Merge ~lgp171188/launchpad:allow-reporting-bugs-arbitrary-packages-distros-without-publishing into launchpad:master

[Guruprasad]

Allow bugtasks against any package in a distroseries without published sources

[Colin Watson (cjwatson)]

review: Approve

diff --git a/lib/lp/bugs/model/bugtask.py b/lib/lp/bugs/model/bugtask.py
index 33d3647..c006618 100644
--- a/lib/lp/bugs/model/bugtask.py
+++ b/lib/lp/bugs/model/bugtask.py
@@ -357,11 +357,13 @@ def validate_target(
     if IDistributionSourcePackage.providedBy(
         target
     ) or ISourcePackage.providedBy(target):
-        # If the distribution has at least one series, check that the
-        # source package has been published in the distribution.
+        # If the distribution has at least one series and has published
+        # sources, check that the source package has been published in
+        # the distribution.
         if (
             check_source_package
             and target.sourcepackagename is not None
+            and target.distribution.has_published_sources
             and len(target.distribution.series) > 0
         ):
             try:
diff --git a/lib/lp/bugs/model/tests/test_bugtask.py b/lib/lp/bugs/model/tests/test_bugtask.py
index 598a27a..c3eb248 100644
--- a/lib/lp/bugs/model/tests/test_bugtask.py
+++ b/lib/lp/bugs/model/tests/test_bugtask.py
@@ -70,7 +70,7 @@ from lp.services.database.sqlbase import (
 from lp.services.features.testing import FeatureFixture
 from lp.services.job.tests import block_on_job
 from lp.services.log.logger import DevNullLogger
-from lp.services.propertycache import get_property_cache
+from lp.services.propertycache import clear_property_cache, get_property_cache
 from lp.services.searchbuilder import any
 from lp.services.webapp.authorization import check_permission
 from lp.services.webapp.interfaces import ILaunchBag, OAuthPermission
@@ -3461,27 +3461,52 @@ class TestValidateTarget(TestCaseWithFactory, ValidateTargetMixin):
         )
 
     def test_dsp_without_publications_disallowed(self):
-        # If a distribution has series, a DistributionSourcePackage task
-        # can only be created if the package is published in a distro
-        # archive.
+        # If a distribution has series and has published sources,
+        # a DistributionSourcePackage task can only be created if
+        # the package is published in a distro archive.
         series = self.factory.makeDistroSeries()
+        self.assertFalse(series.distribution.has_published_sources)
         dsp = self.factory.makeDistributionSourcePackage(
             distribution=series.distribution
         )
+        self.factory.makeSourcePackagePublishingHistory(
+            distroseries=series,
+            sourcepackagename=dsp.sourcepackagename,
+            archive=series.main_archive,
+        )
+        clear_property_cache(series.distribution)
+        self.assertTrue(series.distribution.has_published_sources)
+        another_dsp = self.factory.makeDistributionSourcePackage(
+            distribution=series.distribution
+        )
         task = self.factory.makeBugTask()
         self.assertRaisesWithContent(
             IllegalTarget,
-            "Package %s not published in %s"
-            % (dsp.sourcepackagename.name, dsp.distribution.displayname),
+            "Package {} not published in {}".format(
+                another_dsp.sourcepackagename.name,
+                another_dsp.distribution.displayname,
+            ),
             validate_target,
             task.bug,
-            dsp,
+            another_dsp,
+        )
+
+    def test_dsp_with_distribution_has_published_sources_false(self):
+        # If a distribution has one or more series and does not have
+        # published sources, a bug task can be created against any existing
+        # DistributionSourcePackage instance.
+        series = self.factory.makeDistroSeries()
+        self.assertFalse(series.distribution.has_published_sources)
+        dsp = self.factory.makeDistributionSourcePackage(
+            distribution=series.distribution
         )
+        task = self.factory.makeBugTask()
+        validate_target(task.bug, dsp)
 
     def test_dsp_with_publications_allowed(self):
-        # If a distribution has series, a DistributionSourcePackage task
-        # can only be created if the package is published in a distro
-        # archive.
+        # If a distribution has one or more series and has published sources,
+        # a DistributionSourcePackage task can only be created if the package
+        # is published in a distro archive.
         series = self.factory.makeDistroSeries()
         dsp = self.factory.makeDistributionSourcePackage(
             distribution=series.distribution
@@ -3495,13 +3520,22 @@ class TestValidateTarget(TestCaseWithFactory, ValidateTargetMixin):
         validate_target(task.bug, dsp)
 
     def test_dsp_with_only_ppa_publications_disallowed(self):
-        # If a distribution has series, a DistributionSourcePackage task
-        # can only be created if the package is published in a distro
-        # archive. PPA publications don't count.
+        # If a distribution has one or more series and has published sources,
+        # a DistributionSourcePackage task can only be created if the package
+        # is published in a distro archive. PPA publications don't count.
         series = self.factory.makeDistroSeries()
         dsp = self.factory.makeDistributionSourcePackage(
             distribution=series.distribution
         )
+        another_dsp = self.factory.makeDistributionSourcePackage(
+            distribution=series.distribution
+        )
+        self.factory.makeSourcePackagePublishingHistory(
+            distroseries=series,
+            sourcepackagename=another_dsp.sourcepackagename,
+            archive=series.main_archive,
+        )
+        self.assertTrue(series.distribution.has_published_sources)
         task = self.factory.makeBugTask()
         self.factory.makeSourcePackagePublishingHistory(
             distroseries=series,
diff --git a/lib/lp/bugs/scripts/tests/test_uct.py b/lib/lp/bugs/scripts/tests/test_uct.py
index 20ae931..9813d86 100644
--- a/lib/lp/bugs/scripts/tests/test_uct.py
+++ b/lib/lp/bugs/scripts/tests/test_uct.py
@@ -575,15 +575,8 @@ class TestUCTImporterExporter(TestCaseWithFactory):
                     sourcepackagename=self.ubuntu_package.sourcepackagename,
                 ),
             )
-
-        for series in (self.esm_current_series, self.esm_supported_series):
-            self.factory.makeSourcePackagePublishingHistory(
-                distroseries=series,
-                sourcepackagerelease=self.factory.makeSourcePackageRelease(
-                    distroseries=series,
-                    sourcepackagename=self.esm_package.sourcepackagename,
-                ),
-            )
+        # Note: The ubuntu-esm distribution does not have any source packages
+        # published.
 
         self.lp_cve = self.factory.makeCVE("2022-23222")
         self.cve = CVE(
@@ -894,6 +887,92 @@ class TestUCTImporterExporter(TestCaseWithFactory):
             "UCT CVE entry CVE-2022-23222", import_bug_activity.message
         )
 
+    def test_create_bug_distribution_has_published_sources_false(self):
+        distribution = self.factory.makeDistribution(
+            name="no-published-sources"
+        )
+        self.assertFalse(distribution.has_published_sources)
+        supported_series = self.factory.makeDistroSeries(
+            distribution=distribution,
+            status=SeriesStatus.SUPPORTED,
+            name="supported-series",
+        )
+        current_series = self.factory.makeDistroSeries(
+            distribution=distribution,
+            status=SeriesStatus.CURRENT,
+            name="current-series",
+        )
+        affected_package = self.factory.makeDistributionSourcePackage(
+            distribution=distribution
+        )
+        cve = CVE(
+            sequence="CVE-2022-1234",
+            date_made_public=datetime.datetime(
+                2022, 1, 1, 8, 15, tzinfo=datetime.timezone.utc
+            ),
+            date_notice_issued=datetime.datetime(
+                2021, 1, 1, 8, 15, tzinfo=datetime.timezone.utc
+            ),
+            date_coordinated_release=datetime.datetime(
+                2020, 1, 1, 8, 15, tzinfo=datetime.timezone.utc
+            ),
+            distro_packages=[
+                CVE.DistroPackage(
+                    target=affected_package,
+                    importance=BugTaskImportance.LOW,
+                    package_name=affected_package.sourcepackagename,
+                ),
+            ],
+            series_packages=[
+                CVE.SeriesPackage(
+                    target=SourcePackage(
+                        sourcepackagename=affected_package.sourcepackagename,
+                        distroseries=supported_series,
+                    ),
+                    package_name=affected_package.sourcepackagename,
+                    importance=BugTaskImportance.HIGH,
+                    status=BugTaskStatus.FIXRELEASED,
+                    status_explanation="released",
+                ),
+                CVE.SeriesPackage(
+                    target=SourcePackage(
+                        sourcepackagename=affected_package.sourcepackagename,
+                        distroseries=current_series,
+                    ),
+                    package_name=affected_package.sourcepackagename,
+                    importance=None,
+                    status=BugTaskStatus.DOESNOTEXIST,
+                    status_explanation="does not exist",
+                ),
+            ],
+            upstream_packages=[],
+            importance=BugTaskImportance.MEDIUM,
+            status=VulnerabilityStatus.ACTIVE,
+            assignee=self.factory.makePerson(),
+            discovered_by="tr3e wang",
+            description="description",
+            ubuntu_description="ubuntu-description",
+            bug_urls=["https://github.com/mm2/Little-CMS/issues/29"],
+            references=["https://ubuntu.com/security/notices/USN-5368-1"],
+            notes="author> text",
+            mitigation="mitigation",
+            cvss=[
+                CVSS(
+                    authority="nvd",
+                    vector_string=(
+                        "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H "
+                        "[7.8 HIGH]"
+                    ),
+                ),
+            ],
+            patch_urls=[],
+        )
+        lp_cve = self.factory.makeCVE(sequence="2022-1234")
+        bug = self.importer.create_bug(cve, lp_cve)
+        self.checkBug(bug, cve)
+        self.checkBugTasks(bug, cve)
+        self.assertEqual([lp_cve], bug.cves)
+
     def test_find_existing_bug(self):
         self.assertIsNone(
             self.importer._find_existing_bug(self.cve, self.lp_cve)