pulp-container 2.26.16__tar.gz → 2.26.18__tar.gz

{pulp_container-2.26.16 → pulp_container-2.26.18}/CHANGES.md

@@ -8,6 +8,21 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.26.18 (2026-10-07) {: #2.26.18 }
+
+No significant changes.
+
+---
+
+## 2.26.17 (2026-09-23) {: #2.26.17 }
+
+#### Bugfixes {: #2.26.17-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.26.16 (2026-06-08) {: #2.26.16 }
 
 #### Bugfixes {: #2.26.16-bugfix }

{pulp_container-2.26.16 → pulp_container-2.26.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.26.16
+Version: 2.26.18
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -19,6 +19,6 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema<4.25,>=4.4
 Requires-Dist: pulpcore<3.100,>=3.73.2
-Requires-Dist: pyjwt[crypto]<2.14,>=2.4
+Requires-Dist: pyjwt[crypto]<2.16,>=2.4
 Requires-Dist: pysequoia<0.2.0,>=0.1.33
 Dynamic: license-file

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.26.16"
+    version = "2.26.18"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/authorization.py

@@ -10,7 +10,6 @@ import jwt
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 from django.conf import settings
-from django.db.models import F, Value
 from django.http import HttpRequest
 from rest_framework.request import Request
 
@@ -21,10 +20,10 @@ from pulp_container.app.access_policy import RegistryAccessPolicy
 from pulp_container.app.models import (
     ContainerDistribution,
     ContainerNamespace,
-    ContainerPullThroughDistribution,
 )
+from pulp_container.app.pull_through import get_pull_through_distribution
 
-TOKEN_EXPIRATION_TIME = settings.get("TOKEN_EXPIRATION_TIME", 300)
+TOKEN_EXPIRATION_TIME = getattr(settings, "TOKEN_EXPIRATION_TIME", 300)
 
 FakeView = namedtuple("FakeView", "action, get_object, get_serializer")
 
@@ -209,15 +208,6 @@ class AuthorizationService:
         }
 
 
-def get_pull_through_distribution(path, domain):
-    return (
-        ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-        .filter(pulp_domain=domain, path__startswith=F("base_path"))
-        .order_by("-base_path")
-        .first()
-    )
-
-
 class PermissionChecker:
     def __init__(self, user):
         self.user = user

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/cache.py

@@ -1,11 +1,14 @@
 from django.core.exceptions import ObjectDoesNotExist
-from django.db.models import F, Value
 
 from pulpcore.plugin.cache import AsyncContentCache, CacheKeys, SyncContentCache
 from pulpcore.plugin.util import cache_key, get_domain
 
 from pulp_container.app.exceptions import RepositoryNotFound
-from pulp_container.app.models import ContainerDistribution, ContainerPullThroughDistribution
+from pulp_container.app.models import ContainerDistribution
+from pulp_container.app.pull_through import (
+    get_pull_through_distribution,
+    get_pull_through_distribution_path,
+)
 
 ACCEPT_HEADER_KEY = "accept_header"
 QUERY_KEY = "query"
@@ -83,15 +86,12 @@ def find_base_path_cached(request, cached):
         try:
             distro = ContainerDistribution.objects.get(base_path=path, pulp_domain=domain)
         except ObjectDoesNotExist:
-            distro = (
-                ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-                .filter(path__startswith=F("base_path"), pulp_domain=domain)
-                .order_by("-base_path")
-                .first()
-            )
+            distro = get_pull_through_distribution(path, domain)
             if not distro:
                 raise RepositoryNotFound(name=path)
 
+            return cache_key(get_pull_through_distribution_path(distro))
+
         return cache_key(distro.base_path)
 
 

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/checks.py

@@ -1,6 +1,11 @@
 from django.conf import settings
 from django.core.checks import Error as CheckError
+from django.core.checks import Warning as CheckWarning
 from django.core.checks import register
+from django.db import OperationalError, ProgrammingError
+
+from pulp_container.app.models import ContainerPullThroughDistribution
+from pulp_container.constants import PULL_THROUGH_DISTRIBUTION_LABEL
 
 
 @register(deploy=True)
@@ -45,3 +50,28 @@ def container_settings_check(app_configs, **kwargs):
         )
 
     return errors
+
+
+@register()
+def pull_through_distribution_check(app_configs, **kwargs):
+    """Warn when legacy pull-through distributions need repair."""
+    try:
+        needs_repair = ContainerPullThroughDistribution.objects.exclude(
+            pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL
+        ).exists()
+    except (OperationalError, ProgrammingError):
+        return []
+
+    if not needs_repair:
+        return []
+
+    return [
+        CheckWarning(
+            "Pull-through distributions need base-path repair.",
+            hint=(
+                "Run 'pulpcore-manager container-repair-pull-through-distributions' and "
+                "resolve any distributions it reports."
+            ),
+            id="pulp_container.W001",
+        )
+    ]

pulp_container-2.26.18/pulp_container/app/management/commands/container-repair-pull-through-distributions.py

@@ -0,0 +1,73 @@
+from gettext import gettext as _
+from uuid import uuid4
+
+from django.conf import settings
+from django.core.management import BaseCommand
+from django.db import transaction
+
+from pulpcore.plugin.cache import SyncContentCache
+
+from pulp_container.app.models import ContainerPullThroughDistribution
+from pulp_container.app.pull_through import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+    find_container_distribution_overlaps,
+)
+
+
+class Command(BaseCommand):
+    """Repair pull-through distributions whose registry path is stored as their base path."""
+
+    help = _("Repair pull-through distribution base paths and report remaining overlaps.")
+
+    def handle(self, *args, **options):
+        """Move eligible pull-through base paths and report unresolved overlaps."""
+        repaired = 0
+        migrated_base_paths_and_domain = []
+        distributions = ContainerPullThroughDistribution.objects.exclude(
+            pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL
+        ).select_related("pulp_domain")
+
+        for distribution in distributions.iterator():
+            old_base_path = distribution.base_path
+            distribution.base_path = str(uuid4())
+            distribution.pulp_labels = {
+                **(distribution.pulp_labels or {}),
+                PULL_THROUGH_DISTRIBUTION_LABEL: old_base_path,
+            }
+            migrated_base_paths_and_domain.append((old_base_path, distribution.pulp_domain))
+            with transaction.atomic():
+                distribution.save(update_fields=["base_path", "pulp_labels"])
+            repaired += 1
+
+        self.stdout.write(self.style.SUCCESS(f"Repaired {repaired} pull-through distributions."))
+
+        overlaps = find_container_distribution_overlaps()
+        if overlaps:
+            self.stdout.write(
+                self.style.WARNING(
+                    "The following container distributions have overlapping base paths:"
+                )
+            )
+            for distribution, other in overlaps:
+                self.stdout.write(
+                    f"  {self._format_distribution(distribution).strip()} overlaps "
+                    f"{self._format_distribution(other).strip()}"
+                )
+
+        if settings.CACHE_ENABLED and migrated_base_paths_and_domain:
+            if settings.DOMAIN_ENABLED:
+                old_base_paths = [
+                    f"{domain.name}:{base_path}"
+                    for base_path, domain in migrated_base_paths_and_domain
+                ]
+            else:
+                old_base_paths = [base_path for base_path, _ in migrated_base_paths_and_domain]
+            SyncContentCache().delete(base_key=old_base_paths)
+            self.stdout.write(self.style.SUCCESS("Flushed repaired distribution cache entries."))
+
+    @staticmethod
+    def _format_distribution(distribution):
+        return (
+            f"  domain={distribution.pulp_domain.name!r} pk={distribution.pk} "
+            f"name={distribution.name!r} base_path={distribution.base_path!r}"
+        )

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/models.py

@@ -2,7 +2,6 @@ import json
 import os
 import re
 import tempfile
-import time
 from gettext import gettext as _
 from logging import getLogger
 
@@ -937,8 +936,7 @@ INCOMPLETE_EXT = ".part"
 
 def generate_filename(instance, filename):
     """Method for generating upload file name"""
-    filename = os.path.join(instance.upload_dir, str(instance.pk) + INCOMPLETE_EXT)
-    return time.strftime(filename)
+    return os.path.join(instance.upload_dir, str(instance.pk) + INCOMPLETE_EXT)
 
 
 class Upload(CoreUpload):

pulp_container-2.26.18/pulp_container/app/pull_through.py

@@ -0,0 +1,69 @@
+from django.db.models import F, Q, TextField, Value
+from django.db.models.functions import Concat
+
+from pulpcore.plugin.models import Distribution
+
+from pulp_container.app.models import ContainerDistribution, ContainerPullThroughDistribution
+from pulp_container.constants import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+)
+
+
+def is_pull_through_distribution_marked(distribution):
+    """Return whether a pull-through distribution stores its registry path in pulp_labels."""
+    return (distribution.pulp_labels or {}).get(PULL_THROUGH_DISTRIBUTION_LABEL)
+
+
+def get_pull_through_distribution_path(distribution):
+    """Return the registry path represented by a pull-through distribution."""
+    if base_path := is_pull_through_distribution_marked(distribution):
+        return base_path
+    return distribution.base_path
+
+
+def _match_path(queryset, path, field):
+    """Return the longest segment-aware path match from a queryset."""
+    prefix_field = f"{field}_prefix"
+    return (
+        queryset.annotate(
+            requested_path=Value(path, output_field=TextField()),
+            **{prefix_field: Concat(F(field), Value("/"), output_field=TextField())},
+        )
+        .filter(Q(requested_path=F(field)) | Q(requested_path__startswith=F(prefix_field)))
+        .order_by(f"-{field}")
+        .first()
+    )
+
+
+def get_pull_through_distribution(path, domain):
+    """Find a pull-through distribution using the repaired scheme, then the legacy scheme."""
+    distributions = ContainerPullThroughDistribution.objects.filter(pulp_domain=domain)
+    marked = distributions.filter(pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL)
+    if distribution := _match_path(marked, path, f"pulp_labels__{PULL_THROUGH_DISTRIBUTION_LABEL}"):
+        return distribution
+
+    legacy = distributions.exclude(pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL)
+    return _match_path(legacy, path, "base_path")
+
+
+def find_container_distribution_overlaps():
+    """Return pairs where a container distribution overlaps any distribution."""
+    container_ids = set(ContainerDistribution.objects.values_list("pk", flat=True))
+    distributions = Distribution.objects.select_related("pulp_domain").order_by(
+        "pulp_domain_id", "base_path", "pk"
+    )
+    by_domain_and_path = {
+        (distribution.pulp_domain_id, distribution.base_path): distribution
+        for distribution in distributions.iterator()
+    }
+    overlaps = []
+
+    for distribution in by_domain_and_path.values():
+        parts = distribution.base_path.split("/")
+        for index in range(1, len(parts)):
+            parent_path = "/".join(parts[:index])
+            if parent := by_domain_and_path.get((distribution.pulp_domain_id, parent_path)):
+                if parent.pk in container_ids or distribution.pk in container_ids:
+                    overlaps.append((parent, distribution))
+
+    return overlaps

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/registry_api.py

@@ -66,6 +66,10 @@ from pulp_container.app.exceptions import (
     RepositoryInvalid,
     RepositoryNotFound,
 )
+from pulp_container.app.pull_through import (
+    get_pull_through_distribution,
+    get_pull_through_distribution_path,
+)
 from pulp_container.app.redirects import (
     AzureStorageRedirects,
     FileStorageRedirects,
@@ -230,7 +234,7 @@ class ContainerRegistryApiMixin:
         """
         List of authentication classes to check for this view.
         """
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return [RegistryAuthentication]
         return [TokenAuthentication]
 
@@ -239,7 +243,7 @@ class ContainerRegistryApiMixin:
         """
         List of permission classes to check for this view.
         """
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return [RegistryPermission]
         return [TokenPermission]
 
@@ -309,18 +313,12 @@ class ContainerRegistryApiMixin:
 
     def get_pull_through_drv(self, path):
         domain = get_domain()
-        pull_through_cache_distribution = (
-            models.ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-            .filter(path__startswith=F("base_path"), pulp_domain=domain)
-            .order_by("-base_path")
-            .first()
-        )
+        pull_through_cache_distribution = get_pull_through_distribution(path, domain)
         if not pull_through_cache_distribution or not self.request.user.is_authenticated:
             raise RepositoryNotFound(name=path)
 
-        upstream_name = path.split(pull_through_cache_distribution.base_path, maxsplit=1)[1].strip(
-            "/"
-        )
+        pull_through_path = get_pull_through_distribution_path(pull_through_cache_distribution)
+        upstream_name = path.split(pull_through_path, maxsplit=1)[1].strip("/")
         try:
             pull_through_remote = models.ContainerPullThroughRemote.objects.get(
                 pk=pull_through_cache_distribution.remote_id
@@ -468,7 +466,7 @@ class VersionView(ContainerRegistryApiMixin, APIView):
         """
         List of permission classes to check for this view.
         """
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return [IsAuthenticated]
         return [TokenPermission]
 
@@ -560,7 +558,7 @@ class CatalogView(ContainerRegistryApiMixin, ListAPIView):
         distribution_permission = "container.pull_containerdistribution"
         namespace_permission = "container.namespace_pull_containerdistribution"
 
-        if settings.get("TOKEN_AUTH_DISABLED", False):
+        if getattr(settings, "TOKEN_AUTH_DISABLED", False):
             return queryset
 
         public_repositories = queryset.filter(private=False)

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/serializers.py

@@ -1,5 +1,6 @@
 import re
 from gettext import gettext as _
+from uuid import uuid4
 
 from django.core.validators import URLValidator
 from pulp_file.app.models import FileContent
@@ -32,13 +33,31 @@ from pulpcore.plugin.util import get_domain
 
 from pulp_container.app import fields, models
 from pulp_container.app.utils import get_full_path
-from pulp_container.constants import SIGNATURE_TYPE
+from pulp_container.constants import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+    SIGNATURE_TYPE,
+)
 
 VALID_SIGNATURE_NAME_REGEX = r"^sha256:[0-9a-f]{64}@[0-9a-f]{32}$"
 VALID_TAG_REGEX = r"^[A-Za-z0-9][A-Za-z0-9._-]*$"
 VALID_BASE_PATH_REGEX_COMPILED = re.compile(r"^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9])*$")
 
 
+def validate_registry_path(value):
+    """Validate a path that will be exposed by the container registry."""
+    if len(value) > 255:
+        raise serializers.ValidationError(
+            _("The entered registry path cannot be longer than 255 characters.")
+        )
+
+    if not all(re.match(VALID_BASE_PATH_REGEX_COMPILED, part) for part in value.split("/")):
+        raise serializers.ValidationError(
+            _("The provided registry path contains forbidden characters.")
+        )
+
+    return value
+
+
 class TagSerializer(NoArtifactContentSerializer):
     """
     Serializer for Tags.
@@ -456,17 +475,9 @@ class ContainerDistributionSerializer(DistributionSerializer, GetOrCreateSeriali
 
     def validate_base_path(self, value):
         """Check whether the passed repository base path is valid or not."""
-        if len(value) > 255:
-            raise serializers.ValidationError(
-                _("The entered base path cannot be longer than 255 characters.")
-            )
-
-        if not all(re.match(VALID_BASE_PATH_REGEX_COMPILED, p) for p in value.split("/")):
-            raise serializers.ValidationError(
-                _("The provided base path contains forbidden characters.")
-            )
-
-        return value
+        validate_registry_path(value)
+        # Ensure we follow pulpcore's cross-distribution overlap validation in addition to the OCI rules.
+        return super().validate_base_path(value)
 
     class Meta:
         model = models.ContainerDistribution
@@ -513,18 +524,49 @@ class ContainerPullThroughDistributionSerializer(DistributionSerializer):
     description = serializers.CharField(
         help_text=_("An optional description."), required=False, allow_null=True
     )
+    base_path = serializers.CharField(
+        help_text=_("The registry path exposed by this pull-through distribution.")
+    )
+
+    def validate_base_path(self, value):
+        """Check whether the passed repository base path is valid or not."""
+        validate_registry_path(value)
+        # Ensure we follow pulpcore's cross-distribution overlap validation in addition to the OCI rules.
+        return super().validate_base_path(value)
 
     def validate(self, data):
         validated_data = super().validate(data)
+        registry_path = validated_data.get("base_path")
+
+        # This is the temporary fix for pull-through distros violating core's overlapping base-path rule
+        # Save the base_path in pulp_labels to avoid overlapping base-paths with this PT's child distros
+        # A permanent fix should have us move off this field or Distributions all together.
+        if self.instance is None:
+            base_path = validated_data.pop("base_path")
+            validated_data["base_path"] = str(uuid4())
+            validated_data.setdefault("pulp_labels", {})[PULL_THROUGH_DISTRIBUTION_LABEL] = (
+                base_path
+            )
+        elif (
+            "base_path" in validated_data and validated_data["base_path"] != self.instance.base_path
+        ):
+            is_marked = (self.instance.pulp_labels or {}).get(PULL_THROUGH_DISTRIBUTION_LABEL)
+            if is_marked:
+                message = _("This value cannot be updated.")
+            else:
+                message = _(
+                    "Run 'pulpcore-manager container-repair-pull-through-distributions' before "
+                    "updating this value."
+                )
+            raise serializers.ValidationError({"base_path": message})
 
         if "content_guard" not in validated_data:
             validated_data["content_guard"] = ContentRedirectContentGuardSerializer.get_or_create(
                 {"name": "content redirect", "pulp_domain": get_domain()}
             )
 
-        base_path = validated_data.get("base_path")
-        if base_path:
-            namespace_name = base_path.split("/")[0]
+        if registry_path:
+            namespace_name = registry_path.split("/")[0]
             validated_data["namespace"] = ContainerNamespaceSerializer.get_or_create(
                 {"name": namespace_name, "pulp_domain": get_domain()}
             )

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/app/viewsets.py

@@ -12,6 +12,7 @@ from django_filters import CharFilter, MultipleChoiceFilter
 from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
+from rest_framework.exceptions import ValidationError
 
 from pulpcore.plugin.models import Content, PulpTemporaryFile, RepositoryVersion
 from pulpcore.plugin.serializers import AsyncOperationResponseSerializer
@@ -41,6 +42,7 @@ from pulpcore.plugin.viewsets import (
 )
 
 from pulp_container.app import models, serializers, tasks
+from pulp_container.constants import PULL_THROUGH_DISTRIBUTION_LABEL
 
 log = logging.getLogger(__name__)
 
@@ -1541,6 +1543,28 @@ class ContainerPullThroughDistributionViewSet(DistributionViewSet, RolesMixin):
         ],
     }
 
+    @action(
+        detail=True,
+        methods=["post"],
+        serializer_class=DistributionViewSet.set_label.kwargs["serializer_class"],
+    )
+    def set_label(self, request, pk=None, **kwargs):
+        """Prevent clients from changing the internal pull-through marker."""
+        if request.data.get("key") == PULL_THROUGH_DISTRIBUTION_LABEL:
+            raise ValidationError("This label is managed by pulp_container.")
+        return super().set_label(request, pk, **kwargs)
+
+    @action(
+        detail=True,
+        methods=["post"],
+        serializer_class=DistributionViewSet.unset_label.kwargs["serializer_class"],
+    )
+    def unset_label(self, request, pk=None, **kwargs):
+        """Prevent clients from removing the internal pull-through marker."""
+        if request.data.get("key") == PULL_THROUGH_DISTRIBUTION_LABEL:
+            raise ValidationError("This label is managed by pulp_container.")
+        return super().unset_label(request, pk, **kwargs)
+
 
 class ContainerNamespaceViewSet(
     NamedModelViewSet,

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/constants.py

@@ -75,6 +75,8 @@ SIGNATURE_PAYLOAD_MAX_SIZE = 4 * MEGABYTE
 
 SIGNATURE_API_EXTENSION_VERSION = 2
 
+PULL_THROUGH_DISTRIBUTION_LABEL = "pulp_container.pull_through"
+
 MANIFEST_TYPE = SimpleNamespace(
     ARTIFACT="artifact",
     BOOTABLE="bootable",

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/tests/functional/api/test_content_cache.py

@@ -76,7 +76,7 @@ def test_content_cache(
     monitor_task,
 ):
     """A test case that verifies the functionality of the Redis caching machinery."""
-    if not pulp_settings.get("CACHE_ENABLED"):
+    if not getattr(pulp_settings, "CACHE_ENABLED", False):
         pytest.skip("The caching machinery was not enabled")
 
     repo = container_repository_factory()

{pulp_container-2.26.16 → pulp_container-2.26.18}/pulp_container/tests/functional/api/test_domains.py

@@ -222,11 +222,12 @@ def test_cross_domain_pulp_apis(
         },
         pulp_domain=domain1.name,
     )
+    pt_distribution_name = str(uuid.uuid4())
     with pytest.raises(container_bindings.ApiException) as e:
         container_bindings.DistributionsPullThroughApi.create(
             {
-                "name": str(uuid.uuid4()),
-                "base_path": str(uuid.uuid4()),
+                "name": pt_distribution_name,
+                "base_path": pt_distribution_name,
                 "remote": pt_remote.pulp_href,
             },
             pulp_domain=domain2.name,