Merge lp:~cjwatson/launchpad/snap-allow-network into lp:launchpad

[Colin Watson]

Add Snap.allow_internet: if false, do not dispatch a proxy token to builds of that snap.

This will allow snaps that are intended to be delivered with Ubuntu images to be restricted to build from only resources on Launchpad, and thus be reproducible, supportable, etc.

Requires https://code.launchpad.net/~cjwatson/launchpad/db-snap-allow-network/+merge/336923.

[lp:~cjwatson/launchpad/snap-allow-network]

18538. By Colin Watson on 2018-04-04

Rename Snap.allow_network to Snap.allow_internet.

18539. By Colin Watson on 2018-04-04

Remove Snap.allow_internet backfilling, since we're going to do this in the DB patch instead.

18540. By Colin Watson on 2018-04-04

Merge devel.

[William Grant (wgrant)]

review: Approve (code)

=== modified file 'lib/lp/snappy/browser/snap.py'
--- lib/lp/snappy/browser/snap.py	2017-03-27 19:28:36 +0000
+++ lib/lp/snappy/browser/snap.py	2018-04-04 14:15:46 +0000
@@ -1,4 +1,4 @@
-# Copyright 2015-2017 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2018 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Snap views."""
@@ -319,6 +319,7 @@
         'name',
         'private',
         'require_virtualized',
+        'allow_internet',
         'auto_build',
         'store_upload',
         ])
@@ -648,7 +649,7 @@
 
     page_title = 'Administer'
 
-    field_names = ['private', 'require_virtualized']
+    field_names = ['private', 'require_virtualized', 'allow_internet']
 
     def validate(self, data):
         super(SnapAdminView, self).validate(data)

=== modified file 'lib/lp/snappy/browser/tests/test_snap.py'
--- lib/lp/snappy/browser/tests/test_snap.py	2017-12-19 17:16:02 +0000
+++ lib/lp/snappy/browser/tests/test_snap.py	2018-04-04 14:15:46 +0000
@@ -1,4 +1,4 @@
-# Copyright 2015-2017 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2018 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Test snap package views."""
@@ -573,7 +573,7 @@
             user=self.person)
 
     def test_admin_snap(self):
-        # Admins can change require_virtualized and privacy.
+        # Admins can change require_virtualized, privacy, and allow_internet.
         login("[e-mail]")
         commercial_admin = self.factory.makePerson(
             member_of=[getUtility(ILaunchpadCelebrities).commercial_admin])
@@ -581,16 +581,19 @@
         snap = self.factory.makeSnap(registrant=self.person)
         self.assertTrue(snap.require_virtualized)
         self.assertFalse(snap.private)
+        self.assertTrue(snap.allow_internet)
 
         browser = self.getViewBrowser(snap, user=commercial_admin)
         browser.getLink("Administer snap package").click()
         browser.getControl("Require virtualized builders").selected = False
         browser.getControl("Private").selected = True
+        browser.getControl("Allow external network access").selected = False
         browser.getControl("Update snap package").click()
 
         login_person(self.person)
         self.assertFalse(snap.require_virtualized)
         self.assertTrue(snap.private)
+        self.assertFalse(snap.allow_internet)
 
     def test_admin_snap_privacy_mismatch(self):
         # Cannot make snap public if it still contains private information.

=== modified file 'lib/lp/snappy/interfaces/snap.py'
--- lib/lp/snappy/interfaces/snap.py	2018-03-22 14:56:41 +0000
+++ lib/lp/snappy/interfaces/snap.py	2018-04-04 14:15:46 +0000
@@ -600,6 +600,13 @@
         value_type=Reference(schema=IProcessor),
         readonly=False))
 
+    allow_internet = exported(Bool(
+        title=_("Allow external network access"),
+        required=True, readonly=False,
+        description=_(
+            "Allow access to external network resources via a proxy.  "
+            "Resources hosted on Launchpad itself are always allowed.")))
+
 
 class ISnap(
     ISnapView, ISnapEdit, ISnapEditableAttributes, ISnapAdminAttributes,

=== modified file 'lib/lp/snappy/model/snap.py'
--- lib/lp/snappy/model/snap.py	2018-03-22 15:33:25 +0000
+++ lib/lp/snappy/model/snap.py	2018-04-04 14:15:46 +0000
@@ -198,6 +198,8 @@
 
     private = Bool(name='private')
 
+    allow_internet = Bool(name='allow_internet', allow_none=False)
+
     store_upload = Bool(name='store_upload', allow_none=False)
 
     store_series_id = Int(name='store_series', allow_none=True)
@@ -213,9 +215,9 @@
                  description=None, branch=None, git_ref=None, auto_build=False,
                  auto_build_archive=None, auto_build_pocket=None,
                  auto_build_channels=None, require_virtualized=True,
-                 date_created=DEFAULT, private=False, store_upload=False,
-                 store_series=None, store_name=None, store_secrets=None,
-                 store_channels=None):
+                 date_created=DEFAULT, private=False, allow_internet=True,
+                 store_upload=False, store_series=None, store_name=None,
+                 store_secrets=None, store_channels=None):
         """Construct a `Snap`."""
         super(Snap, self).__init__()
         self.registrant = registrant
@@ -233,6 +235,7 @@
         self.date_created = date_created
         self.date_last_modified = date_created
         self.private = private
+        self.allow_internet = allow_internet
         self.store_upload = store_upload
         self.store_series = store_series
         self.store_name = store_name
@@ -669,8 +672,8 @@
             auto_build_archive=None, auto_build_pocket=None,
             auto_build_channels=None, require_virtualized=True,
             processors=None, date_created=DEFAULT, private=False,
-            store_upload=False, store_series=None, store_name=None,
-            store_secrets=None, store_channels=None):
+            allow_internet=True, store_upload=False, store_series=None,
+            store_name=None, store_secrets=None, store_channels=None):
         """See `ISnapSet`."""
         if not registrant.inTeam(owner):
             if owner.is_team:
@@ -713,9 +716,10 @@
             auto_build_pocket=auto_build_pocket,
             auto_build_channels=auto_build_channels,
             require_virtualized=require_virtualized, date_created=date_created,
-            private=private, store_upload=store_upload,
-            store_series=store_series, store_name=store_name,
-            store_secrets=store_secrets, store_channels=store_channels)
+            private=private, allow_internet=allow_internet,
+            store_upload=store_upload, store_series=store_series,
+            store_name=store_name, store_secrets=store_secrets,
+            store_channels=store_channels)
         store.add(snap)
 
         if processors is None:

=== modified file 'lib/lp/snappy/model/snapbuildbehaviour.py'
--- lib/lp/snappy/model/snapbuildbehaviour.py	2018-03-23 13:26:09 +0000
+++ lib/lp/snappy/model/snapbuildbehaviour.py	2018-04-04 14:15:46 +0000
@@ -85,7 +85,7 @@
         """
         build = self.build
         args = {}
-        if config.snappy.builder_proxy_host:
+        if config.snappy.builder_proxy_host and build.snap.allow_internet:
             token = yield self._requestProxyToken()
             args["proxy_url"] = (
                 "http://{username}:{password}@{host}:{port}".format(

=== modified file 'lib/lp/snappy/tests/test_snap.py'
--- lib/lp/snappy/tests/test_snap.py	2018-02-08 12:47:44 +0000
+++ lib/lp/snappy/tests/test_snap.py	2018-04-04 14:15:46 +0000
@@ -653,6 +653,7 @@
         self.assertIsNone(snap.auto_build_channels)
         self.assertTrue(snap.require_virtualized)
         self.assertFalse(snap.private)
+        self.assertTrue(snap.allow_internet)
 
     def test_creation_git(self):
         # The metadata entries supplied when a Snap is created for a Git
@@ -674,6 +675,7 @@
         self.assertIsNone(snap.auto_build_channels)
         self.assertTrue(snap.require_virtualized)
         self.assertFalse(snap.private)
+        self.assertTrue(snap.allow_internet)
 
     def test_creation_git_url(self):
         # A Snap can be backed directly by a URL for an external Git
@@ -1378,6 +1380,7 @@
             self.assertIsNone(snap["git_path"])
             self.assertIsNone(snap["git_ref_link"])
             self.assertTrue(snap["require_virtualized"])
+            self.assertTrue(snap["allow_internet"])
 
     def test_new_git(self):
         # Ensure Snap creation based on a Git branch works.
@@ -1398,6 +1401,7 @@
             self.assertEqual(ref.path, snap["git_path"])
             self.assertEqual(self.getURL(ref), snap["git_ref_link"])
             self.assertTrue(snap["require_virtualized"])
+            self.assertTrue(snap["allow_internet"])
 
     def test_new_private(self):
         # Ensure private Snap creation works.

=== modified file 'lib/lp/snappy/tests/test_snapbuildbehaviour.py'
--- lib/lp/snappy/tests/test_snapbuildbehaviour.py	2018-03-23 13:26:09 +0000
+++ lib/lp/snappy/tests/test_snapbuildbehaviour.py	2018-04-04 14:15:46 +0000
@@ -414,6 +414,14 @@
         self.assertFalse(isProxy(args["channels"]))
         self.assertEqual({"snapcraft": "edge"}, args["channels"])
 
+    def test_extraBuildArgs_disallow_internet(self):
+        # If external network access is not allowed for the snap,
+        # _extraBuildArgs does not dispatch a proxy token.
+        job = self.makeJob(allow_internet=False)
+        args = yield job._extraBuildArgs()
+        self.assertNotIn("proxy_url", args)
+        self.assertNotIn("revocation_endpoint", args)
+
     @defer.inlineCallbacks
     def test_composeBuildRequest_proxy_url_set(self):
         job = self.makeJob()

=== modified file 'lib/lp/testing/factory.py'
--- lib/lp/testing/factory.py	2018-03-22 16:48:16 +0000
+++ lib/lp/testing/factory.py	2018-04-04 14:15:46 +0000
@@ -4672,9 +4672,9 @@
                  auto_build_archive=None, auto_build_pocket=None,
                  auto_build_channels=None, is_stale=None,
                  require_virtualized=True, processors=None,
-                 date_created=DEFAULT, private=False, store_upload=False,
-                 store_series=None, store_name=None, store_secrets=None,
-                 store_channels=None):
+                 date_created=DEFAULT, private=False, allow_internet=True,
+                 store_upload=False, store_series=None, store_name=None,
+                 store_secrets=None, store_channels=None):
         """Make a new Snap."""
         if registrant is None:
             registrant = self.makePerson()
@@ -4699,9 +4699,9 @@
             auto_build=auto_build, auto_build_archive=auto_build_archive,
             auto_build_pocket=auto_build_pocket,
             auto_build_channels=auto_build_channels, private=private,
-            store_upload=store_upload, store_series=store_series,
-            store_name=store_name, store_secrets=store_secrets,
-            store_channels=store_channels)
+            allow_internet=allow_internet, store_upload=store_upload,
+            store_series=store_series, store_name=store_name,
+            store_secrets=store_secrets, store_channels=store_channels)
         if is_stale is not None:
             removeSecurityProxy(snap).is_stale = is_stale
         IStore(snap).flush()