From 9ef613b156ee3ef79e73fdb0835b5ad5020d0a1a Mon Sep 17 00:00:00 2001 From: Diego Herrera Date: Nov 23 2024 04:40:54 +0000 Subject: [PATCH 1/3] Add repo check to ACL tests Signed-off-by: Diego Herrera --- diff --git a/pagure_distgit_tests/test_dist_git_auth.py b/pagure_distgit_tests/test_dist_git_auth.py index 1fd5381..c380027 100644 --- a/pagure_distgit_tests/test_dist_git_auth.py +++ b/pagure_distgit_tests/test_dist_git_auth.py @@ -401,9 +401,9 @@ class DistGitAuthTestsFedora(DistGitAuthTests): "PR_ONLY": False, "ACL_BLOCK_UNSPECIFIED": False, "BLACKLIST_RES": ["refs/heads/c[0-9]+.*"], - "UNSPECIFIED_BLACKLIST_RES": ["refs/heads/f[0-9]+"], + "UNSPECIFIED_BLACKLIST_RES": ["refs/heads/f[0-9]+", "refs/heads/epel[0-9]+"], "RCM_GROUP": "relenggroup", - "RCM_BRANCHES": ["refs/heads/f[0-9]+"], + "RCM_BRANCHES": ["refs/heads/f[0-9]+", "refs/heads/epel[0-9]+"], "ACL_PROTECTED_NAMESPACES": ["rpms", "modules", "container"], "PDC_URL": "invalid://", "BODHI_URL": "invalid://", @@ -505,6 +505,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests): @patch("dist_git_auth.requests") def test_protected_supported_branch_committer(self, mock_requests): + repodir = os.path.join(self.path, "repos") + repos = tests.create_projects_git(repodir, bare=True) + tests.add_content_git_repo(repos[0], branch="f39") + repodir = os.path.join(self.path, "repos", "test.git") project = self.create_namespaced_project("rpms", "test") res = Mock() res.ok = True @@ -544,7 +548,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests): username="pingou", refname="refs/heads/f39", pull_request=None, - repodir=None, + repodir=repodir, repotype="main", revfrom=None, revto=None, @@ -557,6 +561,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests): @patch("dist_git_auth.requests") def test_protected_supported_branch_non_committer(self, mock_requests): project = self.create_namespaced_project("rpms", "test") + repodir = os.path.join(self.path, "repos") + repos = tests.create_projects_git(repodir, bare=True) + tests.add_content_git_repo(repos[0], branch="f39") + repodir = os.path.join(self.path, "repos", "test.git") res = Mock() res.ok = True res.json.return_value = { @@ -595,7 +603,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests): username="foo", refname="refs/heads/f39", pull_request=None, - repodir=None, + repodir=repodir, repotype="main", revfrom=None, revto=None, @@ -608,6 +616,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests): @patch("dist_git_auth.requests") def test_protected_supported_branch_epel_minor(self, mock_requests): project = self.create_namespaced_project("rpms", "test") + repodir = os.path.join(self.path, "repos") + repos = tests.create_projects_git(repodir, bare=True) + tests.add_content_git_repo(repos[0], branch="epel10.1") + repodir = os.path.join(self.path, "repos", "test.git") res = Mock() res.ok = True res.json.return_value = { @@ -646,7 +658,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests): username="foo", refname="refs/heads/epel10.1", pull_request=None, - repodir=None, + repodir=repodir, repotype="main", revfrom=None, revto=None, @@ -659,6 +671,10 @@ class DistGitAuthTestsFedora(DistGitAuthTests): @patch("dist_git_auth.requests") def test_protected_supported_branch_epel(self, mock_requests): project = self.create_namespaced_project("rpms", "test") + repodir = os.path.join(self.path, "repos") + repos = tests.create_projects_git(repodir, bare=True) + tests.add_content_git_repo(repos[0], branch="epel10") + repodir = os.path.join(self.path, "repos", "test.git") res = Mock() res.ok = True res.json.return_value = { @@ -697,7 +713,7 @@ class DistGitAuthTestsFedora(DistGitAuthTests): username="foo", refname="refs/heads/epel10", pull_request=None, - repodir=None, + repodir=repodir, repotype="main", revfrom=None, revto=None, From fa45f63d85b6748af33b60d72459d83d255654c6 Mon Sep 17 00:00:00 2001 From: Diego Herrera Date: Nov 23 2024 04:45:06 +0000 Subject: [PATCH 2/3] Add test case for restricting users creating branches for unspecified blacklisted names Signed-off-by: Diego Herrera --- diff --git a/pagure_distgit_tests/test_dist_git_auth.py b/pagure_distgit_tests/test_dist_git_auth.py index c380027..6f3b47a 100644 --- a/pagure_distgit_tests/test_dist_git_auth.py +++ b/pagure_distgit_tests/test_dist_git_auth.py @@ -751,6 +751,114 @@ class DistGitAuthTestsFedora(DistGitAuthTests): self.expect_info_msg("Unspecified ref refs/heads/f28 is blocked") + @patch("dist_git_auth.requests") + def test_protected_create_unspecified_blacklisted_branch_fail(self, mock_requests): + project = self.create_namespaced_project("rpms", "test") + repodir = os.path.join(self.path, "repos") + repos = tests.create_projects_git(repodir, bare=True) + repodir = os.path.join(self.path, "repos", "test.git") + res = Mock() + res.ok = True + res.json.return_value = { + "pages": 1, + "releases": [ + { + "name": "EPEL-10.0", + "long_name": "Fedora EPEL 10.0", + "version": "10.0", + "id_prefix": "FEDORA-EPEL", + "branch": "epel10", + "dist_tag": "epel10.0", + "stable_tag": "epel10.0", + "testing_tag": "epel10.0-testing", + "candidate_tag": "epel10.0-testing-candidate", + "pending_signing_tag": "epel10.0-signing-pending", + "pending_testing_tag": "epel10.0-testing-pending", + "pending_stable_tag": "epel10.0-pending", + "override_tag": "epel10.0-override", + "mail_template": "fedora_epel_legacy_errata_template", + "state": "current", + "composed_by_bodhi": True, + "create_automatic_updates": False, + "package_manager": "unspecified", + "testing_repository": None, + "eol": None, + }, + ], + } + + mock_requests.get.return_value = res + + self.assertFalse( + self.dga.check_acl( + self.session, + project=project, + username="pingou", + refname="refs/heads/epel10", + pull_request=None, + repodir=repodir, + repotype="main", + revfrom=None, + revto=None, + is_internal=False, + ) + ) + + self.expect_info_msg("Unspecified ref refs/heads/epel10 is blocked") + + @patch("dist_git_auth.requests") + def test_protected_create_unspecified_blacklisted_branch_success(self, mock_requests): + project = self.create_namespaced_project("rpms", "test") + repodir = os.path.join(self.path, "repos") + repos = tests.create_projects_git(repodir, bare=True) + repodir = os.path.join(self.path, "repos", "test.git") + res = Mock() + res.ok = True + res.json.return_value = { + "pages": 1, + "releases": [ + { + "name": "EPEL-10.0", + "long_name": "Fedora EPEL 10.0", + "version": "10.0", + "id_prefix": "FEDORA-EPEL", + "branch": "epel10", + "dist_tag": "epel10.0", + "stable_tag": "epel10.0", + "testing_tag": "epel10.0-testing", + "candidate_tag": "epel10.0-testing-candidate", + "pending_signing_tag": "epel10.0-signing-pending", + "pending_testing_tag": "epel10.0-testing-pending", + "pending_stable_tag": "epel10.0-pending", + "override_tag": "epel10.0-override", + "mail_template": "fedora_epel_legacy_errata_template", + "state": "current", + "composed_by_bodhi": True, + "create_automatic_updates": False, + "package_manager": "unspecified", + "testing_repository": None, + "eol": None, + }, + ], + } + + mock_requests.get.return_value = res + + self.assertTrue( + self.dga.check_acl( + self.session, + project=project, + username="releng", + refname="refs/heads/epel10", + pull_request=None, + repodir=repodir, + repotype="main", + revfrom=None, + revto=None, + is_internal=False, + ) + ) + def test_is_not_retired_package(self): projects = tests.create_projects_git(os.path.join(self.path, "repos"), bare=True) tests.add_content_git_repo(projects[0]) From 56515d7ba6a1763ba0dd1be6e68d18eb66158572 Mon Sep 17 00:00:00 2001 From: Diego Herrera Date: Nov 23 2024 04:49:11 +0000 Subject: [PATCH 3/3] Restricting users creating branches for unspecified blacklisted names Signed-off-by: Diego Herrera --- diff --git a/dist_git_auth.py b/dist_git_auth.py index 546ee7f..9234fad 100644 --- a/dist_git_auth.py +++ b/dist_git_auth.py @@ -81,6 +81,11 @@ class DistGitAuth(GitAuthHelper): cmd = ["ls-tree", branch, "--name-only", "--", "dead.package"] return read_git_output(cmd, abspath) != "dead.package" + def branch_exists(self, branch, abspath): + """Returns if the branch is already created""" + cmd = ["show-ref", "refs/heads/" + branch] + return len(read_git_output(cmd, abspath)) > 0 + def is_supported_branch(self, project, refname, repodir): """Returns whether a specific branch is currently supported for Fedora @@ -135,6 +140,10 @@ class DistGitAuth(GitAuthHelper): else: return None + if not self.branch_exists(refname, repodir): + # If branch doesn't exist, return None + return None + # Branch can be supported, but package can be retired, # in that case don't push active = self.is_not_retired_package(refname, repodir)