Launchpad itself

ubuntu-sru either have too much or too little permission as queue admins

Bug #648611 reported by William Grant
22
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
High
Colin Watson

Bug Description

Queue admin permissions should be able to be granted with pocket and upload status granularity. For example, ubuntu-sru should be able to accept uploads from UNAPPROVED in the Proposed pocket, but not from NEW or other pockets.

Related branches

lp:~cjwatson/launchpad/pocket-queue-admin
Steve Kowalik (community): Approve (code)
Diff: 1186 lines (+570/-88)
12 files modified
lib/lp/_schema_circular_imports.py (+17/-0)
lib/lp/security.py (+14/-5)
lib/lp/soyuz/browser/archivepermission.py (+3/-0)
lib/lp/soyuz/browser/queue.py (+14/-4)
lib/lp/soyuz/browser/tests/test_queue.py (+128/-12)
lib/lp/soyuz/interfaces/archive.py (+98/-4)
lib/lp/soyuz/interfaces/archivepermission.py (+54/-0)
lib/lp/soyuz/interfaces/queue.py (+2/-2)
lib/lp/soyuz/model/archive.py (+46/-13)
lib/lp/soyuz/model/archivepermission.py (+73/-14)
lib/lp/soyuz/scripts/packagecopier.py (+2/-1)
lib/lp/soyuz/stories/webservice/xx-archive.txt (+119/-33)
lp:~cjwatson/launchpad/db-pocket-queue-admin
Stuart Bishop (community): Approve (db)
Robert Collins: Pending (db) requested
Diff: 24 lines (+9/-0)
2 files modified
database/schema/comments.sql (+1/-0)
database/schema/patch-2209-27-1.sql (+8/-0)
lp:~cjwatson/launchpad/fix-pocket-queue-admin-series
Abel Deuring (community): Approve (code)
Diff: 1124 lines (+196/-207)
18 files modified
lib/lp/soyuz/browser/archive.py (+12/-1)
lib/lp/soyuz/doc/archivepermission.txt (+74/-13)
lib/lp/soyuz/model/archivepermission.py (+2/-2)
lib/lp/soyuz/stories/distribution/xx-distribution-packages.txt (+6/-11)
lib/lp/soyuz/stories/ppa/xx-copy-packages.txt (+41/-78)
lib/lp/soyuz/stories/ppa/xx-delete-packages.txt (+8/-17)
lib/lp/soyuz/stories/ppa/xx-ppa-packages.txt (+4/-4)
lib/lp/soyuz/stories/ppa/xx-private-ppa-presentation.txt (+1/-3)
lib/lp/soyuz/stories/ppa/xx-private-ppa-subscription-stories.txt (+2/-5)
lib/lp/soyuz/stories/ppa/xx-private-ppa-subscriptions.txt (+3/-6)
lib/lp/soyuz/stories/ppa/xx-ubuntu-ppas.txt (+2/-5)
lib/lp/soyuz/stories/soyuz/xx-distroseries-sources.txt (+3/-5)
lib/lp/soyuz/stories/soyuz/xx-person-packages.txt (+2/-6)
lib/lp/soyuz/stories/soyuz/xx-private-builds.txt (+7/-14)
lib/lp/soyuz/stories/soyuz/xx-queue-pages-motu.txt (+2/-7)
lib/lp/soyuz/stories/soyuz/xx-queue-pages.txt (+4/-13)
lib/lp/soyuz/stories/webservice/xx-archive.txt (+23/-15)
lib/lp/soyuz/stories/webservice/xx-builds.txt (+0/-2)
William Grant (wgrant)
Changed in soyuz:
assignee: nobody → William Grant (wgrant)
Revision history for this message
Colin Watson (cjwatson) wrote :

Yes please. (Same goes for ubuntu-release for UNAPPROVED in the Release pocket during frozen periods.)

Revision history for this message
Julian Edwards (julian-edwards) wrote : Re: [Bug 648611] [NEW] Queue admin permissions need pocket and status granularity

So, the queue page is going to get even more popular. I guess we need to fix
the timeouts :/

Revision history for this message
Colin Watson (cjwatson) wrote : Re: [Bug 648611] [NEW] Queue admin permissions need pocket and status granularity

Beats it all having to go through manual requests to a small number of
privileged (and busy) human beings ...

Jelmer Vernooij (jelmer)
Changed in soyuz:
status: New → Confirmed
status: Confirmed → New
Julian Edwards (julian-edwards)
Changed in soyuz:
status: New → Triaged
importance: Undecided → High
tags: added: queue-page
William Grant (wgrant)
Changed in launchpad:
assignee: William Grant (wgrant) → nobody
Kate Stewart (kate.stewart)
tags: added: rls-mgr-o-tracking
Revision history for this message
Evan Broder (broder) wrote : Re: Queue admin permissions need pocket and status granularity

This is already loosely covered by the description of the bug, but I wanted to mention another concrete example that came up during today's technical board meeting. Namely, members of ubuntu-backporters should be able to accept packages uploaded to the backports pocket from the UNAPPROVED queue.

Robert Collins (lifeless)
summary: - Queue admin permissions need pocket and status granularity
+ ubuntu-sru either have too much or too little permission as queue admins
Revision history for this message
Colin Watson (cjwatson) wrote :

This is probably related to bug 914779, but is not quite the same (queue admin vs. upload).

Colin Watson (cjwatson)
Changed in launchpad:
status: Triaged → In Progress
assignee: nobody → Colin Watson (cjwatson)
Revision history for this message
Launchpad QA Bot (lpqabot) wrote :

Fixed in db-stable r11779 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/db-stable/revision/11779>.

tags: added: qa-needstesting
Changed in launchpad:
status: In Progress → Fix Committed
Revision history for this message
William Grant (wgrant) wrote :

From staging:

2012-07-23 06:47:27 INFO 2209-27-1 applied just now in 0.1 seconds

Changed in launchpad:
status: Fix Committed → In Progress
tags: added: qa-ok
removed: qa-needstesting
Revision history for this message
Launchpad QA Bot (lpqabot) wrote :

Fixed in stable r15774 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/15774>.

tags: added: qa-needstesting
removed: qa-ok
Changed in launchpad:
status: In Progress → Fix Committed
Revision history for this message
Colin Watson (cjwatson) wrote :

Ordinary pocket queue admin permissions work fine. Per-series ones are broken because the query in ArchivePermission.checkAuthenticated has insufficient parentheses in this case. Fortunately the only thing that calls it in a way that breaks is newPocketQueueAdmin, and since there are no ArchivePermission rows with distroseries NOT NULL at this point, the failure modes are either a timeout (as shown on dogfood) or possibly the ability to create duplicate per-series pocket queue admin permissions.

Since this is a new facility that only Ubuntu is likely to use in the near future and that we'll only be using in very controlled ways to start with, I think we're OK to roll this out for the sake of the pieces that work, as long as I fix the rest of it ASAP.

Changed in launchpad:
status: Fix Committed → In Progress
tags: added: qa-ok
removed: qa-needstesting
Revision history for this message
Launchpad QA Bot (lpqabot) wrote :

Fixed in stable r15826 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/15826>.

Changed in launchpad:
status: In Progress → Fix Committed
Colin Watson (cjwatson)
tags: added: qa-needstesting
removed: qa-ok
Colin Watson (cjwatson)
tags: added: qa-ok
removed: qa-needstesting
Curtis Hovey (sinzui)
Changed in launchpad:
status: Fix Committed → Fix Released
Revision history for this message
Colin Watson (cjwatson) wrote :

I've added the previously-discussed permissions now.

  $ for series in hardy lucid natty oneiric precise; do for pocket in proposed updates; do edit-acl -p ubuntu-sru -S $series --pocket $pocket -t admin add; done; done
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Proposed' in hardy
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Updates' in hardy
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Proposed' in lucid
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Updates' in lucid
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Proposed' in natty
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Updates' in natty
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Proposed' in oneiric
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Updates' in oneiric
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Proposed' in precise
  Added:
  Queue Administration Rights for ubuntu-sru: archive 'primary', pocket 'Updates' in precise
  $ for pocket in release proposed; do edit-acl -p ubuntu-release -S quantal --pocket $pocket -t admin add; done
  Added:
  Queue Administration Rights for ubuntu-release: archive 'primary', pocket 'Release' in quantal
  Added:
  Queue Administration Rights for ubuntu-release: archive 'primary', pocket 'Proposed' in quantal

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.