atex 0.12__tar.gz → 0.13__tar.gz

{atex-0.12 → atex-0.13}/DEVEL.md

@@ -125,6 +125,30 @@ Also note that `.reserve()` and `.abort()` could be also called by a context
 manager as `__enter__` and `__exit__`, ie. by a non-threaded caller (running
 everything in the main thread).
 
+## SSH with -T (`RequestTTY`) problems
+
+We don't allow pseudo-tty allocation via SSH, Podman or any other `Connection`
+because **it can bypass stdout/stderr redirect** done by the test wrapper,
+messing up the control channel (`TEST_CONTROL.md`).
+
+Normally, we redirect `stdout` of the `Connection` to be the control channel,
+leaving `stdin` / `stderr` to be used by the test. However a clever test can
+(even accidentally by launching a tty emulator) regain access to the original
+`stdout`, often closing it when the tty emulation ends, causing `Executor` to
+either report EOF, or straight out lose the session with ie.
+
+```
+TestAbortedError(test wrapper unexpectedly exited with 255 and reconnect was not sent via test control)
+```
+
+To avoid this, we always treat the `ATEX<->SUT` connection as sacred, TTY-less,
+to guarantee that a `dup()` of `stdout` (to a higher `fd` number), followed by
+`dup2(2, 1)` can never be reversed accidentally.
+
+(A malicious test could write bogus data to `ATEX_TEST_CONTROL` anyway, that's
+beside the point.)
+
+
 ## Upcoming API breakages
 
 - rename `FMFTests` argument `plan_name` to `plan`

{atex-0.12 → atex-0.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: atex
-Version: 0.12
+Version: 0.13
 Summary: Ad-hoc Test EXecutor
 Project-URL: Homepage, https://github.com/RHSecurityCompliance/atex
 License-Expression: GPL-3.0-or-later

{atex-0.12 → atex-0.13}/atex/cli/__init__.py

@@ -93,4 +93,4 @@ def main():
     try:
         mains[args._module](args)
     except KeyboardInterrupt:
-        raise SystemExit() from None
+        raise SystemExit from None

{atex-0.12 → atex-0.13}/atex/cli/testingfarm.py

@@ -137,15 +137,20 @@ def stats(args):
             print(f"{count:>{digits}}  {repo_url}")
 
     def request_search_results():
-        if args.before is not None or args.after is not None:
+        func_kwargs = {}
+        if args.before is not None:
+            func_kwargs["created_before"] = args.before
+        if args.after is not None:
+            func_kwargs["created_after"] = args.after
+
+        if args.page is not None:
             for state in args.states.split(","):
                 reply = api.search_requests_paged(
                     state=state,
                     page=args.page,
                     mine=False,
                     ranch=args.ranch,
-                    created_before=args.before,
-                    created_after=args.after,
+                    **func_kwargs,
                 )
                 if reply:
                     yield from reply
@@ -155,6 +160,7 @@ def stats(args):
                     state=state,
                     mine=False,
                     ranch=args.ranch,
+                    **func_kwargs,
                 )
                 if reply:
                     yield from reply

{atex-0.12 → atex-0.13}/atex/connection/ssh.py

@@ -36,6 +36,7 @@ DEFAULT_OPTIONS = {
     "TCPKeepAlive": "no",
     "EscapeChar": "none",
     "ExitOnForwardFailure": "yes",
+    "RequestTTY": "no",
 }
 
 

{atex-0.12 → atex-0.13}/atex/provisioner/testingfarm/api.py

@@ -19,7 +19,7 @@ DEFAULT_API_URL = "https://api.testing-farm.io"
 
 DEFAULT_RESERVE_TEST = {
     "url": "https://github.com/RHSecurityCompliance/atex-reserve",
-    "ref": "0.12",
+    "ref": "main",
     "path": ".",
     "name": "/plans/reserve",
 }
@@ -436,7 +436,7 @@ class Reserve:
     def __init__(
         self, *, compose, arch="x86_64", pool=None, hardware=None, kickstart=None,
         timeout=60, ssh_key=None, source_host=None,
-        reserve_test=None, variables=None, secrets=None,
+        reserve_test=None, variables=None, secrets=None, tags=None,
         api=None,
     ):
         """
@@ -482,6 +482,10 @@ class Reserve:
         exported for the reserve test - variables are visible via TF API,
         secrets are not (but can still be extracted from pipeline log).
 
+        'tags' is a dict of custom key/values to be submitted in TF Request as
+        environments->settings->provisioning->tags, useful for storing custom
+        metadata to be queried later.
+
         'api' is a TestingFarmAPI instance - if unspecified, a sensible default
         will be used.
         """
@@ -521,6 +525,8 @@ class Reserve:
         if variables:
             spec_env["variables"] = variables
         spec_env["secrets"] = secrets.copy() if secrets else {}  # we need it for ssh pubkey
+        if tags:
+            spec_env["settings"]["provisioning"]["tags"] |= tags
 
         self._spec = spec
         self._ssh_key = Path(ssh_key) if ssh_key else None
@@ -537,7 +543,7 @@ class Reserve:
         try:
             r = _http.request("GET", "https://ifconfig.me", headers=curl_agent)
             if r.status != 200:
-                raise ConnectionError()
+                raise ConnectionError
         except (ConnectionError, urllib3.exceptions.RequestError):
             r = _http.request("GET", "https://ifconfig.co", headers=curl_agent)
         return r.data.decode().strip()

{atex-0.12 → atex-0.13}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 name = "atex"
 description = "Ad-hoc Test EXecutor"
 readme = "README.md"
-version = "0.12"
+version = "0.13"
 license = "GPL-3.0-or-later"
 requires-python = ">= 3.11"
 dependencies = [
@@ -61,12 +61,15 @@ select = [
     "COM",  # flake8-commas
     "C4",   # flake8-comprehensions
     "EXE",  # flake8-executable
+    "PIE",  # flake8-pie
     "Q",    # flake8-quotes
+    "RSE",  # flake8-raise
     "SIM",  # flake8-simplify
     "ARG",  # flake8-unused-arguments
     "PTH",  # flake8-use-pathlib
     "PL",   # Pylint
     "RUF",  # Ruff-specific rules
+    "FURB", # refurb
 ]
 ignore = [
     "PTH123",   # builtin-open
@@ -94,6 +97,7 @@ ignore = [
     "SIM103",   # needless-bool
     "SIM105",   # suppressible-exception
     "SIM115",   # open-file-with-context-handler
+    "FURB118",  # reimplemented-operator
 
     # rules from preview
     "E115",     # no-indented-block-comment
@@ -109,6 +113,8 @@ ignore = [
 
     # buggy in ruff, inconsistent across ruff versions
     "RUF100",   # unused-noqa
+    # buggy, triggers on valid code
+    "PIE790",   # unnecessary-placeholder
 ]
 
 [tool.ruff.format]