Merge lp:~apw/ubuntu-archive-tools/copy-proposed-kernel--support-lrg-lrs into lp:ubuntu-archive-tools
- copy-proposed-kernel--support-lrg-lrs
- Merge into trunk
Status: | Merged |
---|---|
Merged at revision: | 1462 |
Proposed branch: | lp:~apw/ubuntu-archive-tools/copy-proposed-kernel--support-lrg-lrs |
Merge into: | lp:ubuntu-archive-tools |
Diff against target: |
533 lines (+239/-72) 1 file modified
copy-proposed-kernel (+239/-72) |
To merge this branch: | bzr merge lp:~apw/ubuntu-archive-tools/copy-proposed-kernel--support-lrg-lrs |
Related bugs: |
Reviewer | Review Type | Date Requested | Status |
---|---|---|---|
Łukasz Zemczak | Approve | ||
Review via email: mp+399495@code.launchpad.net |
Commit message
Add support for the new linux-restricte
Description of the change
Andy Whitcroft (apw) wrote : | # |
> Generally looks good. A whitespace comment inline, but that's not really
> important.
>
> One thing I just would like to make sure is intended: from the commit messages
> I understood that we do not want to allow unembargoing only for selected, safe
> places. But this can be overriden via the --unembargo argument, right? So it's
> like a hard override, skipping over all checks, right?
Right, the automated enablement of --embargo is only for safe source/destination pairs. --embargo on the command line is intended to be a "Look just to what I need there is fire" override.
- 1464. By Andy Whitcroft
-
copy-proposed-
kernel: clean up whitespace Clean up whitespace based on review feedback.
Signed-off-by: Andy Whitcroft <email address hidden>
Preview Diff
1 | === modified file 'copy-proposed-kernel' | |||
2 | --- copy-proposed-kernel 2021-03-10 10:13:48 +0000 | |||
3 | +++ copy-proposed-kernel 2021-03-11 17:44:33 +0000 | |||
4 | @@ -42,14 +42,14 @@ | |||
5 | 42 | self.series = None | 42 | self.series = None |
6 | 43 | self.source = None | 43 | self.source = None |
7 | 44 | self.ppa2 = False | 44 | self.ppa2 = False |
10 | 45 | self.security = False | 45 | self.security = None |
9 | 46 | self.security2 = False | ||
11 | 47 | self.esm = False | 46 | self.esm = False |
12 | 48 | self.fips = False | 47 | self.fips = False |
13 | 49 | self.ibmgt = False | 48 | self.ibmgt = False |
14 | 50 | self.to_signing = False | 49 | self.to_signing = False |
15 | 51 | self.from_signing = False | 50 | self.from_signing = False |
16 | 52 | self.no_auto = False | 51 | self.no_auto = False |
17 | 52 | self.unembargo = False | ||
18 | 53 | 53 | ||
19 | 54 | self.update(**kwargs) | 54 | self.update(**kwargs) |
20 | 55 | 55 | ||
21 | @@ -81,6 +81,25 @@ | |||
22 | 81 | - ['ppa:canonical-kernel-team/ubuntu/ppa', 'Release' ] | 81 | - ['ppa:canonical-kernel-team/ubuntu/ppa', 'Release' ] |
23 | 82 | proposed: | 82 | proposed: |
24 | 83 | - ['ubuntu', 'Proposed' ] | 83 | - ['ubuntu', 'Proposed' ] |
25 | 84 | drivers: | ||
26 | 85 | security-build: | ||
27 | 86 | - ['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release' ] | ||
28 | 87 | - ['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release' ] | ||
29 | 88 | build: | ||
30 | 89 | - ['ppa:canonical-kernel-team/ubuntu/ppa', 'Release' ] | ||
31 | 90 | build-private: | ||
32 | 91 | - ['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release' ] | ||
33 | 92 | signing: | ||
34 | 93 | - ['ppa:canonical-signing/ubuntu/primary', 'Release'] | ||
35 | 94 | proposed: | ||
36 | 95 | - ['ubuntu', 'Proposed' ] | ||
37 | 96 | drivers-contrived: # build-private but no signing is invalid | ||
38 | 97 | build: | ||
39 | 98 | - ['ppa:canonical-kernel-team/ubuntu/ppa', 'Release' ] | ||
40 | 99 | build-private: | ||
41 | 100 | - ['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release' ] | ||
42 | 101 | proposed: | ||
43 | 102 | - ['ubuntu', 'Proposed' ] | ||
44 | 84 | esm: | 103 | esm: |
45 | 85 | security-build: | 104 | security-build: |
46 | 86 | - ['ppa:canonical-kernel-security-team/ubuntu/esm', 'Release'] | 105 | - ['ppa:canonical-kernel-security-team/ubuntu/esm', 'Release'] |
47 | @@ -90,6 +109,17 @@ | |||
48 | 90 | - ['ppa:canonical-signing/ubuntu/esm', 'Release'] | 109 | - ['ppa:canonical-signing/ubuntu/esm', 'Release'] |
49 | 91 | proposed: | 110 | proposed: |
50 | 92 | - ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'] | 111 | - ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'] |
51 | 112 | uc20: | ||
52 | 113 | security-build: | ||
53 | 114 | - ['ppa:canonical-kernel-security-team/ubuntu/uc20', 'Release'] | ||
54 | 115 | - ['ppa:canonical-kernel-security-team/ubuntu/uc20-2', 'Release'] | ||
55 | 116 | - ['ppa:canonical-kernel-security-team/ubuntu/uc20-3', 'Release'] | ||
56 | 117 | build: | ||
57 | 118 | - ['ppa:canonical-kernel-team/ubuntu/uc20-build', 'Release'] | ||
58 | 119 | signing: | ||
59 | 120 | - ['ppa:canonical-signing/ubuntu/uc20', 'Release'] | ||
60 | 121 | proposed: | ||
61 | 122 | - ['ppa:canonical-kernel-team/ubuntu/uc20-staging', 'Release'] | ||
62 | 93 | 14.04: | 123 | 14.04: |
63 | 94 | codename: trusty | 124 | codename: trusty |
64 | 95 | supported: true | 125 | supported: true |
65 | @@ -134,6 +164,8 @@ | |||
66 | 134 | type: signed | 164 | type: signed |
67 | 135 | linux-meta: | 165 | linux-meta: |
68 | 136 | type: meta | 166 | type: meta |
69 | 167 | linux-restricted-modules: | ||
70 | 168 | type: lrm | ||
71 | 137 | linux-ibm-gt: | 169 | linux-ibm-gt: |
72 | 138 | routing: | 170 | routing: |
73 | 139 | security-build: | 171 | security-build: |
74 | @@ -141,65 +173,182 @@ | |||
75 | 141 | - ['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'] | 173 | - ['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'] |
76 | 142 | build: | 174 | build: |
77 | 143 | - ['ppa:ibm-cloud/ubuntu/build', 'Release'] | 175 | - ['ppa:ibm-cloud/ubuntu/build', 'Release'] |
78 | 176 | signing: | ||
79 | 177 | - ['ppa:canonical-signing/ubuntu/ibm-gt', 'Release'] | ||
80 | 144 | proposed: | 178 | proposed: |
81 | 145 | - ['ppa:ibm-cloud/ubuntu/proposed', 'Release'] | 179 | - ['ppa:ibm-cloud/ubuntu/proposed', 'Release'] |
82 | 146 | packages: | 180 | packages: |
83 | 147 | linux-ibm-gt: | 181 | linux-ibm-gt: |
84 | 148 | linux-meta-ibm-gt: | 182 | linux-meta-ibm-gt: |
85 | 149 | type: meta | 183 | type: meta |
86 | 184 | 20.04: | ||
87 | 185 | codename: focal | ||
88 | 186 | supported: true | ||
89 | 187 | sources: | ||
90 | 188 | linux: | ||
91 | 189 | routing: drivers | ||
92 | 190 | packages: | ||
93 | 191 | linux: | ||
94 | 192 | linux-signed: | ||
95 | 193 | type: signed | ||
96 | 194 | linux-meta: | ||
97 | 195 | type: meta | ||
98 | 196 | linux-restricted-modules: | ||
99 | 197 | type: lrm | ||
100 | 198 | linux-restricted-generate: | ||
101 | 199 | type: lrg | ||
102 | 200 | linux-restricted-signatures: | ||
103 | 201 | type: lrs | ||
104 | 202 | linux-contrived: | ||
105 | 203 | routing: drivers-contrived | ||
106 | 204 | packages: | ||
107 | 205 | linux-contrived: | ||
108 | 206 | linux-restricted-generate-contrived: | ||
109 | 207 | type: lrg | ||
110 | 208 | linux-uc20-efi: | ||
111 | 209 | routing: uc20 | ||
112 | 210 | packages: | ||
113 | 211 | linux-uc20-efi: | ||
114 | 212 | linux-signed-uc20-efi: | ||
115 | 213 | type: signed | ||
116 | 150 | """ | 214 | """ |
117 | 151 | cls.ks = KernelSeries(data=data) | 215 | cls.ks = KernelSeries(data=data) |
118 | 152 | 216 | ||
119 | 153 | 217 | ||
120 | 154 | class TestRouting(TestBase): | 218 | class TestRouting(TestBase): |
121 | 155 | def test_default(self): | 219 | def test_default(self): |
123 | 156 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False) | 220 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False, True) |
124 | 157 | result = routing(self.FakeArgs(series='bionic', source='linux'), self.ks) | 221 | result = routing(self.FakeArgs(series='bionic', source='linux'), self.ks) |
125 | 158 | self.assertEqual(expected, result) | 222 | self.assertEqual(expected, result) |
126 | 159 | 223 | ||
127 | 160 | def test_security(self): | 224 | def test_security(self): |
130 | 161 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], True) | 225 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], True, True) |
131 | 162 | result = routing(self.FakeArgs(series='bionic', source='linux', security=True), self.ks) | 226 | result = routing(self.FakeArgs(series='bionic', source='linux', security=1), self.ks) |
132 | 163 | self.assertEqual(expected, result) | 227 | self.assertEqual(expected, result) |
133 | 164 | 228 | ||
134 | 165 | def test_security2(self): | 229 | def test_security2(self): |
137 | 166 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ubuntu', 'Proposed'], True) | 230 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ubuntu', 'Proposed'], True, True) |
138 | 167 | result = routing(self.FakeArgs(series='bionic', source='linux', security2=True), self.ks) | 231 | result = routing(self.FakeArgs(series='bionic', source='linux', security=2), self.ks) |
139 | 168 | self.assertEqual(expected, result) | 232 | self.assertEqual(expected, result) |
140 | 169 | 233 | ||
141 | 170 | def test_to_signing(self): | 234 | def test_to_signing(self): |
143 | 171 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], None, False) | 235 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], None, False, True) |
144 | 172 | result = routing(self.FakeArgs(series='bionic', source='linux', to_signing=True), self.ks) | 236 | result = routing(self.FakeArgs(series='bionic', source='linux', to_signing=True), self.ks) |
145 | 173 | self.assertEqual(expected, result) | 237 | self.assertEqual(expected, result) |
146 | 174 | 238 | ||
149 | 175 | def test_from_signing(self): | 239 | def test_from_signing_no_signing(self): |
150 | 176 | expected = (None, ['ubuntu', 'Proposed'], False) | 240 | # No signing present ... this should fail elsewhere, but confirm it would not |
151 | 241 | # allow unembargo. | ||
152 | 242 | expected = (None, ['ubuntu', 'Proposed'], False, True) | ||
153 | 177 | result = routing(self.FakeArgs(series='bionic', source='linux', from_signing=True), self.ks) | 243 | result = routing(self.FakeArgs(series='bionic', source='linux', from_signing=True), self.ks) |
154 | 178 | self.assertEqual(expected, result) | 244 | self.assertEqual(expected, result) |
155 | 179 | 245 | ||
156 | 246 | def test_from_signing_to_main(self): | ||
157 | 247 | expected = (['ppa:canonical-signing/ubuntu/primary', 'Release'], ['ubuntu', 'Proposed'], True, True) | ||
158 | 248 | result = routing(self.FakeArgs(series='focal', source='linux', from_signing=True), self.ks) | ||
159 | 249 | self.assertEqual(expected, result) | ||
160 | 250 | |||
161 | 251 | def test_from_signing_to_uc20(self): | ||
162 | 252 | expected = (['ppa:canonical-signing/ubuntu/uc20', 'Release'], ['ppa:canonical-kernel-team/ubuntu/uc20-staging', 'Release'], True, True) | ||
163 | 253 | result = routing(self.FakeArgs(series='focal', source='linux-uc20-efi', from_signing=True), self.ks) | ||
164 | 254 | self.assertEqual(expected, result) | ||
165 | 255 | |||
166 | 256 | def test_from_signing_to_private(self): | ||
167 | 257 | expected = (['ppa:canonical-signing/ubuntu/ibm-gt', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True) | ||
168 | 258 | result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', from_signing=True), self.ks) | ||
169 | 259 | self.assertEqual(expected, result) | ||
170 | 260 | |||
171 | 261 | def test_binaries_from_build_to_proposed(self): | ||
172 | 262 | for package, binaries in ( | ||
173 | 263 | ('linux', True), | ||
174 | 264 | ('linux-signed', False), | ||
175 | 265 | ('linux-meta', True), | ||
176 | 266 | ('linux-restricted-modules', True), | ||
177 | 267 | ): | ||
178 | 268 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False, binaries) | ||
179 | 269 | result = routing(self.FakeArgs(series='bionic', source=package), self.ks) | ||
180 | 270 | self.assertEqual(expected, result) | ||
181 | 271 | |||
182 | 272 | def test_binaries_from_build_to_signing(self): | ||
183 | 273 | for package, binaries in ( | ||
184 | 274 | ('linux', True), | ||
185 | 275 | ('linux-signed', False), | ||
186 | 276 | ('linux-meta', True), | ||
187 | 277 | ('linux-restricted-modules', True), | ||
188 | 278 | ): | ||
189 | 279 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries) | ||
190 | 280 | result = routing(self.FakeArgs(series='focal', source=package), self.ks) | ||
191 | 281 | self.assertEqual(expected, result) | ||
192 | 282 | for package, binaries in ( | ||
193 | 283 | ('linux-restricted-generate', True), | ||
194 | 284 | ('linux-restricted-signatures', False), | ||
195 | 285 | ): | ||
196 | 286 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries) | ||
197 | 287 | result = routing(self.FakeArgs(series='focal', source=package), self.ks) | ||
198 | 288 | self.assertEqual(expected, result) | ||
199 | 289 | |||
200 | 290 | def test_binaries_from_build_to_signing(self): | ||
201 | 291 | for package, binaries in ( | ||
202 | 292 | ('linux', True), | ||
203 | 293 | ('linux-signed', False), | ||
204 | 294 | ('linux-meta', True), | ||
205 | 295 | ('linux-restricted-modules', True), | ||
206 | 296 | ): | ||
207 | 297 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries) | ||
208 | 298 | result = routing(self.FakeArgs(series='focal', source=package), self.ks) | ||
209 | 299 | self.assertEqual(expected, result) | ||
210 | 300 | for package, binaries in ( | ||
211 | 301 | ('linux-restricted-generate', True), | ||
212 | 302 | ('linux-restricted-signatures', False), | ||
213 | 303 | ): | ||
214 | 304 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa-ps', 'Release'], ['ppa:canonical-signing/ubuntu/primary', 'Release'], False, binaries) | ||
215 | 305 | result = routing(self.FakeArgs(series='focal', source=package), self.ks) | ||
216 | 306 | self.assertEqual(expected, result) | ||
217 | 307 | |||
218 | 308 | def test_binaries_from_signing_to_proposed(self): | ||
219 | 309 | for package, binaries in ( | ||
220 | 310 | ('linux', True), | ||
221 | 311 | ('linux-signed', True), | ||
222 | 312 | ('linux-meta', True), | ||
223 | 313 | ('linux-restricted-modules', True), | ||
224 | 314 | ('linux-restricted-signatures', True), | ||
225 | 315 | ): | ||
226 | 316 | expected = (['ppa:canonical-signing/ubuntu/primary', 'Release'], ['ubuntu', 'Proposed'], True, binaries) | ||
227 | 317 | result = routing(self.FakeArgs(series='focal', source=package, from_signing=True), self.ks) | ||
228 | 318 | self.assertEqual(expected, result) | ||
229 | 319 | # LRG should not go anywhere but signing. | ||
230 | 320 | self.assertRaises(RoutingError, routing, self.FakeArgs(series='focal', source='linux-restricted-generate', from_signing=True), self.ks) | ||
231 | 321 | |||
232 | 322 | def test_binaries_from_build_to_proposed_lrg(self): | ||
233 | 323 | expected = (['ppa:canonical-kernel-team/ubuntu/ppa', 'Release'], ['ubuntu', 'Proposed'], False, True) | ||
234 | 324 | result = routing(self.FakeArgs(series='focal', source='linux-contrived'), self.ks) | ||
235 | 325 | self.assertEqual(expected, result) | ||
236 | 326 | # LRG should not go anywhere but signing. | ||
237 | 327 | self.assertRaises(RoutingError, routing, self.FakeArgs(series='focal', source='linux-restricted-generate-contrived'), self.ks) | ||
238 | 328 | |||
239 | 180 | def test_esm(self): | 329 | def test_esm(self): |
241 | 181 | expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False) | 330 | expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False, True) |
242 | 182 | result = routing(self.FakeArgs(series='trusty', source='linux'), self.ks) | 331 | result = routing(self.FakeArgs(series='trusty', source='linux'), self.ks) |
243 | 183 | self.assertEqual(expected, result) | 332 | self.assertEqual(expected, result) |
244 | 184 | 333 | ||
245 | 185 | def test_esm_security(self): | 334 | def test_esm_security(self): |
248 | 186 | expected = (['ppa:canonical-kernel-security-team/ubuntu/esm', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False) | 335 | expected = (['ppa:canonical-kernel-security-team/ubuntu/esm', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False, True) |
249 | 187 | result = routing(self.FakeArgs(series='trusty', source='linux', security=True), self.ks) | 336 | result = routing(self.FakeArgs(series='trusty', source='linux', security=1), self.ks) |
250 | 188 | self.assertEqual(expected, result) | 337 | self.assertEqual(expected, result) |
251 | 189 | 338 | ||
252 | 190 | def test_esm_security2(self): | 339 | def test_esm_security2(self): |
253 | 191 | with self.assertRaises(SystemExit), self.capture() as (out, err): | 340 | with self.assertRaises(SystemExit), self.capture() as (out, err): |
256 | 192 | expected = (None, ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False) | 341 | expected = (None, ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False, True) |
257 | 193 | result = routing(self.FakeArgs(series='trusty', source='linux', security2=True), self.ks) | 342 | result = routing(self.FakeArgs(series='trusty', source='linux', security=2), self.ks) |
258 | 194 | self.assertEqual(expected, result) | 343 | self.assertEqual(expected, result) |
259 | 195 | 344 | ||
260 | 196 | def test_esm_to_signing(self): | 345 | def test_esm_to_signing(self): |
262 | 197 | expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False) | 346 | expected = (['ppa:canonical-kernel-esm/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/esm', 'Release'], False, True) |
263 | 198 | result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, to_signing=True), self.ks) | 347 | result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, to_signing=True), self.ks) |
264 | 199 | self.assertEqual(expected, result) | 348 | self.assertEqual(expected, result) |
265 | 200 | 349 | ||
266 | 201 | def test_esm_from_signing(self): | 350 | def test_esm_from_signing(self): |
268 | 202 | expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False) | 351 | expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False, True) |
269 | 203 | result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, from_signing=True), self.ks) | 352 | result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, from_signing=True), self.ks) |
270 | 204 | self.assertEqual(expected, result) | 353 | self.assertEqual(expected, result) |
271 | 205 | 354 | ||
272 | @@ -208,59 +357,66 @@ | |||
273 | 208 | # simple we make from_signing take presidence over to_signing. Test this | 357 | # simple we make from_signing take presidence over to_signing. Test this |
274 | 209 | # is honoured correctly. | 358 | # is honoured correctly. |
275 | 210 | def test_esm_from_signing_override_to_signing(self): | 359 | def test_esm_from_signing_override_to_signing(self): |
277 | 211 | expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False) | 360 | expected = (['ppa:canonical-signing/ubuntu/esm', 'Release'], ['ppa:canonical-kernel-esm/ubuntu/proposed', 'Release'], False, True) |
278 | 212 | result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, to_signing=True, from_signing=True), self.ks) | 361 | result = routing(self.FakeArgs(series='trusty', source='linux', esm=True, to_signing=True, from_signing=True), self.ks) |
279 | 213 | self.assertEqual(expected, result) | 362 | self.assertEqual(expected, result) |
280 | 214 | 363 | ||
281 | 215 | def test_fips(self): | 364 | def test_fips(self): |
283 | 216 | expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False) | 365 | expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True) |
284 | 217 | result = routing(self.FakeArgs(series='xenial', source='linux-fips'), self.ks) | 366 | result = routing(self.FakeArgs(series='xenial', source='linux-fips'), self.ks) |
285 | 218 | self.assertEqual(expected, result) | 367 | self.assertEqual(expected, result) |
286 | 219 | 368 | ||
287 | 220 | def test_fips_security(self): | 369 | def test_fips_security(self): |
290 | 221 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False) | 370 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True) |
291 | 222 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', security=True), self.ks) | 371 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', security=1), self.ks) |
292 | 223 | self.assertEqual(expected, result) | 372 | self.assertEqual(expected, result) |
293 | 224 | 373 | ||
294 | 225 | def test_fips_security2(self): | 374 | def test_fips_security2(self): |
297 | 226 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False) | 375 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True) |
298 | 227 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', security2=True), self.ks) | 376 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', security=2), self.ks) |
299 | 228 | self.assertEqual(expected, result) | 377 | self.assertEqual(expected, result) |
300 | 229 | 378 | ||
301 | 230 | def test_fips_to_signing(self): | 379 | def test_fips_to_signing(self): |
303 | 231 | expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False) | 380 | expected = (['ppa:fips-cc-stig/ubuntu/fips-build', 'Release'], ['ppa:canonical-signing/ubuntu/fips', 'Release'], False, True) |
304 | 232 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', to_signing=True), self.ks) | 381 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', to_signing=True), self.ks) |
305 | 233 | self.assertEqual(expected, result) | 382 | self.assertEqual(expected, result) |
306 | 234 | 383 | ||
307 | 235 | def test_fips_from_signing(self): | 384 | def test_fips_from_signing(self): |
309 | 236 | expected = (['ppa:canonical-signing/ubuntu/fips', 'Release'], ['ppa:ubuntu-advantage/ubuntu/fips-proposed', 'Release'], False) | 385 | expected = (['ppa:canonical-signing/ubuntu/fips', 'Release'], ['ppa:ubuntu-advantage/ubuntu/fips-proposed', 'Release'], False, True) |
310 | 237 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', from_signing=True), self.ks) | 386 | result = routing(self.FakeArgs(series='xenial', source='linux-fips', from_signing=True), self.ks) |
311 | 238 | self.assertEqual(expected, result) | 387 | self.assertEqual(expected, result) |
312 | 239 | 388 | ||
313 | 240 | def test_ibmgt(self): | 389 | def test_ibmgt(self): |
315 | 241 | expected = (['ppa:ibm-cloud/ubuntu/build', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False) | 390 | expected = (['ppa:ibm-cloud/ubuntu/build', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True) |
316 | 242 | result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt'), self.ks) | 391 | result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt'), self.ks) |
317 | 243 | self.assertEqual(expected, result) | 392 | self.assertEqual(expected, result) |
318 | 244 | 393 | ||
319 | 245 | def test_ibmgt_security(self): | 394 | def test_ibmgt_security(self): |
322 | 246 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False) | 395 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True) |
323 | 247 | result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security=True), self.ks) | 396 | result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security=1), self.ks) |
324 | 248 | self.assertEqual(expected, result) | 397 | self.assertEqual(expected, result) |
325 | 249 | 398 | ||
326 | 250 | def test_ibmgt_security2(self): | 399 | def test_ibmgt_security2(self): |
329 | 251 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False) | 400 | expected = (['ppa:canonical-kernel-security-team/ubuntu/ppa2', 'Release'], ['ppa:ibm-cloud/ubuntu/proposed', 'Release'], False, True) |
330 | 252 | result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security2=True), self.ks) | 401 | result = routing(self.FakeArgs(series='bionic', source='linux-ibm-gt', security=2), self.ks) |
331 | 253 | self.assertEqual(expected, result) | 402 | self.assertEqual(expected, result) |
332 | 254 | 403 | ||
333 | 255 | 404 | ||
334 | 405 | class RoutingError(Exception): | ||
335 | 406 | pass | ||
336 | 407 | |||
337 | 408 | |||
338 | 409 | unembargo_from_security = ['ppa:canonical-kernel-security-team/ubuntu/ppa' + v for v in ('', '2', '3')] | ||
339 | 410 | unembargo_from_signing = ['ppa:canonical-signing/ubuntu/primary', 'ppa:canonical-signing/ubuntu/uc20'] | ||
340 | 411 | unembargo_to_ok = ['ubuntu', 'ppa:canonical-kernel-team/ubuntu/uc20-staging'] | ||
341 | 412 | |||
342 | 256 | def routing(args, ks): | 413 | def routing(args, ks): |
343 | 257 | series_name = args.series | 414 | series_name = args.series |
344 | 258 | package_name = args.source | 415 | package_name = args.source |
345 | 259 | 416 | ||
346 | 260 | series = ks.lookup_series(codename=series_name) | 417 | series = ks.lookup_series(codename=series_name) |
347 | 261 | if series is None: | 418 | if series is None: |
350 | 262 | print("ERROR: {} -- series unknown".format(series_name)) | 419 | raise RoutingError("ERROR: {} -- series unknown".format(series_name)) |
349 | 263 | sys.exit(1) | ||
351 | 264 | 420 | ||
352 | 265 | package = None | 421 | package = None |
353 | 266 | package_signed = None | 422 | package_signed = None |
354 | @@ -269,43 +425,38 @@ | |||
355 | 269 | for package_srch in source_srch.packages: | 425 | for package_srch in source_srch.packages: |
356 | 270 | if package_srch.name == package_name: | 426 | if package_srch.name == package_name: |
357 | 271 | package = package_srch | 427 | package = package_srch |
359 | 272 | if package_srch.type == 'signed': | 428 | # XXX: this should be package_srch.signing |
360 | 429 | if package_srch.type in ('signed', 'lrs'): | ||
361 | 273 | package_signed = package_srch | 430 | package_signed = package_srch |
362 | 274 | if package is not None: | 431 | if package is not None: |
363 | 275 | break | 432 | break |
364 | 276 | if package is None: | 433 | if package is None: |
367 | 277 | print("ERROR: {}/{} -- package unknown".format(series_name, package_name)) | 434 | raise RoutingError("ERROR: {}/{} -- package unknown".format(series_name, package_name)) |
366 | 278 | sys.exit(1) | ||
368 | 279 | 435 | ||
369 | 280 | source = package.source | 436 | source = package.source |
370 | 281 | routing = source.routing | 437 | routing = source.routing |
371 | 282 | if routing is None: | 438 | if routing is None: |
374 | 283 | print("ERROR: {}/{} -- package has no routing".format(series_name, package_name)) | 439 | raise RoutingError("ERROR: {}/{} -- package has no routing".format(series_name, package_name)) |
373 | 284 | sys.exit(1) | ||
375 | 285 | 440 | ||
377 | 286 | build_archives = routing.lookup_destination('build') | 441 | # XXX: this should be package_srch.adjunct |
378 | 442 | if package.type in ('lrg', 'lrs'): | ||
379 | 443 | build_archives = routing.lookup_destination('build-private') | ||
380 | 444 | else: | ||
381 | 445 | build_archives = routing.lookup_destination('build') | ||
382 | 287 | security_archives = routing.lookup_destination('security-build') | 446 | security_archives = routing.lookup_destination('security-build') |
383 | 288 | proposed_archive = routing.lookup_destination('proposed', primary=True) | 447 | proposed_archive = routing.lookup_destination('proposed', primary=True) |
384 | 289 | signing_archive = routing.lookup_destination('signing', primary=True) | 448 | signing_archive = routing.lookup_destination('signing', primary=True) |
385 | 290 | 449 | ||
386 | 291 | if build_archives is None or len(build_archives) < 1: | 450 | if build_archives is None or len(build_archives) < 1: |
389 | 292 | print("ERROR: {}/{} -- package has no primary build archive".format(series_name, package_name)) | 451 | raise RoutingError("ERROR: {}/{} -- package has no primary build archive".format(series_name, package_name)) |
388 | 293 | sys.exit(1) | ||
390 | 294 | if args.ppa2 and (build_archives is None or len(build_archives) < 2): | 452 | if args.ppa2 and (build_archives is None or len(build_archives) < 2): |
393 | 295 | print("ERROR: {}/{} -- package has no secondary build archive".format(series_name, package_name)) | 453 | raise RoutingError("ERROR: {}/{} -- package has no secondary build archive".format(series_name, package_name)) |
392 | 296 | sys.exit(1) | ||
394 | 297 | if build_archives is None: | 454 | if build_archives is None: |
397 | 298 | print("ERROR: {}/{} -- package has no build archive".format(series_name, package_name)) | 455 | raise RoutingError("ERROR: {}/{} -- package has no build archive".format(series_name, package_name)) |
396 | 299 | sys.exit(1) | ||
398 | 300 | if proposed_archive is None: | 456 | if proposed_archive is None: |
407 | 301 | print("ERROR: {}/{} -- package has no proposed archive".format(series_name, package_name)) | 457 | RoutingError("ERROR: {}/{} -- package has no proposed archive".format(series_name, package_name)) |
408 | 302 | sys.exit(1) | 458 | if args.security and (security_archives is None or len(security_archives) < args.security): |
409 | 303 | if args.security and (security_archives is None or len(security_archives) < 1): | 459 | RoutingError("ERROR: {}/{} -- package has no security archive #{}".format(series_name, package_name, args.security)) |
402 | 304 | print("ERROR: {}/{} -- package has no primary security archive".format(series_name, package_name)) | ||
403 | 305 | sys.exit(1) | ||
404 | 306 | if args.security2 and (security_archives is None or len(security_archives) < 2): | ||
405 | 307 | print("ERROR: {}/{} -- package has no secondary security archive".format(series_name, package_name)) | ||
406 | 308 | sys.exit(1) | ||
410 | 309 | 460 | ||
411 | 310 | # Default route build -> proposed | 461 | # Default route build -> proposed |
412 | 311 | if args.ppa2: | 462 | if args.ppa2: |
413 | @@ -314,17 +465,9 @@ | |||
414 | 314 | from_archive = build_archives[0] | 465 | from_archive = build_archives[0] |
415 | 315 | to_archive = proposed_archive | 466 | to_archive = proposed_archive |
416 | 316 | 467 | ||
417 | 317 | unembargo = False | ||
418 | 318 | |||
419 | 319 | # Handle security routing. | 468 | # Handle security routing. |
420 | 320 | if args.security: | 469 | if args.security: |
428 | 321 | from_archive = security_archives[0] | 470 | from_archive = security_archives[args.security - 1] |
422 | 322 | if args.security2: | ||
423 | 323 | from_archive = security_archives[1] | ||
424 | 324 | |||
425 | 325 | # Allow us to unembargo when releasing from security to ubuntu. | ||
426 | 326 | if (args.security or args.security2) and to_archive[0] == 'ubuntu': | ||
427 | 327 | unembargo = True | ||
429 | 328 | 471 | ||
430 | 329 | # Handle signing routing. | 472 | # Handle signing routing. |
431 | 330 | if args.from_signing: | 473 | if args.from_signing: |
432 | @@ -335,6 +478,23 @@ | |||
433 | 335 | elif args.no_auto is False and signing_archive is not None and package_signed is not None: | 478 | elif args.no_auto is False and signing_archive is not None and package_signed is not None: |
434 | 336 | to_archive = signing_archive | 479 | to_archive = signing_archive |
435 | 337 | 480 | ||
436 | 481 | # Allow us to unembargo when releasing from security. Ensure the source | ||
437 | 482 | # is somewhere where we expect things which are public. | ||
438 | 483 | unembargo = args.unembargo | ||
439 | 484 | if args.security and from_archive[0] in unembargo_from_security and to_archive[0] in unembargo_to_ok: | ||
440 | 485 | unembargo = True | ||
441 | 486 | elif signing_archive and args.from_signing and from_archive[0] in unembargo_from_signing and to_archive[0] in unembargo_to_ok: | ||
442 | 487 | unembargo = True | ||
443 | 488 | |||
444 | 489 | # We should be copying binaries for non-'signing' packages | ||
445 | 490 | # when on their way to somewhere where signing is intended. | ||
446 | 491 | binaries = True | ||
447 | 492 | # XXX: this should be package_srch.signing | ||
448 | 493 | if (package.type in ('signed', 'lrs') and | ||
449 | 494 | (to_archive == signing_archive or | ||
450 | 495 | (from_archive != signing_archive and to_archive == proposed_archive))): | ||
451 | 496 | binaries = False | ||
452 | 497 | |||
453 | 338 | # Announce the routing if needed. | 498 | # Announce the routing if needed. |
454 | 339 | if (args.testing is False and (routing.name != 'default' or from_archive == signing_archive or to_archive == signing_archive)): | 499 | if (args.testing is False and (routing.name != 'default' or from_archive == signing_archive or to_archive == signing_archive)): |
455 | 340 | msg = "NOTE: directing copy using {} routes".format(routing.name) | 500 | msg = "NOTE: directing copy using {} routes".format(routing.name) |
456 | @@ -344,7 +504,12 @@ | |||
457 | 344 | msg += ' to signing' | 504 | msg += ' to signing' |
458 | 345 | print(msg) | 505 | print(msg) |
459 | 346 | 506 | ||
461 | 347 | return (from_archive, to_archive, unembargo) | 507 | |
462 | 508 | # It is only safe to copy linux-restricted-generate to signing. Refuse to copy. | ||
463 | 509 | if package.type == 'lrg' and to_archive != signing_archive: | ||
464 | 510 | raise RoutingError("ERROR: {}/{} -- package type lrg is embargoed, copy only allowed to signing".format(series_name, package_name)) | ||
465 | 511 | |||
466 | 512 | return (from_archive, to_archive, unembargo, binaries) | ||
467 | 348 | 513 | ||
468 | 349 | 514 | ||
469 | 350 | # SELF-TESTS: | 515 | # SELF-TESTS: |
470 | @@ -356,14 +521,16 @@ | |||
471 | 356 | parser.set_defaults(testing=False) | 521 | parser.set_defaults(testing=False) |
472 | 357 | parser.add_argument('--dry-run', action='store_true', help='Do everything but actually copy the package') | 522 | parser.add_argument('--dry-run', action='store_true', help='Do everything but actually copy the package') |
473 | 358 | parser.add_argument('--ppa2', action='store_true', help='Copy from the kernel build PPA2') | 523 | parser.add_argument('--ppa2', action='store_true', help='Copy from the kernel build PPA2') |
476 | 359 | parser.add_argument('--security', '-S', action='store_true', help='Copy from the kernel security PPA') | 524 | parser.add_argument('--security', '-S', action='store_const', const=1, help='Copy from the kernel security PPA') |
477 | 360 | parser.add_argument('--security2', action='store_true', help='Copy from the kernel security PPA2') | 525 | parser.add_argument('--security2', action='store_const', const=2, dest='security', help='Copy from the kernel security PPA2') |
478 | 526 | parser.add_argument('--security3', action='store_const', const=3, dest='security', help='Copy from the kernel security PPA3') | ||
479 | 361 | parser.add_argument('--esm', '-E', action='store_true', help='Copy from the kernel ESM PPA and to the kernel ESM proposed PPA') | 527 | parser.add_argument('--esm', '-E', action='store_true', help='Copy from the kernel ESM PPA and to the kernel ESM proposed PPA') |
480 | 362 | parser.add_argument('--fips', action='store_true', help='Copy from the kernel FIPS PPA and to the kernel FIPS proposed PPA') | 528 | parser.add_argument('--fips', action='store_true', help='Copy from the kernel FIPS PPA and to the kernel FIPS proposed PPA') |
481 | 363 | parser.add_argument('--ibmgt', action='store_true', help='Copy from the kernel IBM-GT build PPA to the corresponding proposed PPA') | 529 | parser.add_argument('--ibmgt', action='store_true', help='Copy from the kernel IBM-GT build PPA to the corresponding proposed PPA') |
482 | 364 | parser.add_argument('--no-auto', action='store_true', help='Turn off automatic detection of ESM et al based on series') | 530 | parser.add_argument('--no-auto', action='store_true', help='Turn off automatic detection of ESM et al based on series') |
483 | 365 | parser.add_argument('--to-signing', action='store_true', help='Copy from the kernel ESM/FIPS PPA to the ESM/FIPS signing PPA') | 531 | parser.add_argument('--to-signing', action='store_true', help='Copy from the kernel ESM/FIPS PPA to the ESM/FIPS signing PPA') |
484 | 366 | parser.add_argument('--from-signing', action='store_true', help='Copy from the ESM/FIPS signing PPA to the ESM/FIPS proposed PPA') | 532 | parser.add_argument('--from-signing', action='store_true', help='Copy from the ESM/FIPS signing PPA to the ESM/FIPS proposed PPA') |
485 | 533 | parser.add_argument('--unembargo', action='store_true', default=False, help='Allow copies from private PPAs') | ||
486 | 367 | parser.add_argument('series', action='store', help='The series the source package is in') | 534 | parser.add_argument('series', action='store', help='The series the source package is in') |
487 | 368 | parser.add_argument('source', action='store', nargs='+', help='The source package name') | 535 | parser.add_argument('source', action='store', nargs='+', help='The source package name') |
488 | 369 | 536 | ||
489 | @@ -386,8 +553,12 @@ | |||
490 | 386 | # BODGE: routing should just take release/pkg. | 553 | # BODGE: routing should just take release/pkg. |
491 | 387 | args.source = pkg | 554 | args.source = pkg |
492 | 388 | 555 | ||
494 | 389 | (from_archive, to_archive, security) = routing(args, ks) | 556 | try: |
495 | 557 | (from_archive, to_archive, unembargo, include_binaries) = routing(args, ks) | ||
496 | 390 | ##print("from_archive<{}> to_archive<{}>".format(from_archive, to_archive)) | 558 | ##print("from_archive<{}> to_archive<{}>".format(from_archive, to_archive)) |
497 | 559 | except RoutingError as e: | ||
498 | 560 | print("ERROR: {}", e.args[0]) | ||
499 | 561 | sys.exit(1) | ||
500 | 391 | 562 | ||
501 | 392 | if from_archive is None: | 563 | if from_archive is None: |
502 | 393 | print("ERROR: bad source PPA") | 564 | print("ERROR: bad source PPA") |
503 | @@ -414,11 +585,6 @@ | |||
504 | 414 | if versions.total_size == 1: | 585 | if versions.total_size == 1: |
505 | 415 | version = versions[0].source_package_version | 586 | version = versions[0].source_package_version |
506 | 416 | 587 | ||
507 | 417 | include_binaries = (pkg not in ('debian-installer') | ||
508 | 418 | and not pkg.startswith('linux-signed')) | ||
509 | 419 | if args.from_signing: | ||
510 | 420 | include_binaries = True | ||
511 | 421 | |||
512 | 422 | print("""Copying {}/{}: | 588 | print("""Copying {}/{}: |
513 | 423 | From: {} {} {} | 589 | From: {} {} {} |
514 | 424 | To: {} {} {} | 590 | To: {} {} {} |
515 | @@ -426,7 +592,8 @@ | |||
516 | 426 | 592 | ||
517 | 427 | if not version: | 593 | if not version: |
518 | 428 | print("ERROR: no version to copy") | 594 | print("ERROR: no version to copy") |
520 | 429 | sys.exit(1) | 595 | if not args.dry_run: |
521 | 596 | sys.exit(1) | ||
522 | 430 | 597 | ||
523 | 431 | copies.append({ | 598 | copies.append({ |
524 | 432 | 'from_archive': from_archive, | 599 | 'from_archive': from_archive, |
525 | @@ -436,7 +603,7 @@ | |||
526 | 436 | 'to_pocket': to_pocket, | 603 | 'to_pocket': to_pocket, |
527 | 437 | 'version': version, | 604 | 'version': version, |
528 | 438 | 'auto_approve': True, | 605 | 'auto_approve': True, |
530 | 439 | 'unembargo': security, | 606 | 'unembargo': unembargo, |
531 | 440 | }) | 607 | }) |
532 | 441 | 608 | ||
533 | 442 | if args.dry_run: | 609 | if args.dry_run: |
Generally looks good. A whitespace comment inline, but that's not really important.
One thing I just would like to make sure is intended: from the commit messages I understood that we do not want to allow unembargoing only for selected, safe places. But this can be overriden via the --unembargo argument, right? So it's like a hard override, skipping over all checks, right?