pulp-python 3.28.2__py3-none-any.whl → 3.30.0__py3-none-any.whl

pulp_python/app/__init__.py

@@ -1,6 +1,8 @@
+from gettext import gettext as _
+
 from django.db.models.signals import post_migrate
+
 from pulpcore.plugin import PulpPluginAppConfig
-from gettext import gettext as _
 
 
 class PulpPythonPluginAppConfig(PulpPluginAppConfig):
@@ -10,7 +12,7 @@ class PulpPythonPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_python.app"
     label = "python"
-    version = "3.28.2"
+    version = "3.30.0"
     python_package_name = "pulp-python"
     domain_compatible = True
 
@@ -26,7 +28,7 @@ class PulpPythonPluginAppConfig(PulpPluginAppConfig):
 
 # TODO: Remove this when https://github.com/pulp/pulpcore/issues/5500 is resolved
 def _populate_pypi_access_policies(sender, apps, verbosity, **kwargs):
-    from pulp_python.app.pypi.views import PyPIView, SimpleView, UploadView, MetadataView
+    from pulp_python.app.pypi.views import MetadataView, PyPIView, SimpleView, UploadView
 
     try:
         AccessPolicy = apps.get_model("core", "AccessPolicy")

pulp_python/app/management/commands/repair-python-metadata.py

@@ -1,11 +1,12 @@
-import re
 import os
-from django.core.management import BaseCommand, CommandError
+import re
 from gettext import gettext as _
 
 from django.conf import settings
+from django.core.management import BaseCommand, CommandError
 
 from pulpcore.plugin.util import extract_pk
+
 from pulp_python.app.models import PythonPackageContent, PythonRepository
 from pulp_python.app.utils import artifact_to_python_content_data
 
@@ -78,7 +79,10 @@ class Command(BaseCommand):
     Management command to repair metadata of PythonPackageContent.
     """
 
-    help = _("Repair the metadata of PythonPackageContent stored in PythonRepositories")
+    help = _(
+        "[Deprecated] Use the repository `repair_metadata` task instead. "
+        "Repair the metadata of PythonPackageContent stored in PythonRepositories."
+    )
 
     def add_arguments(self, parser):
         """Set up arguments."""

pulp_python/app/migrations/0022_pythonblocklistentry.py

@@ -0,0 +1,48 @@
+# Generated by Django 5.2.10 on 2026-04-16 14:00
+
+import django.db.models.deletion
+import django_lifecycle.mixins
+import pulpcore.app.models.base
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("python", "0021_pythonrepository_upload_duplicate_filenames"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="PythonBlocklistEntry",
+            fields=[
+                (
+                    "pulp_id",
+                    models.UUIDField(
+                        default=pulpcore.app.models.base.pulp_uuid,
+                        editable=False,
+                        primary_key=True,
+                        serialize=False,
+                    ),
+                ),
+                ("pulp_created", models.DateTimeField(auto_now_add=True)),
+                ("pulp_last_updated", models.DateTimeField(auto_now=True, null=True)),
+                ("name", models.TextField(default=None, null=True)),
+                ("version", models.TextField(default=None, null=True)),
+                ("filename", models.TextField(default=None, null=True)),
+                ("added_by", models.TextField(default="")),
+                (
+                    "repository",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="blocklist_entries",
+                        to="python.pythonrepository",
+                    ),
+                ),
+            ],
+            options={
+                "default_related_name": "%(app_label)s_%(model_name)s",
+            },
+            bases=(django_lifecycle.mixins.LifecycleModelMixin, models.Model),
+        ),
+    ]

pulp_python/app/modelresource.py

@@ -1,6 +1,7 @@
 from pulpcore.plugin.importexport import BaseContentResource
 from pulpcore.plugin.modelresources import RepositoryResource
 from pulpcore.plugin.util import get_domain
+
 from pulp_python.app.models import (
     PythonPackageContent,
     PythonRepository,

pulp_python/app/models.py

@@ -1,43 +1,45 @@
 import hashlib
 import json
 from logging import getLogger
+from pathlib import PurePath
 
 from aiohttp.web import json_response
+from django.conf import settings
 from django.contrib.postgres.fields import ArrayField
 from django.core.exceptions import ObjectDoesNotExist
 from django.db import models
-from django.conf import settings
 from django_lifecycle import (
     BEFORE_SAVE,
     hook,
 )
 from rest_framework.serializers import ValidationError
+
 from pulpcore.plugin.models import (
     AutoAddObjPermsMixin,
+    BaseModel,
     Content,
-    Publication,
     Distribution,
+    Publication,
     Remote,
     Repository,
 )
+from pulpcore.plugin.repo_version_utils import (
+    collect_duplicates,
+    remove_duplicates,
+    validate_repo_version,
+)
 from pulpcore.plugin.responses import ArtifactResponse
+from pulpcore.plugin.util import get_domain, get_domain_pk
 
-from pathlib import PurePath
 from .provenance import Provenance
 from .utils import (
-    artifact_to_python_content_data,
+    PYPI_LAST_SERIAL,
+    PYPI_SERIAL_CONSTANT,
     artifact_to_metadata_artifact,
+    artifact_to_python_content_data,
     canonicalize_name,
     python_content_to_json,
-    PYPI_LAST_SERIAL,
-    PYPI_SERIAL_CONSTANT,
-)
-from pulpcore.plugin.repo_version_utils import (
-    collect_duplicates,
-    remove_duplicates,
-    validate_repo_version,
 )
-from pulpcore.plugin.util import get_domain_pk, get_domain
 
 log = getLogger(__name__)
 
@@ -399,9 +401,12 @@ class PythonRepository(Repository, AutoAddObjPermsMixin):
 
         When allow_package_substitution is False, reject any new version that would implicitly
         replace existing content with different checksums (content substitution).
+
+        Also checks newly added content against the repository's blocklist entries.
         """
         if not self.allow_package_substitution:
             self._check_for_package_substitution(new_version)
+        self._check_blocklist(new_version)
         remove_duplicates(new_version)
         validate_repo_version(new_version)
 
@@ -418,3 +423,64 @@ class PythonRepository(Repository, AutoAddObjPermsMixin):
                 "To allow this, set 'allow_package_substitution' to True on the repository. "
                 f"Conflicting packages: {duplicates}"
             )
+
+    def _check_blocklist(self, new_version):
+        """
+        Check newly added content in a repository version against the blocklist.
+        """
+        added_content = PythonPackageContent.objects.filter(
+            pk__in=new_version.added().values_list("pk", flat=True)
+        ).only("filename", "name_normalized", "version")
+        if added_content.exists():
+            self.check_blocklist_for_packages(added_content)
+
+    def check_blocklist_for_packages(self, packages):
+        """
+        Raise a ValidationError if any of the given packages match a blocklist entry.
+        """
+        entries = PythonBlocklistEntry.objects.filter(repository=self)
+        if not entries.exists():
+            return
+
+        blocked = []
+        for pkg in packages:
+            for entry in entries:
+                if entry.filename and entry.filename == pkg.filename:
+                    blocked.append(pkg.filename)
+                    break
+                if entry.name == pkg.name_normalized:
+                    if not entry.version or entry.version == pkg.version:
+                        blocked.append(pkg.filename)
+                        break
+        if blocked:
+            raise ValidationError(
+                "Blocklisted packages cannot be added to this repository: {}".format(
+                    ", ".join(blocked)
+                )
+            )
+
+
+class PythonBlocklistEntry(BaseModel):
+    """
+    An entry in a PythonRepository's package blocklist.
+
+    Blocklist entries prevent packages from being added to the repository.
+    Entries can match by package `name` (all versions), package `name` + `version`,
+    or exact `filename`. Exactly one of `name` or `filename` must be provided.
+    """
+
+    name = models.TextField(null=True, default=None)
+    version = models.TextField(null=True, default=None)
+    filename = models.TextField(null=True, default=None)
+    added_by = models.TextField(default="")
+    repository = models.ForeignKey(
+        PythonRepository, on_delete=models.CASCADE, related_name="blocklist_entries"
+    )
+
+    def __str__(self):
+        if self.filename:
+            return f"<{self._meta.object_name}: {self.filename}>"
+        return f"<{self._meta.object_name}: {self.name} [{self.version or 'all'}]>"
+
+    class Meta:
+        default_related_name = "%(app_label)s_%(model_name)s"

pulp_python/app/pypi/serializers.py

@@ -1,13 +1,15 @@
 import logging
 from gettext import gettext as _
 
-from rest_framework import serializers
+from django.db.utils import IntegrityError
 from pydantic import TypeAdapter, ValidationError
-from pulp_python.app.provenance import Attestation
-from pulp_python.app.utils import DIST_EXTENSIONS, SUPPORTED_METADATA_VERSIONS
+from rest_framework import serializers
+
 from pulpcore.plugin.models import Artifact
 from pulpcore.plugin.util import get_domain
-from django.db.utils import IntegrityError
+
+from pulp_python.app.provenance import Attestation
+from pulp_python.app.utils import DIST_EXTENSIONS, SUPPORTED_METADATA_VERSIONS
 
 log = logging.getLogger(__name__)
 
@@ -110,7 +112,7 @@ class PackageUploadSerializer(serializers.Serializer):
                 attestations = TypeAdapter(list[Attestation]).validate_python(attestations)
             except ValidationError as e:
                 raise serializers.ValidationError(
-                    {"attestations": _("The uploaded attestations are not valid: {}".format(e))}
+                    {"attestations": _("The uploaded attestations are not valid: {}").format(e)}
                 )
 
         sha256 = data.get("sha256_digest")

pulp_python/app/pypi/views.py

@@ -1,60 +1,59 @@
 import logging
-
-from rest_framework.viewsets import ViewSet
-from rest_framework.renderers import BrowsableAPIRenderer, JSONRenderer, TemplateHTMLRenderer
-from rest_framework.response import Response
-from rest_framework.exceptions import NotAcceptable
-from django.core.exceptions import ObjectDoesNotExist
-from django.shortcuts import redirect
-from datetime import datetime, timezone, timedelta
+from datetime import datetime, timedelta, timezone
+from itertools import chain
+from pathlib import PurePath
+from urllib.parse import urljoin, urlparse, urlunsplit
 
 from django.contrib.sessions.models import Session
+from django.core.exceptions import ObjectDoesNotExist
 from django.db import transaction
 from django.db.utils import DatabaseError
 from django.http.response import (
     Http404,
-    HttpResponseNotFound,
-    HttpResponseForbidden,
+    HttpResponse,
     HttpResponseBadRequest,
+    HttpResponseForbidden,
+    HttpResponseNotFound,
     StreamingHttpResponse,
-    HttpResponse,
 )
+from django.shortcuts import redirect
 from drf_spectacular.utils import extend_schema
 from dynaconf import settings
-from itertools import chain
 from packaging.utils import canonicalize_name
-from urllib.parse import urljoin, urlparse, urlunsplit
-from pathlib import PurePath
+from rest_framework.exceptions import NotAcceptable
+from rest_framework.renderers import BrowsableAPIRenderer, JSONRenderer, TemplateHTMLRenderer
+from rest_framework.response import Response
+from rest_framework.viewsets import ViewSet
 
-from pulpcore.plugin.viewsets import OperationPostponedResponse
 from pulpcore.plugin.tasking import dispatch
 from pulpcore.plugin.util import get_domain, get_url
+from pulpcore.plugin.viewsets import OperationPostponedResponse
+
+from pulp_python.app import tasks
 from pulp_python.app.models import (
+    PackageProvenance,
     PythonDistribution,
     PythonPackageContent,
     PythonPublication,
-    PackageProvenance,
 )
 from pulp_python.app.pypi.serializers import (
-    SummarySerializer,
     PackageMetadataSerializer,
     PackageUploadSerializer,
     PackageUploadTaskSerializer,
+    SummarySerializer,
 )
 from pulp_python.app.utils import (
-    write_simple_index,
-    write_simple_index_json,
-    write_simple_detail,
-    write_simple_detail_json,
-    python_content_to_json,
     PYPI_LAST_SERIAL,
     PYPI_SERIAL_CONSTANT,
     get_remote_package_filter,
     get_remote_simple_page,
+    python_content_to_json,
+    write_simple_detail,
+    write_simple_detail_json,
+    write_simple_index,
+    write_simple_index_json,
 )
 
-from pulp_python.app import tasks
-
 log = logging.getLogger(__name__)
 
 ORIGIN_HOST = settings.CONTENT_ORIGIN if settings.CONTENT_ORIGIN else settings.PYPI_API_HOSTNAME

pulp_python/app/replica.py

@@ -1,10 +1,11 @@
-from pulpcore.plugin.replica import Replicator
-
 from pulp_glue.python.context import (
     PulpPythonDistributionContext,
     PulpPythonPublicationContext,
     PulpPythonRepositoryContext,
 )
+
+from pulpcore.plugin.replica import Replicator
+
 from pulp_python.app.models import PythonDistribution, PythonRemote, PythonRepository
 from pulp_python.app.tasks import sync as python_sync
 

pulp_python/app/serializers.py

@@ -2,31 +2,34 @@ import logging
 import os
 import tempfile
 from gettext import gettext as _
+from urllib.parse import urljoin
+
 from django.conf import settings
 from django.db.utils import IntegrityError
 from drf_spectacular.utils import extend_schema_serializer
 from packaging.requirements import Requirement
-from rest_framework import serializers
-from pypi_attestations import AttestationError
+from packaging.version import InvalidVersion, Version
 from pydantic import TypeAdapter, ValidationError
-from urllib.parse import urljoin
+from pypi_attestations import AttestationError
+from rest_framework import serializers
 
 from pulpcore.plugin import models as core_models
 from pulpcore.plugin import serializers as core_serializers
-from pulpcore.plugin.util import get_domain, get_prn, get_current_authenticated_user
+from pulpcore.plugin.util import get_current_authenticated_user, get_domain, get_prn, reverse
 
 from pulp_python.app import models as python_models
 from pulp_python.app.provenance import (
+    AnyPublisher,
     Attestation,
+    AttestationBundle,
     Provenance,
     verify_provenance,
-    AttestationBundle,
-    AnyPublisher,
 )
 from pulp_python.app.utils import (
     DIST_EXTENSIONS,
     artifact_to_metadata_artifact,
     artifact_to_python_content_data,
+    canonicalize_name,
     get_project_metadata_from_file,
     parse_project_metadata,
 )
@@ -53,6 +56,11 @@ class PythonRepositorySerializer(core_serializers.RepositorySerializer):
         default=False,
         required=False,
     )
+    blocklist_entries_href = serializers.SerializerMethodField(
+        help_text=_("URL to the blocklist entries for this repository."),
+        read_only=True,
+    )
+
     allow_package_substitution = serializers.BooleanField(
         help_text=_(
             "Whether to allow package substitution (replacing existing packages with packages "
@@ -65,10 +73,15 @@ class PythonRepositorySerializer(core_serializers.RepositorySerializer):
         required=False,
     )
 
+    def get_blocklist_entries_href(self, obj):
+        repo_href = reverse("repositories-python/python-detail", kwargs={"pk": obj.pk})
+        return f"{repo_href}blocklist_entries/"
+
     class Meta:
         fields = core_serializers.RepositorySerializer.Meta.fields + (
             "autopublish",
             "allow_package_substitution",
+            "blocklist_entries_href",
         )
         model = python_models.PythonRepository
 
@@ -226,7 +239,7 @@ class PythonPackageContentSerializer(core_serializers.SingleArtifactContentUploa
         required=False,
         allow_blank=True,
         help_text=_(
-            "The maintainer's name at a minimum; " "additional contact information may be provided."
+            "The maintainer's name at a minimum; additional contact information may be provided."
         ),
     )
     maintainer_email = serializers.CharField(
@@ -375,7 +388,7 @@ class PythonPackageContentSerializer(core_serializers.SingleArtifactContentUploa
             else:
                 attestations = TypeAdapter(list[Attestation]).validate_python(value)
         except ValidationError as e:
-            raise serializers.ValidationError(_("Invalid attestations: {}".format(e)))
+            raise serializers.ValidationError(_("Invalid attestations: {}").format(e))
         return attestations
 
     def handle_attestations(self, filename, sha256, attestations, offline=True):
@@ -388,7 +401,7 @@ class PythonPackageContentSerializer(core_serializers.SingleArtifactContentUploa
             verify_provenance(filename, sha256, provenance, offline=offline)
         except AttestationError as e:
             raise serializers.ValidationError(
-                {"attestations": _("Attestations failed verification: {}".format(e))}
+                {"attestations": _("Attestations failed verification: {}").format(e)}
             )
         return provenance.model_dump(mode="json")
 
@@ -643,13 +656,13 @@ class PackageProvenanceSerializer(core_serializers.NoArtifactContentUploadSerial
             data["provenance"] = provenance.model_dump(mode="json")
         except ValidationError as e:
             raise serializers.ValidationError(
-                _("The uploaded provenance is not valid: {}".format(e))
+                _("The uploaded provenance is not valid: {}").format(e)
             )
         if data.pop("verify"):
             try:
                 verify_provenance(data["package"].filename, data["package"].sha256, provenance)
             except AttestationError as e:
-                raise serializers.ValidationError(_("Provenance verification failed: {}".format(e)))
+                raise serializers.ValidationError(_("Provenance verification failed: {}").format(e))
         return data
 
     def retrieve(self, validated_data):
@@ -717,7 +730,7 @@ class PythonRemoteSerializer(core_serializers.RemoteSerializer):
     package_types = MultipleChoiceArrayField(
         required=False,
         help_text=_(
-            "The package types to sync for Python content. Leave blank to get every" "package type."
+            "The package types to sync for Python content. Leave blank to get everypackage type."
         ),
         choices=python_models.PACKAGE_TYPES,
         default=list,
@@ -752,7 +765,7 @@ class PythonRemoteSerializer(core_serializers.RemoteSerializer):
                 Requirement(pkg)
             except ValueError as ve:
                 raise serializers.ValidationError(
-                    _("includes specifier {} is invalid. {}".format(pkg, ve))
+                    _("includes specifier {} is invalid. {}").format(pkg, ve)
                 )
         return value
 
@@ -763,7 +776,7 @@ class PythonRemoteSerializer(core_serializers.RemoteSerializer):
                 Requirement(pkg)
             except ValueError as ve:
                 raise serializers.ValidationError(
-                    _("excludes specifier {} is invalid. {}".format(pkg, ve))
+                    _("excludes specifier {} is invalid. {}").format(pkg, ve)
                 )
         return value
 
@@ -780,6 +793,115 @@ class PythonRemoteSerializer(core_serializers.RemoteSerializer):
         model = python_models.PythonRemote
 
 
+class PythonBlocklistEntrySerializer(core_serializers.ModelSerializer):
+    """
+    Serializer for PythonBlocklistEntry.
+
+    The `repository` is supplied by the URL (not the request body) and is injected
+    by the viewset before saving.
+    """
+
+    pulp_href = serializers.SerializerMethodField(
+        read_only=True,
+        help_text=_("The URL of this blocklist entry."),
+    )
+    repository = core_serializers.DetailRelatedField(
+        read_only=True,
+        view_name_pattern=r"repositories(-.*/.*)?-detail",
+        help_text=_("Repository this blocklist entry belongs to."),
+    )
+    name = serializers.CharField(
+        required=False,
+        allow_null=True,
+        default=None,
+        help_text=_(
+            "Package name to block (for all versions). Compared after PEP 503 normalization. "
+            "Required when 'filename' is not provided."
+        ),
+    )
+    version = serializers.CharField(
+        required=False,
+        allow_null=True,
+        default=None,
+        help_text=_("Exact version string to block (e.g. '1.0'). Only used when 'name' is set."),
+    )
+    filename = serializers.CharField(
+        required=False,
+        allow_null=True,
+        default=None,
+        help_text=_("Exact filename to block. Required when 'name' is not provided."),
+    )
+    added_by = serializers.CharField(
+        read_only=True,
+        help_text=_("PRN of the user who added this blocklist entry."),
+    )
+
+    def get_pulp_href(self, obj):
+        repo_href = reverse("repositories-python/python-detail", kwargs={"pk": obj.repository_id})
+        return f"{repo_href}blocklist_entries/{obj.pk}/"
+
+    def validate(self, data):
+        """
+        Validate that the blocklist entry is well-formed and not a duplicate.
+        """
+        name = data.get("name")
+        filename = data.get("filename")
+        version = data.get("version")
+
+        if version and filename:
+            raise serializers.ValidationError(_("'version' cannot be used with 'filename'."))
+        if version and not name:
+            raise serializers.ValidationError(_("'version' requires 'name' to be provided."))
+        if bool(name) == bool(filename):
+            raise serializers.ValidationError(
+                _("Exactly one of 'name' or 'filename' must be provided.")
+            )
+
+        if version:
+            try:
+                Version(version)
+            except InvalidVersion:
+                raise serializers.ValidationError(
+                    {"version": _("'{}' is not a valid version.").format(version)}
+                )
+        if name:
+            data["name"] = canonicalize_name(name)
+            name = data["name"]
+
+        repository = self.context.get("repository")
+        if repository:
+            qs = python_models.PythonBlocklistEntry.objects.filter(repository=repository)
+            if name and qs.filter(name=name, version=version).exists():
+                raise serializers.ValidationError(
+                    _("A blocklist entry with this name and version already exists.")
+                )
+            if filename and qs.filter(filename=filename).exists():
+                raise serializers.ValidationError(
+                    _("A blocklist entry with this filename already exists.")
+                )
+            data["repository"] = repository
+
+        return data
+
+    def create(self, validated_data):
+        """
+        Create a new blocklist entry, recording the authenticated user in `added_by`.
+        """
+        user = get_current_authenticated_user()
+        validated_data["added_by"] = get_prn(user) if user else ""
+        return super().create(validated_data)
+
+    class Meta:
+        fields = core_serializers.ModelSerializer.Meta.fields + (
+            "repository",
+            "name",
+            "version",
+            "filename",
+            "added_by",
+        )
+        model = python_models.PythonBlocklistEntry
+
+
 class PythonBanderRemoteSerializer(serializers.Serializer):
     """
     A Serializer for the initial step of creating a Python Remote from a Bandersnatch config file

pulp_python/app/tasks/publish.py

@@ -1,6 +1,6 @@
-from gettext import gettext as _
 import logging
 import os
+from gettext import gettext as _
 
 from django.core.files import File
 from packaging.utils import canonicalize_name
@@ -10,7 +10,7 @@ from pulpcore.plugin.util import get_domain
 
 from pulp_python.app import models as python_models
 from pulp_python.app.serializers import PythonPublicationSerializer
-from pulp_python.app.utils import write_simple_index, write_simple_detail
+from pulp_python.app.utils import write_simple_detail, write_simple_index
 
 log = logging.getLogger(__name__)
 

pulp_python/app/tasks/repair.py

@@ -7,6 +7,10 @@ from uuid import UUID
 
 from django.db.models import Prefetch
 from django.db.models.query import QuerySet
+
+from pulpcore.plugin.models import ContentArtifact, ProgressReport
+from pulpcore.plugin.util import get_domain
+
 from pulp_python.app.models import PythonPackageContent, PythonRepository
 from pulp_python.app.utils import (
     artifact_to_python_content_data,
@@ -16,8 +20,6 @@ from pulp_python.app.utils import (
     metadata_content_to_artifact,
     parse_metadata,
 )
-from pulpcore.plugin.models import ContentArtifact, ProgressReport
-from pulpcore.plugin.util import get_domain
 
 log = logging.getLogger(__name__)