Merge ~twom/launchpad:concrete-oci-projects into launchpad:master

[Tom Wardill]

OCIRecipe and skeleton of dependent models

[Colin Watson (cjwatson)]

Looks OK so far - just a few relatively minor comments.

review: Approve

7d660b0... by Tom Wardill on 2020-02-06

Traceback errors

b7d86c9... by Tom Wardill on 2020-02-07

Update for latest db patches

[Colin Watson (cjwatson)]

Generally good, though I have a bunch more comments that I'd like to see fixed before this lands.

It's probably obvious, but note that this can't land until the DB patch has been deployed and then merged into master.

review: Approve

6415899... by Tom Wardill on 2020-02-07

Path validator improvements

e77fc47... by Tom Wardill on 2020-02-07

Better named test

[Colin Watson (cjwatson)]

The DB patch has been deployed and I just merged it into master. However, before I forget, please note that you'll need to merge master (or rebase on it) and then implement personmerge properly for OCIRecipe.owner to replace the temporary stub I added for it. Compare https://git.launchpad.net/launchpad/commit?id=454dc1a00d36f984c7f0eb759f38df0fca0361df.

6821448... by Tom Wardill on 2020-02-10

Tidy up ocirecipe interface

14bfa69... by Tom Wardill on 2020-02-10

Tidy ocirecipebuild interface

704052f... by Tom Wardill on 2020-02-10

Use git_ref rather than separate git_repository and git_path variables

1a77f94... by Tom Wardill on 2020-02-10

Handle more build artifacts in destroySelf

6871c91... by Tom Wardill on 2020-02-10

displayname != display_name

229d750... by Tom Wardill on 2020-02-10

Add date_created as DEFAULT

d0463e7... by Tom Wardill on 2020-02-10

Correct uniqueness index

5ea7e97... by Tom Wardill on 2020-02-11

Implement required build duration methods

9670d0e... by Tom Wardill on 2020-02-11

Move to distro_arch_series rather than lower level variables

2771b2c... by Tom Wardill on 2020-02-11

Factory method simplifications

58703ee... by Tom Wardill on 2020-02-11

Add ocirecipe to personmerge

8c6f2ac... by Tom Wardill on 2020-02-12

Format imports

[Colin Watson (cjwatson)]

review: Approve

88c112f... by Tom Wardill on 2020-02-12

Sentence case

c5e1d57... by Tom Wardill on 2020-02-12

Add basic virtualized tests for ocirecipebuild

diff --git a/lib/lp/_schema_circular_imports.py b/lib/lp/_schema_circular_imports.py
index 372744f..70c5b72 100644
--- a/lib/lp/_schema_circular_imports.py
+++ b/lib/lp/_schema_circular_imports.py
@@ -96,6 +96,8 @@ from lp.hardwaredb.interfaces.hwdb import (
     IHWSubmissionDevice,
     IHWVendorID,
     )
+from lp.oci.interfaces.ocirecipe import IOCIRecipe
+from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuild
 from lp.registry.interfaces.commercialsubscription import (
     ICommercialSubscription,
     )
@@ -1090,3 +1092,8 @@ patch_operations_explicit_version(
 
 # IWikiName
 patch_entry_explicit_version(IWikiName, 'beta')
+
+# IOCIRecipe
+patch_collection_property(IOCIRecipe, 'builds', IOCIRecipeBuild)
+patch_collection_property(IOCIRecipe, 'completed_builds', IOCIRecipeBuild)
+patch_collection_property(IOCIRecipe, 'pending_builds', IOCIRecipeBuild)
diff --git a/lib/lp/app/validators/path.py b/lib/lp/app/validators/path.py
new file mode 100644
index 0000000..13e0b06
--- /dev/null
+++ b/lib/lp/app/validators/path.py
@@ -0,0 +1,34 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Validators for paths and path functions."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'path_does_not_escape'
+]
+
+import os
+
+from lp.app.validators import LaunchpadValidationError
+
+
+def path_does_not_escape(path):
+    """First-pass validation that a given path does not escape a root.
+
+    This is only intended as a first defence, usage of this will also
+    require checking for filesystem escapes (symlinks, etc).
+    """
+    # We're not working with complete paths, so we need to make them so
+    fake_base_path = '/target'
+    # Ensure that we start with a common base
+    target_path = os.path.join(fake_base_path, path)
+    # Resolve symlinks and such
+    real_path = os.path.normpath(target_path)
+    # If the paths don't have a common start anymore,
+    # we are attempting an escape
+    if not os.path.commonprefix((real_path, fake_base_path)) == fake_base_path:
+        raise LaunchpadValidationError("Path would escape target directory")
+    return True
diff --git a/lib/lp/app/validators/tests/test_path.py b/lib/lp/app/validators/tests/test_path.py
new file mode 100644
index 0000000..24501a8
--- /dev/null
+++ b/lib/lp/app/validators/tests/test_path.py
@@ -0,0 +1,51 @@
+# Copyright 2020 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Tests for path validators."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+
+from lp.app.validators import LaunchpadValidationError
+from lp.app.validators.path import path_does_not_escape
+from lp.testing import TestCase
+
+
+class TestPathDoesNotEscape(TestCase):
+
+    def test_valid_path(self):
+        self.assertTrue(path_does_not_escape('Buildfile'))
+
+    def test_invalid_path_parent(self):
+        self.assertRaises(
+            LaunchpadValidationError,
+            path_does_not_escape,
+            '../Buildfile')
+
+    def test_invalid_path_elsewhere(self):
+        self.assertRaises(
+            LaunchpadValidationError,
+            path_does_not_escape,
+            '/var/foo/Buildfile')
+
+    def test_starts_with_target(self):
+        self.assertRaises(
+            LaunchpadValidationError,
+            path_does_not_escape,
+            '/target/../../../Buildfile')
+
+    def test_extra_dot_slash(self):
+        self.assertRaises(
+            LaunchpadValidationError,
+            path_does_not_escape,
+            '/foo/./../../bar/./Buildfile')
+
+    def test_starts_with_target_inclusive(self):
+        self.assertRaises(
+            LaunchpadValidationError,
+            path_does_not_escape,
+            '/targetfoo/../../../Buildfile')
+
+    def test_just_target(self):
+        self.assertTrue(path_does_not_escape('/target'))
diff --git a/lib/lp/buildmaster/enums.py b/lib/lp/buildmaster/enums.py
index c6f0aac..a96bce0 100644
--- a/lib/lp/buildmaster/enums.py
+++ b/lib/lp/buildmaster/enums.py
@@ -164,6 +164,12 @@ class BuildFarmJobType(DBEnumeratedType):
         Build a snap package from a recipe.
         """)
 
+    OCIRECIPEBUILD = DBItem(7, """
+        OCI image build
+
+        Build an OCI image from a recipe.
+        """)
+
 
 class BuildQueueStatus(DBEnumeratedType):
     """Build queue status.
diff --git a/lib/lp/code/model/tests/test_gitlookup.py b/lib/lp/code/model/tests/test_gitlookup.py
index 02da9e6..d527b06 100644
--- a/lib/lp/code/model/tests/test_gitlookup.py
+++ b/lib/lp/code/model/tests/test_gitlookup.py
@@ -111,8 +111,8 @@ class TestGetByUniqueName(TestCaseWithFactory):
             repository.unique_name + "-nonexistent"))
 
     def test_ociproject(self):
-        ociproject = self.factory.makeOCIProject()
-        repository = self.factory.makeGitRepository(target=ociproject)
+        oci_project = self.factory.makeOCIProject()
+        repository = self.factory.makeGitRepository(target=oci_project)
         self.assertEqual(
             repository, self.lookup.getByUniqueName(repository.unique_name))
         self.assertIsNone(self.lookup.getByUniqueName(
@@ -168,7 +168,7 @@ class TestGetByPath(TestCaseWithFactory):
         self.assertEqual(
             (repository, ""), self.lookup.getByPath(repository.unique_name))
 
-    def test_ociproject_default(self):
+    def test_ociproject_official(self):
         oci_project = self.factory.makeOCIProject()
         repository = self.factory.makeGitRepository(target=oci_project)
         with person_logged_in(repository.target.distribution.owner):
diff --git a/lib/lp/configure.zcml b/lib/lp/configure.zcml
index 533d714..a3e7c08 100644
--- a/lib/lp/configure.zcml
+++ b/lib/lp/configure.zcml
@@ -30,6 +30,7 @@
     <include package="lp.code" />
     <include package="lp.coop.answersbugs" />
     <include package="lp.hardwaredb" />
+    <include package="lp.oci" />
     <include package="lp.snappy" />
     <include package="lp.soyuz" />
     <include package="lp.translations" />
diff --git a/lib/lp/oci/__init__.py b/lib/lp/oci/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/lib/lp/oci/__init__.py
diff --git a/lib/lp/oci/configure.zcml b/lib/lp/oci/configure.zcml
new file mode 100644
index 0000000..30212b9
--- /dev/null
+++ b/lib/lp/oci/configure.zcml
@@ -0,0 +1,59 @@
+<!-- Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+     GNU Affero General Public License version 3 (see the file LICENSE).
+-->
+<configure
+    xmlns="http://namespaces.zope.org/zope"
+    xmlns:i18n="http://namespaces.zope.org/i18n"
+    xmlns:lp="http://namespaces.canonical.com/lp"
+    i18n_domain="launchpad">
+
+    <!-- OCIRecipe -->
+    <class
+        class="lp.oci.model.ocirecipe.OCIRecipe">
+        <require
+            permission="launchpad.View"
+            interface="lp.oci.interfaces.ocirecipe.IOCIRecipeView
+                       lp.oci.interfaces.ocirecipe.IOCIRecipeEditableAttributes
+                       lp.oci.interfaces.ocirecipe.IOCIRecipeAdminAttributes"/>
+        <require
+            permission="launchpad.Edit"
+            interface="lp.oci.interfaces.ocirecipe.IOCIRecipeEdit"
+            set_schema="lp.oci.interfaces.ocirecipe.IOCIRecipeEditableAttributes" />
+        <require
+            permission="launchpad.Admin"
+            set_schema="lp.oci.interfaces.ocirecipe.IOCIRecipeAdminAttributes" />
+    </class>
+    <securedutility
+        class="lp.oci.model.ocirecipe.OCIRecipeSet"
+        provides="lp.oci.interfaces.ocirecipe.IOCIRecipeSet">
+        <allow
+            interface="lp.oci.interfaces.ocirecipe.IOCIRecipeSet"/>
+    </securedutility>
+
+    <!-- OCIRecipeBuild -->
+    <class class="lp.oci.model.ocirecipebuild.OCIRecipeBuild">
+        <require
+            permission="launchpad.View"
+            interface="lp.oci.interfaces.ocirecipebuild.IOCIRecipeBuildView" />
+        <require
+            permission="launchpad.Edit"
+            interface="lp.oci.interfaces.ocirecipebuild.IOCIRecipeBuildEdit" />
+        <require
+            permission="launchpad.Admin"
+            interface="lp.oci.interfaces.ocirecipebuild.IOCIRecipeBuildAdmin" />
+    </class>
+
+    <!-- OCIRecipeBuildSet -->
+    <securedutility
+        class="lp.oci.model.ocirecipebuild.OCIRecipeBuildSet"
+        provides="lp.oci.interfaces.ocirecipebuild.IOCIRecipeBuildSet">
+        <allow interface="lp.oci.interfaces.ocirecipebuild.IOCIRecipeBuildSet" />
+    </securedutility>
+    <securedutility
+        class="lp.oci.model.ocirecipebuild.OCIRecipeBuildSet"
+        provides="lp.buildmaster.interfaces.buildfarmjob.ISpecificBuildFarmJobSource"
+        name="OCIRECIPEBUILD">
+        <allow interface="lp.buildmaster.interfaces.buildfarmjob.ISpecificBuildFarmJobSource" />
+    </securedutility>
+
+</configure>
diff --git a/lib/lp/oci/interfaces/__init__.py b/lib/lp/oci/interfaces/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/lib/lp/oci/interfaces/__init__.py
diff --git a/lib/lp/oci/interfaces/ocirecipe.py b/lib/lp/oci/interfaces/ocirecipe.py
new file mode 100644
index 0000000..340adfc
--- /dev/null
+++ b/lib/lp/oci/interfaces/ocirecipe.py
@@ -0,0 +1,242 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Interfaces related to recipes for OCI Images."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'DuplicateOCIRecipeName',
+    'IOCIRecipe',
+    'IOCIRecipeEdit',
+    'IOCIRecipeEditableAttributes',
+    'IOCIRecipeSet',
+    'IOCIRecipeView',
+    'NoSourceForOCIRecipe',
+    'NoSuchOCIRecipe',
+    'OCIRecipeBuildAlreadyPending',
+    'OCIRecipeNotOwner',
+    ]
+
+from lazr.restful.declarations import error_status
+from lazr.restful.fields import (
+    CollectionField,
+    Reference,
+    ReferenceChoice,
+    )
+from six.moves import http_client
+from zope.interface import Interface
+from zope.schema import (
+    Bool,
+    Datetime,
+    Int,
+    Text,
+    TextLine,
+    )
+from zope.security.interfaces import Unauthorized
+
+from lp import _
+from lp.app.errors import NameLookupFailed
+from lp.app.validators.name import name_validator
+from lp.app.validators.path import path_does_not_escape
+from lp.code.interfaces.gitref import IGitRef
+from lp.code.interfaces.gitrepository import IGitRepository
+from lp.registry.interfaces.ociproject import IOCIProject
+from lp.registry.interfaces.role import IHasOwner
+from lp.services.fields import (
+    PersonChoice,
+    PublicPersonChoice,
+    )
+
+
+@error_status(http_client.UNAUTHORIZED)
+class OCIRecipeNotOwner(Unauthorized):
+    """The registrant/requester is not the owner or a member of its team."""
+
+
+@error_status(http_client.BAD_REQUEST)
+class OCIRecipeBuildAlreadyPending(Exception):
+    """A build was requested when an identical build was already pending."""
+
+    def __init__(self):
+        super(OCIRecipeBuildAlreadyPending, self).__init__(
+            "An identical build of this snap package is already pending.")
+
+
+@error_status(http_client.BAD_REQUEST)
+class DuplicateOCIRecipeName(Exception):
+    """An OCI Recipe already exists with the same name."""
+
+
+class NoSuchOCIRecipe(NameLookupFailed):
+    """The requested OCI Recipe does not exist."""
+    _message_prefix = "No such OCI recipe exists for this OCI project"
+
+
+@error_status(http_client.BAD_REQUEST)
+class NoSourceForOCIRecipe(Exception):
+    """OCI Recipes must have a source and build file."""
+
+    def __init__(self):
+        super(NoSourceForOCIRecipe, self).__init__(
+            "New OCI recipes must have a git branch and build file.")
+
+
+class IOCIRecipeView(Interface):
+    """`IOCIRecipe` attributes that require launchpad.View permission."""
+
+    id = Int(title=_("ID"), required=True, readonly=True)
+    date_created = Datetime(
+        title=_("Date created"), required=True, readonly=True)
+    date_last_modified = Datetime(
+        title=_("Date last modified"), required=True, readonly=True)
+
+    registrant = PublicPersonChoice(
+        title=_("Registrant"),
+        description=_("The user who registered this recipe."),
+        vocabulary='ValidPersonOrTeam', required=True, readonly=True)
+
+    builds = CollectionField(
+        title=_("Completed builds of this OCI recipe."),
+        description=_(
+            "Completed builds of this OCI recipe, sorted in descending "
+            "order of finishing."),
+        # Really IOCIRecipeBuild, patched in _schema_circular_imports.
+        value_type=Reference(schema=Interface),
+        required=True, readonly=True)
+
+    completed_builds = CollectionField(
+        title=_("Completed builds of this OCI recipe."),
+        description=_(
+            "Completed builds of this OCI recipe, sorted in descending "
+            "order of finishing."),
+        # Really IOCIRecipeBuild, patched in _schema_circular_imports.
+        value_type=Reference(schema=Interface), readonly=True)
+
+    pending_builds = CollectionField(
+        title=_("Pending builds of this OCI recipe."),
+        description=_(
+            "Pending builds of this OCI recipe, sorted in descending "
+            "order of creation."),
+        # Really IOCIRecipeBuild, patched in _schema_circular_imports.
+        value_type=Reference(schema=Interface), readonly=True)
+
+    def requestBuild(requester, architecture):
+        """Request that the OCI recipe is built.
+
+        :param requester: The person requesting the build.
+        :param architecture: The architecture to build for.
+        :return: `IOCIRecipeBuild`.
+        """
+
+
+class IOCIRecipeEdit(Interface):
+    """`IOCIRecipe` methods that require launchpad.Edit permission."""
+
+    def destroySelf():
+        """Delete this OCI recipe, provided that it has no builds."""
+
+
+class IOCIRecipeEditableAttributes(IHasOwner):
+    """`IOCIRecipe` attributes that can be edited.
+
+    These attributes need launchpad.View to see, and launchpad.Edit to change.
+    """
+
+    name = TextLine(
+        title=_("The name of this recipe."),
+        constraint=name_validator,
+        required=True,
+        readonly=False)
+
+    owner = PersonChoice(
+        title=_("Owner"),
+        required=True,
+        vocabulary="AllUserTeamsParticipationPlusSelf",
+        description=_("The owner of this OCI recipe."),
+        readonly=False)
+
+    oci_project = Reference(
+        IOCIProject,
+        title=_("The OCI project that this recipe is for."),
+        required=True,
+        readonly=True)
+
+    official = Bool(
+        title=_("OCI project official"),
+        required=True,
+        default=False,
+        description=_("True if this recipe is official for its OCI project."),
+        readonly=False)
+
+    git_ref = Reference(
+        IGitRef, title=_("Git branch"), required=False, readonly=False,
+        description=_(
+            "The Git branch containing a Dockerfile at the location "
+            "defined by the build_file attribute."))
+
+    git_repository = ReferenceChoice(
+        title=_("Git repository"),
+        schema=IGitRepository, vocabulary="GitRepository",
+        required=False, readonly=True,
+        description=_(
+            "A Git repository with a branch containing a Dockerfile "
+            "at the location defined by the build_file attribute."))
+
+    git_path = TextLine(
+        title=_("Git branch path"), required=False, readonly=False,
+        description=_(
+            "The path of the Git branch containing a Dockerfile "
+            "at the location defined by the build_file attribute."))
+
+    description = Text(
+        title=_("A short description of this recipe."),
+        readonly=False)
+
+    build_file = TextLine(
+        title=_("The relative path to the file within this recipe's "
+                "branch that defines how to build the recipe."),
+        constraint=path_does_not_escape,
+        required=True,
+        readonly=False)
+
+    build_daily = Bool(
+        title=_("Build daily"),
+        required=True,
+        default=False,
+        description=_("If True, this recipe should be built daily."),
+        readonly=False)
+
+
+class IOCIRecipeAdminAttributes(Interface):
+    """`IOCIRecipe` attributes that can be edited by admins.
+
+    These attributes need launchpad.View to see, and launchpad.Admin to change.
+    """
+
+    require_virtualized = Bool(
+        title=_("Require virtualized builders"), required=True, readonly=False,
+        description=_("Only build this OCI recipe on virtual builders."))
+
+
+class IOCIRecipe(IOCIRecipeView, IOCIRecipeEdit, IOCIRecipeEditableAttributes,
+                 IOCIRecipeAdminAttributes):
+    """A recipe for building Open Container Initiative images."""
+
+
+class IOCIRecipeSet(Interface):
+    """A utility to create and access OCI Recipes."""
+
+    def new(name, registrant, owner, oci_project, git_ref, description,
+            official, require_virtualized, build_file, date_created):
+        """Create an IOCIRecipe."""
+
+    def exists(owner, oci_project, name):
+        """Check to see if an existing OCI Recipe exists."""
+
+    def getByName(owner, oci_project, name):
+        """Return the appropriate `OCIRecipe` for the given objects."""
+
+    def findByOwner(owner):
+        """Return all OCI Recipes with the given `owner`."""
diff --git a/lib/lp/oci/interfaces/ocirecipebuild.py b/lib/lp/oci/interfaces/ocirecipebuild.py
new file mode 100644
index 0000000..5ee6b46
--- /dev/null
+++ b/lib/lp/oci/interfaces/ocirecipebuild.py
@@ -0,0 +1,63 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Interfaces for a build record for OCI recipes."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'IOCIRecipeBuild',
+    'IOCIRecipeBuildSet',
+    ]
+
+from lazr.restful.fields import Reference
+from zope.interface import Interface
+from zope.schema import Text
+
+from lp import _
+from lp.buildmaster.interfaces.buildfarmjob import ISpecificBuildFarmJobSource
+from lp.buildmaster.interfaces.packagebuild import IPackageBuild
+from lp.oci.interfaces.ocirecipe import IOCIRecipe
+from lp.services.database.constants import DEFAULT
+from lp.services.fields import PublicPersonChoice
+
+
+class IOCIRecipeBuildEdit(Interface):
+    # XXX twom 2020-02-10 This will probably need cancel() implementing
+    pass
+
+
+class IOCIRecipeBuildView(IPackageBuild):
+
+    requester = PublicPersonChoice(
+        title=_("Requester"),
+        description=_("The person who requested this OCI recipe build."),
+        vocabulary='ValidPersonOrTeam', required=True, readonly=True)
+
+    recipe = Reference(
+        IOCIRecipe,
+        title=_("The OCI recipe to build."),
+        required=True,
+        readonly=True)
+
+
+class IOCIRecipeBuildAdmin(Interface):
+    # XXX twom 2020-02-10 This will probably need rescore() implementing
+    pass
+
+
+class IOCIRecipeBuild(IOCIRecipeBuildAdmin, IOCIRecipeBuildEdit,
+                      IOCIRecipeBuildView):
+    """A build record for an OCI recipe."""
+
+
+class IOCIRecipeBuildSet(ISpecificBuildFarmJobSource):
+    """A utility to create and access OCIRecipeBuilds."""
+
+    def new(requester, recipe, distro_arch_series,
+            date_created=DEFAULT):
+        """Create an `IOCIRecipeBuild`."""
+
+    def preloadBuildsData(builds):
+        """Load the data related to a list of OCI recipe builds."""
diff --git a/lib/lp/oci/model/__init__.py b/lib/lp/oci/model/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/lib/lp/oci/model/__init__.py
diff --git a/lib/lp/oci/model/ocirecipe.py b/lib/lp/oci/model/ocirecipe.py
new file mode 100644
index 0000000..0d4d20f
--- /dev/null
+++ b/lib/lp/oci/model/ocirecipe.py
@@ -0,0 +1,295 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""A recipe for building Open Container Initiative images."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'OCIRecipe',
+    'OCIRecipeSet',
+    ]
+
+
+from lazr.lifecycle.event import ObjectCreatedEvent
+import pytz
+from storm.expr import (
+    Desc,
+    Not,
+    )
+from storm.locals import (
+    Bool,
+    DateTime,
+    Int,
+    Reference,
+    Store,
+    Storm,
+    Unicode,
+    )
+from zope.component import getUtility
+from zope.event import notify
+from zope.interface import implementer
+
+from lp.buildmaster.enums import BuildStatus
+from lp.buildmaster.interfaces.buildqueue import IBuildQueueSet
+from lp.buildmaster.model.buildfarmjob import BuildFarmJob
+from lp.buildmaster.model.buildqueue import BuildQueue
+from lp.oci.interfaces.ocirecipe import (
+    DuplicateOCIRecipeName,
+    IOCIRecipe,
+    IOCIRecipeSet,
+    NoSourceForOCIRecipe,
+    NoSuchOCIRecipe,
+    OCIRecipeBuildAlreadyPending,
+    OCIRecipeNotOwner,
+    )
+from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuildSet
+from lp.oci.model.ocirecipebuild import OCIRecipeBuild
+from lp.services.database.constants import DEFAULT
+from lp.services.database.decoratedresultset import DecoratedResultSet
+from lp.services.database.interfaces import (
+    IMasterStore,
+    IStore,
+    )
+from lp.services.database.stormexpr import (
+    Greatest,
+    NullsLast,
+    )
+
+
+@implementer(IOCIRecipe)
+class OCIRecipe(Storm):
+
+    __storm_table__ = 'OCIRecipe'
+
+    id = Int(primary=True)
+    date_created = DateTime(
+        name="date_created", tzinfo=pytz.UTC, allow_none=False)
+    date_last_modified = DateTime(
+        name="date_last_modified", tzinfo=pytz.UTC, allow_none=False)
+
+    registrant_id = Int(name='registrant', allow_none=False)
+    registrant = Reference(registrant_id, "Person.id")
+
+    owner_id = Int(name='owner', allow_none=False)
+    owner = Reference(owner_id, 'Person.id')
+
+    oci_project_id = Int(name='oci_project', allow_none=False)
+    oci_project = Reference(oci_project_id, "OCIProject.id")
+
+    name = Unicode(name="name", allow_none=False)
+    description = Unicode(name="description")
+
+    official = Bool(name="official", default=False)
+
+    git_repository_id = Int(name="git_repository", allow_none=False)
+    git_repository = Reference(git_repository_id, "GitRepository.id")
+    git_path = Unicode(name="git_path", allow_none=False)
+    build_file = Unicode(name="build_file", allow_none=False)
+
+    require_virtualized = Bool(name="require_virtualized", default=True,
+                               allow_none=False)
+
+    build_daily = Bool(name="build_daily", default=False)
+
+    def __init__(self, name, registrant, owner, oci_project, git_ref,
+                 description=None, official=False, require_virtualized=True,
+                 build_file=None, date_created=DEFAULT):
+        super(OCIRecipe, self).__init__()
+        self.name = name
+        self.registrant = registrant
+        self.owner = owner
+        self.oci_project = oci_project
+        self.description = description
+        self.build_file = build_file
+        self.official = official
+        self.require_virtualized = require_virtualized
+        self.date_created = date_created
+        self.git_ref = git_ref
+
+    def destroySelf(self):
+        """See `IOCIRecipe`."""
+        # XXX twom 2019-11-26 This needs to expand as more build artifacts
+        # are added
+        store = IStore(OCIRecipe)
+        buildqueue_records = store.find(
+            BuildQueue,
+            BuildQueue._build_farm_job_id == OCIRecipeBuild.build_farm_job_id,
+            OCIRecipeBuild.recipe == self)
+        for buildqueue_record in buildqueue_records:
+            buildqueue_record.destroySelf()
+        build_farm_job_ids = list(store.find(
+            OCIRecipeBuild.build_farm_job_id, OCIRecipeBuild.recipe == self))
+        store.find(OCIRecipeBuild, OCIRecipeBuild.recipe == self).remove()
+        store.remove(self)
+        store.find(
+            BuildFarmJob, BuildFarmJob.id.is_in(build_farm_job_ids)).remove()
+
+    @property
+    def git_ref(self):
+        """See `IOCIRecipe`."""
+        if self.git_repository is not None:
+            return self.git_repository.getRefByPath(self.git_path)
+        return None
+
+    @git_ref.setter
+    def git_ref(self, value):
+        """See `IOCIRecipe`."""
+        if value is not None:
+            self.git_path = value.path
+            self.git_repository = value.repository
+        else:
+            self.git_repository = None
+            self.git_path = None
+
+    def _checkRequestBuild(self, requester):
+        if not requester.inTeam(self.owner):
+            raise OCIRecipeNotOwner(
+                "%s cannot create OCI image builds owned by %s." %
+                (requester.display_name, self.owner.display_name))
+
+    def requestBuild(self, requester, distro_arch_series):
+        self._checkRequestBuild(requester)
+
+        pending = IStore(self).find(
+            OCIRecipeBuild,
+            OCIRecipeBuild.recipe == self.id,
+            OCIRecipeBuild.processor == distro_arch_series.processor,
+            OCIRecipeBuild.status == BuildStatus.NEEDSBUILD)
+        if pending.any() is not None:
+            raise OCIRecipeBuildAlreadyPending
+
+        build = getUtility(IOCIRecipeBuildSet).new(
+            requester, self, distro_arch_series)
+        build.queueBuild()
+        notify(ObjectCreatedEvent(build, user=requester))
+        return build
+
+    @property
+    def _pending_states(self):
+        """All the build states we consider pending (non-final)."""
+        return [
+            BuildStatus.NEEDSBUILD,
+            BuildStatus.BUILDING,
+            BuildStatus.UPLOADING,
+            BuildStatus.CANCELLING,
+            ]
+
+    def _getBuilds(self, filter_term, order_by):
+        """The actual query to get the builds."""
+        query_args = [
+            OCIRecipeBuild.recipe == self,
+            ]
+        if filter_term is not None:
+            query_args.append(filter_term)
+        result = Store.of(self).find(OCIRecipeBuild, *query_args)
+        result.order_by(order_by)
+
+        def eager_load(rows):
+            getUtility(IOCIRecipeBuildSet).preloadBuildsData(rows)
+            getUtility(IBuildQueueSet).preloadForBuildFarmJobs(rows)
+
+        return DecoratedResultSet(result, pre_iter_hook=eager_load)
+
+    @property
+    def builds(self):
+        """See `IOCIRecipe`."""
+        order_by = (
+            NullsLast(Desc(Greatest(
+                OCIRecipeBuild.date_started,
+                OCIRecipeBuild.date_finished))),
+            Desc(OCIRecipeBuild.date_created),
+            Desc(OCIRecipeBuild.id))
+        return self._getBuilds(None, order_by)
+
+    @property
+    def completed_builds(self):
+        """See `IOCIRecipe`."""
+        filter_term = (Not(OCIRecipeBuild.status.is_in(self._pending_states)))
+        order_by = (
+            NullsLast(Desc(Greatest(
+                OCIRecipeBuild.date_started,
+                OCIRecipeBuild.date_finished))),
+            Desc(OCIRecipeBuild.id))
+        return self._getBuilds(filter_term, order_by)
+
+    @property
+    def pending_builds(self):
+        """See `IOCIRecipe`."""
+        filter_term = (OCIRecipeBuild.status.is_in(self._pending_states))
+        # We want to order by date_created but this is the same as ordering
+        # by id (since id increases monotonically) and is less expensive.
+        order_by = Desc(OCIRecipeBuild.id)
+        return self._getBuilds(filter_term, order_by)
+
+
+class OCIRecipeArch(Storm):
+    """Link table to back `OCIRecipe.processors`."""
+
+    __storm_table__ = "OCIRecipeArch"
+    __storm_primary__ = ("recipe_id", "processor_id")
+
+    recipe_id = Int(name="recipe", allow_none=False)
+    recipe = Reference(recipe_id, "OCIRecipe.id")
+
+    processor_id = Int(name="processor", allow_none=False)
+    processor = Reference(processor_id, "Processor.id")
+
+    def __init__(self, recipe, processor):
+        self.recipe = recipe
+        self.processor = processor
+
+
+@implementer(IOCIRecipeSet)
+class OCIRecipeSet:
+
+    def new(self, name, registrant, owner, oci_project, git_ref, build_file,
+            description=None, official=False, require_virtualized=True,
+            date_created=DEFAULT):
+        """See `IOCIRecipeSet`."""
+        if not registrant.inTeam(owner):
+            if owner.is_team:
+                raise OCIRecipeNotOwner(
+                    "%s is not a member of %s." %
+                    (registrant.displayname, owner.displayname))
+            else:
+                raise OCIRecipeNotOwner(
+                    "%s cannot create OCI images owned by %s." %
+                    (registrant.displayname, owner.displayname))
+
+        if not (git_ref and build_file):
+            raise NoSourceForOCIRecipe
+
+        if self.exists(owner, oci_project, name):
+            raise DuplicateOCIRecipeName
+
+        store = IMasterStore(OCIRecipe)
+        oci_recipe = OCIRecipe(
+            name, registrant, owner, oci_project, git_ref, description,
+            official, require_virtualized, build_file, date_created)
+        store.add(oci_recipe)
+
+        return oci_recipe
+
+    def _getByName(self, owner, oci_project, name):
+        return IStore(OCIRecipe).find(
+            OCIRecipe,
+            OCIRecipe.owner == owner,
+            OCIRecipe.name == name,
+            OCIRecipe.oci_project == oci_project).one()
+
+    def exists(self, owner, oci_project, name):
+        """See `IOCIRecipeSet`."""
+        return self._getByName(owner, oci_project, name) is not None
+
+    def getByName(self, owner, oci_project, name):
+        """See `IOCIRecipeSet`."""
+        oci_recipe = self._getByName(owner, oci_project, name)
+        if oci_recipe is None:
+            raise NoSuchOCIRecipe(name)
+        return oci_recipe
+
+    def findByOwner(self, owner):
+        """See `IOCIRecipe`."""
+        return IStore(OCIRecipe).find(OCIRecipe, OCIRecipe.owner == owner)
diff --git a/lib/lp/oci/model/ocirecipebuild.py b/lib/lp/oci/model/ocirecipebuild.py
new file mode 100644
index 0000000..d069800
--- /dev/null
+++ b/lib/lp/oci/model/ocirecipebuild.py
@@ -0,0 +1,194 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""A build record for OCI Recipes."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'OCIRecipeBuild',
+    'OCIRecipeBuildSet',
+    ]
+
+from datetime import timedelta
+
+import pytz
+from storm.locals import (
+    Bool,
+    DateTime,
+    Desc,
+    Int,
+    Reference,
+    Store,
+    Storm,
+    Unicode,
+    )
+from storm.store import EmptyResultSet
+from zope.component import getUtility
+from zope.interface import implementer
+
+from lp.buildmaster.enums import (
+    BuildFarmJobType,
+    BuildStatus,
+    )
+from lp.buildmaster.interfaces.buildfarmjob import IBuildFarmJobSource
+from lp.buildmaster.model.buildfarmjob import SpecificBuildFarmJobSourceMixin
+from lp.buildmaster.model.packagebuild import PackageBuildMixin
+from lp.oci.interfaces.ocirecipebuild import (
+    IOCIRecipeBuild,
+    IOCIRecipeBuildSet,
+    )
+from lp.services.database.constants import DEFAULT
+from lp.services.database.decoratedresultset import DecoratedResultSet
+from lp.services.database.enumcol import DBEnum
+from lp.services.database.interfaces import (
+    IMasterStore,
+    IStore,
+    )
+
+
+@implementer(IOCIRecipeBuild)
+class OCIRecipeBuild(PackageBuildMixin, Storm):
+
+    __storm_table__ = 'OCIRecipeBuild'
+
+    job_type = BuildFarmJobType.OCIRECIPEBUILD
+
+    id = Int(name='id', primary=True)
+
+    requester_id = Int(name='requester', allow_none=False)
+    requester = Reference(requester_id, 'Person.id')
+
+    recipe_id = Int(name='recipe', allow_none=False)
+    recipe = Reference(recipe_id, 'OCIRecipe.id')
+
+    processor_id = Int(name='processor', allow_none=False)
+    processor = Reference(processor_id, 'Processor.id')
+
+    virtualized = Bool(name='virtualized')
+
+    date_created = DateTime(
+        name='date_created', tzinfo=pytz.UTC, allow_none=False)
+    date_started = DateTime(name='date_started', tzinfo=pytz.UTC)
+    date_finished = DateTime(name='date_finished', tzinfo=pytz.UTC)
+    date_first_dispatched = DateTime(
+        name='date_first_dispatched', tzinfo=pytz.UTC)
+
+    builder_id = Int(name='builder')
+    builder = Reference(builder_id, 'Builder.id')
+
+    status = DBEnum(name='status', enum=BuildStatus, allow_none=False)
+
+    log_id = Int(name='log')
+    log = Reference(log_id, 'LibraryFileAlias.id')
+
+    upload_log_id = Int(name='upload_log')
+    upload_log = Reference(upload_log_id, 'LibraryFileAlias.id')
+
+    dependencies = Unicode(name='dependencies')
+
+    failure_count = Int(name='failure_count', allow_none=False)
+
+    build_farm_job_id = Int(name='build_farm_job', allow_none=False)
+    build_farm_job = Reference(build_farm_job_id, 'BuildFarmJob.id')
+
+    def __init__(self, build_farm_job, requester, recipe,
+                 processor, virtualized, date_created):
+
+        self.requester = requester
+        self.recipe = recipe
+        self.processor = processor
+        self.virtualized = virtualized
+        self.date_created = date_created
+        self.status = BuildStatus.NEEDSBUILD
+        self.build_farm_job = build_farm_job
+
+    def calculateScore(self):
+        # XXX twom 2020-02-11 - This might need an addition?
+        return 2510
+
+    def estimateDuration(self):
+        """See `IBuildFarmJob`."""
+        median = self.getMedianBuildDuration()
+        if median is not None:
+            return median
+        return timedelta(minutes=30)
+
+    def getMedianBuildDuration(self):
+        """Return the median duration of our successful builds."""
+        store = IStore(self)
+        result = store.find(
+            (OCIRecipeBuild.date_started, OCIRecipeBuild.date_finished),
+            OCIRecipeBuild.recipe == self.recipe_id,
+            OCIRecipeBuild.processor == self.processor_id,
+            OCIRecipeBuild.status == BuildStatus.FULLYBUILT)
+        result.order_by(Desc(OCIRecipeBuild.date_finished))
+        durations = [row[1] - row[0] for row in result[:9]]
+        if len(durations) == 0:
+            return None
+        durations.sort()
+        return durations[len(durations) // 2]
+
+    @property
+    def archive(self):
+        # XXX twom 2019-12-05 This may need to change when an OCIProject
+        # pillar isn't just a distribution
+        return self.recipe.oci_project.distribution.main_archive
+
+    @property
+    def distribution(self):
+        # XXX twom 2019-12-05 This may need to change when an OCIProject
+        # pillar isn't just a distribution
+        return self.recipe.oci_project.distribution
+
+    # Stub attributes to match the IPackageBuild interface that we
+    # will not use in this implementation.
+    pocket = None
+    distro_series = None
+
+
+@implementer(IOCIRecipeBuildSet)
+class OCIRecipeBuildSet(SpecificBuildFarmJobSourceMixin):
+    """See `IOCIRecipeBuildSet`."""
+
+    def new(self, requester, recipe, distro_arch_series,
+            date_created=DEFAULT):
+        """See `IOCIRecipeBuildSet`."""
+
+        virtualized = (
+            not distro_arch_series.processor.supports_nonvirtualized
+            or recipe.require_virtualized)
+
+        store = IMasterStore(OCIRecipeBuild)
+        build_farm_job = getUtility(IBuildFarmJobSource).new(
+            OCIRecipeBuild.job_type, BuildStatus.NEEDSBUILD, date_created)
+        ocirecipebuild = OCIRecipeBuild(
+            build_farm_job, requester, recipe, distro_arch_series.processor,
+            virtualized, date_created)
+        store.add(ocirecipebuild)
+        return ocirecipebuild
+
+    def preloadBuildsData(self, builds):
+        """See `IOCIRecipeBuildSet`."""
+        # XXX twom 2019-12-02 Currently a no-op skeleton, to be filled in
+        return
+
+    def getByID(self, build_id):
+        """See `ISpecificBuildFarmJobSource`."""
+        store = IMasterStore(OCIRecipeBuild)
+        return store.get(OCIRecipeBuild, build_id)
+
+    def getByBuildFarmJob(self, build_farm_job):
+        """See `ISpecificBuildFarmJobSource`."""
+        return Store.of(build_farm_job).find(
+            OCIRecipeBuild, build_farm_job_id=build_farm_job.id).one()
+
+    def getByBuildFarmJobs(self, build_farm_jobs):
+        """See `ISpecificBuildFarmJobSource`."""
+        if len(build_farm_jobs) == 0:
+            return EmptyResultSet()
+        rows = Store.of(build_farm_jobs[0]).find(
+            OCIRecipeBuild, OCIRecipeBuild.build_farm_job_id.is_in(
+                bfj.id for bfj in build_farm_jobs))
+        return DecoratedResultSet(rows, pre_iter_hook=self.preloadBuildsData)
diff --git a/lib/lp/oci/tests/__init__.py b/lib/lp/oci/tests/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/lib/lp/oci/tests/__init__.py
diff --git a/lib/lp/oci/tests/test_ocirecipe.py b/lib/lp/oci/tests/test_ocirecipe.py
new file mode 100644
index 0000000..db71400
--- /dev/null
+++ b/lib/lp/oci/tests/test_ocirecipe.py
@@ -0,0 +1,208 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Tests for OCI image building recipe functionality."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from zope.component import getUtility
+from zope.security.proxy import removeSecurityProxy
+
+from lp.buildmaster.enums import BuildStatus
+from lp.oci.interfaces.ocirecipe import (
+    DuplicateOCIRecipeName,
+    IOCIRecipe,
+    IOCIRecipeSet,
+    NoSourceForOCIRecipe,
+    NoSuchOCIRecipe,
+    OCIRecipeBuildAlreadyPending,
+    OCIRecipeNotOwner,
+    )
+from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuildSet
+from lp.testing import (
+    admin_logged_in,
+    person_logged_in,
+    TestCaseWithFactory,
+    )
+from lp.testing.layers import DatabaseFunctionalLayer
+
+
+class TestOCIRecipe(TestCaseWithFactory):
+
+    layer = DatabaseFunctionalLayer
+
+    def test_implements_interface(self):
+        target = self.factory.makeOCIRecipe()
+        with admin_logged_in():
+            self.assertProvides(target, IOCIRecipe)
+
+    def test_checkRequestBuild(self):
+        ocirecipe = removeSecurityProxy(self.factory.makeOCIRecipe())
+        unrelated_person = self.factory.makePerson()
+        self.assertRaises(
+            OCIRecipeNotOwner,
+            ocirecipe._checkRequestBuild,
+            unrelated_person)
+
+    def test_requestBuild(self):
+        ocirecipe = self.factory.makeOCIRecipe()
+        oci_arch = self.factory.makeOCIRecipeArch(recipe=ocirecipe)
+        build = ocirecipe.requestBuild(ocirecipe.owner, oci_arch)
+        self.assertEqual(build.status, BuildStatus.NEEDSBUILD)
+
+    def test_requestBuild_already_exists(self):
+        ocirecipe = self.factory.makeOCIRecipe()
+        oci_arch = self.factory.makeOCIRecipeArch(recipe=ocirecipe)
+        ocirecipe.requestBuild(ocirecipe.owner, oci_arch)
+
+        self.assertRaises(
+            OCIRecipeBuildAlreadyPending,
+            ocirecipe.requestBuild,
+            ocirecipe.owner, oci_arch)
+
+    def test_destroySelf(self):
+        oci_recipe = self.factory.makeOCIRecipe()
+        build_ids = []
+        for x in range(3):
+            build_ids.append(
+                self.factory.makeOCIRecipeBuild(recipe=oci_recipe).id)
+
+        with person_logged_in(oci_recipe.owner):
+            oci_recipe.destroySelf()
+
+        for build_id in build_ids:
+            self.assertIsNone(getUtility(IOCIRecipeBuildSet).getByID(build_id))
+
+    def test_getBuilds(self):
+        # Test the various getBuilds methods.
+        oci_recipe = self.factory.makeOCIRecipe()
+        builds = [self.factory.makeOCIRecipeBuild(recipe=oci_recipe)
+                  for x in range(3)]
+        # We want the latest builds first.
+        builds.reverse()
+
+        self.assertEqual(builds, list(oci_recipe.builds))
+        self.assertEqual([], list(oci_recipe.completed_builds))
+        self.assertEqual(builds, list(oci_recipe.pending_builds))
+
+        # Change the status of one of the builds and retest.
+        builds[0].updateStatus(BuildStatus.BUILDING)
+        builds[0].updateStatus(BuildStatus.FULLYBUILT)
+        self.assertEqual(builds, list(oci_recipe.builds))
+        self.assertEqual(builds[:1], list(oci_recipe.completed_builds))
+        self.assertEqual(builds[1:], list(oci_recipe.pending_builds))
+
+    def test_getBuilds_cancelled_never_started_last(self):
+        # A cancelled build that was never even started sorts to the end.
+        oci_recipe = self.factory.makeOCIRecipe()
+        fullybuilt = self.factory.makeOCIRecipeBuild(recipe=oci_recipe)
+        instacancelled = self.factory.makeOCIRecipeBuild(recipe=oci_recipe)
+        fullybuilt.updateStatus(BuildStatus.BUILDING)
+        fullybuilt.updateStatus(BuildStatus.FULLYBUILT)
+        instacancelled.updateStatus(BuildStatus.CANCELLED)
+        self.assertEqual([fullybuilt, instacancelled], list(oci_recipe.builds))
+        self.assertEqual(
+            [fullybuilt, instacancelled], list(oci_recipe.completed_builds))
+        self.assertEqual([], list(oci_recipe.pending_builds))
+
+
+class TestOCIRecipeSet(TestCaseWithFactory):
+
+    layer = DatabaseFunctionalLayer
+
+    def test_implements_interface(self):
+        target_set = getUtility(IOCIRecipeSet)
+        with admin_logged_in():
+            self.assertProvides(target_set, IOCIRecipeSet)
+
+    def test_new(self):
+        registrant = self.factory.makePerson()
+        owner = self.factory.makeTeam(members=[registrant])
+        oci_project = self.factory.makeOCIProject()
+        [git_ref] = self.factory.makeGitRefs()
+        target = getUtility(IOCIRecipeSet).new(
+            name='a name',
+            registrant=registrant,
+            owner=owner,
+            oci_project=oci_project,
+            git_ref=git_ref,
+            description='a description',
+            official=False,
+            require_virtualized=False,
+            build_file='build file')
+        self.assertEqual(target.registrant, registrant)
+        self.assertEqual(target.owner, owner)
+        self.assertEqual(target.oci_project, oci_project)
+        self.assertEqual(target.official, False)
+        self.assertEqual(target.require_virtualized, False)
+        self.assertEqual(target.git_ref, git_ref)
+
+    def test_already_exists(self):
+        owner = self.factory.makePerson()
+        oci_project = self.factory.makeOCIProject()
+        self.factory.makeOCIRecipe(
+            owner=owner, registrant=owner, name="already exists",
+            oci_project=oci_project)
+
+        self.assertRaises(
+            DuplicateOCIRecipeName,
+            self.factory.makeOCIRecipe,
+            owner=owner,
+            registrant=owner,
+            name="already exists",
+            oci_project=oci_project)
+
+    def test_no_source_git_ref(self):
+        owner = self.factory.makePerson()
+        oci_project = self.factory.makeOCIProject()
+        recipe_set = getUtility(IOCIRecipeSet)
+        self.assertRaises(
+            NoSourceForOCIRecipe,
+            recipe_set.new,
+            name="no source",
+            registrant=owner,
+            owner=owner,
+            oci_project=oci_project,
+            git_ref=None,
+            build_file='build_file')
+
+    def test_no_source_build_file(self):
+        owner = self.factory.makePerson()
+        oci_project = self.factory.makeOCIProject()
+        recipe_set = getUtility(IOCIRecipeSet)
+        [git_ref] = self.factory.makeGitRefs()
+        self.assertRaises(
+            NoSourceForOCIRecipe,
+            recipe_set.new,
+            name="no source",
+            registrant=owner,
+            owner=owner,
+            oci_project=oci_project,
+            git_ref=git_ref,
+            build_file=None)
+
+    def test_getByName(self):
+        owner = self.factory.makePerson()
+        name = "a test recipe"
+        oci_project = self.factory.makeOCIProject()
+        target = self.factory.makeOCIRecipe(
+            owner=owner, registrant=owner, name=name, oci_project=oci_project)
+
+        for _ in range(3):
+            self.factory.makeOCIRecipe(oci_project=oci_project)
+
+        result = getUtility(IOCIRecipeSet).getByName(owner, oci_project, name)
+        self.assertEqual(target, result)
+
+    def test_getByName_missing(self):
+        owner = self.factory.makePerson()
+        oci_project = self.factory.makeOCIProject()
+        for _ in range(3):
+            self.factory.makeOCIRecipe(
+                owner=owner, registrant=owner, oci_project=oci_project)
+        self.assertRaises(
+            NoSuchOCIRecipe,
+            getUtility(IOCIRecipeSet).getByName,
+            owner=owner,
+            oci_project=oci_project,
+            name="missing")
diff --git a/lib/lp/registry/interfaces/ociprojectseries.py b/lib/lp/registry/interfaces/ociprojectseries.py
index 8ef9705..3019c22 100644
--- a/lib/lp/registry/interfaces/ociprojectseries.py
+++ b/lib/lp/registry/interfaces/ociprojectseries.py
@@ -34,7 +34,7 @@ class IOCIProjectSeriesView(Interface):
 
     id = Int(title=_("ID"), required=True, readonly=True)
 
-    ociproject = Reference(
+    oci_project = Reference(
         IOCIProject,
         title=_("The OCI project that this series belongs to."),
         required=True, readonly=True)
diff --git a/lib/lp/registry/model/ociproject.py b/lib/lp/registry/model/ociproject.py
index 7dcfdea..c13ee66 100644
--- a/lib/lp/registry/model/ociproject.py
+++ b/lib/lp/registry/model/ociproject.py
@@ -110,7 +110,7 @@ class OCIProject(BugTargetBase, StormBase):
                   status=SeriesStatus.DEVELOPMENT, date_created=DEFAULT):
         """See `IOCIProject`."""
         series = OCIProjectSeries(
-            ociproject=self,
+            oci_project=self,
             name=name,
             summary=summary,
             registrant=registrant,
@@ -123,7 +123,7 @@ class OCIProject(BugTargetBase, StormBase):
         """See `IOCIProject`."""
         ret = IStore(OCIProjectSeries).find(
             OCIProjectSeries,
-            OCIProjectSeries.ociproject == self
+            OCIProjectSeries.oci_project == self
             ).order_by(OCIProjectSeries.date_created)
         return ret
 
diff --git a/lib/lp/registry/model/ociprojectseries.py b/lib/lp/registry/model/ociprojectseries.py
index 04a81e9..31ccac3 100644
--- a/lib/lp/registry/model/ociprojectseries.py
+++ b/lib/lp/registry/model/ociprojectseries.py
@@ -36,8 +36,8 @@ class OCIProjectSeries(StormBase):
 
     id = Int(primary=True)
 
-    ociproject_id = Int(name='ociproject', allow_none=False)
-    ociproject = Reference(ociproject_id, "OCIProject.id")
+    oci_project_id = Int(name='ociproject', allow_none=False)
+    oci_project = Reference(oci_project_id, "OCIProject.id")
 
     name = Unicode(name="name", allow_none=False)
 
@@ -52,13 +52,13 @@ class OCIProjectSeries(StormBase):
     status = DBEnum(
         name='status', allow_none=False, enum=SeriesStatus)
 
-    def __init__(self, ociproject, name, summary,
+    def __init__(self, oci_project, name, summary,
                  registrant, status, date_created=DEFAULT):
         if not valid_name(name):
             raise InvalidName(
                 "%s is not a valid name for an OCI project series." % name)
         self.name = name
-        self.ociproject = ociproject
+        self.oci_project = oci_project
         self.summary = summary
         self.registrant = registrant
         self.status = status
diff --git a/lib/lp/registry/personmerge.py b/lib/lp/registry/personmerge.py
index 323dc2e..e71d5ff 100644
--- a/lib/lp/registry/personmerge.py
+++ b/lib/lp/registry/personmerge.py
@@ -15,6 +15,7 @@ from lp.code.interfaces.branchcollection import (
     IBranchCollection,
     )
 from lp.code.interfaces.gitcollection import IGitCollection
+from lp.oci.interfaces.ocirecipe import IOCIRecipeSet
 from lp.registry.interfaces.mailinglist import (
     IMailingListSet,
     MailingListStatus,
@@ -671,6 +672,24 @@ def _mergeSnap(cur, from_person, to_person):
         IStore(snaps[0]).flush()
 
 
+def _mergeOCIRecipe(cur, from_person, to_person):
+    # This shouldn't use removeSecurityProxy
+    oci_recipes = getUtility(IOCIRecipeSet).findByOwner(from_person)
+    existing_names = [
+        r.name for r in getUtility(IOCIRecipeSet).findByOwner(to_person)]
+    for recipe in oci_recipes:
+        new_name = recipe.name
+        count = 1
+        while new_name in existing_names:
+            new_name = '%s-%s' % (recipe.name, count)
+            count += 1
+        naked_recipe = removeSecurityProxy(recipe)
+        naked_recipe.owner = to_person
+        naked_recipe.name = new_name
+    if not oci_recipes.is_empty():
+        IStore(oci_recipes[0]).flush()
+
+
 def _purgeUnmergableTeamArtifacts(from_team, to_team, reviewer):
     """Purge team artifacts that cannot be merged, but can be removed."""
     # A team cannot have more than one mailing list.
@@ -898,6 +917,9 @@ def merge_people(from_person, to_person, reviewer, delete=False):
     _mergeSnap(cur, from_person, to_person)
     skip.append(('snap', 'owner'))
 
+    _mergeOCIRecipe(cur, from_person, to_person)
+    skip.append(('ocirecipe', 'owner'))
+
     # Sanity check. If we have a reference that participates in a
     # UNIQUE index, it must have already been handled by this point.
     # We can tell this by looking at the skip list.
diff --git a/lib/lp/registry/tests/test_ociprojectseries.py b/lib/lp/registry/tests/test_ociprojectseries.py
index 3d4e6cf..f3da75c 100644
--- a/lib/lp/registry/tests/test_ociprojectseries.py
+++ b/lib/lp/registry/tests/test_ociprojectseries.py
@@ -48,7 +48,7 @@ class TestOCIProjectSeries(TestCaseWithFactory):
             oci_project, name, summary, registrant, status, date_created)
         self.assertThat(
             project_series, MatchesStructure.byEquality(
-                ociproject=project_series.ociproject,
+                oci_project=project_series.oci_project,
                 name=project_series.name,
                 summary=project_series.summary,
                 registrant=project_series.registrant,
diff --git a/lib/lp/registry/tests/test_personmerge.py b/lib/lp/registry/tests/test_personmerge.py
index 5a6a78f..890b421 100644
--- a/lib/lp/registry/tests/test_personmerge.py
+++ b/lib/lp/registry/tests/test_personmerge.py
@@ -18,6 +18,7 @@ from zope.security.proxy import removeSecurityProxy
 from lp.app.enums import InformationType
 from lp.app.interfaces.launchpad import ILaunchpadCelebrities
 from lp.code.interfaces.gitrepository import IGitRepositorySet
+from lp.oci.interfaces.ocirecipe import IOCIRecipeSet
 from lp.registry.interfaces.accesspolicy import (
     IAccessArtifactGrantSource,
     IAccessPolicyGrantSource,
@@ -660,6 +661,45 @@ class TestMergePeople(TestCaseWithFactory, KarmaTestMixin):
         self.assertIsNone(snaps[1].git_path)
         self.assertEqual(u'foo-1', snaps[1].name)
 
+    def test_merge_moves_oci_recipes(self):
+        # When person/teams are merged, oci recipes owned by the from
+        # person are moved.
+        duplicate = self.factory.makePerson()
+        mergee = self.factory.makePerson()
+        self.factory.makeOCIRecipe(registrant=duplicate, owner=duplicate)
+        self._do_premerge(duplicate, mergee)
+        login_person(mergee)
+        duplicate, mergee = self._do_merge(duplicate, mergee)
+        self.assertEqual(
+            1, getUtility(IOCIRecipeSet).findByOwner(mergee).count())
+
+    def test_merge_with_duplicated_oci_recipes(self):
+        # If both the from and to people have oci recipes with the same
+        # name, merging renames the duplicate from the from person's side.
+        duplicate = self.factory.makePerson()
+        mergee = self.factory.makePerson()
+        [ref] = self.factory.makeGitRefs()
+        [ref2] = self.factory.makeGitRefs()
+        self.factory.makeOCIRecipe(
+            registrant=duplicate, owner=duplicate, name=u'foo', git_ref=ref)
+        self.factory.makeOCIRecipe(
+            registrant=mergee, owner=mergee, name=u'foo', git_ref=ref2)
+        self._do_premerge(duplicate, mergee)
+        login_person(mergee)
+        duplicate, mergee = self._do_merge(duplicate, mergee)
+        oci_recipes = sorted(
+            getUtility(IOCIRecipeSet).findByOwner(mergee),
+            key=attrgetter("name"))
+        self.assertEqual(2, len(oci_recipes))
+        self.assertEqual(ref2, oci_recipes[0].git_ref)
+        self.assertEqual(ref2.repository, oci_recipes[0].git_repository)
+        self.assertEqual(ref2.path, oci_recipes[0].git_path)
+        self.assertEqual(u'foo', oci_recipes[0].name)
+        self.assertEqual(ref, oci_recipes[1].git_ref)
+        self.assertEqual(ref.repository, oci_recipes[1].git_repository)
+        self.assertEqual(ref.path, oci_recipes[1].git_path)
+        self.assertEqual(u'foo-1', oci_recipes[1].name)
+
 
 class TestMergeMailingListSubscriptions(TestCaseWithFactory):
 
diff --git a/lib/lp/security.py b/lib/lp/security.py
index c2d45ac..e31c65c 100644
--- a/lib/lp/security.py
+++ b/lib/lp/security.py
@@ -112,6 +112,8 @@ from lp.hardwaredb.interfaces.hwdb import (
     IHWSubmissionDevice,
     IHWVendorID,
     )
+from lp.oci.interfaces.ocirecipe import IOCIRecipe
+from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuild
 from lp.registry.enums import PersonVisibility
 from lp.registry.interfaces.announcement import IAnnouncement
 from lp.registry.interfaces.distribution import IDistribution
@@ -3469,4 +3471,42 @@ class EditOCIProjectSeries(AuthorizationBase):
     def checkAuthenticated(self, user):
         """Maintainers, drivers, and admins can drive projects."""
         return (user.in_admin or
-                user.isDriver(self.obj.ociproject.pillar))
+                user.isDriver(self.obj.oci_project.pillar))
+
+
+class ViewOCIRecipe(AnonymousAuthorization):
+    """Anyone can view an `IOCIRecipe`."""
+    usedfor = IOCIRecipe
+
+
+class EditOCIRecipe(AuthorizationBase):
+    permission = 'launchpad.Edit'
+    usedfor = IOCIRecipe
+
+    def checkAuthenticated(self, user):
+        return (
+            user.isOwner(self.obj) or
+            user.in_commercial_admin or user.in_admin)
+
+
+class AdminOCIRecipe(AuthorizationBase):
+    """Restrict changing build settings on OCI recipes.
+
+    The security of the non-virtualised build farm depends on these
+    settings, so they can only be changed by "PPA"/commercial admins, or by
+    "PPA" self admins on OCI recipes that they can already edit.
+    """
+    permission = 'launchpad.Admin'
+    usedfor = IOCIRecipe
+
+    def checkAuthenticated(self, user):
+        if user.in_ppa_admin or user.in_commercial_admin or user.in_admin:
+            return True
+        return (
+            user.in_ppa_self_admins
+            and EditSnap(self.obj).checkAuthenticated(user))
+
+
+class ViewOCIRecipeBuild(AnonymousAuthorization):
+    """Anyone can view an `IOCIRecipe`."""
+    usedfor = IOCIRecipeBuild
diff --git a/lib/lp/testing/factory.py b/lib/lp/testing/factory.py
index 4009403..d0ecd18 100644
--- a/lib/lp/testing/factory.py
+++ b/lib/lp/testing/factory.py
@@ -157,6 +157,9 @@ from lp.hardwaredb.interfaces.hwdb import (
     IHWSubmissionDeviceSet,
     IHWSubmissionSet,
     )
+from lp.oci.interfaces.ocirecipe import IOCIRecipeSet
+from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuildSet
+from lp.oci.model.ocirecipe import OCIRecipeArch
 from lp.registry.enums import (
     BranchSharingPolicy,
     BugSharingPolicy,
@@ -4936,6 +4939,58 @@ class BareLaunchpadObjectFactory(ObjectFactory):
             oci_project = self.makeOCIProject(**kwargs)
         return oci_project.newSeries(name, summary, registrant)
 
+    def makeOCIRecipe(self, name=None, registrant=None, owner=None,
+                      oci_project=None, git_ref=None, description=None,
+                      official=False, require_virtualized=True,
+                      build_file=None, date_created=DEFAULT):
+        """Make a new OCIRecipe."""
+        if name is None:
+            name = self.getUniqueString(u"oci-recipe-name")
+        if registrant is None:
+            registrant = self.makePerson()
+        if description is None:
+            description = self.getUniqueString(u"oci-recipe-description")
+        if owner is None:
+            owner = self.makeTeam(members=[registrant])
+        if oci_project is None:
+            oci_project = self.makeOCIProject()
+        if git_ref is None:
+            [git_ref] = self.makeGitRefs()
+        if build_file is None:
+            build_file = self.getUniqueUnicode(u"build_file_for")
+        return getUtility(IOCIRecipeSet).new(
+            name=name,
+            registrant=registrant,
+            owner=owner,
+            oci_project=oci_project,
+            git_ref=git_ref,
+            build_file=build_file,
+            description=description,
+            official=official,
+            require_virtualized=require_virtualized,
+            date_created=date_created)
+
+    def makeOCIRecipeArch(self, recipe=None, processor=None):
+        """Make a new OCIRecipeArch."""
+        if recipe is None:
+            recipe = self.makeOCIRecipe()
+        if processor is None:
+            processor = self.makeProcessor()
+        return OCIRecipeArch(recipe, processor)
+
+    def makeOCIRecipeBuild(self, requester=None, recipe=None,
+                           distro_arch_series=None, date_created=DEFAULT):
+        """Make a new OCIRecipeBuild."""
+        if requester is None:
+            requester = self.makePerson()
+        if distro_arch_series is None:
+            distro_arch_series = self.makeDistroArchSeries()
+        if recipe is None:
+            recipe = self.makeOCIRecipe()
+
+        return getUtility(IOCIRecipeBuildSet).new(
+            requester, recipe, distro_arch_series, date_created)
+
 
 # Some factory methods return simple Python types. We don't add
 # security wrappers for them, as well as for objects created by