From ea36a088531b5662b91f73c7351f2de19499b616 Mon Sep 17 00:00:00 2001
From: Brian Stinson <bstinson@redhat.com>
Date: Jan 07 2024 21:45:29 +0000
Subject: Add a configuration option to define who can import RPM builds into koji


This allows us to expand an ownership check when signing modular content
tags to allow signing imported RPMs. This configuration option is
additive, any robosignatory sites out there without the config option it
defaults to the empty list.

Fixes: #59

Signed-off-by: Brian Stinson <bstinson@redhat.com>

---

diff --git a/robosignatory.toml b/robosignatory.toml
index 06063f9..da62899 100644
--- a/robosignatory.toml
+++ b/robosignatory.toml
@@ -94,6 +94,8 @@ handlers = ["console"]
         [consumer_config.koji_instances.primary]
         url = 'http://koji.fedoraproject.org/kojihub'
         mbs_user = 'mbs/mbs.example.com'
+        # Users that are allowed to import builds into your koji instance
+        build_import_users = ['my-import-user', 'kojiadmin']
 
             [consumer_config.koji_instances.primary.options]
             # Only ssl and kerberos are supported at the moment
diff --git a/robosignatory/tag.py b/robosignatory/tag.py
index 8fc1003..06fa77f 100644
--- a/robosignatory/tag.py
+++ b/robosignatory/tag.py
@@ -43,6 +43,10 @@ class TagSigner:
                             'tags': {}}
             if 'mbs_user' in instance_info:
                 instance_obj['mbs_user'] = instance_info['mbs_user']
+            if 'build_import_users' in instance_info:
+                instance_obj['build_import_users'] = instance_info['build_import_users']
+            else:
+                instance_obj['build_import_users'] = []
             for tag in instance_info['tags']:
                 if tag['from'] in instance_obj['tags']:
                     raise Exception('From detected twice: %s' % tag['from'])
@@ -258,9 +262,10 @@ class TagSigner:
         log.info('Content tag: %s', content_koji_tag)
         log.info('Signing all module content')
         for build in instance['client'].listTagged(content_koji_tag):
-            if build['owner_name'] != instance['mbs_user']:
+            if build['owner_name'] != instance['mbs_user'] and \
+                build['owner_name'] not in instance['build_import_users']:
                 log.error(
-                    'Build {build_id} has owner {owner_name}, which is NOT mbs_user!'.format(
+                    'Build {build_id} has owner {owner_name}, which is NOT mbs_user and is not in build_import_users!'.format(
                         **build
                     )
                 )
diff --git a/tests/test_tag.py b/tests/test_tag.py
index d196c91..5c510e1 100644
--- a/tests/test_tag.py
+++ b/tests/test_tag.py
@@ -16,6 +16,7 @@ TEST_CONFIG = {
         'test': {
             'url': 'https://koji.example.com',
             'mbs_user': 'mbs_user',
+            'build_import_users': ['kojiadmin',],
             'options': {
                 'authmethod': 'kerberos',
                 'principal': 'test@EXAMPLE.COM',
@@ -322,7 +323,7 @@ class TestTagSigner:
 
         if error == 'non-mbs-owner':
             expected_log_msgs.append(
-                f"Build {build_id} has owner {build_owner}, which is NOT mbs_user!")
+                f"Build {build_id} has owner {build_owner}, which is NOT mbs_user and is not in build_import_users!")
             expected_exc_ctx = raises(Exception,
                                       match="Modular content tag contains invalid owned build")
         elif error == 'untrusted-tagger':