Merge lp:~apw/ubuntu-archive-tools/copy-proposed-kernel--support-lrg-lrs into lp:ubuntu-archive-tools

[Andy Whitcroft]

Add support for the new linux-restricted-generate/linux-restricted-signatures workflow.

[Łukasz Zemczak (sil2100)]

Generally looks good. A whitespace comment inline, but that's not really important.

One thing I just would like to make sure is intended: from the commit messages I understood that we do not want to allow unembargoing only for selected, safe places. But this can be overriden via the --unembargo argument, right? So it's like a hard override, skipping over all checks, right?

review: Approve

[Andy Whitcroft (apw)]

> Generally looks good. A whitespace comment inline, but that's not really
> important.
>
> One thing I just would like to make sure is intended: from the commit messages
> I understood that we do not want to allow unembargoing only for selected, safe
> places. But this can be overriden via the --unembargo argument, right? So it's
> like a hard override, skipping over all checks, right?

Right, the automated enablement of --embargo is only for safe source/destination pairs. --embargo on the command line is intended to be a "Look just to what I need there is fire" override.

[lp:~apw/ubuntu-archive-tools/copy-proposed-kernel--support-lrg-lrs]

1464. By Andy Whitcroft on 2021-03-11

copy-proposed-kernel: clean up whitespace

Clean up whitespace based on review feedback.

Signed-off-by: Andy Whitcroft <email address hidden>

=== modified file 'copy-proposed-kernel'
--- copy-proposed-kernel	2021-03-10 10:13:48 +0000
+++ copy-proposed-kernel	2021-03-11 17:44:33 +0000
@@ -42,14 +42,14 @@
             self.series = None
             self.source = None
             self.ppa2 = False
-            self.security = False
-            self.security2 = False
+            self.security = None
             self.esm = False
             self.fips = False
             self.ibmgt = False
             self.to_signing = False
             self.from_signing = False
             self.no_auto = False
+            self.unembargo = False
 
             self.update(**kwargs)
 
@@ -81,6 +81,25 @@
                             - ['ppa:canonical-kernel-team/ubuntu/ppa', 'Release' ]
                         proposed:
                             - ['ubuntu', 'Proposed' ]
+                    drivers:
+                        security-build:
+                            - ['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release' ]
+                            - ['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release' ]
+                        build:
+                            - ['ppa:canonical-kernel-team/ubuntu/ppa', 'Release' ]
+                        build-private:
+                            - ['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release' ]
+                        signing:
+                            - ['ppa:canonical-signing/ubuntu/primary', 'Release']
+                        proposed:
+                            - ['ubuntu', 'Proposed' ]
+                    drivers-contrived: # build-private but no signing is invalid
+                        build:
+                            - ['ppa:canonical-kernel-team/ubuntu/ppa', 'Release' ]
+                        build-private:
+                            - ['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release' ]
+                        proposed:
+                            - ['ubuntu', 'Proposed' ]
                     esm:
                         security-build:
                             - ['ppa:canonical-kernel-security-team/ubuntu/esm', 'Release']
@@ -90,6 +109,17 @@
                             - ['ppa:canonical-signing/ubuntu/esm', 'Release']
                         proposed:
                             - ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release']
+                    uc20:
+                        security-build:
+                            - ['ppa:canonical-kernel-security-team/ubuntu/uc20', 'Release']
+                            - ['ppa:canonical-kernel-security-team/ubuntu/uc20-2', 'Release']
+                            - ['ppa:canonical-kernel-security-team/ubuntu/uc20-3', 'Release']
+                        build:
+                            - ['ppa:canonical-kernel-team/ubuntu/uc20-build', 'Release']
+                        signing:
+                            - ['ppa:canonical-signing/ubuntu/uc20', 'Release']
+                        proposed:
+                            - ['ppa:canonical-kernel-team/ubuntu/uc20-staging', 'Release']
             14.04:
                 codename: trusty
                 supported: true
@@ -134,6 +164,8 @@
                                 type: signed
                             linux-meta:
                                 type: meta
+                            linux-restricted-modules:
+                                type: lrm
                     linux-ibm-gt:
                         routing:
                             security-build:
@@ -141,65 +173,182 @@
                                 - ['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release']
                             build:
                                 - ['ppa:ibm-cloud/ubuntu/build', 'Release']
+                            signing:
+                                - ['ppa:canonical-signing/ubuntu/ibm-gt', 'Release']
                             proposed:
                                 - ['ppa:ibm-cloud/ubuntu/proposed', 'Release']
                         packages:
                             linux-ibm-gt:
                             linux-meta-ibm-gt:
                                 type: meta
+            20.04:
+                codename: focal
+                supported: true
+                sources:
+                    linux:
+                        routing: drivers
+                        packages:
+                            linux:
+                            linux-signed:
+                                type: signed
+                            linux-meta:
+                                type: meta
+                            linux-restricted-modules:
+                                type: lrm
+                            linux-restricted-generate:
+                                type: lrg
+                            linux-restricted-signatures:
+                                type: lrs
+                    linux-contrived:
+                        routing: drivers-contrived
+                        packages:
+                            linux-contrived:
+                            linux-restricted-generate-contrived:
+                                type: lrg
+                    linux-uc20-efi:
+                        routing: uc20
+                        packages:
+                            linux-uc20-efi:
+                            linux-signed-uc20-efi:
+                                type: signed
         """
         cls.ks = KernelSeries(data=data)
 
 
 class TestRouting(TestBase):
     def test_default(self):
-        expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False)
+        expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False, True)
         result = routing(self.FakeArgs(series='bionic', source='linux'), self.ks)
         self.assertEqual(expected, result)
 
     def test_security(self):
-        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], True)
-        result = routing(self.FakeArgs(series='bionic', source='linux', security=True), self.ks)
+        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], True, True)
+        result = routing(self.FakeArgs(series='bionic', source='linux', security=1), self.ks)
         self.assertEqual(expected, result)
 
     def test_security2(self):
-        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ubuntu', 'Proposed'], True)
-        result = routing(self.FakeArgs(series='bionic', source='linux', security2=True), self.ks)
+        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ubuntu', 'Proposed'], True, True)
+        result = routing(self.FakeArgs(series='bionic', source='linux', security=2), self.ks)
         self.assertEqual(expected, result)
 
     def test_to_signing(self):
-        expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], None, False)
+        expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], None, False, True)
         result = routing(self.FakeArgs(series='bionic', source='linux', to_signing=True), self.ks)
         self.assertEqual(expected, result)
 
-    def test_from_signing(self):
-        expected = (None, ['ubuntu', 'Proposed'], False)
+    def test_from_signing_no_signing(self):
+        # No signing present ... this should fail elsewhere, but confirm it would not
+        # allow unembargo.
+        expected = (None, ['ubuntu', 'Proposed'], False, True)
         result = routing(self.FakeArgs(series='bionic', source='linux', from_signing=True), self.ks)
         self.assertEqual(expected, result)
 
+    def test_from_signing_to_main(self):
+        expected = (['ppa:canonical-signing/ubuntu/primary', 'Release'], ['ubuntu', 'Proposed'], True, True)
+        result = routing(self.FakeArgs(series='focal', source='linux', from_signing=True), self.ks)
+        self.assertEqual(expected, result)
+
+    def test_from_signing_to_uc20(self):
+        expected = (['ppa:canonical-signing/ubuntu/uc20', 'Release'], ['ppa:canonical-kernel-team/ubuntu/uc20-staging', 'Release'], True, True)
+        result = routing(self.FakeArgs(series='focal', source='linux-uc20-efi', from_signing=True), self.ks)
+        self.assertEqual(expected, result)
+
+    def test_from_signing_to_private(self):
+        expected = (['ppa:canonical-signing/ubuntu/ibm-gt', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True)
+        result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', from_signing=True), self.ks)
+        self.assertEqual(expected, result)
+
+    def test_binaries_from_build_to_proposed(self):
+        for package, binaries in (
+                ('linux', True),
+                ('linux-signed', False),
+                ('linux-meta', True),
+                ('linux-restricted-modules', True),
+                ):
+            expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False, binaries)
+            result = routing(self.FakeArgs(series='bionic', source=package), self.ks)
+            self.assertEqual(expected, result)
+
+    def test_binaries_from_build_to_signing(self):
+        for package, binaries in (
+                ('linux', True),
+                ('linux-signed', False),
+                ('linux-meta', True),
+                ('linux-restricted-modules', True),
+                ):
+            expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries)
+            result = routing(self.FakeArgs(series='focal', source=package), self.ks)
+            self.assertEqual(expected, result)
+        for package, binaries in (
+                ('linux-restricted-generate', True),
+                ('linux-restricted-signatures', False),
+                ):
+            expected = (['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries)
+            result = routing(self.FakeArgs(series='focal', source=package), self.ks)
+            self.assertEqual(expected, result)
+
+    def test_binaries_from_build_to_signing(self):
+        for package, binaries in (
+                ('linux', True),
+                ('linux-signed', False),
+                ('linux-meta', True),
+                ('linux-restricted-modules', True),
+                ):
+            expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries)
+            result = routing(self.FakeArgs(series='focal', source=package), self.ks)
+            self.assertEqual(expected, result)
+        for package, binaries in (
+                ('linux-restricted-generate', True),
+                ('linux-restricted-signatures', False),
+                ):
+            expected = (['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries)
+            result = routing(self.FakeArgs(series='focal', source=package), self.ks)
+            self.assertEqual(expected, result)
+
+    def test_binaries_from_signing_to_proposed(self):
+        for package, binaries in (
+                ('linux', True),
+                ('linux-signed', True),
+                ('linux-meta', True),
+                ('linux-restricted-modules', True),
+                ('linux-restricted-signatures', True),
+                ):
+            expected = (['ppa:canonical-signing/ubuntu/primary', 'Release'], ['ubuntu', 'Proposed'], True, binaries)
+            result = routing(self.FakeArgs(series='focal', source=package, from_signing=True), self.ks)
+            self.assertEqual(expected, result)
+        # LRG should not go anywhere but signing.
+        self.assertRaises(RoutingError, routing, self.FakeArgs(series='focal', source='linux-restricted-generate', from_signing=True), self.ks)
+
+    def test_binaries_from_build_to_proposed_lrg(self):
+        expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False, True)
+        result = routing(self.FakeArgs(series='focal', source='linux-contrived'), self.ks)
+        self.assertEqual(expected, result)
+        # LRG should not go anywhere but signing.
+        self.assertRaises(RoutingError, routing, self.FakeArgs(series='focal', source='linux-restricted-generate-contrived'), self.ks)
+
     def test_esm(self):
-        expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False)
+        expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False, True)
         result = routing(self.FakeArgs(series='trusty', source='linux'), self.ks)
         self.assertEqual(expected, result)
 
     def test_esm_security(self):
-        expected = (['ppa:canonical-kernel-security-team/ubuntu/esm', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False)
-        result = routing(self.FakeArgs(series='trusty', source='linux', security=True), self.ks)
+        expected = (['ppa:canonical-kernel-security-team/ubuntu/esm', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False, True)
+        result = routing(self.FakeArgs(series='trusty', source='linux', security=1), self.ks)
         self.assertEqual(expected, result)
 
     def test_esm_security2(self):
         with self.assertRaises(SystemExit), self.capture() as (out, err):
-            expected = (None, ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False)
-            result = routing(self.FakeArgs(series='trusty', source='linux', security2=True), self.ks)
+            expected = (None, ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False, True)
+            result = routing(self.FakeArgs(series='trusty', source='linux', security=2), self.ks)
             self.assertEqual(expected, result)
 
     def test_esm_to_signing(self):
-        expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False)
+        expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False, True)
         result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, to_signing=True), self.ks)
         self.assertEqual(expected, result)
 
     def test_esm_from_signing(self):
-        expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False)
+        expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False, True)
         result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, from_signing=True), self.ks)
         self.assertEqual(expected, result)
 
@@ -208,59 +357,66 @@
     # simple we make from_signing take presidence over to_signing.  Test this
     # is honoured correctly.
     def test_esm_from_signing_override_to_signing(self):
-        expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False)
+        expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False, True)
         result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, to_signing=True, from_signing=True), self.ks)
         self.assertEqual(expected, result)
 
     def test_fips(self):
-        expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False)
+        expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True)
         result = routing(self.FakeArgs(series='xenial', source='linux-fips'), self.ks)
         self.assertEqual(expected, result)
 
     def test_fips_security(self):
-        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False)
-        result = routing(self.FakeArgs(series='xenial', source='linux-fips', security=True), self.ks)
+        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True)
+        result = routing(self.FakeArgs(series='xenial', source='linux-fips', security=1), self.ks)
         self.assertEqual(expected, result)
 
     def test_fips_security2(self):
-        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False)
-        result = routing(self.FakeArgs(series='xenial', source='linux-fips', security2=True), self.ks)
+        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True)
+        result = routing(self.FakeArgs(series='xenial', source='linux-fips', security=2), self.ks)
         self.assertEqual(expected, result)
 
     def test_fips_to_signing(self):
-        expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False)
+        expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True)
         result = routing(self.FakeArgs(series='xenial', source='linux-fips', to_signing=True), self.ks)
         self.assertEqual(expected, result)
 
     def test_fips_from_signing(self):
-        expected = (['ppa:canonical-signing/ubuntu/fips', 'Release'], ['ppa:ubuntu-advantage/ubuntu/fips-proposed', 'Release'], False)
+        expected = (['ppa:canonical-signing/ubuntu/fips', 'Release'], ['ppa:ubuntu-advantage/ubuntu/fips-proposed', 'Release'], False, True)
         result = routing(self.FakeArgs(series='xenial', source='linux-fips', from_signing=True), self.ks)
         self.assertEqual(expected, result)
 
     def test_ibmgt(self):
-        expected = (['ppa:ibm-cloud/ubuntu/build', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False)
+        expected = (['ppa:ibm-cloud/ubuntu/build', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True)
         result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt'), self.ks)
         self.assertEqual(expected, result)
 
     def test_ibmgt_security(self):
-        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False)
-        result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security=True), self.ks)
+        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True)
+        result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security=1), self.ks)
         self.assertEqual(expected, result)
 
     def test_ibmgt_security2(self):
-        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False)
-        result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security2=True), self.ks)
+        expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True)
+        result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security=2), self.ks)
         self.assertEqual(expected, result)
 
 
+class RoutingError(Exception):
+    pass
+
+
+unembargo_from_security = ['ppa:canonical-kernel-security-team/ubuntu/ppa' + v for v in ('', '2', '3')]
+unembargo_from_signing = ['ppa:canonical-signing/ubuntu/primary', 'ppa:canonical-signing/ubuntu/uc20']
+unembargo_to_ok = ['ubuntu', 'ppa:canonical-kernel-team/ubuntu/uc20-staging']
+
 def routing(args, ks):
     series_name = args.series
     package_name = args.source
 
     series = ks.lookup_series(codename=series_name)
     if series is None:
-        print("ERROR: {} -- series unknown".format(series_name))
-        sys.exit(1)
+        raise RoutingError("ERROR: {} -- series unknown".format(series_name))
 
     package = None
     package_signed = None
@@ -269,43 +425,38 @@
         for package_srch in source_srch.packages:
             if package_srch.name == package_name:
                 package = package_srch
-            if package_srch.type == 'signed':
+            # XXX: this should be package_srch.signing
+            if package_srch.type in ('signed', 'lrs'):
                 package_signed = package_srch
         if package is not None:
             break
     if package is None:
-        print("ERROR: {}/{} -- package unknown".format(series_name, package_name))
-        sys.exit(1)
+        raise RoutingError("ERROR: {}/{} -- package unknown".format(series_name, package_name))
 
     source = package.source
     routing = source.routing
     if routing is None:
-        print("ERROR: {}/{} -- package has no routing".format(series_name, package_name))
-        sys.exit(1)
+        raise RoutingError("ERROR: {}/{} -- package has no routing".format(series_name, package_name))
 
-    build_archives = routing.lookup_destination('build')
+    # XXX: this should be package_srch.adjunct
+    if package.type in ('lrg', 'lrs'):
+        build_archives = routing.lookup_destination('build-private')
+    else:
+        build_archives = routing.lookup_destination('build')
     security_archives = routing.lookup_destination('security-build')
     proposed_archive = routing.lookup_destination('proposed', primary=True)
     signing_archive = routing.lookup_destination('signing', primary=True)
 
     if build_archives is None or len(build_archives) < 1:
-        print("ERROR: {}/{} -- package has no primary build archive".format(series_name, package_name))
-        sys.exit(1)
+        raise RoutingError("ERROR: {}/{} -- package has no primary build archive".format(series_name, package_name))
     if args.ppa2 and (build_archives is None or len(build_archives) < 2):
-        print("ERROR: {}/{} -- package has no secondary build archive".format(series_name, package_name))
-        sys.exit(1)
+        raise RoutingError("ERROR: {}/{} -- package has no secondary build archive".format(series_name, package_name))
     if build_archives is None:
-        print("ERROR: {}/{} -- package has no build archive".format(series_name, package_name))
-        sys.exit(1)
+        raise RoutingError("ERROR: {}/{} -- package has no build archive".format(series_name, package_name))
     if proposed_archive is None:
-        print("ERROR: {}/{} -- package has no proposed archive".format(series_name, package_name))
-        sys.exit(1)
-    if args.security and (security_archives is None or len(security_archives) < 1):
-        print("ERROR: {}/{} -- package has no primary security archive".format(series_name, package_name))
-        sys.exit(1)
-    if args.security2 and (security_archives is None or len(security_archives) < 2):
-        print("ERROR: {}/{} -- package has no secondary security archive".format(series_name, package_name))
-        sys.exit(1)
+        RoutingError("ERROR: {}/{} -- package has no proposed archive".format(series_name, package_name))
+    if args.security and (security_archives is None or len(security_archives) < args.security):
+        RoutingError("ERROR: {}/{} -- package has no security archive #{}".format(series_name, package_name, args.security))
 
     # Default route build -> proposed
     if args.ppa2:
@@ -314,17 +465,9 @@
         from_archive = build_archives[0]
     to_archive = proposed_archive
 
-    unembargo = False
-
     # Handle security routing.
     if args.security:
-        from_archive = security_archives[0]
-    if args.security2:
-        from_archive = security_archives[1]
-
-    # Allow us to unembargo when releasing from security to ubuntu.
-    if (args.security or args.security2) and to_archive[0] == 'ubuntu':
-        unembargo = True
+        from_archive = security_archives[args.security - 1]
 
     # Handle signing routing.
     if args.from_signing:
@@ -335,6 +478,23 @@
     elif args.no_auto is False and signing_archive is not None and package_signed is not None:
         to_archive = signing_archive
 
+    # Allow us to unembargo when releasing from security.  Ensure the source
+    # is somewhere where we expect things which are public.
+    unembargo = args.unembargo
+    if args.security and from_archive[0] in unembargo_from_security and to_archive[0] in unembargo_to_ok:
+        unembargo = True
+    elif signing_archive and args.from_signing and from_archive[0] in unembargo_from_signing and to_archive[0] in unembargo_to_ok:
+        unembargo = True
+
+    # We should be copying binaries for non-'signing' packages
+    # when on their way to somewhere where signing is intended.
+    binaries = True
+    # XXX: this should be package_srch.signing
+    if (package.type in ('signed', 'lrs') and
+            (to_archive == signing_archive or
+            (from_archive != signing_archive and to_archive == proposed_archive))):
+        binaries = False
+
     # Announce the routing if needed.
     if (args.testing is False and (routing.name != 'default' or from_archive == signing_archive or to_archive == signing_archive)):
         msg = "NOTE: directing copy using {} routes".format(routing.name)
@@ -344,7 +504,12 @@
             msg += ' to signing'
         print(msg)
 
-    return (from_archive, to_archive, unembargo)
+
+    # It is only safe to copy linux-restricted-generate to signing. Refuse to copy.
+    if package.type == 'lrg' and to_archive != signing_archive:
+        raise RoutingError("ERROR: {}/{} -- package type lrg is embargoed, copy only allowed to signing".format(series_name, package_name))
+
+    return (from_archive, to_archive, unembargo, binaries)
 
 
 # SELF-TESTS:
@@ -356,14 +521,16 @@
 parser.set_defaults(testing=False)
 parser.add_argument('--dry-run', action='store_true', help='Do everything but actually copy the package')
 parser.add_argument('--ppa2', action='store_true', help='Copy from the kernel build PPA2')
-parser.add_argument('--security', '-S', action='store_true', help='Copy from the kernel security PPA')
-parser.add_argument('--security2', action='store_true', help='Copy from the kernel security PPA2')
+parser.add_argument('--security', '-S', action='store_const', const=1, help='Copy from the kernel security PPA')
+parser.add_argument('--security2', action='store_const', const=2, dest='security',  help='Copy from the kernel security PPA2')
+parser.add_argument('--security3', action='store_const', const=3, dest='security',  help='Copy from the kernel security PPA3')
 parser.add_argument('--esm', '-E', action='store_true', help='Copy from the kernel ESM PPA and to the kernel ESM proposed PPA')
 parser.add_argument('--fips', action='store_true', help='Copy from the kernel FIPS PPA and to the kernel FIPS proposed PPA')
 parser.add_argument('--ibmgt', action='store_true', help='Copy from the kernel IBM-GT build PPA to the corresponding proposed PPA')
 parser.add_argument('--no-auto', action='store_true', help='Turn off automatic detection of ESM et al based on series')
 parser.add_argument('--to-signing', action='store_true', help='Copy from the kernel ESM/FIPS PPA to the ESM/FIPS signing PPA')
 parser.add_argument('--from-signing', action='store_true', help='Copy from the ESM/FIPS signing PPA to the ESM/FIPS proposed PPA')
+parser.add_argument('--unembargo', action='store_true', default=False, help='Allow copies from private PPAs')
 parser.add_argument('series', action='store', help='The series the source package is in')
 parser.add_argument('source', action='store', nargs='+', help='The source package name')
 
@@ -386,8 +553,12 @@
     # BODGE: routing should just take release/pkg.
     args.source = pkg
 
-    (from_archive, to_archive, security) = routing(args, ks)
+    try:
+        (from_archive, to_archive, unembargo, include_binaries) = routing(args, ks)
     ##print("from_archive<{}> to_archive<{}>".format(from_archive, to_archive))
+    except RoutingError as e:
+        print("ERROR: {}", e.args[0])
+        sys.exit(1)
 
     if from_archive is None:
         print("ERROR: bad source PPA")
@@ -414,11 +585,6 @@
     if versions.total_size == 1:
         version = versions[0].source_package_version
 
-    include_binaries = (pkg not in ('debian-installer')
-                        and not pkg.startswith('linux-signed'))
-    if args.from_signing:
-        include_binaries = True
-
     print("""Copying {}/{}:
      From: {} {} {}
      To: {} {} {}
@@ -426,7 +592,8 @@
 
     if not version:
         print("ERROR: no version to copy")
-        sys.exit(1)
+        if not args.dry_run:
+            sys.exit(1)
 
     copies.append({
             'from_archive': from_archive,
@@ -436,7 +603,7 @@
             'to_pocket': to_pocket,
             'version': version,
             'auto_approve': True,
-            'unembargo': security,
+            'unembargo': unembargo,
         })
 
 if args.dry_run: