Merge ~jslarraz/ubuntu-security-tools:changelog_fix into ubuntu-security-tools:master

[Jorge Sancho Larraz]

Fix umt changelog when same package version is used on one release and devel

Fix umt changelog when same package version is used on one release and devel. It is intended to prevent issues during the sync period.

[Alex Murray (alexmurray)]

LGTM - one suggestion to make it more future-proof which would be worthwhile I think.

review: Approve

[Steve Beattie (sbeattie)]

On Sun, Oct 29, 2023 at 11:40:30PM -0000, Alex Murray wrote:
> Review: Approve
>
> LGTM - one suggestion to make it more future-proof which would be worthwhile I think.
>
> Diff comments:
>
> > diff --git a/package-tools/tests/test_increment_version.py b/package-tools/tests/test_increment_version.py
> > index 49dfa86..4d75802 100755
> > --- a/package-tools/tests/test_increment_version.py
> > +++ b/package-tools/tests/test_increment_version.py
> > @@ -3,15 +3,20 @@ from increment_version import increment_version_security
> >
> >
> > class TestIncrementVersion(unittest.TestCase):
> > +
> > + def setUp(self):
> > + self.devel_release = "noble"
>
> Can we instead do something like the following to make this more future-proof:
>
> self.devel_release = subprocess.check_output(["ubuntu-distro-info", "--devel"]) or "noble"

There are two issues with this approach, one fixable, one not:

1) using a subprocess unnecessarily, when the distro_info python module
   is already present:

   $ python3 -q
   >>> import distro_info
   >>> ubuntu_info = distro_info.UbuntuDistroInfo()
   >>> ubuntu_info.devel()
   'noble'

2) there is a small window of time between the last devel releasse
   (e.g. mantic) gets released and when the new release has not
   been announced where the distro-info-data package does not have
   information about the current development release, like on one of
   my systems that has not pulled in the updated package:

   $ distro-info --devel
   ubuntu-distro-info: Distribution data outdated.
   Please check for an update for distro-info-data. See /usr/share/doc/distro-info-data/README.Debian for details.
   $ python3 -q
   >>> import distro_info
   >>> ubuntu_info = distro_info.UbuntuDistroInfo()
   >>> ubuntu_info.devel()
   Traceback (most recent call last):
     File "<stdin>", line 1, in <module>
     File "/usr/lib/python3/dist-packages/distro_info.py", line 163, in devel
       raise DistroDataOutdated()
   distro_info.DistroDataOutdated: Distribution data outdated. Please check for an update for distro-info-data. See /usr/share/doc/distro-info-data/README.Debian for details.

I also dislike having another place to edit in the ReleaseCycle tasks,
but distro-info-data's unreliability kind of makes that difficult to
deal with, so we may just need to put up with it.

Most tools in the security-tools repo deal with releases via
~/.ubuntu-security-tools.conf to be independent of UCT's knowledge
of releases I guess, which we would definitely want for something we
might run in a CI pipeline, but that also means we wouldn't have a
configured security-tools.conf file to read, either.

Thanks.

--
Steve Beattie
<email address hidden>

diff --git a/build-tools/umt b/build-tools/umt
index e7034a9..3e3bc05 100755
--- a/build-tools/umt
+++ b/build-tools/umt
@@ -417,7 +417,7 @@ def cmd_changelog():
             note = "No-change re-build upload."
     else:
         pkg_list = search_packages(details['package'], use_rmadison=True)   # Avoid dependencies on local installation
-        new_ver = increment_version_security(details['version'], opt.esm, details=details, pkg_list=pkg_list)
+        new_ver = increment_version_security(details['version'], opt.esm, details=details, pkg_list=pkg_list, devel_release=ust['release_devel'])
 
         if opt.repeat:
             repeat_release = opt.release
diff --git a/package-tools/increment_version.py b/package-tools/increment_version.py
index 7c48ca3..89b5e42 100644
--- a/package-tools/increment_version.py
+++ b/package-tools/increment_version.py
@@ -18,18 +18,18 @@ def _validate_version(old_version):
 
     return old_version
 
-def get_suffix(devel, details, pkg_list):
+def get_suffix(devel, details, pkg_list, devel_release=""):
     if devel:
         suffix = "ubuntu1"
     else:
         suffix = "ubuntu0.1"
         if (details is not None) and (pkg_list is not None):
-            release_id = get_release_id(details, pkg_list)
+            release_id = get_release_id(details, pkg_list, devel_release)
             if release_id is not None:
                 suffix = "ubuntu0." + release_id + ".1"
     return suffix
 
-def get_release_id(details, pkg_list):
+def get_release_id(details, pkg_list, devel_release=""):
     release_id = None
     if (details is None) or (pkg_list is None) or \
             (False in [x in details for x in ['package', 'release']]):
@@ -45,6 +45,7 @@ def get_release_id(details, pkg_list):
             if (
                 (cve_lib.get_orig_rel_name(release) in cve_lib.releases)
                 and (cve_lib.get_orig_rel_name(release) != target_release)
+                and (cve_lib.get_orig_rel_name(release) != devel_release)
                 and (base_version == get_base_version(pkg_list[release][0]))
                 and (
                     cve_lib.is_active_release(release)
@@ -101,13 +102,13 @@ def increment_version_build(old_version):
         new_version = old_version + "build1"
     return new_version
 
-def increment_version_security(old_version, esm=False, devel=False, details=None, pkg_list=None):
+def increment_version_security(old_version, esm=False, devel=False, details=None, pkg_list=None, devel_release=""):
     """Returns an incremented version number per security update rules"""
     old_version = _validate_version(old_version)
 
     if "build" in old_version:
         # eg 2.0-2build1
-        suffix = get_suffix(devel, details, pkg_list)
+        suffix = get_suffix(devel, details, pkg_list, devel_release)
         new_version = re.sub("build.*", "", old_version) + suffix
         if esm:
             new_version = new_version + "~esm1"
@@ -140,7 +141,7 @@ def increment_version_security(old_version, esm=False, devel=False, details=None
             )
     elif not "-" in old_version or re.search("-[+a-z.0-9]+$", old_version):
         # eg 2.0-2 or 2.0cvs.20060707-2 or 1.5.0-3+cvs20071006
-        suffix = get_suffix(devel, details, pkg_list)
+        suffix = get_suffix(devel, details, pkg_list, devel_release)
         new_version = old_version + suffix
         if esm:
             new_version = new_version + "~esm1"
diff --git a/package-tools/tests/test_increment_version.py b/package-tools/tests/test_increment_version.py
index 49dfa86..62a036d 100755
--- a/package-tools/tests/test_increment_version.py
+++ b/package-tools/tests/test_increment_version.py
@@ -1,17 +1,21 @@
 import unittest
 from increment_version import increment_version_security
 
-
 class TestIncrementVersion(unittest.TestCase):
+
+    def setUp(self):
+        self.devel_release = 'devel_release'
+
     def test_increment_version_security(self):
         class TC:
-            def __init__(self, version, expected, esm=False, devel=False, details=None, pkg_list=None):
+            def __init__(self, version, expected, esm=False, devel=False, details=None, pkg_list=None, devel_release=""):
                 self.version = version
                 self.expected = expected
                 self.esm = esm
                 self.devel = devel
                 self.details = details
                 self.pkg_list = pkg_list
+                self.devel_release = devel_release
 
         test_cases = [
             TC("2.0-2", "2.0-2ubuntu0.1"),
@@ -60,8 +64,8 @@ class TestIncrementVersion(unittest.TestCase):
             TC("4.3-1", "4.3-1ubuntu0.1", details={'package': 'plib', 'release': 'focal'},
                pkg_list={'focal': ['4.3-1', '', ''], 'kinetic': ['4.3-1', '', '']}),
             # The exact same version is used also in the development release
-            TC("4.3-1", "4.3-1ubuntu0.20.04.1", details={'package': 'plib', 'release': 'focal'},
-               pkg_list={'focal': ['4.3-1', '', ''], 'mantic': ['4.3-1', '', '']}),
+            TC("4.3-1", "4.3-1ubuntu0.1", details={'package': 'plib', 'release': 'focal'},
+               pkg_list={'focal': ['4.3-1', '', ''], self.devel_release: ['4.3-1', '', '']}),
             # The exact same version is used in a LTS release which is out of standard support but the package is
             # supported by esm
             TC("4.3-1", "4.3-1ubuntu0.20.04.1", details={'package': 'busybox', 'release': 'focal'},
@@ -93,12 +97,12 @@ class TestIncrementVersion(unittest.TestCase):
             TC("4.3-1", "4.3-1ubuntu0.23.04.1", details={'package': 'plib', 'release': 'lunar'},
                pkg_list={'focal': ['4.3-1', '', ''], 'lunar': ['4.3-1', '', '']}),
             # Target release is the development one, the exact same version is used in other active release
-            TC("4.3-1", "4.3-1ubuntu1", devel=True, details={'package': 'plib', 'release': 'mantic'},
-               pkg_list={'focal': ['4.3-1', '', ''], 'mantic': ['4.3-1', '', '']}),
+            TC("4.3-1", "4.3-1ubuntu1", devel=True, details={'package': 'plib', 'release': self.devel_release},
+               pkg_list={'focal': ['4.3-1', '', ''], self.devel_release: ['4.3-1', '', '']}),
         ]
         for tc in test_cases:
             with self.subTest(version=tc.version, esm=tc.esm, devel=tc.devel, details=tc.details, pkg_list=tc.pkg_list):
                 self.assertEqual(
-                    increment_version_security(tc.version, esm=tc.esm, devel=tc.devel, details=tc.details, pkg_list=tc.pkg_list),
+                    increment_version_security(tc.version, esm=tc.esm, devel=tc.devel, details=tc.details, pkg_list=tc.pkg_list, devel_release=self.devel_release),
                     tc.expected,
                 )