pulp-container 2.22.9__tar.gz → 2.22.11__tar.gz

{pulp_container-2.22.9 → pulp_container-2.22.11}/CHANGES.md

@@ -8,6 +8,24 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.22.11 (2026-09-23) {: #2.22.11 }
+
+#### Bugfixes {: #2.22.11-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
+## 2.22.10 (2026-07-23) {: #2.22.10 }
+
+#### Bugfixes {: #2.22.10-bugfix }
+
+- Fixed OS and architecture filters being silently ignored when filtering manifest lists in the flatpak index.
+- Fixed a serialization issue with the FlatpakIndex cache.
+
+---
+
 ## 2.22.9 (2026-07-21) {: #2.22.9 }
 
 #### Bugfixes {: #2.22.9-bugfix }

{pulp_container-2.22.9 → pulp_container-2.22.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.22.9
+Version: 2.22.11
 Summary: Container plugin for the Pulp Project
 Home-page: https://pulpproject.org/
 Author: Pulp Team
@@ -18,7 +18,7 @@ Requires-Python: >=3.8
 License-File: LICENSE
 Requires-Dist: jsonschema<4.24,>=4.4
 Requires-Dist: pulpcore<3.70,>=3.49.0
-Requires-Dist: pyjwt[crypto]<2.10,>=2.4
+Requires-Dist: pyjwt[crypto]<2.14,>=2.4
 Requires-Dist: pycares<4.9
 Requires-Dist: pysequoia<0.2.0,>=0.1.33
 Dynamic: author

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/__init__.py

@@ -1,7 +1,8 @@
-from pulpcore.plugin import PulpPluginAppConfig
 from django.db import connection
 from django.db.models.signals import post_migrate
 
+from pulpcore.plugin import PulpPluginAppConfig
+
 update_sequences_to_bigint = """
 ALTER TABLE container_blobmanifest ALTER COLUMN id TYPE bigint;
 ALTER TABLE container_manifestlistmanifest ALTER COLUMN id TYPE bigint;
@@ -23,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.22.9"
+    version = "2.22.11"
     python_package_name = "pulp-container"
 
     @staticmethod
@@ -34,6 +35,6 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     def ready(self):
         super().ready()
-        from . import checks
+        from . import checks  # noqa: F401
 
         post_migrate.connect(PulpContainerPluginAppConfig.update_sequences, sender=self)

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/authorization.py

@@ -2,27 +2,23 @@ import base64
 import hashlib
 import random
 import uuid
-
-import jwt
-
 from collections import defaultdict, namedtuple
 from datetime import datetime
 from functools import partial
 
+import jwt
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import serialization
 from django.conf import settings
 from django.http import HttpRequest
-from django.db.models import F, Value
 from rest_framework.request import Request
 
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives import serialization
-
+from pulp_container.app.access_policy import RegistryAccessPolicy
 from pulp_container.app.models import (
     ContainerDistribution,
     ContainerNamespace,
-    ContainerPullThroughDistribution,
 )
-from pulp_container.app.access_policy import RegistryAccessPolicy
+from pulp_container.app.pull_through import get_pull_through_distribution
 
 TOKEN_EXPIRATION_TIME = settings.get("TOKEN_EXPIRATION_TIME", 300)
 
@@ -209,15 +205,6 @@ class AuthorizationService:
         }
 
 
-def get_pull_through_distribution(path):
-    return (
-        ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-        .filter(path__startswith=F("base_path"))
-        .order_by("-base_path")
-        .first()
-    )
-
-
 class PermissionChecker:
     def __init__(self, user):
         self.user = user

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/cache.py

@@ -1,10 +1,13 @@
 from django.core.exceptions import ObjectDoesNotExist
-from django.db.models import F, Value
 
-from pulpcore.plugin.cache import CacheKeys, AsyncContentCache, SyncContentCache
+from pulpcore.plugin.cache import AsyncContentCache, CacheKeys, SyncContentCache
 
-from pulp_container.app.models import ContainerDistribution, ContainerPullThroughDistribution
 from pulp_container.app.exceptions import RepositoryNotFound
+from pulp_container.app.models import ContainerDistribution
+from pulp_container.app.pull_through import (
+    get_pull_through_distribution,
+    get_pull_through_distribution_path,
+)
 
 ACCEPT_HEADER_KEY = "accept_header"
 QUERY_KEY = "query"
@@ -72,15 +75,12 @@ def find_base_path_cached(request, cached):
         try:
             distro = ContainerDistribution.objects.get(base_path=path)
         except ObjectDoesNotExist:
-            distro = (
-                ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-                .filter(path__startswith=F("base_path"))
-                .order_by("-base_path")
-                .first()
-            )
+            distro = get_pull_through_distribution(path)
             if not distro:
                 raise RepositoryNotFound(name=path)
 
+            return get_pull_through_distribution_path(distro)
+
         return distro.base_path
 
 

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/checks.py

@@ -1,5 +1,11 @@
 from django.conf import settings
-from django.core.checks import Error as CheckError, register
+from django.core.checks import Error as CheckError
+from django.core.checks import Warning as CheckWarning
+from django.core.checks import register
+from django.db import OperationalError, ProgrammingError
+
+from pulp_container.app.models import ContainerPullThroughDistribution
+from pulp_container.constants import PULL_THROUGH_DISTRIBUTION_LABEL
 
 
 @register(deploy=True)
@@ -44,3 +50,28 @@ def container_settings_check(app_configs, **kwargs):
         )
 
     return errors
+
+
+@register()
+def pull_through_distribution_check(app_configs, **kwargs):
+    """Warn when legacy pull-through distributions need repair."""
+    try:
+        needs_repair = ContainerPullThroughDistribution.objects.exclude(
+            pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL
+        ).exists()
+    except (OperationalError, ProgrammingError):
+        return []
+
+    if not needs_repair:
+        return []
+
+    return [
+        CheckWarning(
+            "Pull-through distributions need base-path repair.",
+            hint=(
+                "Run 'pulpcore-manager container-repair-pull-through-distributions' and "
+                "resolve any distributions it reports."
+            ),
+            id="pulp_container.W001",
+        )
+    ]

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/content.py

@@ -1,6 +1,7 @@
 from aiohttp import web
 
 from pulpcore.plugin.content import app
+
 from pulp_container.app.registry import Registry
 
 registry = Registry()

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/management/commands/container-handle-image-data.py

@@ -1,8 +1,6 @@
-from json.decoder import JSONDecodeError
-
-from gettext import gettext as _
-
 from contextlib import suppress
+from gettext import gettext as _
+from json.decoder import JSONDecodeError
 
 from django.conf import settings
 from django.core.exceptions import ObjectDoesNotExist
@@ -12,9 +10,7 @@ from django.db.models import Q
 from pulpcore.plugin.cache import SyncContentCache
 
 from pulp_container.app.models import ContainerDistribution, Manifest
-
 from pulp_container.app.utils import get_content_data
-
 from pulp_container.constants import MEDIA_TYPE
 
 

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/management/commands/container-repair-media-type.py

@@ -1,5 +1,4 @@
 import json
-
 from gettext import gettext as _
 
 from django.conf import settings
@@ -7,9 +6,8 @@ from django.core.management import BaseCommand
 
 from pulpcore.plugin.cache import SyncContentCache
 
-from pulp_container.app.models import Manifest, ContainerDistribution
+from pulp_container.app.models import ContainerDistribution, Manifest
 from pulp_container.app.utils import determine_media_type_from_json
-
 from pulp_container.constants import MEDIA_TYPE
 
 

pulp_container-2.22.11/pulp_container/app/management/commands/container-repair-pull-through-distributions.py

@@ -0,0 +1,66 @@
+from gettext import gettext as _
+from uuid import uuid4
+
+from django.conf import settings
+from django.core.management import BaseCommand
+from django.db import transaction
+
+from pulpcore.plugin.cache import SyncContentCache
+
+from pulp_container.app.models import ContainerPullThroughDistribution
+from pulp_container.app.pull_through import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+    find_container_distribution_overlaps,
+)
+
+
+class Command(BaseCommand):
+    """Repair pull-through distributions whose registry path is stored as their base path."""
+
+    help = _("Repair pull-through distribution base paths and report remaining overlaps.")
+
+    def handle(self, *args, **options):
+        """Move eligible pull-through base paths and report unresolved overlaps."""
+        repaired = 0
+        migrated_base_paths = []
+        distributions = ContainerPullThroughDistribution.objects.exclude(
+            pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL
+        )
+
+        for distribution in distributions.iterator():
+            old_base_path = distribution.base_path
+            distribution.base_path = str(uuid4())
+            distribution.pulp_labels = {
+                **(distribution.pulp_labels or {}),
+                PULL_THROUGH_DISTRIBUTION_LABEL: old_base_path,
+            }
+            migrated_base_paths.append(old_base_path)
+            with transaction.atomic():
+                distribution.save(update_fields=["base_path", "pulp_labels"])
+            repaired += 1
+
+        self.stdout.write(self.style.SUCCESS(f"Repaired {repaired} pull-through distributions."))
+
+        overlaps = find_container_distribution_overlaps()
+        if overlaps:
+            self.stdout.write(
+                self.style.WARNING(
+                    "The following container distributions have overlapping base paths:"
+                )
+            )
+            for distribution, other in overlaps:
+                self.stdout.write(
+                    f"  {self._format_distribution(distribution).strip()} overlaps "
+                    f"{self._format_distribution(other).strip()}"
+                )
+
+        if settings.CACHE_ENABLED and migrated_base_paths:
+            SyncContentCache().delete(base_key=migrated_base_paths)
+            self.stdout.write(self.style.SUCCESS("Flushed repaired distribution cache entries."))
+
+    @staticmethod
+    def _format_distribution(distribution):
+        return (
+            f"  pk={distribution.pk} name={distribution.name!r} "
+            f"base_path={distribution.base_path!r}"
+        )

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/modelresource.py

@@ -1,11 +1,12 @@
 from import_export import fields, widgets
-from pulpcore.plugin.importexport import QueryModelResource, BaseContentResource
+
+from pulpcore.plugin.importexport import BaseContentResource, QueryModelResource
 from pulpcore.plugin.modelresources import RepositoryResource
 
 from pulp_container.app.models import (
     Blob,
-    ContainerRepository,
     ContainerPushRepository,
+    ContainerRepository,
     Manifest,
     ManifestListManifest,
     ManifestSignature,

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/models.py

@@ -1,17 +1,15 @@
-from gettext import gettext as _
-
 import json
 import os
 import re
 import tempfile
-import time
+from gettext import gettext as _
 from logging import getLogger
 
-from django.db import models
 from django.conf import settings
 from django.contrib.postgres import fields
+from django.db import models
 from django.shortcuts import redirect
-from django_lifecycle import hook, AFTER_CREATE, AFTER_DELETE, AFTER_UPDATE
+from django_lifecycle import AFTER_CREATE, AFTER_DELETE, AFTER_UPDATE, hook
 
 from pulpcore.plugin.cache import SyncContentCache
 from pulpcore.plugin.download import DownloaderFactory
@@ -20,17 +18,17 @@ from pulpcore.plugin.models import (
     AutoAddObjPermsMixin,
     BaseModel,
     Content,
+    Distribution,
     Remote,
     Repository,
-    Distribution,
     SigningService,
+)
+from pulpcore.plugin.models import (
     Upload as CoreUpload,
 )
 from pulpcore.plugin.repo_version_utils import remove_duplicates, validate_repo_version
 from pulpcore.plugin.util import gpg_verify
 
-
-from . import downloaders
 from pulp_container.app.utils import get_content_data, integer_overflow_safe
 from pulp_container.constants import (
     COSIGN_MEDIA_TYPES,
@@ -41,6 +39,8 @@ from pulp_container.constants import (
     SIGNATURE_TYPE,
 )
 
+from . import downloaders
+
 logger = getLogger(__name__)
 
 
@@ -936,8 +936,7 @@ INCOMPLETE_EXT = ".part"
 
 def generate_filename(instance, filename):
     """Method for generating upload file name"""
-    filename = os.path.join(instance.upload_dir, str(instance.pk) + INCOMPLETE_EXT)
-    return time.strftime(filename)
+    return os.path.join(instance.upload_dir, str(instance.pk) + INCOMPLETE_EXT)
 
 
 class Upload(CoreUpload):

pulp_container-2.22.11/pulp_container/app/pull_through.py

@@ -0,0 +1,66 @@
+from django.db.models import F, Q, TextField, Value
+from django.db.models.functions import Concat
+
+from pulpcore.plugin.models import Distribution
+
+from pulp_container.app.models import ContainerDistribution, ContainerPullThroughDistribution
+from pulp_container.constants import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+)
+
+
+def is_pull_through_distribution_marked(distribution):
+    """Return whether a pull-through distribution stores its registry path in pulp_labels."""
+    return (distribution.pulp_labels or {}).get(PULL_THROUGH_DISTRIBUTION_LABEL)
+
+
+def get_pull_through_distribution_path(distribution):
+    """Return the registry path represented by a pull-through distribution."""
+    if base_path := is_pull_through_distribution_marked(distribution):
+        return base_path
+    return distribution.base_path
+
+
+def _match_path(queryset, path, field):
+    """Return the longest segment-aware path match from a queryset."""
+    prefix_field = f"{field}_prefix"
+    return (
+        queryset.annotate(
+            requested_path=Value(path, output_field=TextField()),
+            **{prefix_field: Concat(F(field), Value("/"), output_field=TextField())},
+        )
+        .filter(Q(requested_path=F(field)) | Q(requested_path__startswith=F(prefix_field)))
+        .order_by(f"-{field}")
+        .first()
+    )
+
+
+def get_pull_through_distribution(path):
+    """Find a pull-through distribution using the repaired scheme, then the legacy scheme."""
+    distributions = ContainerPullThroughDistribution.objects.all()
+    marked = distributions.filter(pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL)
+    if distribution := _match_path(marked, path, f"pulp_labels__{PULL_THROUGH_DISTRIBUTION_LABEL}"):
+        return distribution
+
+    legacy = distributions.exclude(pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL)
+    return _match_path(legacy, path, "base_path")
+
+
+def find_container_distribution_overlaps():
+    """Return pairs where a container distribution overlaps any distribution."""
+    container_ids = set(ContainerDistribution.objects.values_list("pk", flat=True))
+    distributions = list(Distribution.objects.order_by("base_path", "pk"))
+    by_path = {}
+    for distribution in distributions:
+        by_path.setdefault(distribution.base_path, []).append(distribution)
+    overlaps = []
+
+    for distribution in distributions:
+        parts = distribution.base_path.split("/")
+        for index in range(1, len(parts)):
+            parent_path = "/".join(parts[:index])
+            for parent in by_path.get(parent_path, []):
+                if parent.pk in container_ids or distribution.pk in container_ids:
+                    overlaps.append((parent, distribution))
+
+    return overlaps

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/registry.py

@@ -1,35 +1,32 @@
 import json
 import logging
 import os
-
-from asgiref.sync import sync_to_async
-
 from contextlib import suppress
 from urllib.parse import urljoin
 
 from aiohttp import web
-from aiohttp.client_exceptions import ClientResponseError, ClientConnectionError
+from aiohttp.client_exceptions import ClientConnectionError, ClientResponseError
 from aiohttp.web_exceptions import HTTPTooManyRequests
-from django_guid import set_guid
-from django_guid.utils import generate_guid
+from asgiref.sync import sync_to_async
 from django.core.exceptions import ObjectDoesNotExist
 from django.db import IntegrityError
+from django_guid import set_guid
+from django_guid.utils import generate_guid
 from multidict import MultiDict
 
-from pulpcore.plugin.content import Handler, PathNotResolved
-from pulpcore.plugin.util import get_domain
-from pulpcore.plugin.models import RemoteArtifact, Content, ContentArtifact
-from pulpcore.plugin.content import ArtifactResponse
-from pulpcore.plugin.tasking import dispatch
+from pulpcore.plugin.content import ArtifactResponse, Handler, PathNotResolved
 from pulpcore.plugin.exceptions import TimeoutException
+from pulpcore.plugin.models import Content, ContentArtifact, RemoteArtifact
+from pulpcore.plugin.tasking import dispatch
+from pulpcore.plugin.util import get_domain
 
 from pulp_container.app.cache import RegistryContentCache
-from pulp_container.app.models import ContainerDistribution, Tag, Blob, Manifest, BlobManifest
+from pulp_container.app.models import Blob, BlobManifest, ContainerDistribution, Manifest, Tag
 from pulp_container.app.tasks import download_image_data
 from pulp_container.app.utils import (
     calculate_digest,
-    get_accepted_media_types,
     determine_media_type,
+    get_accepted_media_types,
     save_artifact,
 )
 from pulp_container.constants import BLOB_CONTENT_TYPE, EMPTY_BLOB, MEDIA_TYPE, V2_ACCEPT_HEADERS

{pulp_container-2.22.9 → pulp_container-2.22.11}/pulp_container/app/registry_api.py

@@ -7,36 +7,26 @@ Check `Plugin Writer's Guide`_ for more details.
 
 import base64
 import binascii
+import hashlib
 import json
 import logging
-import hashlib
 import re
-
-from aiohttp.client_exceptions import ClientResponseError, ClientConnectionError
 from itertools import chain
-from urllib.parse import urljoin, urlparse, urlunparse, parse_qs, urlencode
 from tempfile import NamedTemporaryFile
+from urllib.parse import parse_qs, urlencode, urljoin, urlparse, urlunparse
 
+from aiohttp.client_exceptions import ClientConnectionError, ClientResponseError
+from django.conf import settings
 from django.core.exceptions import ObjectDoesNotExist
 from django.core.files.base import ContentFile, File
 from django.db import IntegrityError, transaction
-from django.db.models import F, Value
 from django.forms.models import model_to_dict
 from django.shortcuts import get_object_or_404
-
-from django.conf import settings
-
-from pulpcore.plugin.models import Artifact, ContentArtifact, UploadChunk
-from pulpcore.plugin.files import PulpTemporaryUploadedFile
-from pulpcore.plugin.tasking import add_and_remove, dispatch
-from pulpcore.plugin.util import get_objects_for_user, get_url, get_domain
-from pulpcore.plugin.exceptions import TimeoutException
-
 from rest_framework.exceptions import (
     AuthenticationFailed,
     NotAuthenticated,
-    PermissionDenied,
     ParseError,
+    PermissionDenied,
     Throttled,
 )
 from rest_framework.generics import ListAPIView
@@ -46,38 +36,48 @@ from rest_framework.renderers import BaseRenderer, JSONRenderer
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.settings import api_settings
-from rest_framework.viewsets import ViewSet
-from rest_framework.views import APIView, exception_handler
 from rest_framework.status import HTTP_401_UNAUTHORIZED
+from rest_framework.views import APIView, exception_handler
+from rest_framework.viewsets import ViewSet
+
+from pulpcore.plugin.exceptions import TimeoutException
+from pulpcore.plugin.files import PulpTemporaryUploadedFile
+from pulpcore.plugin.models import Artifact, ContentArtifact, UploadChunk
+from pulpcore.plugin.tasking import add_and_remove, dispatch
+from pulpcore.plugin.util import get_domain, get_objects_for_user, get_url
 
 from pulp_container.app import models, serializers
 from pulp_container.app.authorization import AuthorizationService, PermissionChecker
 from pulp_container.app.cache import (
-    find_base_path_cached,
     FlatpakIndexStaticCache,
     RegistryApiCache,
+    find_base_path_cached,
 )
 from pulp_container.app.exceptions import (
     BadGateway,
+    BlobInvalid,
+    BlobNotFound,
     GatewayTimeout,
     InvalidRequest,
-    RepositoryNotFound,
-    RepositoryInvalid,
-    BlobNotFound,
-    BlobInvalid,
-    ManifestNotFound,
     ManifestInvalid,
+    ManifestNotFound,
     ManifestSignatureInvalid,
+    RepositoryInvalid,
+    RepositoryNotFound,
+)
+from pulp_container.app.pull_through import (
+    get_pull_through_distribution,
+    get_pull_through_distribution_path,
 )
 from pulp_container.app.redirects import (
+    AzureStorageRedirects,
     FileStorageRedirects,
     S3StorageRedirects,
-    AzureStorageRedirects,
 )
 from pulp_container.app.token_verification import (
     RegistryAuthentication,
-    TokenAuthentication,
     RegistryPermission,
+    TokenAuthentication,
     TokenPermission,
 )
 from pulp_container.app.utils import (
@@ -309,18 +309,12 @@ class ContainerRegistryApiMixin:
         return distribution, repository, repository_version
 
     def get_pull_through_drv(self, path):
-        pull_through_cache_distribution = (
-            models.ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-            .filter(path__startswith=F("base_path"))
-            .order_by("-base_path")
-            .first()
-        )
+        pull_through_cache_distribution = get_pull_through_distribution(path)
         if not pull_through_cache_distribution or not self.request.user.is_authenticated:
             raise RepositoryNotFound(name=path)
 
-        upstream_name = path.split(pull_through_cache_distribution.base_path, maxsplit=1)[1].strip(
-            "/"
-        )
+        pull_through_path = get_pull_through_distribution_path(pull_through_cache_distribution)
+        upstream_name = path.split(pull_through_path, maxsplit=1)[1].strip("/")
         try:
             pull_through_remote = models.ContainerPullThroughRemote.objects.get(
                 pk=pull_through_cache_distribution.remote_id
@@ -571,9 +565,9 @@ class FlatpakIndexDynamicView(APIView):
         elif manifest.media_type in (models.MEDIA_TYPE.MANIFEST_LIST, models.MEDIA_TYPE.INDEX_OCI):
             mlms = manifest.listed_manifests.through.objects.filter(image_manifest__pk=manifest.pk)
             if oss:
-                mlms.filter(os__in=oss)
+                mlms = mlms.filter(os__in=oss)
             if architectures:
-                mlms.filter(architecture__in=architectures)
+                mlms = mlms.filter(architecture__in=architectures)
             for mlm in mlms:
                 self.recurse_through_manifest_lists(
                     tag, mlm.manifest_list, oss, architectures, manifests
@@ -679,7 +673,7 @@ class FlatpakIndexDynamicView(APIView):
                     continue
                 images.append(
                     {
-                        "Tags": tagged,
+                        "Tags": list(tagged),
                         "Digest": manifest.digest,
                         "MediaType": manifest.media_type,
                         "OS": os,