecond=0, tzinfo=None).isoformat() + 'Z'
 
 
+class SnapProxyMixin:
+    """Methods for handling builds with the Snap Build Proxy enabled."""
+
+    @defer.inlineCallbacks
+    def addProxyArgs(self, args, allow_internet=True):
+        if config.snappy.builder_proxy_host and allow_internet:
+            token = yield self._requestProxyToken()
+            args["proxy_url"] = (
+                "http://{username}:{password}@{host}:{port}".format(
+                    username=token['username'],
+                    password=token['secret'],
+                    host=config.snappy.builder_proxy_host,
+                    port=config.snappy.builder_proxy_port))
+            args["revocation_endpoint"] = (
+                "{endpoint}/{token}".format(
+                    endpoint=config.snappy.builder_proxy_auth_api_endpoint,
+                    token=token['username']))
+
+    @defer.inlineCallbacks
+    def _requestProxyToken(self):
+        admin_username = config.snappy.builder_proxy_auth_api_admin_username
+        if not admin_username:
+            raise CannotBuild(
+                "builder_proxy_auth_api_admin_username is not configured.")
+        secret = config.snappy.builder_proxy_auth_api_admin_secret
+        if not secret:
+            raise CannotBuild(
+                "builder_proxy_auth_api_admin_secret is not configured.")
+        url = config.snappy.builder_proxy_auth_api_endpoint
+        if not secret:
+            raise CannotBuild(
+                "builder_proxy_auth_api_endpoint is not configured.")
+        timestamp = int(time.time())
+        proxy_username = '{build_id}-{timestamp}'.format(
+            build_id=self.build.build_cookie,
+            timestamp=timestamp)
+        auth_string = '{}:{}'.format(admin_username, secret).strip()
+        auth_header = b'Basic ' + base64.b64encode(auth_string)
+
+        response = yield treq.post(
+            url, headers={'Authorization': auth_header},
+            json={'username': proxy_username},
+            reactor=self._slave.reactor,
+            pool=self._slave.pool)
+        response = yield check_status(response)
+        token = yield treq.json_content(response)
+        defer.returnValue(token)
+
+
 @adapter(ISnapBuild)
 @implementer(IBuildFarmJobBehaviour)
-class SnapBuildBehaviour(BuildFarmJobBehaviourBase):
+class SnapBuildBehaviour(SnapProxyMixin, BuildFarmJobBehaviourBase):
     """Dispatches `SnapBuild` jobs to slaves."""
 
     builder_type = "snap"
@@ -111,18 +161,7 @@ class SnapBuildBehaviour(BuildFarmJobBehaviourBase):
         build = self.build
         args = yield super(SnapBuildBehaviour, self).extraBuildArgs(
             logger=logger)
-        if config.snappy.builder_proxy_host and build.snap.allow_internet:
-            token = yield self._requestProxyToken()
-            args["proxy_url"] = (
-                "http://{username}:{password}@{host}:{port}".format(
-                    username=token['username'],
-                    password=token['secret'],
-                    host=config.snappy.builder_proxy_host,
-                    port=config.snappy.builder_proxy_port))
-            args["revocation_endpoint"] = (
-                "{endpoint}/{token}".format(
-                    endpoint=config.snappy.builder_proxy_auth_api_endpoint,
-                    token=token['username']))
+        yield self.addProxyArgs(args, build.snap.allow_internet)
         args["name"] = build.snap.store_name or build.snap.name
         channels = build.channels or {}
         if "snapcraft" not in channels:
@@ -188,36 +227,6 @@ class SnapBuildBehaviour(BuildFarmJobBehaviourBase):
             args["build_request_timestamp"] = timestamp
         defer.returnValue(args)
 
-    @defer.inlineCallbacks
-    def _requestProxyToken(self):
-        admin_username = config.snappy.builder_proxy_auth_api_admin_username
-        if not admin_username:
-            raise CannotBuild(
-                "builder_proxy_auth_api_admin_username is not configured.")
-        secret = config.snappy.builder_proxy_auth_api_admin_secret
-        if not secret:
-            raise CannotBuild(
-                "builder_proxy_auth_api_admin_secret is not configured.")
-        url = config.snappy.builder_proxy_auth_api_endpoint
-        if not secret:
-            raise CannotBuild(
-                "builder_proxy_auth_api_endpoint is not configured.")
-        timestamp = int(time.time())
-        proxy_username = '{build_id}-{timestamp}'.format(
-            build_id=self.build.build_cookie,
-            timestamp=timestamp)
-        auth_string = '{}:{}'.format(admin_username, secret).strip()
-        auth_header = b'Basic ' + base64.b64encode(auth_string)
-
-        response = yield treq.post(
-            url, headers={'Authorization': auth_header},
-            json={'username': proxy_username},
-            reactor=self._slave.reactor,
-            pool=self._slave.pool)
-        response = yield check_status(response)
-        token = yield treq.json_content(response)
-        defer.returnValue(token)
-
     def verifySuccessfulBuild(self):
         """See `IBuildFarmJobBehaviour`."""
         # The implementation in BuildFarmJobBehaviourBase checks whether the
diff --git a/lib/lp/snappy/tests/test_snapbuildbehaviour.py b/lib/lp/snappy/tests/test_snapbuildbehaviour.py
index 2755523..f851008 100644
--- a/lib/lp/snappy/tests/test_snapbuildbehaviour.py
+++ b/lib/lp/snappy/tests/test_snapbuildbehaviour.py
@@ -24,7 +24,6 @@ from testtools.matchers import (
     AfterPreprocessing,
     ContainsDict,
     Equals,
-    HasLength,
     Is,
     IsInstance,
     MatchesDict,
@@ -38,13 +37,10 @@ from testtools.twistedsupport import (
 import transaction
 from twisted.internet import (
     defer,
-    endpoints,
     reactor,
     )
-from twisted.python.compat import nativeString
 from twisted.trial.unittest import TestCase as TrialTestCase
 from twisted.web import (
-    resource,
     server,
     xmlrpc,
     )
@@ -71,6 +67,11 @@ from lp.buildmaster.tests.mock_slaves import (
     OkSlave,
     SlaveTestHelpers,
     )
+from lp.buildmaster.tests.snapbuildproxy import (
+    InProcessProxyAuthAPIFixture,
+    ProxyURLMatcher,
+    RevocationEndpointMatcher,
+    )
 from lp.buildmaster.tests.test_buildfarmjobbehaviour import (
     TestGetUploadMethodsMixin,
     TestHandleStatusMixin,
@@ -100,7 +101,6 @@ from lp.soyuz.adapters.archivedependencies import (
     )
 from lp.soyuz.enums import PackagePublishingStatus
 from lp.soyuz.interfaces.archive import ArchiveDisabled
-from lp.soyuz.interfaces.component import IComponentSet
 from lp.soyuz.tests.soyuz import Base64KeyMatches
 from lp.testing import (
     TestCase,
@@ -116,69 +116,6 @@ from lp.testing.layers import LaunchpadZopelessLayer
 from lp.xmlrpc.interfaces import IPrivateApplication
 
 
-class ProxyAuthAPITokensResource(resource.Resource):
-    """A test tokens resource for the proxy authentication API."""
-
-    isLeaf = True
-
-    def __init__(self):
-        resource.Resource.__init__(self)
-        self.requests = []
-
-    def render_POST(self, request):
-        content = request.content.read()
-        self.requests.append({
-            "method": request.method,
-            "uri": request.uri,
-            "headers": dict(request.requestHeaders.getAllRawHeaders()),
-            "content": content,
-            })
-        username = json.loads(content)["username"]
-        return json.dumps({
-            "username": username,
-            "secret": uuid.uuid4().hex,
-            "timestamp": datetime.utcnow().isoformat(),
-            })
-
-
-class InProcessProxyAuthAPIFixture(fixtures.Fixture):
-    """A fixture that pretends to be the proxy authentication API.
-
-    Users of this fixture must call the `start` method, which returns a
-    `Deferred`, and arrange for that to get back to the reactor.  This is
-    necessary because the basic fixture API does not allow `setUp` to return
-    anything.  For example:
-
-        class TestSomething(TestCase):
-
-            run_tests_with = AsynchronousDeferredRunTest.make_factory(
-                timeout=10)
-
-            @defer.inlineCallbacks
-            def setUp(self):
-                super(TestSomething, self).setUp()
-                yield self.useFixture(InProcessProxyAuthAPIFixture()).start()
-    """
-
-    @defer.inlineCallbacks
-    def start(self):
-        root = resource.Resource()
-        self.tokens = ProxyAuthAPITokensResource()
-        root.putChild("tokens", self.tokens)
-        endpoint = endpoints.serverFromString(reactor, nativeString("tcp:0"))
-        site = server.Site(self.tokens)
-        self.addCleanup(site.stopFactory)
-        port = yield endpoint.listen(site)
-        self.addCleanup(port.stopListening)
-        config.push("in-process-proxy-auth-api-fixture", dedent("""
-            [snappy]
-            builder_proxy_auth_api_admin_secret: admin-secret
-            builder_proxy_auth_api_endpoint: http://%s:%s/tokens
-            """) %
-            (port.getHost().host, port.getHost().port))
-        self.addCleanup(config.pop, "in-process-proxy-auth-api-fixture")
-
-
 class InProcessAuthServer(xmlrpc.XMLRPC):
 
     def __init__(self, *args, **kwargs):
@@ -380,21 +317,6 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
         self.addCleanup(slave.pool.closeCachedConnections)
         return job
 
-    def getProxyURLMatcher(self, job):
-        return AfterPreprocessing(urlsplit, MatchesStructure(
-            scheme=Equals("http"),
-            username=Equals("{}-{}".format(
-                job.build.build_cookie, int(self.now))),
-            password=HasLength(32),
-            hostname=Equals(config.snappy.builder_proxy_host),
-            port=Equals(config.snappy.builder_proxy_port),
-            path=Equals("")))
-
-    def getRevocationEndpointMatcher(self, job):
-        return Equals("{}/{}-{}".format(
-            config.snappy.builder_proxy_auth_api_endpoint,
-            job.build.build_cookie, int(self.now)))
-
     @defer.inlineCallbacks
     def test_composeBuildRequest(self):
         job = self.makeJob()
@@ -466,8 +388,8 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
             "fast_cleanup": Is(True),
             "name": Equals("test-snap"),
             "private": Is(False),
-            "proxy_url": self.getProxyURLMatcher(job),
-            "revocation_endpoint": self.getRevocationEndpointMatcher(job),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
             "series": Equals("unstable"),
             "trusted_keys": Equals(expected_trusted_keys),
             }))
@@ -507,8 +429,8 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
             "git_path": Equals(ref.name),
             "name": Equals("test-snap"),
             "private": Is(False),
-            "proxy_url": self.getProxyURLMatcher(job),
-            "revocation_endpoint": self.getRevocationEndpointMatcher(job),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
             "series": Equals("unstable"),
             "trusted_keys": Equals(expected_trusted_keys),
             }))
@@ -537,8 +459,8 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
             "git_repository": Equals(ref.repository.git_https_url),
             "name": Equals("test-snap"),
             "private": Is(False),
-            "proxy_url": self.getProxyURLMatcher(job),
-            "revocation_endpoint": self.getRevocationEndpointMatcher(job),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
             "series": Equals("unstable"),
             "trusted_keys": Equals(expected_trusted_keys),
             }))
@@ -584,8 +506,8 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
             "git_path": Equals(ref.name),
             "name": Equals("test-snap"),
             "private": Is(True),
-            "proxy_url": self.getProxyURLMatcher(job),
-            "revocation_endpoint": self.getRevocationEndpointMatcher(job),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
             "series": Equals("unstable"),
             "trusted_keys": Equals(expected_trusted_keys),
             }))
@@ -616,8 +538,8 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
             "git_path": Equals("master"),
             "name": Equals("test-snap"),
             "private": Is(False),
-            "proxy_url": self.getProxyURLMatcher(job),
-            "revocation_endpoint": self.getRevocationEndpointMatcher(job),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
             "series": Equals("unstable"),
             "trusted_keys": Equals(expected_trusted_keys),
             }))
@@ -646,8 +568,8 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
             "git_repository": Equals(url),
             "name": Equals("test-snap"),
             "private": Is(False),
-            "proxy_url": self.getProxyURLMatcher(job),
-            "revocation_endpoint": self.getRevocationEndpointMatcher(job),
+            "proxy_url": ProxyURLMatcher(job, self.now),
+            "revocation_endpoint":  RevocationEndpointMatcher(job, self.now),
             "series": Equals("unstable"),
             "trusted_keys": Equals(expected_trusted_keys),
             }))
@@ -808,7 +730,7 @@ class TestAsyncSnapBuildBehaviour(TestSnapBuildBehaviourBase):
         job = self.makeJob()
         build_request = yield job.composeBuildRequest(None)
         self.assertThat(
-            build_request[4]["proxy_url"], self.getProxyURLMatcher(job))
+            build_request[4]["proxy_url"], ProxyURLMatcher(job, self.now))
 
     @defer.inlineCallbacks
     def test_composeBuildRequest_deleted(self):
diff --git a/lib/lp/testing/factory.py b/lib/lp/testing/factory.py
index 85a05b6..c402c4c 100644
--- a/lib/lp/testing/factory.py
+++ b/lib/lp/testing/factory.py
@@ -4991,9 +4991,15 @@ class BareLaunchpadObjectFactory(ObjectFactory):
         if requester is None:
             requester = self.makePerson()
         if distro_arch_series is None:
-            distro_arch_series = self.makeDistroArchSeries()
+            distroseries = self.makeDistroSeries(status=SeriesStatus.CURRENT)
+            processor = getUtility(IProcessorSet).getByName("386")
+            distro_arch_series = self.makeDistroArchSeries(
+                distroseries=distroseries, architecturetag="i386",
+                processor=processor)
         if recipe is None:
-            recipe = self.makeOCIRecipe()
+            oci_project = self.makeOCIProject(
+                pillar=distro_arch_series.distroseries.distribution)
+            recipe = self.makeOCIRecipe(oci_project=oci_project)
         oci_build = getUtility(IOCIRecipeBuildSet).new(
             requester, recipe, distro_arch_series, date_created)
         if duration is not None:
@@ -5010,12 +5016,13 @@ class BareLaunchpadObjectFactory(ObjectFactory):
         return oci_build
 
     def makeOCIFile(self, build=None, library_file=None,
-                    layer_file_digest=None):
+                    layer_file_digest=None, content=None, filename=None):
         """Make a new OCIFile."""
         if build is None:
             build = self.makeOCIRecipeBuild()
         if library_file is None:
-            library_file = self.makeLibraryFileAlias()
+            library_file = self.makeLibraryFileAlias(
+                content=content, filename=filename)
         return OCIFile(build=build, library_file=library_file,
                        layer_file_digest=layer_file_digest)
 
diff --git a/lib/lp/translations/tests/test_translationtemplatesbuildbehaviour.py b/lib/lp/translations/tests/test_translationtemplatesbuildbehaviour.py
index b387251..32dd553 100644
--- a/lib/lp/translations/tests/test_translationtemplatesbuildbehaviour.py
+++ b/lib/lp/translations/tests/test_translationtemplatesbuildbehaviour.py
@@ -138,7 +138,7 @@ class TestTranslationTemplatesBuildBehaviour(
         buildqueue = FakeBuildQueue(behaviour)
         path = behaviour.templates_tarball_path
         # Poke the file we're expecting into the mock slave.
-        behaviour._slave.valid_file_hashes.append(path)
+        behaviour._slave.valid_files[path] = ''
 
         def got_tarball(filename):
             tarball = open(filename, 'r')