pulp-container 2.29.0__tar.gz → 2.29.2__tar.gz

{pulp_container-2.29.0 → pulp_container-2.29.2}/CHANGES.md

@@ -8,6 +8,23 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.29.2 (2026-10-08) {: #2.29.2 }
+
+#### Bugfixes {: #2.29.2-bugfix }
+
+- Fixed global auth token leakage. CVE-2026-103868
+
+---
+
+## 2.29.1 (2026-09-23) {: #2.29.1 }
+
+#### Bugfixes {: #2.29.1-bugfix }
+
+- Prevent container distributions from overlapping other distribution base paths. Pull-through distributions **NEED** to be fixed before upgrading pulpcore; run `pulpcore-manager container-repair-pull-through-distributions` to repair existing distributions.
+  [#2494](https://github.com/pulp/pulp_container/issues/2494)
+
+---
+
 ## 2.29.0 (2026-08-10) {: #2.29.0 }
 
 #### Features {: #2.29.0-feature }

{pulp_container-2.29.0 → pulp_container-2.29.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.0
+Version: 2.29.2
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -18,7 +18,7 @@ Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: jsonschema<4.27,>=4.4
-Requires-Dist: pulpcore<3.130,>=3.111.0
-Requires-Dist: pyjwt[crypto]<2.14,>=2.4
-Requires-Dist: pysequoia<0.2.0,>=0.1.33
+Requires-Dist: pulpcore<3.130,>=3.118.0
+Requires-Dist: pyjwt[crypto]<2.16,>=2.4
+Requires-Dist: pysequoia<0.2.0,>=0.1.35
 Dynamic: license-file

{pulp_container-2.29.0 → pulp_container-2.29.2}/functest_requirements.txt

@@ -1,6 +1,5 @@
 pytest<10
-python-gnupg
 pytest-xdist
 pytest-timeout
 pytest-custom_exit_code
-trustme~=1.2.1
+trustme~=1.2.1

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.29.0"
+    version = "2.29.2"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/authorization.py

@@ -10,7 +10,6 @@ import jwt
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 from django.conf import settings
-from django.db.models import F, Value
 from django.http import HttpRequest
 from rest_framework.request import Request
 
@@ -21,8 +20,8 @@ from pulp_container.app.access_policy import RegistryAccessPolicy
 from pulp_container.app.models import (
     ContainerDistribution,
     ContainerNamespace,
-    ContainerPullThroughDistribution,
 )
+from pulp_container.app.pull_through import get_pull_through_distribution
 
 TOKEN_EXPIRATION_TIME = getattr(settings, "TOKEN_EXPIRATION_TIME", 300)
 
@@ -209,15 +208,6 @@ class AuthorizationService:
         }
 
 
-def get_pull_through_distribution(path, domain):
-    return (
-        ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-        .filter(pulp_domain=domain, path__startswith=F("base_path"))
-        .order_by("-base_path")
-        .first()
-    )
-
-
 class PermissionChecker:
     def __init__(self, user):
         self.user = user

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/cache.py

@@ -1,11 +1,14 @@
 from django.core.exceptions import ObjectDoesNotExist
-from django.db.models import F, Value
 
 from pulpcore.plugin.cache import AsyncContentCache, CacheKeys, SyncContentCache
 from pulpcore.plugin.util import cache_key, get_domain
 
 from pulp_container.app.exceptions import RepositoryNotFound
-from pulp_container.app.models import ContainerDistribution, ContainerPullThroughDistribution
+from pulp_container.app.models import ContainerDistribution
+from pulp_container.app.pull_through import (
+    get_pull_through_distribution,
+    get_pull_through_distribution_path,
+)
 
 ACCEPT_HEADER_KEY = "accept_header"
 QUERY_KEY = "query"
@@ -37,9 +40,9 @@ class RegistryContentCache(RegistryCache, AsyncContentCache):
         key = ":".join(all_keys[k] for k in self.keys)
         return key
 
-    async def make_response(self, key, base_key):
+    async def make_response(self, key, base_key, *args, **kwargs):
         """Fix the Content-Type header to remove the charset."""
-        response = await super().make_response(key, base_key)
+        response = await super().make_response(key, base_key, *args, **kwargs)
         if response is not None:
             if content_type := response.headers.get("Content-Type"):
                 response.headers["Content-Type"] = content_type.split(";")[0]
@@ -83,15 +86,12 @@ def find_base_path_cached(request, cached):
         try:
             distro = ContainerDistribution.objects.get(base_path=path, pulp_domain=domain)
         except ObjectDoesNotExist:
-            distro = (
-                ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-                .filter(path__startswith=F("base_path"), pulp_domain=domain)
-                .order_by("-base_path")
-                .first()
-            )
+            distro = get_pull_through_distribution(path, domain)
             if not distro:
                 raise RepositoryNotFound(name=path)
 
+            return cache_key(get_pull_through_distribution_path(distro))
+
         return cache_key(distro.base_path)
 
 

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/checks.py

@@ -1,6 +1,11 @@
 from django.conf import settings
 from django.core.checks import Error as CheckError
+from django.core.checks import Warning as CheckWarning
 from django.core.checks import register
+from django.db import OperationalError, ProgrammingError
+
+from pulp_container.app.models import ContainerPullThroughDistribution
+from pulp_container.constants import PULL_THROUGH_DISTRIBUTION_LABEL
 
 
 @register(deploy=True)
@@ -45,3 +50,28 @@ def container_settings_check(app_configs, **kwargs):
         )
 
     return errors
+
+
+@register()
+def pull_through_distribution_check(app_configs, **kwargs):
+    """Warn when legacy pull-through distributions need repair."""
+    try:
+        needs_repair = ContainerPullThroughDistribution.objects.exclude(
+            pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL
+        ).exists()
+    except (OperationalError, ProgrammingError):
+        return []
+
+    if not needs_repair:
+        return []
+
+    return [
+        CheckWarning(
+            "Pull-through distributions need base-path repair.",
+            hint=(
+                "Run 'pulpcore-manager container-repair-pull-through-distributions' and "
+                "resolve any distributions it reports."
+            ),
+            id="pulp_container.W001",
+        )
+    ]

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/downloaders.py

@@ -25,15 +25,12 @@ class RegistryAuthHttpDownloader(HttpDownloader):
     Additionally, use custom headers from DeclarativeArtifact.extra_data['headers']
     """
 
-    registry_auth = {"bearer": None, "basic": None}
-    token_lock = asyncio.Lock()
-
     def __init__(self, *args, **kwargs):
         """
         Initialize the downloader.
         """
         self.remote = kwargs.pop("remote")
-
+        self.factory = kwargs.pop("factory")
         super().__init__(*args, **kwargs)
 
     async def _run(self, handle_401=True, extra_data=None):
@@ -57,8 +54,8 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             headers = extra_data.get("headers", headers)
             repo_name = extra_data.get("repo_name", None)
         http_method = extra_data.get("http_method", "get") if extra_data is not None else "get"
-        this_token = self.registry_auth["bearer"]
-        basic_auth = self.registry_auth["basic"]
+        this_token = self.factory.registry_auth["bearer"]
+        basic_auth = self.factory.registry_auth["basic"]
         auth_headers = self.auth_header(this_token, basic_auth)
         headers.update(auth_headers)
         # aiohttps does not allow to send auth argument and auth header together
@@ -81,16 +78,16 @@ class RegistryAuthHttpDownloader(HttpDownloader):
                     if "bearer" in response_auth_header.lower():
                         # Token has not been updated during request
                         if (
-                            self.registry_auth["bearer"] is None
-                            or self.registry_auth["bearer"] == this_token
+                            self.factory.registry_auth["bearer"] is None
+                            or self.factory.registry_auth["bearer"] == this_token
                         ):
-                            self.registry_auth["bearer"] = None
+                            self.factory.registry_auth["bearer"] = None
                             await self.update_token(response_auth_header, this_token, repo_name)
                         return await self._run(handle_401=False, extra_data=extra_data)
                     elif "basic" in response_auth_header.lower():
                         if self.remote.username:
                             basic = aiohttp.BasicAuth(self.remote.username, self.remote.password)
-                            self.registry_auth["basic"] = basic.encode()
+                            self.factory.registry_auth["basic"] = basic.encode()
                         return await self._run(handle_401=False, extra_data=extra_data)
                 else:
                     raise
@@ -111,10 +108,10 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         """
         Update the Bearer token to be used with all requests.
         """
-        async with self.token_lock:
+        async with self.factory.token_lock:
             if (
-                self.registry_auth["bearer"] is not None
-                and self.registry_auth["bearer"] == used_token
+                self.factory.registry_auth["bearer"] is not None
+                and self.factory.registry_auth["bearer"] == used_token
             ):
                 return
             log.info("Updating bearer token")
@@ -157,7 +154,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
 
             token_js = json.loads(token_data)
             token = token_js.get("token") or token_js.get("access_token")
-            self.registry_auth["bearer"] = token
+            self.factory.registry_auth["bearer"] = token
 
     @staticmethod
     def auth_header(token, basic_auth):
@@ -187,6 +184,21 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         )
 
 
+class RegistryAuthDownloaderFactory(DownloaderFactory):
+    """
+    A downloader factory for registry access that can also share the authentication tokens.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.registry_auth = {"bearer": None, "basic": None}
+        self.token_lock = asyncio.Lock()
+
+    def _http_or_https(self, download_class, url, **kwargs):
+        kwargs.setdefault("factory", self)
+        return super()._http_or_https(download_class, url, **kwargs)
+
+
 class NoAuthSignatureDownloader(HttpDownloader):
     """A downloader class suited for signature downloads."""
 

pulp_container-2.29.2/pulp_container/app/management/commands/container-repair-pull-through-distributions.py

@@ -0,0 +1,73 @@
+from gettext import gettext as _
+from uuid import uuid4
+
+from django.conf import settings
+from django.core.management import BaseCommand
+from django.db import transaction
+
+from pulpcore.plugin.cache import SyncContentCache
+
+from pulp_container.app.models import ContainerPullThroughDistribution
+from pulp_container.app.pull_through import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+    find_container_distribution_overlaps,
+)
+
+
+class Command(BaseCommand):
+    """Repair pull-through distributions whose registry path is stored as their base path."""
+
+    help = _("Repair pull-through distribution base paths and report remaining overlaps.")
+
+    def handle(self, *args, **options):
+        """Move eligible pull-through base paths and report unresolved overlaps."""
+        repaired = 0
+        migrated_base_paths_and_domain = []
+        distributions = ContainerPullThroughDistribution.objects.exclude(
+            pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL
+        ).select_related("pulp_domain")
+
+        for distribution in distributions.iterator():
+            old_base_path = distribution.base_path
+            distribution.base_path = str(uuid4())
+            distribution.pulp_labels = {
+                **(distribution.pulp_labels or {}),
+                PULL_THROUGH_DISTRIBUTION_LABEL: old_base_path,
+            }
+            migrated_base_paths_and_domain.append((old_base_path, distribution.pulp_domain))
+            with transaction.atomic():
+                distribution.save(update_fields=["base_path", "pulp_labels"])
+            repaired += 1
+
+        self.stdout.write(self.style.SUCCESS(f"Repaired {repaired} pull-through distributions."))
+
+        overlaps = find_container_distribution_overlaps()
+        if overlaps:
+            self.stdout.write(
+                self.style.WARNING(
+                    "The following container distributions have overlapping base paths:"
+                )
+            )
+            for distribution, other in overlaps:
+                self.stdout.write(
+                    f"  {self._format_distribution(distribution).strip()} overlaps "
+                    f"{self._format_distribution(other).strip()}"
+                )
+
+        if settings.CACHE_ENABLED and migrated_base_paths_and_domain:
+            if settings.DOMAIN_ENABLED:
+                old_base_paths = [
+                    f"{domain.name}:{base_path}"
+                    for base_path, domain in migrated_base_paths_and_domain
+                ]
+            else:
+                old_base_paths = [base_path for base_path, _ in migrated_base_paths_and_domain]
+            SyncContentCache().delete(base_key=old_base_paths)
+            self.stdout.write(self.style.SUCCESS("Flushed repaired distribution cache entries."))
+
+    @staticmethod
+    def _format_distribution(distribution):
+        return (
+            f"  domain={distribution.pulp_domain.name!r} pk={distribution.pk} "
+            f"name={distribution.name!r} base_path={distribution.base_path!r}"
+        )

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/models.py

@@ -13,7 +13,6 @@ from django.shortcuts import redirect
 from django_lifecycle import AFTER_CREATE, AFTER_DELETE, AFTER_UPDATE, hook
 
 from pulpcore.plugin.cache import SyncContentCache
-from pulpcore.plugin.download import DownloaderFactory
 from pulpcore.plugin.models import (
     Artifact,
     AutoAddObjPermsMixin,
@@ -510,17 +509,17 @@ class ContainerRemote(Remote, AutoAddObjPermsMixin):
         """
         Downloader Factory that maps to custom downloaders which support registry auth.
 
-        Upon first access, the DownloaderFactory is instantiated and saved internally.
+        Upon first access, the RegistryAuthDownloaderFactory is instantiated and saved internally.
 
         Returns:
-            DownloadFactory: The instantiated DownloaderFactory to be used by
+            DownloadFactory: The instantiated RegistryAuthDownloaderFactory to be used by
                 get_downloader()
 
         """
         try:
             return self._download_factory
         except AttributeError:
-            self._download_factory = DownloaderFactory(
+            self._download_factory = downloaders.RegistryAuthDownloaderFactory(
                 self,
                 downloader_overrides={
                     "http": downloaders.RegistryAuthHttpDownloader,

pulp_container-2.29.2/pulp_container/app/pull_through.py

@@ -0,0 +1,69 @@
+from django.db.models import F, Q, TextField, Value
+from django.db.models.functions import Concat
+
+from pulpcore.plugin.models import Distribution
+
+from pulp_container.app.models import ContainerDistribution, ContainerPullThroughDistribution
+from pulp_container.constants import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+)
+
+
+def is_pull_through_distribution_marked(distribution):
+    """Return whether a pull-through distribution stores its registry path in pulp_labels."""
+    return (distribution.pulp_labels or {}).get(PULL_THROUGH_DISTRIBUTION_LABEL)
+
+
+def get_pull_through_distribution_path(distribution):
+    """Return the registry path represented by a pull-through distribution."""
+    if base_path := is_pull_through_distribution_marked(distribution):
+        return base_path
+    return distribution.base_path
+
+
+def _match_path(queryset, path, field):
+    """Return the longest segment-aware path match from a queryset."""
+    prefix_field = f"{field}_prefix"
+    return (
+        queryset.annotate(
+            requested_path=Value(path, output_field=TextField()),
+            **{prefix_field: Concat(F(field), Value("/"), output_field=TextField())},
+        )
+        .filter(Q(requested_path=F(field)) | Q(requested_path__startswith=F(prefix_field)))
+        .order_by(f"-{field}")
+        .first()
+    )
+
+
+def get_pull_through_distribution(path, domain):
+    """Find a pull-through distribution using the repaired scheme, then the legacy scheme."""
+    distributions = ContainerPullThroughDistribution.objects.filter(pulp_domain=domain)
+    marked = distributions.filter(pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL)
+    if distribution := _match_path(marked, path, f"pulp_labels__{PULL_THROUGH_DISTRIBUTION_LABEL}"):
+        return distribution
+
+    legacy = distributions.exclude(pulp_labels__has_key=PULL_THROUGH_DISTRIBUTION_LABEL)
+    return _match_path(legacy, path, "base_path")
+
+
+def find_container_distribution_overlaps():
+    """Return pairs where a container distribution overlaps any distribution."""
+    container_ids = set(ContainerDistribution.objects.values_list("pk", flat=True))
+    distributions = Distribution.objects.select_related("pulp_domain").order_by(
+        "pulp_domain_id", "base_path", "pk"
+    )
+    by_domain_and_path = {
+        (distribution.pulp_domain_id, distribution.base_path): distribution
+        for distribution in distributions.iterator()
+    }
+    overlaps = []
+
+    for distribution in by_domain_and_path.values():
+        parts = distribution.base_path.split("/")
+        for index in range(1, len(parts)):
+            parent_path = "/".join(parts[:index])
+            if parent := by_domain_and_path.get((distribution.pulp_domain_id, parent_path)):
+                if parent.pk in container_ids or distribution.pk in container_ids:
+                    overlaps.append((parent, distribution))
+
+    return overlaps

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/registry_api.py

@@ -75,6 +75,10 @@ from pulp_container.app.exceptions import (
     RepositoryInvalid,
     RepositoryNotFound,
 )
+from pulp_container.app.pull_through import (
+    get_pull_through_distribution,
+    get_pull_through_distribution_path,
+)
 from pulp_container.app.redirects import (
     AzureStorageRedirects,
     FileStorageRedirects,
@@ -366,18 +370,12 @@ class ContainerRegistryApiMixin:
 
     def get_pull_through_drv(self, path):
         domain = get_domain()
-        pull_through_cache_distribution = (
-            models.ContainerPullThroughDistribution.objects.annotate(path=Value(path))
-            .filter(path__startswith=F("base_path"), pulp_domain=domain)
-            .order_by("-base_path")
-            .first()
-        )
+        pull_through_cache_distribution = get_pull_through_distribution(path, domain)
         if not pull_through_cache_distribution or not self.request.user.is_authenticated:
             raise RepositoryNotFound(name=path)
 
-        upstream_name = path.split(pull_through_cache_distribution.base_path, maxsplit=1)[1].strip(
-            "/"
-        )
+        pull_through_path = get_pull_through_distribution_path(pull_through_cache_distribution)
+        upstream_name = path.split(pull_through_path, maxsplit=1)[1].strip("/")
         try:
             pull_through_remote = models.ContainerPullThroughRemote.objects.get(
                 pk=pull_through_cache_distribution.remote_id

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/serializers.py

@@ -1,5 +1,6 @@
 import re
 from gettext import gettext as _
+from uuid import uuid4
 
 from django.core.validators import URLValidator
 from pulp_file.app.models import FileContent
@@ -33,13 +34,31 @@ from pulpcore.plugin.util import get_domain
 
 from pulp_container.app import fields, models
 from pulp_container.app.utils import get_full_path
-from pulp_container.constants import SIGNATURE_TYPE
+from pulp_container.constants import (
+    PULL_THROUGH_DISTRIBUTION_LABEL,
+    SIGNATURE_TYPE,
+)
 
 VALID_SIGNATURE_NAME_REGEX = r"^sha256:[0-9a-f]{64}@[0-9a-f]{32}$"
 VALID_TAG_REGEX = r"^[A-Za-z0-9][A-Za-z0-9._-]*$"
 VALID_BASE_PATH_REGEX_COMPILED = re.compile(r"^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9])*$")
 
 
+def validate_registry_path(value):
+    """Validate a path that will be exposed by the container registry."""
+    if len(value) > 255:
+        raise serializers.ValidationError(
+            _("The entered registry path cannot be longer than 255 characters.")
+        )
+
+    if not all(re.match(VALID_BASE_PATH_REGEX_COMPILED, part) for part in value.split("/")):
+        raise serializers.ValidationError(
+            _("The provided registry path contains forbidden characters.")
+        )
+
+    return value
+
+
 class TagSerializer(NoArtifactContentSerializer):
     """
     Serializer for Tags.
@@ -499,17 +518,9 @@ class ContainerDistributionSerializer(DistributionSerializer, GetOrCreateSeriali
 
     def validate_base_path(self, value):
         """Check whether the passed repository base path is valid or not."""
-        if len(value) > 255:
-            raise serializers.ValidationError(
-                _("The entered base path cannot be longer than 255 characters.")
-            )
-
-        if not all(re.match(VALID_BASE_PATH_REGEX_COMPILED, p) for p in value.split("/")):
-            raise serializers.ValidationError(
-                _("The provided base path contains forbidden characters.")
-            )
-
-        return value
+        validate_registry_path(value)
+        # Ensure we follow pulpcore's cross-distribution overlap validation in addition to the OCI rules.
+        return super().validate_base_path(value)
 
     class Meta:
         model = models.ContainerDistribution
@@ -556,18 +567,49 @@ class ContainerPullThroughDistributionSerializer(DistributionSerializer):
     description = serializers.CharField(
         help_text=_("An optional description."), required=False, allow_null=True
     )
+    base_path = serializers.CharField(
+        help_text=_("The registry path exposed by this pull-through distribution.")
+    )
+
+    def validate_base_path(self, value):
+        """Check whether the passed repository base path is valid or not."""
+        validate_registry_path(value)
+        # Ensure we follow pulpcore's cross-distribution overlap validation in addition to the OCI rules.
+        return super().validate_base_path(value)
 
     def validate(self, data):
         validated_data = super().validate(data)
+        registry_path = validated_data.get("base_path")
+
+        # This is the temporary fix for pull-through distros violating core's overlapping base-path rule
+        # Save the base_path in pulp_labels to avoid overlapping base-paths with this PT's child distros
+        # A permanent fix should have us move off this field or Distributions all together.
+        if self.instance is None:
+            base_path = validated_data.pop("base_path")
+            validated_data["base_path"] = str(uuid4())
+            validated_data.setdefault("pulp_labels", {})[PULL_THROUGH_DISTRIBUTION_LABEL] = (
+                base_path
+            )
+        elif (
+            "base_path" in validated_data and validated_data["base_path"] != self.instance.base_path
+        ):
+            is_marked = (self.instance.pulp_labels or {}).get(PULL_THROUGH_DISTRIBUTION_LABEL)
+            if is_marked:
+                message = _("This value cannot be updated.")
+            else:
+                message = _(
+                    "Run 'pulpcore-manager container-repair-pull-through-distributions' before "
+                    "updating this value."
+                )
+            raise serializers.ValidationError({"base_path": message})
 
         if "content_guard" not in validated_data:
             validated_data["content_guard"] = ContentRedirectContentGuardSerializer.get_or_create(
                 {"name": "content redirect", "pulp_domain": get_domain()}
             )
 
-        base_path = validated_data.get("base_path")
-        if base_path:
-            namespace_name = base_path.split("/")[0]
+        if registry_path:
+            namespace_name = registry_path.split("/")[0]
             validated_data["namespace"] = ContainerNamespaceSerializer.get_or_create(
                 {"name": namespace_name, "pulp_domain": get_domain()}
             )

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/app/viewsets.py

@@ -11,6 +11,7 @@ from django_filters import CharFilter, MultipleChoiceFilter
 from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
+from rest_framework.exceptions import ValidationError
 
 from pulpcore.plugin.models import Content, PulpTemporaryFile
 from pulpcore.plugin.serializers import AsyncOperationResponseSerializer
@@ -40,6 +41,7 @@ from pulpcore.plugin.viewsets import (
 )
 
 from pulp_container.app import models, serializers, tasks
+from pulp_container.constants import PULL_THROUGH_DISTRIBUTION_LABEL
 
 log = logging.getLogger(__name__)
 
@@ -1599,6 +1601,28 @@ class ContainerPullThroughDistributionViewSet(DistributionViewSet, RolesMixin):
         ],
     }
 
+    @action(
+        detail=True,
+        methods=["post"],
+        serializer_class=DistributionViewSet.set_label.kwargs["serializer_class"],
+    )
+    def set_label(self, request, pk=None, **kwargs):
+        """Prevent clients from changing the internal pull-through marker."""
+        if request.data.get("key") == PULL_THROUGH_DISTRIBUTION_LABEL:
+            raise ValidationError("This label is managed by pulp_container.")
+        return super().set_label(request, pk, **kwargs)
+
+    @action(
+        detail=True,
+        methods=["post"],
+        serializer_class=DistributionViewSet.unset_label.kwargs["serializer_class"],
+    )
+    def unset_label(self, request, pk=None, **kwargs):
+        """Prevent clients from removing the internal pull-through marker."""
+        if request.data.get("key") == PULL_THROUGH_DISTRIBUTION_LABEL:
+            raise ValidationError("This label is managed by pulp_container.")
+        return super().unset_label(request, pk, **kwargs)
+
 
 class ContainerNamespaceViewSet(
     NamedModelViewSet,

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/constants.py

@@ -75,6 +75,8 @@ SIGNATURE_PAYLOAD_MAX_SIZE = 4 * MEGABYTE
 
 SIGNATURE_API_EXTENSION_VERSION = 2
 
+PULL_THROUGH_DISTRIBUTION_LABEL = "pulp_container.pull_through"
+
 MANIFEST_TYPE = SimpleNamespace(
     ARTIFACT="artifact",
     BOOTABLE="bootable",

{pulp_container-2.29.0 → pulp_container-2.29.2}/pulp_container/tests/functional/api/test_domains.py

@@ -237,11 +237,12 @@ def test_cross_domain_pulp_apis(
         },
         pulp_domain=domain1.name,
     )
+    pt_distribution_name = str(uuid.uuid4())
     with pytest.raises(container_bindings.ApiException) as e:
         container_bindings.DistributionsPullThroughApi.create(
             {
-                "name": str(uuid.uuid4()),
-                "base_path": str(uuid.uuid4()),
+                "name": pt_distribution_name,
+                "base_path": pt_distribution_name,
                 "remote": pt_remote.pulp_href,
             },
             pulp_domain=domain2.name,