katello 4.12.1 → 4.13.0

data/app/lib/actions/katello/repository/create.rb

@@ -13,10 +13,13 @@ module Actions
 
           org = repository.organization
           sequence do
-            create_action = plan_action(Pulp3::Orchestration::Repository::Create,
-                                        repository, SmartProxy.pulp_primary, force_repo_create)
-
-            return if create_action.error
+            # Container push repositories will already be in pulp. The version_href is
+            # directly updated after a push.
+            unless root.is_container_push
+              create_action = plan_action(Pulp3::Orchestration::Repository::Create,
+                                          repository, SmartProxy.pulp_primary, force_repo_create)
+              return if create_action.error
+            end
 
             # when creating a clone, the following actions are handled by the
             # publish/promote process
@@ -32,13 +35,16 @@ module Actions
               end
             end
 
-            concurrence do
-              plan_self(:repository_id => repository.id, :clone => clone)
-              if !clone && repository.url.present?
-                repository.product.alternate_content_sources.with_type(repository.content_type).each do |acs|
-                  acs.smart_proxies.each do |smart_proxy|
-                    smart_proxy_acs = ::Katello::SmartProxyAlternateContentSource.create(alternate_content_source_id: acs.id, smart_proxy_id: smart_proxy.id, repository_id: repository.id)
-                    plan_action(Pulp3::Orchestration::AlternateContentSource::Create, smart_proxy_acs)
+            # Container push repos do not need metadata generation or ACS (they do not sync)
+            unless root.is_container_push
+              concurrence do
+                plan_self(:repository_id => repository.id, :clone => clone)
+                if !clone && repository.url.present?
+                  repository.product.alternate_content_sources.with_type(repository.content_type).each do |acs|
+                    acs.smart_proxies.each do |smart_proxy|
+                      smart_proxy_acs = ::Katello::SmartProxyAlternateContentSource.create(alternate_content_source_id: acs.id, smart_proxy_id: smart_proxy.id, repository_id: repository.id)
+                      plan_action(Pulp3::Orchestration::AlternateContentSource::Create, smart_proxy_acs)
+                    end
                   end
                 end
               end

data/app/lib/actions/katello/repository/create_root.rb

@@ -2,13 +2,15 @@ module Actions
   module Katello
     module Repository
       class CreateRoot < Actions::EntryAction
-        def plan(root)
+        def plan(root, relative_path = nil)
           root.save!
           repository = ::Katello::Repository.new(:environment => root.organization.library,
                                       :content_view_version => root.organization.library.default_content_view_version,
                                       :root => root)
-          repository.relative_path = repository.custom_repo_path
+          repository.container_repository_name = relative_path
+          repository.relative_path = relative_path || repository.custom_repo_path
           repository.save!
+
           action_subject(repository)
           plan_action(::Actions::Katello::Repository::Create, repository)
         end

data/app/lib/actions/katello/repository/metadata_generate.rb

@@ -1,8 +1,10 @@
 module Actions
   module Katello
     module Repository
-      class MetadataGenerate < Actions::Base
+      class MetadataGenerate < Actions::EntryAction
         def plan(repository, options = {})
+          action_subject(repository)
+          repository.check_ready_to_act!
           source_repository = options.fetch(:source_repository, nil)
           source_repository ||= repository.target_repository if repository.link?
           smart_proxy = options.fetch(:smart_proxy, SmartProxy.pulp_primary)
@@ -15,6 +17,10 @@ module Actions
                         :source_repository => source_repository,
                         :matching_content => matching_content)
         end
+
+        def resource_locks
+          :link
+        end
       end
     end
   end

data/app/lib/actions/katello/repository/remove_content.rb

@@ -5,6 +5,7 @@ module Actions
         include Dynflow::Action::WithSubPlans
 
         def plan(repository, content_units, options = {})
+          repository.check_ready_to_act!
           sync_capsule = options.fetch(:sync_capsule, true)
           if repository.redhat?
             fail _("Cannot remove content from a non-custom repository")

data/app/lib/actions/katello/repository/sync.rb

@@ -20,6 +20,7 @@ module Actions
         #   of Katello and we just need to finish the rest of the orchestration
         def plan(repo, options = {})
           action_subject(repo)
+          repo.check_ready_to_act!
 
           validate_contents = options.fetch(:validate_contents, false)
           skip_metadata_check = options.fetch(:skip_metadata_check, false) || (validate_contents && (repo.yum? || repo.deb?))
@@ -100,7 +101,7 @@ module Actions
         def notify_on_failure(_plan)
           notification = MailNotification[:repository_sync_failure]
           repo = ::Katello::Repository.find(input.fetch(:repository, {})[:id])
-          notification.users.where(disabled: [nil, false], mail_enabled: true).each do |user|
+          notification.users.with_enabled_email.each do |user|
             notification.deliver(user: user, repo: repo, task: task)
           end
         end

data/app/lib/actions/katello/repository/upload_files.rb

@@ -8,6 +8,7 @@ module Actions
       class UploadFiles < Actions::EntryAction
         def plan(repository, files, content_type = nil, options = {})
           action_subject(repository)
+          repository.check_ready_to_act!
           repository.clear_smart_proxy_sync_histories
           tmp_files = prepare_tmp_files(files)
 

data/app/lib/actions/katello/upstream_subscriptions/bind_entitlement.rb

@@ -4,7 +4,7 @@ module Actions
       class BindEntitlement < Actions::Base
         def run
           output[:response] = ::Katello::Resources::Candlepin::UpstreamConsumer
-            .bind_entitlement(pool)
+            .bind_entitlement(**pool)
         end
 
         def humanized_name

data/app/lib/actions/pulp3/capsule_content/verify_checksum.rb

@@ -0,0 +1,27 @@
+module Actions
+  module Pulp3
+    module CapsuleContent
+      class VerifyChecksum < Pulp3::AbstractAsyncTask
+        def plan(repository, smart_proxy)
+          plan_self(:repository_id => repository.id, :smart_proxy_id => smart_proxy.id)
+        end
+
+        def invoke_external_task
+          repo = ::Katello::Repository.find(input[:repository_id])
+          output[:pulp_tasks] = repo.backend_service(smart_proxy).with_mirror_adapter.repair
+        end
+
+        def repos_to_repair(smart_proxy, environment, content_view, repository)
+          smart_proxy_helper = ::Katello::SmartProxyHelper.new(smart_proxy)
+          smart_proxy_helper.lifecycle_environment_check(environment, repository)
+          if repository
+            [repository]
+          else
+            repositories = smart_proxy_helper.repositories_available_to_capsule(environment, content_view).by_rpm_count
+            repositories
+          end
+        end
+      end
+    end
+  end
+end

data/app/lib/actions/pulp3/orchestration/content_view_version/export_repository.rb

@@ -3,26 +3,24 @@ module Actions
     module Orchestration
       module ContentViewVersion
         class ExportRepository < Actions::EntryAction
-          def plan(repository,
-                    chunk_size: nil,
-                    from_history: nil,
-                    format: ::Katello::Pulp3::ContentViewVersion::Export::IMPORTABLE)
+          def plan(repository, opts = {})
+            opts[:format] ||= ::Katello::Pulp3::ContentViewVersion::Export::IMPORTABLE
             action_subject(repository)
             validate_repositories_immediate!(repository)
-            validate_export_types!(repository, format)
+            validate_export_types!(repository, opts[:format])
             content_view = ::Katello::Pulp3::ContentViewVersion::Export.find_repository_export_view(
                                                                            repository: repository,
                                                                            create_by_default: true,
-                                                                           format: format)
+                                                                           format: opts[:format])
             content_view.update!(repository_ids: [repository.library_instance_or_self.id])
 
             sequence do
               publish_action = plan_action(::Actions::Katello::ContentView::Publish, content_view, '')
               export_action = plan_action(Actions::Katello::ContentViewVersion::Export,
                                           content_view_version: publish_action.version,
-                                          chunk_size: chunk_size,
-                                          from_history: from_history,
-                                          format: format)
+                                          chunk_size: opts[:chunk_size],
+                                          from_history: opts[:from_history],
+                                          format: opts[:format])
               plan_self(export_action_output: export_action.output)
             end
           end

data/app/lib/actions/pulp3/orchestration/content_view_version/syncable_export.rb

@@ -16,10 +16,11 @@ module Actions
             param :export_history_id, Integer
           end
 
-          def plan(content_view_version:,
-                   smart_proxy:,
-                   destination_server:,
-                   from_content_view_version:)
+          def plan(opts = {})
+            content_view_version = opts[:content_view_version]
+            smart_proxy = opts[:smart_proxy]
+            destination_server = opts[:destination_server]
+            from_content_view_version = opts[:from_content_view_version]
             format = ::Katello::Pulp3::ContentViewVersion::Export::SYNCABLE
             sequence do
               export_service = ::Katello::Pulp3::ContentViewVersion::Export.create(

data/app/lib/actions/pulp3/orchestration/orphan_cleanup/remove_orphans.rb

@@ -14,6 +14,7 @@ module Actions
                   plan_action(Actions::Pulp3::OrphanCleanup::DeleteOrphanRemotes, proxy)
                 end
                 plan_action(Actions::Pulp3::OrphanCleanup::RemoveOrphans, proxy)
+                plan_action(Actions::Pulp3::OrphanCleanup::PurgeCompletedTasks, proxy)
               end
             end
           end

data/app/lib/actions/pulp3/orphan_cleanup/purge_completed_tasks.rb

@@ -0,0 +1,15 @@
+module Actions
+  module Pulp3
+    module OrphanCleanup
+      class PurgeCompletedTasks < Pulp3::AbstractAsyncTask
+        def plan(smart_proxy)
+          plan_self(:smart_proxy_id => smart_proxy.id)
+        end
+
+        def run
+          output[:pulp_tasks] = ::Katello::Pulp3::Api::Core.new(smart_proxy).purge_completed_tasks
+        end
+      end
+    end
+  end
+end

data/app/lib/katello/concerns/base_template_scope_extensions.rb

@@ -216,9 +216,14 @@ module Katello
         keyword :includes, Array, of: [String, Symbol], desc: 'An array of associations represented by strings or symbols, to be included in the SQL query. The list can be extended
           from plugins and can not be fully documented here. Most used associations are :subscription, :products, :organization', default: nil
         returns array_of: 'Pool', desc: 'The collection that can be iterated over using each_record'
+        keyword :expiring_in_days, String, desc: "Return subscriptions expiring in the given number of days. Leave blank to return all subscriptions.", default: nil
       end
-      def load_pools(search: '', includes: nil)
-        load_resource(klass: Pool.readable, search: search, permission: nil, includes: includes)
+      def load_pools(search: '', includes: nil, expiring_in_days: nil)
+        pools = Pool.readable
+        if expiring_in_days
+          pools = pools.expiring_in_days(expiring_in_days)
+        end
+        load_resource(klass: pools, search: search, permission: nil, includes: includes)
       end
 
       apipie :method, 'Returns the last time the host checked in via RHSM' do

data/app/lib/katello/http_resource.rb

@@ -38,6 +38,7 @@ module Katello
       get: Net::HTTP::Get,
       post: Net::HTTP::Post,
       put: Net::HTTP::Put,
+      patch: Net::HTTP::Patch,
       delete: Net::HTTP::Delete
     }.freeze
 
@@ -84,7 +85,11 @@ module Katello
       def issue_request(method:, path:, headers: {}, payload: nil)
         logger.debug("Resource #{method.upcase} request: #{path}")
         logger.debug "Headers: #{headers.to_json}"
-        logger.debug "Body: #{filter_sensitive_data(payload.to_json)}"
+        begin
+          logger.debug "Body: #{filter_sensitive_data(payload.to_json)}"
+        rescue JSON::GeneratorError, Encoding::UndefinedConversionError
+          logger.debug "Body: Error: could not render payload as json"
+        end
 
         client = rest_client(REQUEST_MAP[method], method, path)
         args = [method, payload, headers].compact

data/app/lib/katello/resources/candlepin/consumer.rb

@@ -7,7 +7,7 @@ module Katello
         class << self
           def all_uuids
             cp_consumers = Organization.all.map do |org|
-              ::Katello::Resources::Candlepin::Consumer.get('owner' => org.label, :include_only => [:uuid])
+              ::Katello::Resources::Candlepin::Consumer.get('owner' => org.label, :include_only => [:uuid], :sort_by => "uuid")
             end
             cp_consumers.flatten!
             cp_consumers.map { |consumer| consumer["uuid"] }

data/app/lib/katello/resources/candlepin/upstream_consumer.rb

@@ -40,19 +40,31 @@ module Katello
             raise ::Katello::Errors::UpstreamEntitlementGone
           end
 
-          def get_export(url, client_cert, client_key, ca_file)
+          def start_upstream_export(url, client_cert, client_key, ca_file)
             logger.debug "Sending GET request to upstream Candlepin: #{url}"
-            return resource(url: url, client_cert: client_cert, client_key: client_key, ca_file: ca_file).get
+            resource(url: url, client_cert: client_cert, client_key: client_key, ca_file: ca_file).get
           rescue RestClient::Exception => e
             raise e
           end
 
+          alias_method :retrieve_upstream_export, :start_upstream_export
+
           def update(url, client_cert, client_key, ca_file, attributes)
             logger.debug "Sending PUT request to upstream Candlepin: #{url} #{attributes.to_json}"
-            return resource(url: url, client_cert: client_cert, client_key: client_key, ca_file: ca_file).put(attributes.to_json,
-                                                                       'accept' => 'application/json',
-                                                                       'accept-language' => I18n.locale,
-                                                                       'content-type' => 'application/json')
+            resource(
+              url: url,
+              client_cert: client_cert,
+              client_key: client_key,
+              ca_file: ca_file).put(
+                attributes.to_json,
+                'accept' => 'application/json',
+                'accept-language' => I18n.locale,
+                'content-type' => 'application/json')
+          end
+
+          def regenerate_upstream_identity(url, client_cert, client_key, ca_file)
+            logger.debug "Sending POST request to upstream Candlepin: #{url}"
+            resource(url: url, client_cert: client_cert, client_key: client_key, ca_file: ca_file).post(nil)
           end
 
           def bind_entitlement(**pool)

data/app/lib/katello/resources/candlepin/upstream_job.rb

@@ -12,7 +12,7 @@ module Katello
 
           def get(id, upstream)
             url = API_URL
-            response = Resources::Candlepin::UpstreamConsumer.get_export("#{url}#{path(id)}", upstream['idCert']['cert'],
+            response = Resources::Candlepin::UpstreamConsumer.start_upstream_export("#{url}#{path(id)}", upstream['idCert']['cert'],
               upstream['idCert']['key'], nil)
             job = JSON.parse(response)
             job.with_indifferent_access

data/app/lib/katello/resources/registry.rb

@@ -18,10 +18,35 @@ module Katello
           client.options.merge!(options)
           client.get(headers)
         end
+
+        def self.put(path, body, headers)
+          logger.debug "Sending PUT request to Registry: #{path}"
+          resource = RegistryResource.load_class
+          joined_path = resource.prefix.chomp("/") + path
+          resource.issue_request(method: :put, path: joined_path, headers: headers, payload: body)
+        end
+
+        def self.patch(path, body, headers)
+          logger.debug "Sending PATCH request to Registry: #{path}"
+          resource = RegistryResource.load_class
+          joined_path = resource.prefix.chomp("/") + path
+          resource.issue_request(method: :patch, path: joined_path, headers: headers, payload: body)
+        end
+
+        def self.post(path, body, headers)
+          logger.debug "Sending PUT request to Registry: #{path}"
+          resource = RegistryResource.load_class
+          joined_path = resource.prefix.chomp("/") + path
+          resource.issue_request(method: :post, path: joined_path, headers: headers, payload: body)
+        end
       end
 
       class RegistryResource < HttpResource
         class << self
+          def logger
+            ::Foreman::Logging.logger('katello/registry_proxy')
+          end
+
           def load_class
             pulp_primary = ::SmartProxy.pulp_primary
             content_app_url = pulp_primary.setting(SmartProxy::PULP3_FEATURE, 'content_app_url')

data/app/mailers/katello/subscription_mailer.rb

@@ -10,14 +10,11 @@ module Katello
 
       ::User.as(user.login) do
         @pools = Katello::Pool.readable.expiring_in_days(days_from_now)
-        @affected_hosts = ::Host::Managed.with_pools_expiring_in_days(days_from_now)
       end
 
-      if @affected_hosts.any?
-        start_report_task(days_from_now)
-        @report_url = report_url
-        @report_link = report_link
-      end
+      start_report_task(days_from_now)
+      @report_url = report_url
+      @report_link = report_link
 
       set_locale_for(user) do
         mail(:to => user.mail, :subject => _("You have subscriptions expiring within %s days") % days_from_now)

data/app/models/katello/concerns/organization_extensions.rb

@@ -100,16 +100,55 @@ module Katello
           end
         end
 
-        def manifest_expired?
-          manifest_expiry = owner_details.dig(:upstreamConsumer, :idCert, :serial, :expiration)
+        def manifest_expiration_date(cached: true)
+          Rails.cache.fetch("#{self.label}_manifest_expiration_date", expires_in: 1.minute, force: !cached) do
+            unless manifest_imported?(cached: cached)
+              Rails.logger.error "Manifest not imported for organization #{self.label}"
+              return nil
+            end
+            manifest_expiry = owner_details.dig(:upstreamConsumer, :idCert, :serial, :expiration)
+
+            if manifest_expiry.present?
+              DateTime.parse(manifest_expiry)
+            else
+              Rails.logger.error "Unable to parse manifest expiration date from owner details"
+              nil
+            end
+          end
+        end
+
+        def manifest_expired?(cached: true)
+          manifest_expiry = manifest_expiration_date(cached: cached)
 
           if manifest_expiry
-            DateTime.parse(manifest_expiry) < DateTime.now
+            manifest_expiry < DateTime.now
           else
             false
           end
         end
 
+        def manifest_expiring_soon?(days = Setting[:expire_soon_days])
+          return false if !manifest_imported? || manifest_expired?
+          manifest_expiry = manifest_expiration_date
+
+          if manifest_expiry
+            manifest_expiry < DateTime.now + days.days
+          else
+            false
+          end
+        end
+
+        def manifest_expire_days_remaining
+          manifest_expiry = manifest_expiration_date
+          return 0 if manifest_expired?
+
+          if manifest_expiry
+            (manifest_expiry - DateTime.now).to_i
+          else
+            0
+          end
+        end
+
         def manifest_history
           imports.map { |i| OpenStruct.new(i) }
         end

data/app/models/katello/content_view.rb

@@ -454,6 +454,8 @@ module Katello
           ).each do |facet|
             facet.update_applicability_counts
             facet.update_errata_status
+          rescue NoMethodError
+            Rails.logger.warn _('Errata statuses not updated for deleted content facet with UUID %s') % facet.uuid
           end
         end
       end
@@ -634,6 +636,7 @@ module Katello
         check_ready_to_import!
       else
         fail _("Import-only content views can not be published directly") if import_only? && !syncable
+        check_repositories_blocking_publish!
         check_composite_action_allowed!(organization.library)
         check_docker_repository_names!([organization.library])
         check_orphaned_content_facets!(environments: self.environments)
@@ -642,6 +645,16 @@ module Katello
       true
     end
 
+    def check_repositories_blocking_publish!
+      blocking_tasks = repositories&.map { |repo| repo.blocking_task }&.compact
+
+      if blocking_tasks&.any?
+        errored_tasks = blocking_tasks.uniq.map { |task| "- #{Setting['foreman_url']}/foreman_tasks/tasks/#{task&.id}" }.join("\n")
+        fail _("Pending tasks detected in repositories of this content view. Please wait for the tasks: " +
+                 errored_tasks + " before publishing.")
+      end
+    end
+
     def check_docker_repository_names!(environments)
       environments.each do |environment|
         repositories = []
@@ -789,6 +802,10 @@ module Katello
       repositories.any? { |repo| repo.last_indexed && repo.last_indexed > latest_version_object.created_at }
     end
 
+    def unpublishable?
+      default? || import_only? || generated?
+    end
+
     def needs_publish?
       #Returns
       # True:
@@ -808,7 +825,9 @@ module Katello
       #     a) No changes were detected via audits *and*
       #        Audit for CV publish exists (Audits haven't been cleaned up)
       #        *and* applied_filters field is set(Published after upgrade)
+      #     b) Default, import only and generated CVs can not be published, hence these will always return false.
       #
+      return false if unpublishable?
       return true unless latest_version_object
       return nil unless last_publish_task_success?
       return composite_cv_components_changed? if composite?
@@ -868,6 +887,17 @@ module Katello
       filters.present?
     end
 
+    def blocking_task
+      blocking_task_labels = [
+        ::Actions::Katello::ContentView::Publish.name
+      ]
+      ForemanTasks::Task::DynflowTask.where(:label => blocking_task_labels)
+                                     .where.not(state: 'stopped')
+                                     .for_resource(self)
+                                     .order(:started_at)
+                                     .last
+    end
+
     protected
 
     def remove_repository(repository)

data/app/models/katello/content_view_environment_content_facet.rb

@@ -5,7 +5,7 @@ module Katello
 
     validates :content_view_environment_id, presence: true
     validates :content_facet_id, presence: true, unless: :new_record?
-    validate :ensure_valid_content_source
+    validate :ensure_valid_content_source, if: proc { Setting['validate_host_lce_content_source_coherence'] }
 
     def ensure_valid_content_source
       source = self.content_facet&.content_source
@@ -14,7 +14,9 @@ module Katello
       hostname = self.content_facet&.host&.name
       return unless [source, env].all? { |x| x.present? }
       unless source.lifecycle_environments.include?(env)
-        errors.add(:base, _("Host %{hostname}: Cannot add content view environment to content facet. The host's content source '%{content_source}' does not sync lifecycle environment '%{lce}'.") % { hostname: hostname, content_source: source.name, lce: env.name })
+        error_msg = _("Host %{hostname}: Cannot add content view environment to content facet. The host's content source '%{content_source}' does not sync lifecycle environment '%{lce}'.") % { hostname: hostname, content_source: source.name, lce: env.name }
+        Rails.logger.warn error_msg
+        errors.add(:base, error_msg)
       end
     end
   end

data/app/models/katello/glue/provider.rb

@@ -32,6 +32,10 @@ module Katello
 
     module InstanceMethods
       API_URL = 'https://subscription.rhsm.redhat.com/subscription/consumers/'.freeze
+      def api_url(upstream = {})
+        # Default to Red Hat
+        upstream['apiUrl'] || API_URL
+      end
 
       def sync
         Rails.logger.debug "Syncing provider #{name}"
@@ -62,34 +66,37 @@ module Katello
           fail _("Upstream identity certificate not available")
         end
 
-        # Default to Red Hat
-        url = upstream['apiUrl'] || API_URL
-
         params = {}
         params[:capabilities] = Resources::Candlepin::CandlepinPing.ping['managerCapabilities'].inject([]) do |result, element|
           result << {'name' => element}
         end
         params[:facts] = {:distributor_version => DISTRIBUTOR_VERSION }
-        Resources::Candlepin::UpstreamConsumer.update("#{url}#{upstream['uuid']}", upstream['idCert']['cert'],
+        Resources::Candlepin::UpstreamConsumer.update("#{api_url(upstream)}#{upstream['uuid']}", upstream['idCert']['cert'],
                                                       upstream['idCert']['key'], ca_file, params)
       end
 
-      def start_owner_upstream_export(upstream)
+      def owner_upstream_regenerate_identity_cert(upstream)
         validate_upstream_identity_cert!(upstream)
-        url = upstream['apiUrl'] || API_URL
+        Rails.logger.debug "Sending request to regenerate identity certificate for upstream consumer: #{upstream['uuid']}"
+        response = Resources::Candlepin::UpstreamConsumer.regenerate_upstream_identity("#{api_url(upstream)}#{upstream['uuid']}", upstream['idCert']['cert'],
+          upstream['idCert']['key'], ca_file)
+        JSON.parse(response)
+      end
 
-        response = Resources::Candlepin::UpstreamConsumer.get_export("#{url}#{upstream['uuid']}/export/async", upstream['idCert']['cert'],
+      def start_owner_upstream_export(upstream)
+        validate_upstream_identity_cert!(upstream)
+        response = Resources::Candlepin::UpstreamConsumer.start_upstream_export("#{api_url(upstream)}#{upstream['uuid']}/export/async", upstream['idCert']['cert'],
           upstream['idCert']['key'], ca_file)
         JSON.parse(response)
       end
 
       def retrieve_owner_upstream_export(upstream, zip_file_path, export_id)
         validate_upstream_identity_cert!(upstream)
-        url = upstream['apiUrl'] || API_URL
-
-        data = Resources::Candlepin::UpstreamConsumer.get_export("#{url}#{upstream['uuid']}/export/#{export_id}", upstream['idCert']['cert'],
-                                                             upstream['idCert']['key'], ca_file)
-
+        data = Resources::Candlepin::UpstreamConsumer.retrieve_upstream_export(
+          "#{api_url(upstream)}#{upstream['uuid']}/export/#{export_id}",
+          upstream['idCert']['cert'],
+          upstream['idCert']['key'], ca_file
+        )
         File.write(zip_file_path, data, mode: 'wb')
 
         true

data/app/models/katello/glue/pulp/repos.rb

@@ -50,7 +50,7 @@ module Katello
       end
 
       def last_sync_audit
-        Audited::Audit.where(:auditable_id => self.repositories, :auditable_type => Katello::Repository.name).order(:created_at).last
+        Audited::Audit.where(:auditable_id => self.repositories, :auditable_type => Katello::Repository.name, :action => "sync").order(:created_at).last
       end
 
       def last_sync
@@ -58,13 +58,14 @@ module Katello
       end
 
       def last_repo_sync_task
-        @last_sync_task ||= last_repo_sync_tasks.first
+        @last_sync_task ||= last_repo_sync_tasks&.first
       end
 
       def last_repo_sync_tasks
         ids = repos(self.library, nil, false).pluck(:id).join(',')
         label = ::Actions::Katello::Repository::Sync.name
         type = ::Katello::Repository.name
+        return nil if ids.empty?
         ForemanTasks::Task.search_for("label = #{label} and resource_type = #{type} and resource_id ^ (#{ids})")
           .order("started_at desc")
       end
@@ -132,7 +133,14 @@ module Katello
 
         repo_param[:mirroring_policy] = Katello::RootRepository::MIRRORING_POLICY_ADDITIVE if repo_param[:mirroring_policy].blank?
 
-        RootRepository.new(repo_param.merge(:product_id => self.id))
+        repo_param = repo_param.merge(:product_id => self.id)
+
+        # Container push may concurrently call root add several times before the db can update.
+        if repo_param[:is_container_push]
+          RootRepository.create_or_find_by!(repo_param)
+        else
+          RootRepository.new(repo_param)
+        end
       end
     end
   end