openshift-update-proxy 1.2.0__tar.gz → 1.3.0__tar.gz

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openshift-update-proxy
-Version: 1.2.0
+Version: 1.3.0
 Summary: Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)
 Author-email: Simon Lauger <simon@lauger.de>
 License-Expression: Apache-2.0
@@ -189,7 +189,9 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
-`/configmaps/4.16.8?arch=arm64`.
+`/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
+`release-image-<version>`; digest lookups use `signature-sha256-<digest>` as the
+version is not known there.
 
 Alternatively, a release digest can be passed directly:
 

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.3.0}/README.md

@@ -158,7 +158,9 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
-`/configmaps/4.16.8?arch=arm64`.
+`/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
+`release-image-<version>`; digest lookups use `signature-sha256-<digest>` as the
+version is not known there.
 
 Alternatively, a release digest can be passed directly:
 

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "openshift-update-proxy"
-version = "1.2.0"
+version = "1.3.0"
 description = "Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)"
 readme = "README.md"
 license = "Apache-2.0"

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.3.0}/src/openshift_update_proxy/__init__.py

@@ -1,3 +1,3 @@
 """OpenShift update proxy for disconnected environments."""
 
-__version__ = "1.2.0"
+__version__ = "1.3.0"

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.3.0}/src/openshift_update_proxy/app.py

@@ -5,6 +5,7 @@ import logging
 import re
 
 import requests
+import urllib3
 from flask import Flask, Response, jsonify, request
 
 from openshift_update_proxy import __version__, catalog, graph, lifecycle
@@ -34,7 +35,7 @@ VERSION_PATTERN = re.compile(r"^(?P<major>\d+)\.(?P<minor>\d+)\.\d+[A-Za-z0-9.+-
 CONFIGMAP_TEMPLATE = """apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: signature-sha256-{short_digest}
+  name: {name}
   namespace: openshift-config-managed
   labels:
     release.openshift.io/verification-signatures: ""
@@ -46,6 +47,23 @@ def create_app(config: Config | None = None) -> Flask:
     app = Flask(__name__)
     app.config["proxy"] = config or Config()
 
+    # the insecure request warning would be emitted on every upstream call;
+    # skipping verification is an explicit opt-in, so silence it
+    if not app.config["proxy"].ssl_verify:
+        urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+    @app.after_request
+    def log_request(response: Response) -> Response:
+        if request.path != "/healthz":
+            logger.info(
+                '%s "%s %s" %s',
+                request.remote_addr,
+                request.method,
+                request.full_path if request.query_string else request.path,
+                response.status_code,
+            )
+        return response
+
     @app.route("/")
     def index() -> Response:
         return jsonify(
@@ -190,9 +208,11 @@ def create_app(config: Config | None = None) -> Flask:
         digest_match = DIGEST_PATTERN.match(ref)
         version_match = VERSION_PATTERN.match(ref)
 
+        name = None
         if digest_match:
             digest = digest_match.group("digest")
         elif version_match:
+            name = f"release-image-{ref}"
             arch = request.args.get("arch", "amd64")
             channel_prefix = request.args.get("channel_prefix", "stable")
 
@@ -228,7 +248,9 @@ def create_app(config: Config | None = None) -> Flask:
         if not signatures:
             return Response("no signatures found for digest\n", status=404, mimetype="text/plain")
 
-        return Response(_render_configmap(digest, signatures), mimetype="application/yaml")
+        return Response(
+            _render_configmap(digest, signatures, name=name), mimetype="application/yaml"
+        )
 
     return app
 
@@ -290,10 +312,13 @@ def _fetch_signatures(cfg: Config, digest: str, limit: int = 10) -> list[bytes]:
     return signatures
 
 
-def _render_configmap(digest: str, signatures: list[bytes]) -> str:
+def _render_configmap(digest: str, signatures: list[bytes], name: str | None = None) -> str:
     binary_data = "\n".join(
         f"  sha256-{digest}-{index}: {base64.b64encode(signature).decode('ascii')}"
         for index, signature in enumerate(signatures, start=1)
     )
 
-    return CONFIGMAP_TEMPLATE.format(short_digest=digest[:16], binary_data=binary_data)
+    return CONFIGMAP_TEMPLATE.format(
+        name=name or f"signature-sha256-{digest[:16]}",
+        binary_data=binary_data,
+    )

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.3.0}/src/openshift_update_proxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openshift-update-proxy
-Version: 1.2.0
+Version: 1.3.0
 Summary: Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)
 Author-email: Simon Lauger <simon@lauger.de>
 License-Expression: Apache-2.0
@@ -189,7 +189,9 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
-`/configmaps/4.16.8?arch=arm64`.
+`/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
+`release-image-<version>`; digest lookups use `signature-sha256-<digest>` as the
+version is not known there.
 
 Alternatively, a release digest can be passed directly:
 

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.3.0}/tests/test_app.py

@@ -168,7 +168,9 @@ def test_configmap_by_version_resolves_digest(client, monkeypatch):
     assert response.status_code == 200
     assert graph_calls["params"]["channel"] == "stable-4.16"
     assert graph_calls["params"]["arch"] == "arm64"
-    assert f"sha256-{DIGEST}-1:" in response.data.decode()
+    body = response.data.decode()
+    assert "name: release-image-4.16.8" in body
+    assert f"sha256-{DIGEST}-1:" in body
 
 
 def test_configmap_by_version_returns_404_for_unknown_version(client, monkeypatch):
@@ -203,6 +205,44 @@ def test_configmap_by_version_rejects_invalid_arch(client):
     assert response.status_code == 400
 
 
+def test_requests_are_logged(client, caplog, monkeypatch):
+    monkeypatch.setattr(app_module.requests, "get", lambda *a, **kw: FakeResponse(b"{}"))
+
+    with caplog.at_level("INFO", logger="openshift-update-proxy"):
+        client.get("/api/upgrades_info/v1/graph?channel=stable-4.16")
+
+    assert any(
+        '"GET /api/upgrades_info/v1/graph?channel=stable-4.16" 200' in record.message
+        for record in caplog.records
+    )
+
+
+def test_healthz_is_not_logged(client, caplog):
+    with caplog.at_level("INFO", logger="openshift-update-proxy"):
+        client.get("/healthz")
+
+    assert not caplog.records
+
+
+def test_insecure_warnings_disabled_when_verify_off(monkeypatch):
+    from openshift_update_proxy.app import create_app
+    from openshift_update_proxy.config import Config
+
+    calls = []
+    monkeypatch.setattr(
+        app_module.urllib3, "disable_warnings", lambda category: calls.append(category)
+    )
+
+    monkeypatch.setenv("INSECURE_SKIP_TLS_VERIFY", "true")
+    create_app(Config())
+    assert calls == [app_module.urllib3.exceptions.InsecureRequestWarning]
+
+    calls.clear()
+    monkeypatch.delenv("INSECURE_SKIP_TLS_VERIFY")
+    create_app(Config())
+    assert calls == []
+
+
 def test_ssl_verify_enabled_by_default(config):
     assert config.ssl_verify is True