pulpcore 3.110.0__tar.gz → 3.110.2__tar.gz

{pulpcore-3.110.0 → pulpcore-3.110.2}/CHANGES.md

@@ -8,6 +8,51 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.110.2 (2026-05-07) {: #3.110.2 }
+
+### REST API {: #3.110.2-rest-api }
+
+#### Bugfixes {: #3.110.2-rest-api-bugfix }
+
+- Fixed `add-signing-service` management command failing with "There are N keys matching the key id" for PGP keys that have subkeys.
+
+### Plugin API {: #3.110.2-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.110.2-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.110.2-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.110.1 (2026-05-05) {: #3.110.1 }
+
+### REST API {: #3.110.1-rest-api }
+
+#### Bugfixes {: #3.110.1-rest-api-bugfix }
+
+- Fixed `TypeError: 'str' object has no attribute 'tolower'` in `_ensure_bool` during incremental content exports. Changed `.tolower()` to `.lower()`.
+  [#7678](https://github.com/pulp/pulpcore/issues/7678)
+
+### Plugin API {: #3.110.1-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.110.1-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.110.1-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.110.0 (2026-04-28) {: #3.110.0 }
 
 ### REST API {: #3.110.0-rest-api }

{pulpcore-3.110.0 → pulpcore-3.110.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.110.0
+Version: 3.110.2
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later

{pulpcore-3.110.0 → pulpcore-3.110.2}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.110.0"
+    version = "3.110.2"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.110.0 → pulpcore-3.110.2}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.110.0"
+    version = "3.110.2"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.110.0 → pulpcore-3.110.2}/pulpcore/app/apps.py

@@ -237,7 +237,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.110.0"
+    version = "3.110.2"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.110.0 → pulpcore-3.110.2}/pulpcore/app/management/commands/add-signing-service.py

@@ -82,10 +82,17 @@ class Command(BaseCommand):
         if result.returncode != 0:
             raise CommandError(result.stderr.strip())
 
-        fpr_lines = [line for line in result.stdout.splitlines() if line.startswith("fpr:")]
-        if len(fpr_lines) != 1:
-            raise CommandError(_("There are {} keys matching the key id.").format(len(fpr_lines)))
-        fingerprint = fpr_lines[0].split(":")[9]
+        lines = result.stdout.splitlines()
+
+        # Count actual keys (pub:/sec: lines), not fingerprint lines. GPG emits
+        # a separate fpr: line for the primary key and each subkey, so a single
+        # key with subkeys produces multiple fpr: lines.
+        key_lines = [l for l in lines if l.startswith(("pub:", "sec:"))]  # noqa: E741
+        if len(key_lines) != 1:
+            raise CommandError(_("There are {} keys matching the key id.").format(len(key_lines)))
+
+        # Use the primary key fingerprint (first fpr: line in GPG's output).
+        fingerprint = [l.split(":")[9] for l in lines if l.startswith("fpr:")][0]  # noqa: E741
 
         result = subprocess.run(
             gpg_cmd + ["--armor", "--export", key_id],

{pulpcore-3.110.0 → pulpcore-3.110.2}/pulpcore/app/tasks/export.py

@@ -46,9 +46,9 @@ def _ensure_bool(value):
     if isinstance(value, bool):
         return value
     if isinstance(value, str):
-        if value.tolower() in ["yes", "y", "true", "t", "on", "1"]:
+        if value.lower() in ["yes", "y", "true", "t", "on", "1"]:
             return True
-        if value.tolower() in ["no", "n", "false", "f", "off", "0"]:
+        if value.lower() in ["no", "n", "false", "f", "off", "0"]:
             return False
     if value == 1:
         return True

{pulpcore-3.110.0 → pulpcore-3.110.2}/pulpcore/pytest_plugin.py

@@ -1,7 +1,6 @@
 import asyncio
 import json
 import os
-import pathlib
 import shutil
 import socket
 import ssl
@@ -1072,43 +1071,61 @@ def dispatch_task_group(dispatch_task):
 
 # GPG related fixtures
 
+PULP_FIXTURES_SIGNING_KEYS_URL = (
+    "https://raw.githubusercontent.com/pulp/pulp-fixtures/master/common/signing_keys/"
+)
+KEY_V4_RSA2K_PUBLIC = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v4-rsa2k.asc"
+KEY_V4_RSA2K_PRIVATE = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v4-rsa2k.secret"
+KEY_V4_RSA4K_PUBLIC = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v4-rsa4k.asc"
+KEY_V4_RSA4K_PRIVATE = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v4-rsa4k.secret"
+KEY_V4_ED25519_PUBLIC = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v4-ed25519.asc"
+KEY_V4_ED25519_PRIVATE = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v4-ed25519.secret"
+KEY_V6_RSA4K_PUBLIC = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-rsa4k.asc"
+KEY_V6_RSA4K_PRIVATE = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-rsa4k.secret"
+KEY_V6_ED25519_PUBLIC = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-ed25519.asc"
+KEY_V6_ED25519_PRIVATE = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-ed25519.secret"
+KEY_V6_MLDSA65_ED25519_PUBLIC = (
+    PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-mldsa65-ed25519.asc"
+)
+KEY_V6_MLDSA65_ED25519_PRIVATE = (
+    PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-mldsa65-ed25519.secret"
+)
+KEY_V6_MLDSA87_ED448_PUBLIC = PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-mldsa87-ed448.asc"
+KEY_V6_MLDSA87_ED448_PRIVATE = (
+    PULP_FIXTURES_SIGNING_KEYS_URL + "pulp-testkey-v6-mldsa87-ed448.secret"
+)
+
 
-SIGNING_SCRIPT_STRING = r"""#!/usr/bin/env bash
+SIGNING_SCRIPT_STRING = """#!/usr/bin/env bash
 
 FILE_PATH=$1
 SIGNATURE_PATH="$1.asc"
 
-GPG_KEY_ID="pulp-fixture-signing-key"
+GPG_KEY_ID="{gpg_key_id}"
 
 # Create a detached signature
-gpg --quiet --batch --homedir HOMEDIRHERE --detach-sign --local-user "${GPG_KEY_ID}" \
-   --armor --output ${SIGNATURE_PATH} ${FILE_PATH}
+gpg --quiet --batch --homedir {gpg_home} --detach-sign --local-user "${{GPG_KEY_ID}}" \\
+   --armor --output ${{SIGNATURE_PATH}} ${{FILE_PATH}}
 
 # Check the exit status
 STATUS=$?
-if [[ ${STATUS} -eq 0 ]]; then
-   echo {\"file\": \"${FILE_PATH}\", \"signature\": \"${SIGNATURE_PATH}\"}
+if [[ ${{STATUS}} -eq 0 ]]; then
+   echo '{{"file": "'${{FILE_PATH}}'", "signature": "'${{SIGNATURE_PATH}}'"}}'
 else
-   exit ${STATUS}
+   exit ${{STATUS}}
 fi
 """
 
 
 @pytest.fixture(scope="session")
-def signing_script_path(signing_script_temp_dir, signing_gpg_homedir_path):
-    signing_script_file = signing_script_temp_dir / "sign-metadata.sh"
-    signing_script_file.write_text(
-        SIGNING_SCRIPT_STRING.replace("HOMEDIRHERE", str(signing_gpg_homedir_path))
-    )
-
-    signing_script_file.chmod(0o755)
-
-    return signing_script_file
+def signing_script_path(signing_script_temp_dir, signing_gpg_homedir_path, signing_gpg_metadata):
+    _gpg, fingerprint, _keyid = signing_gpg_metadata
+    return make_signing_script(signing_gpg_homedir_path, fingerprint, signing_script_temp_dir)
 
 
 @pytest.fixture(scope="session")
 def signing_script_temp_dir(tmp_path_factory):
-    return tmp_path_factory.mktemp("sigining_script_dir")
+    return tmp_path_factory.mktemp("signing_script_dir")
 
 
 @pytest.fixture(scope="session")
@@ -1149,30 +1166,7 @@ def sign_with_ascii_armored_detached_signing_service(signing_script_path, signin
 def signing_gpg_metadata(signing_gpg_homedir_path):
     """A fixture that returns a GPG instance and related metadata (i.e., fingerprint, keyid)."""
     PRIVATE_KEY_URL = "https://raw.githubusercontent.com/pulp/pulp-fixtures/master/common/GPG-PRIVATE-KEY-fixture-signing"  # noqa: E501
-
-    try:
-        import gnupg
-    except ImportError:
-        pytest.fail("python-gnupg is not installed, add to your functest_requirements.txt")
-    key_file = pathlib.Path(__file__).parent / "GPG-PRIVATE-KEY-fixture-signing"
-    if key_file.exists():
-        private_key_data = key_file.read_text()
-    else:
-        response = requests.get(PRIVATE_KEY_URL)
-        response.raise_for_status()
-        private_key_data = response.text
-        with suppress(FileNotFoundError, PermissionError):
-            key_file.write_text(private_key_data)
-
-    gpg = gnupg.GPG(gnupghome=signing_gpg_homedir_path)
-    gpg.import_keys(private_key_data)
-
-    key = gpg.list_keys()[0]
-    fingerprint = key["fingerprint"]
-    keyid = key["keyid"]
-
-    gpg.trust_keys(fingerprint, "TRUST_ULTIMATE")
-    return gpg, fingerprint, keyid
+    return import_signing_key(PRIVATE_KEY_URL, signing_gpg_homedir_path)
 
 
 @pytest.fixture(scope="session")
@@ -1194,53 +1188,102 @@ def _ascii_armored_detached_signing_service_name(
     signing_gpg_metadata,
     signing_gpg_homedir_path,
 ):
-    service_name = str(uuid.uuid4())
     _gpg, fingerprint, _keyid = signing_gpg_metadata
+    service_name = create_signing_service(
+        signing_gpg_homedir_path, fingerprint, signing_script_path
+    )
+
+    yield service_name
+
+    remove_signing_service(service_name)
+
+
+@pytest.fixture(scope="session")
+def ascii_armored_detached_signing_service(
+    _ascii_armored_detached_signing_service_name, pulpcore_bindings
+):
+    return pulpcore_bindings.SigningServicesApi.list(
+        name=_ascii_armored_detached_signing_service_name
+    ).results[0]
+
 
+def import_signing_key(key_url, gpg_home):
+    """Import a PGP key into a GPG home directory and trust it.
+
+    Returns ``(gpg, fingerprint, keyid)``.
+    """
+    try:
+        import gnupg
+    except ImportError:
+        pytest.skip("python-gnupg not installed")
+
+    gpg = gnupg.GPG(gnupghome=gpg_home)
+
+    response = requests.get(key_url)
+    response.raise_for_status()
+    result = gpg.import_keys(response.content)
+    assert result.count >= 1, f"Failed to import key from {key_url}"
+
+    key_info = gpg.list_keys()[0]
+    fingerprint = key_info["fingerprint"]
+    keyid = key_info["keyid"]
+    gpg.trust_keys(fingerprint, "TRUST_ULTIMATE")
+
+    return gpg, fingerprint, keyid
+
+
+def make_signing_script(gpg_home, fingerprint, script_dir=None):
+    """Create a detached-signature signing script.
+
+    Returns the script path.
+    """
+    if script_dir is None:
+        script_dir = gpg_home
+    script_path = script_dir / "sign.sh"
+    script_path.write_text(SIGNING_SCRIPT_STRING.format(gpg_home=gpg_home, gpg_key_id=fingerprint))
+    script_path.chmod(0o755)
+    return script_path
+
+
+def create_signing_service(
+    gpg_home, fingerprint, script_path, *, service_class="core:AsciiArmoredDetachedSigningService"
+):
+    """Register a signing service via pulpcore-manager.
+
+    Returns the service name.
+    """
+    service_name = str(uuid.uuid4())
     cmd = (
         "pulpcore-manager",
         "add-signing-service",
         service_name,
-        str(signing_script_path),
+        str(script_path),
         fingerprint,
         "--class",
-        "core:AsciiArmoredDetachedSigningService",
+        service_class,
         "--gnupghome",
-        str(signing_gpg_homedir_path),
-    )
-    completed_process = subprocess.run(
-        cmd,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
+        str(gpg_home),
     )
+    completed = subprocess.run(cmd, capture_output=True, text=True)
+    assert completed.returncode == 0, completed.stderr
 
-    assert completed_process.returncode == 0
+    return service_name
 
-    yield service_name
 
-    cmd = (
-        "pulpcore-manager",
-        "remove-signing-service",
-        service_name,
-        "--class",
-        "core:AsciiArmoredDetachedSigningService",
-    )
+def remove_signing_service(service_name, service_class="core:AsciiArmoredDetachedSigningService"):
+    """Remove a signing service created by ``create_signing_service``."""
     subprocess.run(
-        cmd,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
+        (
+            "pulpcore-manager",
+            "remove-signing-service",
+            service_name,
+            "--class",
+            service_class,
+        ),
+        capture_output=True,
     )
 
 
-@pytest.fixture(scope="session")
-def ascii_armored_detached_signing_service(
-    _ascii_armored_detached_signing_service_name, pulpcore_bindings
-):
-    return pulpcore_bindings.SigningServicesApi.list(
-        name=_ascii_armored_detached_signing_service_name
-    ).results[0]
-
-
 # if content_origin == None, base_url will return the relative path and
 # we need to add the hostname to run the tests
 @pytest.fixture(scope="session")

pulpcore-3.110.2/pulpcore/tests/functional/api/test_signing_service.py

@@ -0,0 +1,30 @@
+import pytest
+
+from pulpcore.pytest_plugin import (
+    KEY_V4_RSA4K_PRIVATE,
+    create_signing_service,
+    import_signing_key,
+    make_signing_script,
+    remove_signing_service,
+)
+
+
+@pytest.mark.parallel
+def test_crud_signing_service(ascii_armored_detached_signing_service):
+    service = ascii_armored_detached_signing_service
+    assert "/api/v3/signing-services/" in service.pulp_href
+
+
+def test_add_signing_service_key_with_subkeys(tmp_path_factory):
+    """Verify that add-signing-service works with a PGP key that has subkeys.
+
+    Keys with signing subkeys produce multiple fpr: lines in GPG's colon
+    output, which previously caused add-signing-service to fail.
+    """
+    gpg_home = tmp_path_factory.mktemp("gpghome_subkey_test")
+    _gpg, fingerprint, _keyid = import_signing_key(KEY_V4_RSA4K_PRIVATE, gpg_home)
+    script_path = make_signing_script(gpg_home, fingerprint)
+    service_name = create_signing_service(gpg_home, fingerprint, script_path)
+    assert len(fingerprint) == 40
+
+    remove_signing_service(service_name)

{pulpcore-3.110.0 → pulpcore-3.110.2}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.110.0
+Version: 3.110.2
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later

{pulpcore-3.110.0 → pulpcore-3.110.2}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulpcore"
-version = "3.110.0"
+version = "3.110.2"
 description = "Pulp Django Application and Related Modules"
 readme = "README.md"
 authors = [
@@ -207,7 +207,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.110.0"
+current_version = "3.110.2"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"
@@ -286,11 +286,11 @@ extend-select = [
   "T10",
 ]
 
+[tool.ruff.lint.flake8-tidy-imports.banned-api]
+# This section is managed by the plugin template. Do not edit manually.
+"distutils".msg = "The 'distutils' module has been deprecated since Python 3.9."
+
 [tool.ruff.lint.isort]
 # This section is managed by the plugin template. Do not edit manually.
 sections = { second-party = ["pulpcore"] }
 section-order = ["future", "standard-library", "third-party", "second-party", "first-party", "local-folder"]
-
-[tool.ruff.lint.flake8-tidy-imports.banned-api]
-# TODO Add this to the plugin template
-"distutils".msg = "The 'distutils' module has been deprecated since Python 3.9."

pulpcore-3.110.0/pulpcore/tests/functional/api/test_signing_service.py

@@ -1,7 +0,0 @@
-import pytest
-
-
-@pytest.mark.parallel
-def test_crud_signing_service(ascii_armored_detached_signing_service):
-    service = ascii_armored_detached_signing_service
-    assert "/api/v3/signing-services/" in service.pulp_href