Skip to content

PULP-2642: upgrade pulp_python to 3.38.0 + per-domain ATTESTATION_VERIFICATION_KEYS (PULP-2643 + PULP-2647) #1671

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
YasenT merged 2 commits into from
Nov 6, 2026
Merged

PULP-2642: upgrade pulp_python to 3.38.0 + per-domain ATTESTATION_VERIFICATION_KEYS (PULP-2643 + PULP-2647) #1671

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fb1ac2b
PULP-2642: upgrade pulp_python to 3.38.0 with per-domain attestation …
carlosthe19916 Nov 5, 2026
46d4d1f
PULP-2647: default ATTESTATION_VERIFICATION_KEYS to empty map
carlosthe19916 Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 10 additions & 10 deletions .tekton/pulp-deploy-and-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -605,7 +605,7 @@ spec:
{
"name": "pulp-api",
"env": [
{"name": "PULP_ATTESTATION_VERIFICATION_KEY", "value": "/etc/pki/attestation/test-key.pem"}
{"name": "PULP_ATTESTATION_VERIFICATION_KEYS", "value": "@json {\"default\": \"/etc/pki/attestation/test-key.pem\"}"}
Comment thread
sourcery-ai[bot] marked this conversation as resolved.
Resolved
],
"volumeMounts": [
{"mountPath": "/data","name": "bindings"},
Expand Down Expand Up @@ -635,7 +635,7 @@ spec:
{
"name": "pulp-worker",
"env": [
{"name": "PULP_ATTESTATION_VERIFICATION_KEY", "value": "/etc/pki/attestation/test-key.pem"}
{"name": "PULP_ATTESTATION_VERIFICATION_KEYS", "value": "@json {\"default\": \"/etc/pki/attestation/test-key.pem\"}"}
],
"volumeMounts": [
{"mountPath": "/etc/pki/attestation","name": "attestation-test-keys","readOnly": true}
Expand Down Expand Up @@ -694,8 +694,8 @@ spec:
from pkgutil import extend_path
__path__ = extend_path(__path__, __name__)
EOF
cat __tmp_init__.py | cmd_stdin_prefix bash -c "cat > /tmp/home/.local/lib/python3.11/site-packages/pulpcore/__init__.py"
cat __tmp_init__.py | cmd_stdin_prefix bash -c "cat > /tmp/home/.local/lib/python3.11/site-packages/pulpcore/client/__init__.py"
cat __tmp_init__.py | cmd_stdin_prefix bash -c "cat > /tmp/home/.local/lib/python3.12/site-packages/pulpcore/__init__.py"
cat __tmp_init__.py | cmd_stdin_prefix bash -c "cat > /tmp/home/.local/lib/python3.12/site-packages/pulpcore/client/__init__.py"

- name: pulp-functional-tests
when:
Expand Down Expand Up @@ -806,25 +806,25 @@ spec:
oc_wrapper get route
set +e
# Only testing test_download_content because it is a very thorough test that tests that all the components of pulp can work
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.11/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --suppress-no-test-exit-code --pyargs pulp_rpm.tests.functional -m parallel -n 8 -k 'test_download_content' --junitxml=/tmp/home/junit-pulp-parallel.xml" || debug_and_fail
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.12/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --suppress-no-test-exit-code --pyargs pulp_rpm.tests.functional -m parallel -n 8 -k 'test_download_content' --junitxml=/tmp/home/junit-pulp-parallel.xml" || debug_and_fail
# Never test test_package_manager_consume because they require sudo
# Do not test test_domain_create because it requires more than 2GB of RAM
# Only testing test_download_policies because they are very thorough tests that test that all the components of pulp can work
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.11/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_rpm.tests.functional -m 'not parallel' -k 'test_download_policies' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.12/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_rpm.tests.functional -m 'not parallel' -k 'test_download_policies' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail

# Run the jq header auth test
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.11/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulpcore.tests.functional -m 'parallel' -n 8 -k 'test_jq_header_remote_auth' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.12/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulpcore.tests.functional -m 'parallel' -n 8 -k 'test_jq_header_remote_auth' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail

### END Adapted from ./.github/workflows/scripts/script.sh

# Run pulp_maven functional tests
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.11/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_maven.tests.functional.api.test_download_content --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.12/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_maven.tests.functional.api.test_download_content --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail

# Run pulp_npm functional tests
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.11/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_npm.tests.functional -k 'test_pull_through_install' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.12/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_npm.tests.functional -k 'test_pull_through_install' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail

# Run pulp_service functional tests
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.11/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_service.tests.functional -m 'not parallel' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail
cmd_prefix bash -c "HOME=/tmp/home PYTHONPATH=/tmp/home/.local/lib/python3.12/site-packages/ XDG_CONFIG_HOME=/tmp/home/.config API_PROTOCOL=http API_HOST=pulp-api API_PORT=8000 ADMIN_USERNAME=admin ADMIN_PASSWORD=$PASSWORD /tmp/home/.local/bin/pytest -o cache_dir=/tmp/home/.cache/pytest_cache -v -r sx --color=yes --pyargs pulp_service.tests.functional -m 'not parallel' --junitxml=/tmp/home/junit-pulp-serial.xml" || debug_and_fail

- name: push-api-json-files-to-pulp
when:
Expand Down
4 changes: 1 addition & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
FROM registry.access.redhat.com/ubi9/ubi
ARG PYTHON_VERSION=3.11
ARG PYTHON_VERSION=3.12
Comment thread
sourcery-ai[bot] marked this conversation as resolved.
Resolved
ENV PYTHONUNBUFFERED=0
ENV DJANGO_SETTINGS_MODULE=pulpcore.app.settings
ENV PULP_SETTINGS=/etc/pulp/settings.py
Expand Down Expand Up @@ -133,8 +133,6 @@ RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages <


COPY images/assets/keys/SIGSTORE-redhat-release3.pem /etc/pki/sigstore/SIGSTORE-redhat-release3
COPY images/assets/patches/0048-Re-enable-attestation-verification-with-vendored-key.patch /tmp/
RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0048-Re-enable-attestation-verification-with-vendored-key.patch

COPY images/assets/patches/0049-Skip-content-units-validation.patch /tmp/
RUN patch -p1 -d /usr/local/lib/pulp/lib/python${PYTHON_VERSION}/site-packages < /tmp/0049-Skip-content-units-validation.patch
Expand Down
19 changes: 10 additions & 9 deletions deploy/clowdapp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,8 +387,8 @@ objects:
value: ${{PULP_API_ROOT}}
- name: PULP_DB_ENCRYPTION_KEY
value: ${{PULP_DB_ENCRYPTION_KEY}}
- name: PULP_ATTESTATION_VERIFICATION_KEY
value: ${{PULP_ATTESTATION_VERIFICATION_KEY}}
- name: PULP_ATTESTATION_VERIFICATION_KEYS
Comment thread
sourcery-ai[bot] marked this conversation as resolved.
Resolved
value: ${{PULP_ATTESTATION_VERIFICATION_KEYS}}
- name: PULP_CACHE_ENABLED
value: ${PULP_CACHE_ENABLED}
- name: PULP_STORAGES__default__OPTIONS__default_acl
Expand Down Expand Up @@ -590,8 +590,8 @@ objects:
value: ${{PULP_API_ROOT}}
- name: PULP_DB_ENCRYPTION_KEY
value: ${{PULP_DB_ENCRYPTION_KEY}}
- name: PULP_ATTESTATION_VERIFICATION_KEY
value: ${{PULP_ATTESTATION_VERIFICATION_KEY}}
- name: PULP_ATTESTATION_VERIFICATION_KEYS
value: ${{PULP_ATTESTATION_VERIFICATION_KEYS}}
- name: PULP_CACHE_ENABLED
value: ${PULP_CACHE_ENABLED}
- name: PULP_STORAGES__default__OPTIONS__default_acl
Expand Down Expand Up @@ -748,8 +748,8 @@ objects:
value: ${{PULP_API_ROOT}}
- name: PULP_DB_ENCRYPTION_KEY
value: ${{PULP_DB_ENCRYPTION_KEY}}
- name: PULP_ATTESTATION_VERIFICATION_KEY
value: ${{PULP_ATTESTATION_VERIFICATION_KEY}}
- name: PULP_ATTESTATION_VERIFICATION_KEYS
value: ${{PULP_ATTESTATION_VERIFICATION_KEYS}}
- name: PULP_CACHE_ENABLED
value: ${PULP_CACHE_ENABLED}
- name: PULP_STORAGES__default__OPTIONS__default_acl
Expand Down Expand Up @@ -1804,9 +1804,10 @@ parameters:
- name: PULP_DB_ENCRYPTION_KEY
description: Path to DB encryption key
value: "/etc/pulp/keys/database_fields.symmetric.key"
- name: PULP_ATTESTATION_VERIFICATION_KEY
description: Path to attestation verification key
value: "/etc/pki/sigstore/SIGSTORE-redhat-release3"
- name: PULP_ATTESTATION_VERIFICATION_KEYS

@dkliban dkliban Nov 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's have a default value here, but we should keep the actual values for stage and prod deployments in app-interface.

@carlosthe19916 carlosthe19916 Nov 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, good point. I moved it to app-interface as suggested here https://gitlab.cee.redhat.com/service/app-interface/-/merge_requests/217576

and then keep here only the default value in this repository

description: Per-domain map of domain name to attestation verification key file path (pulp_python 3.38.0+). Empty by default; the real per-environment maps are set as app-interface parameters for the stage and prod deployments.
value: >
'@json {}'
- name: PULP_CACHE_ENABLED
description: Enable CACHE. Need REDIS installed.
value: "true"
Expand Down
2 changes: 1 addition & 1 deletion dev-container/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
AUTHENTICATION_JSON_HEADER = "HTTP_X_RH_IDENTITY"
AUTHENTICATION_JSON_HEADER_JQ_FILTER = ".identity.user.username"

ATTESTATION_VERIFICATION_KEY = "/etc/pki/attestation/test-key.pem"
ATTESTATION_VERIFICATION_KEYS = {"default": "/etc/pki/attestation/test-key.pem"}

DOMAIN_ACCESS_POLICIES = {
"lightwell": {
Expand Down
Loading
Loading