Merge ~ines-almeida/launchpad:pro-enable-core18/update-logic into launchpad:master

[Ines Almeida]

Exclude archive dependencies that are private unless snap is pro_enable

Add 'pro_enable' attribute to snap admin UI

This MP depends on: https://code.launchpad.net/~ines-almeida/launchpad/+git/launchpad/+merge/453932

[Colin Watson (cjwatson)]

review: Approve

add27ba... by Ines Almeida on 2023-10-23

Prevent snap pro-enable test from failing once DB restriction patch is applied

e21dce7... by Ines Almeida on 2023-10-23

Fix typo

diff --git a/lib/lp/snappy/browser/snap.py b/lib/lp/snappy/browser/snap.py
index 96097fb..b783dcd 100644
--- a/lib/lp/snappy/browser/snap.py
+++ b/lib/lp/snappy/browser/snap.py
@@ -524,6 +524,7 @@ class ISnapEditSchema(Interface):
             "auto_build",
             "auto_build_channels",
             "store_upload",
+            "pro_enable",
         ],
     )
 
@@ -933,6 +934,7 @@ class SnapAdminView(BaseSnapEditView):
         "information_type",
         "require_virtualized",
         "allow_internet",
+        "pro_enable",
     ]
 
     @property
diff --git a/lib/lp/snappy/browser/tests/test_snap.py b/lib/lp/snappy/browser/tests/test_snap.py
index 1004c4c..2de0693 100644
--- a/lib/lp/snappy/browser/tests/test_snap.py
+++ b/lib/lp/snappy/browser/tests/test_snap.py
@@ -834,6 +834,7 @@ class TestSnapAdminView(BaseTestSnapView):
         self.assertIsNone(snap.project)
         self.assertFalse(snap.private)
         self.assertTrue(snap.allow_internet)
+        self.assertFalse(snap.pro_enable)
 
         self.factory.makeAccessPolicy(
             pillar=project, type=InformationType.PRIVATESECURITY
@@ -845,6 +846,7 @@ class TestSnapAdminView(BaseTestSnapView):
         browser.getControl("Require virtualized builders").selected = False
         browser.getControl(name="field.information_type").value = private
         browser.getControl("Allow external network access").selected = False
+        browser.getControl("Enable Ubuntu Pro").selected = True
         browser.getControl("Update snap package").click()
 
         login_admin()
@@ -852,6 +854,7 @@ class TestSnapAdminView(BaseTestSnapView):
         self.assertFalse(snap.require_virtualized)
         self.assertTrue(snap.private)
         self.assertFalse(snap.allow_internet)
+        self.assertTrue(snap.pro_enable)
 
     def test_admin_snap_private_without_project(self):
         # Cannot make snap private if it doesn't have a project associated.
diff --git a/lib/lp/snappy/model/snapbuildbehaviour.py b/lib/lp/snappy/model/snapbuildbehaviour.py
index 7d40251..39d8238 100644
--- a/lib/lp/snappy/model/snapbuildbehaviour.py
+++ b/lib/lp/snappy/model/snapbuildbehaviour.py
@@ -137,7 +137,15 @@ class SnapBuildBehaviour(BuilderProxyMixin, BuildFarmJobBehaviourBase):
             tools_fingerprint = None
         archive_dependencies = list(build.archive.dependencies)
         if build.snap_base is not None:
-            archive_dependencies.extend(build.snap_base.dependencies)
+            # Private dependencies are only listed for pro-enabled snaps
+            archive_dependencies.extend(
+                [
+                    dependency
+                    for dependency in build.snap_base.dependencies
+                    if build.snap.pro_enable
+                    or not dependency.dependency.private
+                ]
+            )
         (
             args["archives"],
             args["trusted_keys"],
diff --git a/lib/lp/snappy/tests/test_snap.py b/lib/lp/snappy/tests/test_snap.py
index 665d1d8..f94ab74 100644
--- a/lib/lp/snappy/tests/test_snap.py
+++ b/lib/lp/snappy/tests/test_snap.py
@@ -2321,6 +2321,7 @@ class TestSnapSet(TestCaseWithFactory):
         self.assertFalse(snap.private)
         self.assertTrue(snap.allow_internet)
         self.assertFalse(snap.build_source_tarball)
+        self.assertFalse(snap.pro_enable)
 
     def test_creation_git(self):
         # The metadata entries supplied when a Snap is created for a Git
@@ -2344,6 +2345,7 @@ class TestSnapSet(TestCaseWithFactory):
         self.assertFalse(snap.private)
         self.assertTrue(snap.allow_internet)
         self.assertFalse(snap.build_source_tarball)
+        self.assertFalse(snap.pro_enable)
 
     def test_creation_git_url(self):
         # A Snap can be backed directly by a URL for an external Git
@@ -3789,6 +3791,7 @@ class TestSnapWebservice(TestCaseWithFactory):
             self.assertTrue(snap["require_virtualized"])
             self.assertTrue(snap["allow_internet"])
             self.assertFalse(snap["build_source_tarball"])
+            self.assertFalse(snap["pro_enable"])
 
     def test_new_git(self):
         # Ensure Snap creation based on a Git branch works.
@@ -3814,6 +3817,7 @@ class TestSnapWebservice(TestCaseWithFactory):
             self.assertTrue(snap["require_virtualized"])
             self.assertTrue(snap["allow_internet"])
             self.assertFalse(snap["build_source_tarball"])
+            self.assertFalse(snap["pro_enable"])
 
     def test_new_private(self):
         # Ensure private Snap creation works.
diff --git a/lib/lp/snappy/tests/test_snapbuildbehaviour.py b/lib/lp/snappy/tests/test_snapbuildbehaviour.py
index 1f5aeb6..1729666 100644
--- a/lib/lp/snappy/tests/test_snapbuildbehaviour.py
+++ b/lib/lp/snappy/tests/test_snapbuildbehaviour.py
@@ -973,7 +973,7 @@ class TestAsyncSnapBuildBehaviour(StatsMixin, TestSnapBuildBehaviourBase):
     @defer.inlineCallbacks
     def test_extraBuildArgs_snap_base_with_private_archive_dependencies(self):
         # If the build is using a snap base that has archive dependencies on
-        # private PPAs, extraBuildArgs sends them.
+        # private PPAs, extraBuildArgs excludes them.
         self.useFixture(InProcessAuthServerFixture())
         self.pushConfig(
             "launchpad", internal_macaroon_secret_key="some-secret"
@@ -997,10 +997,51 @@ class TestAsyncSnapBuildBehaviour(StatsMixin, TestSnapBuildBehaviourBase):
         with dbuser(config.builddmaster.dbuser):
             args = yield job.extraBuildArgs()
         job.build.updateStatus(BuildStatus.BUILDING)
+
+        expected_archives = [
+            "deb %s %s main universe"
+            % (job.archive.archive_url, job.build.distro_series.name),
+            "deb %s %s-security main universe"
+            % (job.archive.archive_url, job.build.distro_series.name),
+            "deb %s %s-updates main universe"
+            % (job.archive.archive_url, job.build.distro_series.name),
+        ]
+        self.assertEqual(expected_archives, args["archives"])
+
+    @defer.inlineCallbacks
+    def test_extraBuildArgs_pro_enabled_snap_base_private_dependencies(self):
+        # If the build is using a snap base that has archive dependencies on
+        # private PPAs, extraBuildArgs doesn't exclude them if snap base is
+        # pro-enabled
+        self.useFixture(InProcessAuthServerFixture())
+        self.pushConfig(
+            "launchpad", internal_macaroon_secret_key="some-secret"
+        )
+        snap_base = self.factory.makeSnapBase()
+        job = self.makeJob(snap_base=snap_base, pro_enable=True)
+        dependency = self.factory.makeArchive(
+            distribution=job.archive.distribution, private=True
+        )
+        snap_base.addArchiveDependency(
+            dependency,
+            PackagePublishingPocket.RELEASE,
+            getUtility(IComponentSet)["main"],
+        )
+        self.factory.makeBinaryPackagePublishingHistory(
+            archive=dependency,
+            distroarchseries=job.build.distro_arch_series,
+            pocket=PackagePublishingPocket.RELEASE,
+            status=PackagePublishingStatus.PUBLISHED,
+        )
+        with dbuser(config.builddmaster.dbuser):
+            args = yield job.extraBuildArgs()
+        job.build.updateStatus(BuildStatus.BUILDING)
+
         self.assertThat(
             [SourceEntry(item) for item in args["archives"]],
             MatchesListwise(
                 [
+                    # Private dependency
                     MatchesStructure(
                         type=Equals("deb"),
                         uri=AfterPreprocessing(
@@ -1025,6 +1066,7 @@ class TestAsyncSnapBuildBehaviour(StatsMixin, TestSnapBuildBehaviourBase):
                         dist=Equals(job.build.distro_series.name),
                         comps=Equals(["main"]),
                     ),
+                    # Non private dependencies
                     MatchesStructure.byEquality(
                         type="deb",
                         uri=job.archive.archive_url,