Merge ~twom/launchpad:db-oci-policy-distribute-the-credentials into launchpad:db-devel

[Tom Wardill]

Add OCI Credentials field to Distribution

[Ioana Lasc (ilasc)]

LGTM

review: Approve

[William Grant (wgrant)]

Is there a spec for this? What does "in this distribution" mean, given that normal users can create recipes under a distribution's OCI projects?

review: Needs Information (db)

[Tom Wardill (twom)]

> Is there a spec for this? What does "in this distribution" mean, given that
> normal users can create recipes under a distribution's OCI projects?

This is the latest iteration of: https://docs.google.com/document/d/16iPKUri4hn3ezMm4Q5j27EwdZEqYnD3LJgsqJiqvhWo/edit

Creating OCI Projects within an Distribution is limited to the OCI Project Admins (or can be, via feature flag), so it's not open to everyone.

[Tom Wardill (twom)]

> > Is there a spec for this? What does "in this distribution" mean, given that
> > normal users can create recipes under a distribution's OCI projects?
>
> This is the latest iteration of: https://docs.google.com/document/d/16iPKUri4h
> n3ezMm4Q5j27EwdZEqYnD3LJgsqJiqvhWo/edit
>
> Creating OCI Projects within an Distribution is limited to the OCI Project
> Admins (or can be, via feature flag), so it's not open to everyone.

Replacing https://code.launchpad.net/~twom/launchpad/+git/launchpad/+merge/394958 in line with the direction of the spec.

[William Grant (wgrant)]

AIUI anyone can create an OCIRecipe inside an OCIProject, so isn't setting credentials on a whole OCIProject dangerous?

review: Needs Information (db)

[Tom Wardill (twom)]

Using the distribution credentials is limited to 'official' recipes (in https://code.launchpad.net/~twom/launchpad/+git/launchpad/+merge/395984).
Setting an official recipe requires `userIsRecipeAdmin`, which results in `pillar.canAdministrateOCIProjects`.

So a normal user can create a recipe, but that will be a 'build only' recipe and will not result in it being pushed to a registry.
Only a recipe being set to official will result in a push.

[William Grant (wgrant)]

review: Approve (db)

diff --git a/database/schema/patch-2210-24-0.sql b/database/schema/patch-2210-24-0.sql
new file mode 100644
index 0000000..833fa88
--- /dev/null
+++ b/database/schema/patch-2210-24-0.sql
@@ -0,0 +1,11 @@
+-- Copyright 2021 Canonical Ltd.  This software is licensed under the
+-- GNU Affero General Public License version 3 (see the file LICENSE).
+
+SET client_min_messages=ERROR;
+
+ALTER TABLE Distribution
+    ADD COLUMN oci_credentials INTEGER REFERENCES OCIRegistryCredentials;
+
+COMMENT ON COLUMN Distribution.oci_credentials IS 'Credentials and URL to use for uploading all OCI Images in this distribution to a registry.';
+
+INSERT INTO LaunchpadDatabaseRevision VALUES (2210, 24, 0);