pulp-container 2.29.2__tar.gz → 2.29.3__tar.gz

{pulp_container-2.29.2 → pulp_container-2.29.3}/CHANGES.md

@@ -8,6 +8,20 @@
 
 [//]: # (towncrier release notes start)
 
+## 2.29.3 (2026-10-28) {: #2.29.3 }
+
+#### Bugfixes {: #2.29.3-bugfix }
+
+- Allow anonymous pull-through for public distributions
+  [#1976](https://github.com/pulp/pulp_container/issues/1976)
+- Container blob downloads now respect each Domain's object storage redirect setting.
+- Fixed pull-through signature lookups failing with a 500 when the upstream registry (e.g. gcr.io) sends unquoted values in its bearer auth challenge.
+- Fixed the registry Authorization header leaking into a shared module-level headers dict, which could send one remote's credentials to another registry.
+- Retried GHCR requests that fail with 403 using a bearer token, and fell back to GET when a registry (e.g. ECR Public) rejects HEAD on blob endpoints.
+- Treat an explicitly empty Accept header like a missing header when retrieving registry blobs.
+
+---
+
 ## 2.29.2 (2026-10-08) {: #2.29.2 }
 
 #### Bugfixes {: #2.29.2-bugfix }

{pulp_container-2.29.2 → pulp_container-2.29.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.2
+Version: 2.29.3
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container/app/__init__.py

@@ -24,7 +24,7 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_container.app"
     label = "container"
-    version = "2.29.2"
+    version = "2.29.3"
     python_package_name = "pulp-container"
     domain_compatible = True
 

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container/app/downloaders.py

@@ -33,7 +33,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         self.factory = kwargs.pop("factory")
         super().__init__(*args, **kwargs)
 
-    async def _run(self, handle_401=True, extra_data=None):
+    async def _run(self, token_refresh_retries=2, extra_data=None):
         """
         Download, validate, and compute digests on the `url`. This is a coroutine.
 
@@ -45,13 +45,13 @@ class RegistryAuthHttpDownloader(HttpDownloader):
         :meth:`~pulpcore.plugin.download.BaseDownloader._run`.
 
         Args:
-            handle_401(bool): If true, catch 401, request a new token and retry.
+            token_refresh_retries(int): Number of times to retry the request
 
         """
         headers = {}
         repo_name = None
         if extra_data is not None:
-            headers = extra_data.get("headers", headers)
+            headers = dict(extra_data.get("headers", headers))
             repo_name = extra_data.get("repo_name", None)
         http_method = extra_data.get("http_method", "get") if extra_data is not None else "get"
         this_token = self.factory.registry_auth["bearer"]
@@ -73,7 +73,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             except ClientResponseError as e:
                 response_auth_header = response.headers.get("www-authenticate")
                 # Need to retry request
-                if handle_401 and e.status == 401 and response_auth_header is not None:
+                if token_refresh_retries and e.status == 401 and response_auth_header is not None:
                     # check if bearer or basic
                     if "bearer" in response_auth_header.lower():
                         # Token has not been updated during request
@@ -83,12 +83,22 @@ class RegistryAuthHttpDownloader(HttpDownloader):
                         ):
                             self.factory.registry_auth["bearer"] = None
                             await self.update_token(response_auth_header, this_token, repo_name)
-                        return await self._run(handle_401=False, extra_data=extra_data)
+                        return await self._run(
+                            token_refresh_retries=token_refresh_retries - 1, extra_data=extra_data
+                        )
                     elif "basic" in response_auth_header.lower():
                         if self.remote.username:
                             basic = aiohttp.BasicAuth(self.remote.username, self.remote.password)
                             self.factory.registry_auth["basic"] = basic.encode()
-                        return await self._run(handle_401=False, extra_data=extra_data)
+                        return await self._run(
+                            token_refresh_retries=token_refresh_retries - 1, extra_data=extra_data
+                        )
+                elif token_refresh_retries and e.status == 403 and this_token is not None:
+                    # handle 403 with bearer token, this is a special case for ghcr registry
+                    self.factory.registry_auth["bearer"] = None
+                    return await self._run(
+                        token_refresh_retries=token_refresh_retries - 1, extra_data=extra_data
+                    )
                 else:
                     raise
 
@@ -115,14 +125,7 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             ):
                 return
             log.info("Updating bearer token")
-            bearer_info_string = response_auth_header[len("Bearer ") :]
-            bearer_info_list = re.split(",(?=[^=,]+=)", bearer_info_string)
-
-            # The remaining string consists of comma seperated key=value pairs
-            auth_query_dict = {}
-            for key, value in (item.split("=") for item in bearer_info_list):
-                # The value is a string within a string, ex: '"value"'
-                auth_query_dict[key] = json.loads(value)
+            auth_query_dict = self.parse_auth_challenge(response_auth_header)
             try:
                 token_base_url = auth_query_dict.pop("realm")
             except KeyError:
@@ -156,6 +159,24 @@ class RegistryAuthHttpDownloader(HttpDownloader):
             token = token_js.get("token") or token_js.get("access_token")
             self.factory.registry_auth["bearer"] = token
 
+    @staticmethod
+    def parse_auth_challenge(response_auth_header):
+        """
+        Parse the parameters of a Bearer auth challenge into a dictionary.
+
+        Values may be quoted strings or plain tokens (RFC 7235), e.g. gcr.io responds with
+        'Bearer realm="https://gcr.io/v2/token",service=gcr.io'.
+        """
+        bearer_info_string = response_auth_header[len("Bearer ") :]
+        auth_query_dict = {}
+        for match in re.finditer(r'([^=,\s]+)=(?:"((?:[^"\\]|\\.)*)"|([^,]*))', bearer_info_string):
+            key, quoted, plain = match.groups()
+            if quoted is not None:
+                auth_query_dict[key] = re.sub(r"\\(.)", r"\1", quoted)
+            else:
+                auth_query_dict[key] = plain.strip()
+        return auth_query_dict
+
     @staticmethod
     def auth_header(token, basic_auth):
         """

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container/app/registry_api.py

@@ -32,6 +32,7 @@ from rest_framework.exceptions import (
     Throttled,
 )
 from rest_framework.generics import ListAPIView
+from rest_framework.negotiation import DefaultContentNegotiation
 from rest_framework.pagination import BasePagination
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.renderers import BaseRenderer, JSONRenderer
@@ -142,6 +143,15 @@ class ContentRenderer(BaseRenderer):
         return data
 
 
+class BlobContentNegotiation(DefaultContentNegotiation):
+    """Treat an explicitly empty Accept header like a missing header for blobs."""
+
+    def get_accept_list(self, request):
+        if request.headers.get("Accept") == "":
+            return ["*/*"]
+        return super().get_accept_list(request)
+
+
 class ManifestResponse(Response):
     """
     An HTTP response class for returning Manifets.
@@ -371,7 +381,11 @@ class ContainerRegistryApiMixin:
     def get_pull_through_drv(self, path):
         domain = get_domain()
         pull_through_cache_distribution = get_pull_through_distribution(path, domain)
-        if not pull_through_cache_distribution or not self.request.user.is_authenticated:
+        # allow anonymous pull-through access for public distributions
+        if not pull_through_cache_distribution:
+            raise RepositoryNotFound(name=path)
+        # user must be authenticated when pull-through is private
+        if pull_through_cache_distribution.private and not self.request.user.is_authenticated:
             raise RepositoryNotFound(name=path)
 
         pull_through_path = get_pull_through_distribution_path(pull_through_cache_distribution)
@@ -1122,7 +1136,7 @@ class RedirectsMixin:
         domain = get_domain()
         if (
             domain.storage_class == "pulpcore.app.models.storage.FileSystem"
-            or not settings.REDIRECT_TO_OBJECT_STORAGE
+            or not domain.redirect_to_object_storage
         ):
             self.redirects_class = FileStorageRedirects
         elif domain.storage_class == "storages.backends.s3boto3.S3Boto3Storage":
@@ -1139,6 +1153,7 @@ class Blobs(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
     """
 
     renderer_classes = [ContentRenderer]
+    content_negotiation_class = BlobContentNegotiation
 
     def head(self, request, path, pk=None):
         """
@@ -1204,10 +1219,25 @@ class Blobs(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
         relative_url = "/v2/{name}/blobs/{pk}".format(name=remote.namespaced_upstream_name, pk=pk)
         blob_url = urljoin(remote.url, relative_url)
         downloader = remote.get_downloader(url=blob_url)
+        used_get_fallback = False
         try:
-            response = downloader.fetch(
-                extra_data={"headers": V2_ACCEPT_HEADERS, "http_method": "head"}
-            )
+            try:
+                response = downloader.fetch(
+                    extra_data={"headers": V2_ACCEPT_HEADERS, "http_method": "head"}
+                )
+            except ClientResponseError as response_error:
+                if response_error.status in (401, 405):
+                    # Some registries (e.g. ECR Public) reject HEAD on blob endpoints
+                    # regardless of authentication; verify existence via GET instead
+                    used_get_fallback = True
+                    response = downloader.fetch(
+                        extra_data={
+                            "headers": {**V2_ACCEPT_HEADERS, "Range": "bytes=0-0"},
+                            "http_method": "get",
+                        }
+                    )
+                else:
+                    raise
         except ClientResponseError as response_error:
             if response_error.status == 429:
                 # the client could request the blob outside the docker hub pull limit;
@@ -1221,7 +1251,10 @@ class Blobs(RedirectsMixin, ContainerRegistryApiMixin, ViewSet):
             # The remote server is not available at the moment
             raise GatewayTimeout()
         else:
-            if response.headers.get("docker-content-digest") != pk:
+            # Registries that reject HEAD answer the ranged GET with a redirect that
+            # carries no docker-content-digest; the digest is verified later when the
+            # artifact is actually downloaded.
+            if not used_get_fallback and response.headers.get("docker-content-digest") != pk:
                 raise BlobNotFound(digest=pk)
         return blob_url
 
@@ -1772,7 +1805,11 @@ class Signatures(ContainerRegistryApiMixin, ViewSet):
             response_headers = {}
             try:
                 ping_response = ping_downloader.fetch(
-                    extra_data={"headers": V2_ACCEPT_HEADERS, "http_method": "get"}
+                    extra_data={
+                        "headers": V2_ACCEPT_HEADERS,
+                        "http_method": "get",
+                        "repo_name": remote.namespaced_upstream_name,
+                    }
                 )
                 response_headers = ping_response.headers
             except ClientResponseError as e:

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container/app/viewsets.py

@@ -1396,6 +1396,12 @@ class ContainerDistributionViewSet(DistributionViewSet, RolesMixin):
                     "has_model_or_domain_or_obj_perms:container.manage_roles_containerdistribution"
                 ],
             },
+            {
+                "action": ["pull_new_content"],
+                "principal": "*",
+                "effect": "allow",
+                "condition_expression": "not is_private",
+            },
             {
                 "action": ["pull_new_content"],
                 "principal": "authenticated",
@@ -1562,6 +1568,12 @@ class ContainerPullThroughDistributionViewSet(DistributionViewSet, RolesMixin):
                     "has_model_or_domain_or_obj_perms:container.manage_roles_containerpullthroughdistribution"  # noqa
                 ],
             },
+            {
+                "action": ["pull_new_distribution"],
+                "principal": "*",
+                "effect": "allow",
+                "condition_expression": "not is_private",
+            },
             {
                 "action": ["pull_new_distribution"],
                 "principal": "authenticated",

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container/tests/functional/api/test_pull_content.py

@@ -118,7 +118,7 @@ class TestPullContent:
         )
         assert content_response.content == digest_response.content
 
-    def test_create_empty_blob_on_the_fly(self, bindings_cfg, full_path, setup):
+    def test_create_empty_blob_on_the_fly(self, bindings_cfg, full_path, setup, local_registry):
         """
         Test if empty blob getscreated and served on the fly.
         """
@@ -135,6 +135,66 @@ class TestPullContent:
         header_digest = content_response.headers["docker-content-digest"].split(":")[1]
         assert digest == header_digest
 
+        head, _ = local_registry.get_response("HEAD", blob_path)
+        assert head.status_code == 200
+        assert head.headers["Docker-Content-Digest"] == EMPTY_BLOB
+        assert int(head.headers["Content-Length"]) == len(content_response.content)
+        assert head.content == b""
+
+    @pytest.mark.parametrize("blob_type", ["config", "layer"])
+    @pytest.mark.parametrize("method", ["GET", "HEAD"])
+    @pytest.mark.parametrize("accept", [None, "", "*/*"])
+    def test_blob_accept_header(
+        self, blob_type, method, accept, bindings_cfg, full_path, setup, local_registry
+    ):
+        """Blob GET and HEAD redirect successfully for any supported Accept header."""
+        _, distribution, _ = setup
+        path = full_path(distribution)
+        tag = PULP_HELLO_WORLD_LINUX_TAG.lstrip(":")
+        manifest_headers = {
+            "Accept": f"{MEDIA_TYPE.MANIFEST_V2}, {MEDIA_TYPE.MANIFEST_OCI}, "
+            f"{MEDIA_TYPE.MANIFEST_LIST}, {MEDIA_TYPE.INDEX_OCI}"
+        }
+        manifest, _ = local_registry.get_response(
+            "GET", f"/v2/{path}/manifests/{tag}", headers=manifest_headers
+        )
+        manifest.raise_for_status()
+        manifest_data = manifest.json()
+        while "manifests" in manifest_data:
+            child_digest = manifest_data["manifests"][0]["digest"]
+            manifest, _ = local_registry.get_response(
+                "GET", f"/v2/{path}/manifests/{child_digest}", headers=manifest_headers
+            )
+            manifest.raise_for_status()
+            manifest_data = manifest.json()
+        descriptor = (
+            manifest_data["config"] if blob_type == "config" else manifest_data["layers"][0]
+        )
+        digest = descriptor["digest"]
+        blob_path = f"/v2/{path}/blobs/{digest}"
+        headers = {"Accept": accept}
+
+        response, auth = local_registry.get_response(
+            method, blob_path, headers=headers, allow_redirects=False
+        )
+        assert response.status_code == 302
+        assert response.headers["Location"]
+
+        if method == "HEAD":
+            head = requests.head(
+                urljoin(bindings_cfg.host, blob_path),
+                auth=auth,
+                headers=headers,
+                allow_redirects=True,
+            )
+            assert head.status_code == 200
+            assert int(head.headers["Content-Length"]) == descriptor["size"]
+            assert head.content == b""
+
+        download = requests.get(urljoin(bindings_cfg.host, blob_path), auth=auth, headers=headers)
+        download.raise_for_status()
+        assert f"sha256:{hashlib.sha256(download.content).hexdigest()}" == digest
+
     def test_pull_image_from_repository(self, local_registry, registry_client, full_path, setup):
         """Verify that a client can pull the image from Pulp.
 

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container/tests/functional/api/test_pull_through_cache.py

@@ -60,6 +60,9 @@ def pull_and_verify(
     monitor_task,
 ):
     def _pull_and_verify(images, pull_through_distribution):
+        if pull_through_distribution.private and settings.TOKEN_AUTH_DISABLED:
+            pytest.skip("RBAC cannot be tested when token authentication is disabled")
+
         tags_to_verify = []
         pull_through_path = pull_through_distribution.pulp_labels[PULL_THROUGH_DISTRIBUTION_LABEL]
         for version, image_path in enumerate(images, start=1):
@@ -67,12 +70,14 @@ def pull_and_verify(
             local_image_path = f"{pull_through_path}/{image_path}"
             local_image_pull_path = full_path(local_image_path)  # Handle if domain is enabled
 
-            # 0. test if an anonymous user cannot pull new content through the pull-through cache
-            with anonymous_user, pytest.raises(CalledProcessError):
+            # 1. Pull new content anonymously from public caches; private caches require auth.
+            if pull_through_distribution.private:
+                with anonymous_user, pytest.raises(CalledProcessError):
+                    local_registry.pull(local_image_pull_path)
                 local_registry.pull(local_image_pull_path)
-
-            # 1. pull remote content through the pull-through distribution
-            local_registry.pull(local_image_pull_path)
+            else:
+                with anonymous_user:
+                    local_registry.pull(local_image_pull_path)
             local_image = local_registry.inspect(local_image_pull_path)
 
             # when the client pulls the image, a repository, distribution, and remote is created in
@@ -119,9 +124,13 @@ def pull_and_verify(
             tags = container_tag_api.list(repository_version=repository.latest_version_href).results
             assert sorted(tags_to_verify) == sorted([tag.name for tag in tags])
 
-            # 6. test if the anonymous user can pull existing content via the pull-through cache
-            with anonymous_user:
-                local_registry.pull(local_image_pull_path)
+            # 6. Cached content must retain the distribution's access restrictions.
+            if pull_through_distribution.private:
+                with anonymous_user, pytest.raises(CalledProcessError):
+                    local_registry.pull(local_image_pull_path)
+            else:
+                with anonymous_user:
+                    local_registry.pull(local_image_pull_path)
 
     return _pull_and_verify
 
@@ -134,14 +143,18 @@ def test_pull_through_distribution_uses_internal_base_path(pull_through_distribu
     assert distribution.pulp_labels[PULL_THROUGH_DISTRIBUTION_LABEL] != distribution.name
 
 
-def test_manifest_list_pull(delete_orphans_pre, pull_through_distribution, pull_and_verify):
+@pytest.mark.parametrize("private", [False, True])
+def test_manifest_list_pull(
+    delete_orphans_pre, pull_through_distribution, pull_and_verify, private
+):
     images = [f"{PULP_HELLO_WORLD_REPO}:latest", f"{PULP_HELLO_WORLD_REPO}:linux"]
-    pull_and_verify(images, pull_through_distribution())
+    pull_and_verify(images, pull_through_distribution(private=private))
 
 
-def test_manifest_pull(delete_orphans_pre, pull_through_distribution, pull_and_verify):
+@pytest.mark.parametrize("private", [False, True])
+def test_manifest_pull(delete_orphans_pre, pull_through_distribution, pull_and_verify, private):
     images = [f"{PULP_FIXTURE_1}:manifest_a", f"{PULP_FIXTURE_1}:manifest_b"]
-    pull_and_verify(images, pull_through_distribution())
+    pull_and_verify(images, pull_through_distribution(private=private))
 
 
 def test_pull_by_digest(
@@ -153,34 +166,47 @@ def test_pull_by_digest(
     full_path,
     gen_user,
 ):
+    if settings.TOKEN_AUTH_DISABLED:
+        pytest.skip("RBAC cannot be tested when token authentication is disabled")
+
     # THIS TEST FAILS WHEN THE CONTENT IS ALREADY PRESENT IN PULP!!
     image1 = f"{PULP_HELLO_WORLD_REPO}@{PULP_HELLO_WORLD_LINUX_AMD64_DIGEST}"
     image2 = f"{PULP_FIXTURE_1}@{PULP_FIXTURE_1_MANIFEST_A_DIGEST}"
     distribution1 = pull_through_distribution()
-    distribution2 = pull_through_distribution()
+    distribution2 = pull_through_distribution(private=True)
     path1 = distribution1.pulp_labels[PULL_THROUGH_DISTRIBUTION_LABEL]
     path2 = distribution2.pulp_labels[PULL_THROUGH_DISTRIBUTION_LABEL]
     local_image_path1 = f"{full_path(path1)}/{image1}"
     local_image_path2 = f"{full_path(path2)}/{image2}"
 
-    with anonymous_user, pytest.raises(CalledProcessError):
+    with anonymous_user:
         local_registry.pull(local_image_path1)
 
-    local_registry.pull(local_image_path1)
-
     add_pull_through_entities_to_cleanup(local_image_path1.split("@")[0])
 
     with anonymous_user:
         local_registry.pull(local_image_path1)
 
-    with gen_user():
-        local_registry.pull(local_image_path1)
-
-    with gen_user(), pytest.raises(CalledProcessError):
+    consumer = gen_user(
+        object_roles=[
+            ("container.containerpullthroughdistribution_consumer", distribution2.pulp_href)
+        ]
+    )
+    unprivileged_user = gen_user()
+    with anonymous_user, pytest.raises(CalledProcessError):
+        local_registry.pull(local_image_path2)
+    with unprivileged_user, pytest.raises(CalledProcessError):
+        local_registry.pull(local_image_path2)
+    with consumer:
         local_registry.pull(local_image_path2)
 
-    with gen_user(model_roles=["container.containernamespace_collaborator"]):
-        local_registry.pull(local_image_path1)
+    add_pull_through_entities_to_cleanup(local_image_path2.split("@")[0])
+
+    with anonymous_user, pytest.raises(CalledProcessError):
+        local_registry.pull(local_image_path2)
+    with unprivileged_user, pytest.raises(CalledProcessError):
+        local_registry.pull(local_image_path2)
+    with consumer:
         local_registry.pull(local_image_path2)
 
 

pulp_container-2.29.3/pulp_container/tests/unit/test_downloaders.py

@@ -0,0 +1,33 @@
+import pytest
+
+from pulp_container.app.downloaders import RegistryAuthHttpDownloader
+
+
+@pytest.mark.parametrize(
+    "header,expected",
+    [
+        (
+            'Bearer realm="https://auth.docker.io/token",service="registry.docker.io"',
+            {"realm": "https://auth.docker.io/token", "service": "registry.docker.io"},
+        ),
+        (
+            'Bearer realm="https://gcr.io/v2/token",service=gcr.io',
+            {"realm": "https://gcr.io/v2/token", "service": "gcr.io"},
+        ),
+        (
+            'Bearer realm="https://quay.io/v2/auth",service="quay.io",'
+            'scope="repository:foo/bar:pull,push"',
+            {
+                "realm": "https://quay.io/v2/auth",
+                "service": "quay.io",
+                "scope": "repository:foo/bar:pull,push",
+            },
+        ),
+        (
+            'Bearer realm="https://example.com/token", service=example.com, error="a \\"b\\""',
+            {"realm": "https://example.com/token", "service": "example.com", "error": 'a "b"'},
+        ),
+    ],
+)
+def test_parse_auth_challenge(header, expected):
+    assert RegistryAuthHttpDownloader.parse_auth_challenge(header) == expected

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-container
-Version: 2.29.2
+Version: 2.29.3
 Summary: Container plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_container-2.29.2 → pulp_container-2.29.3}/pulp_container.egg-info/SOURCES.txt

@@ -148,6 +148,7 @@ pulp_container/tests/functional/api/test_sync_signatures.py
 pulp_container/tests/functional/api/test_tagging_images.py
 pulp_container/tests/functional/api/test_token_authentication.py
 pulp_container/tests/unit/__init__.py
+pulp_container/tests/unit/test_downloaders.py
 pulp_container/tests/unit/test_json_schemas.py
 pulp_container/tests/unit/test_models.py
 pulp_container/tests/unit/test_pull_through_repair.py

{pulp_container-2.29.2 → pulp_container-2.29.3}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulp-container"
-version = "2.29.2"
+version = "2.29.3"
 description = "Container plugin for the Pulp Project"
 readme = "README.md"
 authors = [
@@ -89,7 +89,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "2.29.2"
+current_version = "2.29.3"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"