pulpcore 3.119.2__tar.gz → 3.120.0__tar.gz

{pulpcore-3.119.2 → pulpcore-3.120.0}/CHANGES.md

@@ -8,25 +8,33 @@
 
 [//]: # (towncrier release notes start)
 
-## 3.119.2 (2026-09-29) {: #3.119.2 }
+## 3.120.0 (2026-09-29) {: #3.120.0 }
 
-### REST API {: #3.119.2-rest-api }
+### REST API {: #3.120.0-rest-api }
 
-#### Bugfixes {: #3.119.2-rest-api-bugfix }
+#### Features {: #3.120.0-rest-api-feature }
+
+- Added workload identity authentication, so a CI job can authenticate with a short-lived OIDC token instead of a stored secret and receive per-request roles computed from the `WORKLOAD_IDENTITY` setting.
+
+#### Bugfixes {: #3.120.0-rest-api-bugfix }
 
 - Improved the performance of the latest publication lookup when serving content
   from a repository-backed distribution.
   [#1995](https://github.com/pulp/pulpcore/issues/1995)
+- Fixed file downloader path sanitation. CVE-2026-90959
+- Fixed the `long_running` pytest-mark, so that it correctly applies even when "nightly"
+  is selected. This includes fixing a window in the task-cleanup path, where a missing
+  worker's jobs were not getting cleaned up until a new task entered the system.
 
-### Plugin API {: #3.119.2-plugin-api }
+### Plugin API {: #3.120.0-plugin-api }
 
 No significant changes.
 
-### Pulp File {: #3.119.2-pulp-file }
+### Pulp File {: #3.120.0-pulp-file }
 
 No significant changes.
 
-### Pulp Cert Guard {: #3.119.2-pulp-cert-guard }
+### Pulp Cert Guard {: #3.120.0-pulp-cert-guard }
 
 No significant changes.
 
@@ -1210,6 +1218,30 @@ No significant changes.
 
 ---
 
+## 3.105.20 (2026-09-23) {: #3.105.20 }
+
+### REST API {: #3.105.20-rest-api }
+
+#### Bugfixes {: #3.105.20-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+- Fixed post-migrate hooks to prevent failing on incomplete or rolled back migrations.
+- Reduce the number and size of queries made for each content app request.
+
+### Plugin API {: #3.105.20-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.105.20-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.105.20-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.105.19 (2026-09-02) {: #3.105.19 }
 
 ### REST API {: #3.105.19-rest-api }
@@ -2652,6 +2684,29 @@ No significant changes.
 
 ---
 
+## 3.85.31 (2026-09-23) {: #3.85.31 }
+
+### REST API {: #3.85.31-rest-api }
+
+#### Bugfixes {: #3.85.31-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+- Fixed post-migrate hooks to prevent failing on incomplete or rolled back migrations.
+
+### Plugin API {: #3.85.31-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.85.31-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.85.31-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.85.30 (2026-09-01) {: #3.85.30 }
 
 ### REST API {: #3.85.30-rest-api }
@@ -4115,6 +4170,28 @@ No significant changes.
 
 ---
 
+## 3.73.45 (2026-09-24) {: #3.73.45 }
+
+### REST API {: #3.73.45-rest-api }
+
+#### Bugfixes {: #3.73.45-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.73.45-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.73.45-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.73.45-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.73.44 (2026-09-02) {: #3.73.44 }
 
 ### REST API {: #3.73.44-rest-api }
@@ -5822,6 +5899,28 @@ No significant changes.
 
 ---
 
+## 3.63.48 (2026-09-24) {: #3.63.48 }
+
+### REST API {: #3.63.48-rest-api }
+
+#### Bugfixes {: #3.63.48-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.63.48-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.63.48-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.63.48-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.63.47 (2026-09-02) {: #3.63.47 }
 
 ### REST API {: #3.63.47-rest-api }
@@ -7747,6 +7846,28 @@ No significant changes.
 
 ---
 
+## 3.49.71 (2026-09-24) {: #3.49.71 }
+
+### REST API {: #3.49.71-rest-api }
+
+#### Bugfixes {: #3.49.71-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.49.71-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.49.71-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.49.71-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.49.70 (2026-09-02) {: #3.49.70 }
 
 ### REST API {: #3.49.70-rest-api }

{pulpcore-3.119.2 → pulpcore-3.120.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.119.2
+Version: 3.120.0
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later
@@ -25,6 +25,7 @@ Requires-Dist: asyncio-throttle<=1.0.2,>=1.0
 Requires-Dist: backoff<2.3,>=2.1.2
 Requires-Dist: click<8.6,>=8.1.0
 Requires-Dist: cryptography<51.0,>=49.0.0
+Requires-Dist: pyjwt<3,>=2.4
 Requires-Dist: Django<5.3,>=5.2.0
 Requires-Dist: django-filter<=26.1,>=24.3
 Requires-Dist: django-guid<3.7,>=3.4.0

{pulpcore-3.119.2 → pulpcore-3.120.0}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.119.2"
+    version = "3.120.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.119.2 → pulpcore-3.120.0}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.119.2"
+    version = "3.120.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.119.2 → pulpcore-3.120.0}/pulpcore/app/access_policy.py

@@ -1,6 +1,7 @@
 from copy import deepcopy
 
 from django.conf import settings
+from django.contrib.auth import get_user_model
 from rest_access_policy import AccessPolicy
 from rest_framework.exceptions import APIException
 
@@ -15,6 +16,17 @@ class DefaultAccessPolicy(AccessPolicy):
     An AccessPolicy that takes default statements from the view(set).
     """
 
+    def get_user_group_values(self, user):
+        """Read groups from the ORM only for real database users.
+
+        drf-access-policy assumes groups live in `django.contrib.auth` and prefetches them,
+        which does not work for a stateless principal. Any non-database user (a workload-identity
+        principal, or another one added later) supplies its groups via a `group_names` attribute.
+        """
+        if isinstance(user, get_user_model()):
+            return super().get_user_group_values(user)
+        return list(getattr(user, "group_names", []))
+
     @classmethod
     def get_access_policy(cls, view):
         """

{pulpcore-3.119.2 → pulpcore-3.120.0}/pulpcore/app/apps.py

@@ -238,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.119.2"
+    version = "3.120.0"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.119.2 → pulpcore-3.120.0}/pulpcore/app/checks.py

@@ -123,3 +123,105 @@ def check_artifact_checksums(app_configs, **kwargs):
         )
 
     return messages
+
+
+_WORKLOAD_IDENTITY_BACKEND = "pulpcore.app.workload_identity.backend.WorkloadIdentityBackend"
+
+
+@register(deploy=True)
+def workload_identity_reserved_username(app_configs, **kwargs):
+    if _WORKLOAD_IDENTITY_BACKEND not in settings.AUTHENTICATION_BACKENDS:
+        return []
+
+    from pulpcore.app.workload_identity import config
+
+    messages = []
+    if not config.config():
+        return messages
+
+    username = config.basic_username()
+    try:
+        from django.contrib.auth import get_user_model
+
+        collides = get_user_model().objects.filter(username=username).exists()
+    except Exception:
+        return messages
+
+    if collides:
+        messages.append(
+            CheckWarning(
+                f"The WORKLOAD_IDENTITY basic_auth_username '{username}' is also a database user. "
+                "A token presented with this username over Basic auth is validated as a workload "
+                "identity token, not as that user's password. Set basic_auth_username to a name "
+                "that is not a real user to avoid ambiguity.",
+                id="pulpcore.W006",
+            )
+        )
+
+    return messages
+
+
+@register(deploy=True)
+def workload_identity_domain_scopes(app_configs, **kwargs):
+    if _WORKLOAD_IDENTITY_BACKEND not in settings.AUTHENTICATION_BACKENDS:
+        return []
+
+    from pulpcore.app.workload_identity import config
+
+    messages = []
+    if settings.DOMAIN_ENABLED or not config.config():
+        return messages
+
+    uses_domain = any(
+        grant.get("scope", {}).get("type") == "domain" or "domain" in grant.get("scope", {})
+        for provider in config.providers().values()
+        for rule in provider.get("rules", [])
+        for grant in rule.get("grants", [])
+    )
+    if uses_domain:
+        messages.append(
+            CheckWarning(
+                "WORKLOAD_IDENTITY has grant scopes that reference a domain, but DOMAIN_ENABLED is "
+                "False. Domain scoping has no effect while domains are disabled.",
+                id="pulpcore.W007",
+            )
+        )
+
+    return messages
+
+
+@register(deploy=True)
+def workload_identity_unqualified_name_scopes(app_configs, **kwargs):
+    if _WORKLOAD_IDENTITY_BACKEND not in settings.AUTHENTICATION_BACKENDS:
+        return []
+
+    from pulpcore.app.workload_identity import config
+
+    messages = []
+    if not settings.DOMAIN_ENABLED or not config.config():
+        return messages
+
+    risky = False
+    for provider in config.providers().values():
+        for rule in provider.get("rules", []):
+            for grant in rule.get("grants", []):
+                scope = grant.get("scope", {})
+                if (
+                    scope.get("type") == "object"
+                    and "name" in scope
+                    and "domain" not in scope
+                    and "prn" not in scope
+                ):
+                    risky = True
+
+    if risky:
+        messages.append(
+            CheckWarning(
+                "WORKLOAD_IDENTITY has object scopes matched by name only while DOMAIN_ENABLED is "
+                "True. A bare name matches that object in every domain, breaking domain isolation. "
+                "Add a 'domain' to the scope or use a 'prn'.",
+                id="pulpcore.W008",
+            )
+        )
+
+    return messages

{pulpcore-3.119.2 → pulpcore-3.120.0}/pulpcore/app/role_util.py

@@ -173,6 +173,28 @@ def get_objects_for_user(
     accept_domain_perms=True,
     accept_global_perms=True,
 ):
+    if (
+        "pulpcore.app.workload_identity.backend.WorkloadIdentityBackend"
+        in settings.AUTHENTICATION_BACKENDS
+    ):
+        from pulpcore.app.workload_identity.principal import WorkloadIdentityPrincipal
+
+        if isinstance(user, WorkloadIdentityPrincipal):
+            from pulpcore.app.workload_identity.authz import grants_queryset
+
+            grants = user.grants
+            if isinstance(perms, str):
+                return grants_queryset(grants, perms, qs)
+            if any_perm:
+                result = qs.none()
+                for permission_name in perms:
+                    result |= grants_queryset(grants, permission_name, qs)
+                return result
+            result = qs.all()
+            for permission_name in perms:
+                result &= grants_queryset(grants, permission_name, qs)
+            return result
+
     new_qs = qs.none()
     replace = False
     if "pulpcore.backends.ObjectRolePermissionBackend" in settings.AUTHENTICATION_BACKENDS:

{pulpcore-3.119.2 → pulpcore-3.120.0}/pulpcore/app/settings.py

@@ -317,6 +317,8 @@ AUTHENTICATION_JSON_HEADER = ""
 AUTHENTICATION_JSON_HEADER_JQ_FILTER = ""
 AUTHENTICATION_JSON_HEADER_OPENAPI_SECURITY_SCHEME = {}
 
+WORKLOAD_IDENTITY = {}
+
 ALLOWED_IMPORT_PATHS = []
 
 ALLOWED_EXPORT_PATHS = []

pulpcore-3.120.0/pulpcore/app/workload_identity/__init__.py

@@ -0,0 +1,5 @@
+"""Workload identity authentication for CI clients.
+
+A short-lived OIDC token from a third-party provider (for example GitHub Actions) becomes a
+stateless principal whose grants are computed per request from the `WORKLOAD_IDENTITY` setting.
+"""

pulpcore-3.120.0/pulpcore/app/workload_identity/authentication.py

@@ -0,0 +1,100 @@
+"""DRF authentication that validates a third-party OIDC token against its provider's JWKS.
+
+The token arrives as a `Bearer` token, or as the password of a `Basic` header whose username
+is the reserved workload-identity name. On success its claims map to grants and a stateless
+`WorkloadIdentityPrincipal` is returned.
+"""
+
+import base64
+import binascii
+import logging
+
+import jwt
+from rest_framework.authentication import BaseAuthentication
+from rest_framework.exceptions import AuthenticationFailed
+
+from pulpcore.app.workload_identity import config, rules
+from pulpcore.app.workload_identity.principal import WorkloadIdentityPrincipal
+
+_logger = logging.getLogger("pulpcore.workload_identity")
+
+
+class WorkloadIdentityAuthentication(BaseAuthentication):
+    """Authenticate requests bearing a third-party OIDC token.
+
+    On success this returns a stateless `WorkloadIdentityPrincipal` whose permissions are
+    derived entirely from the grants earned by the token's claims. When the
+    request carries no token, or a token that is not meant for us, the
+    authenticator returns `None` so that other authenticators may run.
+    """
+
+    def _get_token(self, request):
+        """Return the token from the Authorization header, or None.
+
+        Accepts a `Bearer` token, or a token carried as the password of a `Basic` header whose
+        username is the reserved workload-identity name. Any other `Basic` header is left for the
+        regular authenticators.
+        """
+        header = request.META.get("HTTP_AUTHORIZATION", "")
+        parts = header.split()
+        if len(parts) != 2:
+            return None
+        scheme, value = parts
+        scheme = scheme.lower()
+        if scheme == "bearer":
+            return value
+        if scheme == "basic":
+            try:
+                decoded = base64.b64decode(value).decode("utf-8")
+            except (binascii.Error, ValueError, UnicodeDecodeError):
+                return None
+            username, sep, password = decoded.partition(":")
+            if not sep or username != config.basic_username():
+                return None
+            return password
+        return None
+
+    def authenticate(self, request):
+        """Validate the token and return `(principal, claims)`, or `None` if it is not ours."""
+        token = self._get_token(request)
+        if not token:
+            return None
+
+        try:
+            unverified = jwt.decode(token, options={"verify_signature": False})
+        except jwt.PyJWTError:
+            return None
+        issuer = unverified.get("iss")
+
+        provider = config.provider_for_issuer(issuer)
+        if provider is None:
+            return None
+
+        try:
+            signing_key = config.jwks_client(provider).get_signing_key_from_jwt(token)
+            claims = jwt.decode(
+                token,
+                signing_key.key,
+                algorithms=provider.get("algorithms", ["RS256"]),
+                issuer=provider["issuer"],
+                audience=provider["audience"],
+                options={"require": ["exp", "iss", "aud"]},
+            )
+        except jwt.PyJWTError as exc:
+            _logger.info("Rejecting OIDC token from %s: %s", issuer, exc)
+            raise AuthenticationFailed("Invalid OIDC token.")
+
+        grants = rules.grants_for(provider, claims)
+        if not grants:
+            _logger.info(
+                "No matching OIDC rule for sub=%r repository=%r",
+                claims.get("sub"),
+                claims.get("repository"),
+            )
+            raise AuthenticationFailed("No matching OIDC rule.")
+
+        return (WorkloadIdentityPrincipal(grants, username=""), claims)
+
+    def authenticate_header(self, request):
+        """Return the `WWW-Authenticate` value so failures are 401, not 403."""
+        return "Bearer"

pulpcore-3.120.0/pulpcore/app/workload_identity/authz.py

@@ -0,0 +1,129 @@
+"""Shared authorization logic over a list of grants.
+
+A grant is `{"role": <role name>, "scope": {...}}`. Scope is one of:
+
+* `{"type": "global"}`
+* `{"type": "domain", "domain": "<name>"}`
+* `{"type": "object", "name": "<name>"}` (or `"prn"`)
+
+Roles are read from the database to resolve their permissions; the grant assignment is never stored.
+"""
+
+from django.db.models import Q
+
+from pulpcore.app.models import Domain
+from pulpcore.app.models.role import Role
+from pulpcore.app.util import extract_pk, get_prn
+
+
+def _split(permission):
+    app_label, _, codename = permission.partition(".")
+    return app_label, codename
+
+
+def _role_has_perm(role_name, app_label, codename):
+    if not role_name:
+        return False
+    try:
+        role = Role.objects.get(name=role_name)
+    except Role.DoesNotExist:
+        return False
+    return role.permissions.filter(content_type__app_label=app_label, codename=codename).exists()
+
+
+def _scope_matches(scope, obj):
+    """Whether a scope applies to a single object (`obj` may be `None` for model-level)."""
+    stype = scope.get("type")
+    if stype == "global":
+        return True
+    if obj is None:
+        return False
+    if stype == "domain":
+        if isinstance(obj, Domain):
+            return obj.name == scope.get("domain")
+        domain = getattr(obj, "pulp_domain", None)
+        return domain is not None and domain.name == scope.get("domain")
+    if stype == "object":
+        if "prn" not in scope and "name" not in scope:
+            return False
+        if "prn" in scope:
+            try:
+                if get_prn(obj) != scope["prn"]:
+                    return False
+            except Exception:
+                return False
+        if "name" in scope and str(getattr(obj, "name", None)) != str(scope["name"]):
+            return False
+        if "domain" in scope:
+            domain = getattr(obj, "pulp_domain", None)
+            if domain is None or domain.name != scope["domain"]:
+                return False
+        return True
+    return False
+
+
+def has_grant_perm(grants, permission, obj=None):
+    """True if any grant confers `permission` and its scope matches `obj`."""
+    app_label, codename = _split(permission)
+    for grant in grants:
+        if _role_has_perm(grant.get("role"), app_label, codename) and _scope_matches(
+            grant.get("scope", {}), obj
+        ):
+            return True
+    return False
+
+
+def permissions_for(grants, obj=None):
+    """The set of `app_label.codename` the grants confer, scoped to `obj` when given."""
+    names = {g.get("role") for g in grants if g.get("role")}
+    if not names:
+        return set()
+    role_perms = {}
+    for role in Role.objects.filter(name__in=names).prefetch_related("permissions__content_type"):
+        role_perms[role.name] = {
+            f"{perm.content_type.app_label}.{perm.codename}" for perm in role.permissions.all()
+        }
+    perms = set()
+    for grant in grants:
+        conferred = role_perms.get(grant.get("role"))
+        if not conferred:
+            continue
+        if obj is not None and not _scope_matches(grant.get("scope", {}), obj):
+            continue
+        perms |= conferred
+    return perms
+
+
+def grants_queryset(grants, permission, queryset):
+    """Return `queryset` filtered to the objects the grants allow for `permission`."""
+    app_label, codename = _split(permission)
+    relevant = [g for g in grants if _role_has_perm(g.get("role"), app_label, codename)]
+    if not relevant:
+        return queryset.none()
+
+    has_domain = hasattr(queryset.model, "pulp_domain")
+    predicate = None
+    for grant in relevant:
+        scope = grant.get("scope", {})
+        stype = scope.get("type")
+        if stype == "global":
+            return queryset
+        clause = None
+        if stype == "domain" and has_domain:
+            clause = Q(pulp_domain__name=scope.get("domain"))
+        elif stype == "object":
+            if "prn" in scope:
+                try:
+                    clause = Q(pk=extract_pk(scope["prn"], only_prn=True))
+                except Exception:
+                    clause = None
+            elif "name" in scope:
+                clause = Q(name=scope["name"])
+                if has_domain and "domain" in scope:
+                    clause &= Q(pulp_domain__name=scope["domain"])
+        if clause is not None:
+            predicate = clause if predicate is None else (predicate | clause)
+
+    if predicate is None:
+        return queryset.none()
+    return queryset.filter(predicate)

pulpcore-3.120.0/pulpcore/app/workload_identity/backend.py

@@ -0,0 +1,42 @@
+"""A Django authentication backend that resolves permissions for a workload-identity principal.
+
+Permission checks on a `WorkloadIdentityPrincipal` are answered here, from the per-request
+grants carried on the principal, so the feature plugs into the normal `AUTHENTICATION_BACKENDS`
+machinery. For any other user this backend defers by returning nothing.
+"""
+
+from django.contrib.auth.backends import BaseBackend
+
+from pulpcore.app.workload_identity.authz import has_grant_perm, permissions_for
+from pulpcore.app.workload_identity.principal import WorkloadIdentityPrincipal
+
+
+class WorkloadIdentityBackend(BaseBackend):
+    @staticmethod
+    def _grants(user_obj):
+        if isinstance(user_obj, WorkloadIdentityPrincipal):
+            return user_obj.grants
+        return None
+
+    def has_perm(self, user_obj, perm, obj=None):
+        grants = self._grants(user_obj)
+        if grants is None:
+            return False
+        return has_grant_perm(grants, perm, obj)
+
+    def has_module_perms(self, user_obj, app_label):
+        # BaseBackend has no has_module_perms, so we provide it (mirrors ModelBackend).
+        if self._grants(user_obj) is None:
+            return False
+        prefix = f"{app_label}."
+        return any(perm.startswith(prefix) for perm in self.get_all_permissions(user_obj))
+
+    def get_all_permissions(self, user_obj, obj=None):
+        grants = self._grants(user_obj)
+        if grants is None:
+            return set()
+        perms = permissions_for(grants, obj)
+        if obj is None:
+            return perms
+        # Match ObjectRolePermissionBackend, which returns bare codenames for object-level checks.
+        return {perm.split(".", 1)[1] for perm in perms}