Merge lp:~jtv/launchpad/bug-572497 into lp:launchpad

[Jeroen T. Vermeulen]

Allow "fiera" db user to approve translation templates.

= Bug 572497 =

We've finally gotten the build farm (formerly Soyuz) to dispatch a translation templates build job to a build farm slave; the slave to check out a bzr branch, run intltool on it to generate templates, roll the templates into a tarball, and send it back to the master; and the master to receive the tarball, upload it to the translations import queue, and attempt to approve the resulting entries.

That's where we ran into a database privilege problem—the database user in question is not allowed to read POTemplate. This is a newer addition: the uploads also go straight into approval, which requires read access to some extra tables.

Luckily we have a dedicated database group containing all the permissions needed for this (and a few more, but nothing that could possibly hurt).

I still need tests for this, so am filing this as Work In Progress for now. I can't invoke the build farm from the test suite, so it won't be too realistic. But I can add a unit test that runs the approval code we use here under the fiera database user.

To Q/A, go through the steps in https://dev.launchpad.net/Translations/GenerateTemplatesOnTestServers and verify that (1) the templates get generated and uploaded and make it into approval; and (2) don't strand there with a permissions error (see /srv/launchpad.net/dogfood-logs/buildd-manager.log). If all is well, your templates should appear in your productseries' translations import queue.

Jeroen

[Jeroen T. Vermeulen (jtv)]

Okay, I've updated the test to run as the real database user. This reproduces the problem, and "make schema" then fixes the test.

[Michael Hudson-Doyle (mwhudson)]

Looks fine to me.

review: Approve

[Björn Tillenius (bjornt)]

review: Approve (release-critical)

=== modified file 'database/schema/security.cfg'
--- database/schema/security.cfg	2010-04-21 19:41:18 +0000
+++ database/schema/security.cfg	2010-05-03 04:46:27 +0000
@@ -818,7 +818,7 @@
 
 [fiera]
 type=user
-groups=script
+groups=script,translations_approval
 public.account                                  = SELECT
 public.archive                                  = SELECT, UPDATE
 public.archivearch                              = SELECT, UPDATE

=== modified file 'lib/lp/translations/tests/test_translationbuildapprover.py'
--- lib/lp/translations/tests/test_translationbuildapprover.py	2010-04-12 16:05:17 +0000
+++ lib/lp/translations/tests/test_translationbuildapprover.py	2010-05-03 04:46:27 +0000
@@ -5,10 +5,12 @@
 
 __metaclass__ = type
 
+import transaction
 from unittest import TestLoader
 
 from zope.component import getUtility
 
+from canonical.config import config
 from canonical.testing import LaunchpadZopelessLayer
 from lp.translations.interfaces.translationimportqueue import (
     ITranslationImportQueue, RosettaImportStatus)
@@ -33,6 +35,11 @@
                 productseries=series))
             for path in filenames]
 
+    def _becomeBuilddMaster(self):
+        """Switch db identity to the script that uses this approver."""
+        transaction.commit()
+        self.layer.switchDbUser(config.builddmaster.dbuser)
+
     def test_approve_all_new(self):
         # A happy approval case, all new templates.
         filenames = [
@@ -41,6 +48,8 @@
             'po-domain3/domain3.pot',
             ]
         series = self.factory.makeProductSeries()
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -58,6 +67,8 @@
             'po/eo.po',
             ]
         series = self.factory.makeProductSeries()
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -79,6 +90,8 @@
             productseries=series, name='domain2')
         domain3_pot = self.factory.makePOTemplate(
             productseries=series, name='domain3')
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -102,6 +115,8 @@
             productseries=series, name='domain1')
         domain2_pot = self.factory.makePOTemplate(
             productseries=series, name='domain2')
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -120,6 +135,8 @@
             ]
         product = self.factory.makeProduct(name='fooproduct')
         series = product.getSeries('trunk')
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -133,6 +150,8 @@
             ]
         series = self.factory.makeProductSeries()
         pot = self.factory.makePOTemplate(productseries=series)
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -146,6 +165,8 @@
             'mydomain/mydomain.pot',
             ]
         series = self.factory.makeProductSeries()
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -162,6 +183,8 @@
         series = self.factory.makeProductSeries()
         self.factory.makePOTemplate(productseries=series)
         self.factory.makePOTemplate(productseries=series)
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -174,6 +197,8 @@
             'po-domain2/domain2.pot',
             ]
         series = self.factory.makeProductSeries()
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(
             series, approver, filenames + ['po-domain3/domain3.pot'])
@@ -196,6 +221,8 @@
             productseries=series, name='name1', path=filenames[0])
         domain2_pot = self.factory.makePOTemplate(
             productseries=series, name='name2', path=filenames[1])
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)
 
@@ -215,6 +242,8 @@
         series = self.factory.makeProductSeries()
         domain1_pot = self.factory.makePOTemplate(
             productseries=series, name='domain1', path='po/foo.pot')
+
+        self._becomeBuilddMaster()
         approver = TranslationBuildApprover(filenames, productseries=series)
         entries = self._makeApprovedEntries(series, approver, filenames)