Merge ubuntu-archive-tools:frozen-for-release into ubuntu-archive-tools:main

[Łukasz Zemczak]

Add means to define a stable series to be frozen and let sru-release disallow releasing packages for that series.

This is just a proposal. I thought about putting this into hints as this is basically how we currently do per-package migration hints. This approach depends on creating a file in the given series in the hints git repository. This should have no effect on anything else.

If the file is there (HEAD of git having it), then we consider the series frozen. We can then remove it when we're out of freeze.

[Łukasz Zemczak (sil2100)]

FYI: I did not test this, just a quick brain dump.

[Steve Beattie (sbeattie)]

FYI, the security team would like something generally queryable so that we also know not to publish security updates during a point release freeze. Our team's current publishing tool uses a lookup in launchpad that looks for milestones in the series to be published that are targeted in the net 7 days, but release team does not seem to use these consistently.

Whatever approach the archive and release teams decide here, please communicate that approach more broadly to the community, so that people outside those specific teams can rely on that as well.

Thanks.

[Steve Beattie (sbeattie)]

Sorry, mention to point to the existing code the security team's package publication tool uses: https://git.launchpad.net/ubuntu-qa-tools/tree/security-tools/unembargo#n118

[Robie Basak (racb)]

I think this would be fine in principle. A couple of things I'm unsure about:

1) It fails unsafe. If for example Launchpad has an issue that returns 500, then release will be permitted. Should we instead require positive confirmation that the series is not in freeze? Not being able to release if git.launchpad.net is unavailable doesn't seem too bad to me, especially because --override-freeze exists.

2) Is the britney hints directory the right place to do this? For now, doesn't britney consider all stable releases as inactive? It seems a bit strange to overload this, but I don't feel strongly about this.

But also, if this works, it's better than the current situation, so let's land it and fixes and improvements can come later.

[Robie Basak (racb)]

> If for example Launchpad has an issue that returns 500, then release will be permitted.

Ah I was just guessing. Maybe you'll get an exception instead? Then it's fine.

[Chris Halse Rogers (raof)]

This doesn't do what you think it does; urllib.request.urlopen will *throw an exception* on HTTP error; you only get a status object back if the HTTP call doesn't fail.

So, in its current state, this makes it so that sru-release will fail with an exception when the release is not frozen, and successfully warn you that the release is frozen when it *is* frozen ☺.

review: Needs Fixing

[Łukasz Zemczak (sil2100)]

Whoops, you're right! Thanks!

diff --git a/sru-release b/sru-release
index 5295372..6aaf962 100755
--- a/sru-release
+++ b/sru-release
@@ -37,6 +37,7 @@ import time
 import unittest
 
 from six.moves.urllib.request import urlopen
+from urllib.error import HTTPError
 from io import TextIOWrapper
 
 from launchpadlib.launchpad import Launchpad
@@ -65,6 +66,21 @@ MISSING_PACKAGES_FROM_GROUP = (
     "To ignore this message, pass '--skip-package-group-check'.")
 
 BZR_HINT_BRANCH = "lp:~ubuntu-sru/britney/hints-ubuntu-%s"
+POCKET_FREEZE_URL = "https://git.launchpad.net/~ubuntu-release/britney/+git/" \
+                    "hints-ubuntu/plain/sru-freeze?h=%s"
+
+
+def check_pocket_freeze(release):
+    """Check if the release is in a pocket freeze."""
+
+    try:
+        check = urlopen(POCKET_FREEZE_URL % release)
+        if check.getcode() == 200:
+            return True
+        else:
+            return False
+    except HTTPError:
+        return False
 
 
 def check_package_sets(packages):
@@ -444,6 +460,10 @@ if __name__ == '__main__':
         help=('Skip the package set checks that require some packages '
               'be released together'))
     parser.add_option(
+        '--override-freeze', action='store_true', default=False,
+        help='Override the freeze check and release package even if the '
+             'release is frozen')
+    parser.add_option(
         '--britney', action='store_true', default=False,
         help='Use britney for copying the packages over to -updates (only '
              'works for regular package releases into updates)')
@@ -483,6 +503,12 @@ if __name__ == '__main__':
             sys.stderr.write(e.args[0] + '\n')
             sys.exit(1)
 
+    if not options.override_freeze:
+        if check_pocket_freeze(release):
+            sys.stderr.write(
+                "Release %s is frozen, use --override-freeze to override\n" % release)
+            sys.exit(1)
+
     options.cache = os.path.expanduser(options.cache)
     if not os.path.isdir(options.cache):
         if os.path.exists(options.cache):