pulpcore 3.119.2__tar.gz → 3.121.0__tar.gz

{pulpcore-3.119.2 → pulpcore-3.121.0}/CHANGES.md

@@ -8,6 +8,69 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.121.0 (2026-10-06) {: #3.121.0 }
+
+### REST API {: #3.121.0-rest-api }
+
+#### Features {: #3.121.0-rest-api-feature }
+
+- Added `ETag`/`If-None-Match` and `Last-Modified`/`If-Modified-Since` (`304 Not Modified`) support on content-app responses so edge caches can revalidate without re-downloading.
+  [#7929](https://github.com/pulp/pulpcore/issues/7929)
+
+#### Bugfixes {: #3.121.0-rest-api-bugfix }
+
+- Avoid loading repository version content IDs when serving fallback content during the grace period.
+- Fixed vulnerability report rescans to update existing reports.
+
+### Plugin API {: #3.121.0-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.121.0-pulp-file }
+
+#### Bugfixes {: #3.121.0-pulp-file-bugfix }
+
+- Fixed `optimize` in file sync to honor the value `False`.
+  [#8141](https://github.com/pulp/pulpcore/issues/8141)
+
+### Pulp Cert Guard {: #3.121.0-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.120.0 (2026-09-29) {: #3.120.0 }
+
+### REST API {: #3.120.0-rest-api }
+
+#### Features {: #3.120.0-rest-api-feature }
+
+- Added workload identity authentication, so a CI job can authenticate with a short-lived OIDC token instead of a stored secret and receive per-request roles computed from the `WORKLOAD_IDENTITY` setting.
+
+#### Bugfixes {: #3.120.0-rest-api-bugfix }
+
+- Improved the performance of the latest publication lookup when serving content
+  from a repository-backed distribution.
+  [#1995](https://github.com/pulp/pulpcore/issues/1995)
+- Fixed file downloader path sanitation. CVE-2026-90959
+- Fixed the `long_running` pytest-mark, so that it correctly applies even when "nightly"
+  is selected. This includes fixing a window in the task-cleanup path, where a missing
+  worker's jobs were not getting cleaned up until a new task entered the system.
+
+### Plugin API {: #3.120.0-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.120.0-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.120.0-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.119.2 (2026-09-29) {: #3.119.2 }
 
 ### REST API {: #3.119.2-rest-api }
@@ -1210,6 +1273,52 @@ No significant changes.
 
 ---
 
+## 3.105.21 (2026-10-01) {: #3.105.21 }
+
+### REST API {: #3.105.21-rest-api }
+
+#### Bugfixes {: #3.105.21-rest-api-bugfix }
+
+- Preserve OpenPGP verification compatibility for failed signatures and fix key ID calculation for OpenPGP v6.
+
+### Plugin API {: #3.105.21-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.105.21-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.105.21-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.105.20 (2026-09-23) {: #3.105.20 }
+
+### REST API {: #3.105.20-rest-api }
+
+#### Bugfixes {: #3.105.20-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+- Fixed post-migrate hooks to prevent failing on incomplete or rolled back migrations.
+- Reduce the number and size of queries made for each content app request.
+
+### Plugin API {: #3.105.20-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.105.20-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.105.20-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.105.19 (2026-09-02) {: #3.105.19 }
 
 ### REST API {: #3.105.19-rest-api }
@@ -2652,6 +2761,29 @@ No significant changes.
 
 ---
 
+## 3.85.31 (2026-09-23) {: #3.85.31 }
+
+### REST API {: #3.85.31-rest-api }
+
+#### Bugfixes {: #3.85.31-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+- Fixed post-migrate hooks to prevent failing on incomplete or rolled back migrations.
+
+### Plugin API {: #3.85.31-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.85.31-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.85.31-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.85.30 (2026-09-01) {: #3.85.30 }
 
 ### REST API {: #3.85.30-rest-api }
@@ -4115,6 +4247,28 @@ No significant changes.
 
 ---
 
+## 3.73.45 (2026-09-24) {: #3.73.45 }
+
+### REST API {: #3.73.45-rest-api }
+
+#### Bugfixes {: #3.73.45-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.73.45-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.73.45-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.73.45-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.73.44 (2026-09-02) {: #3.73.44 }
 
 ### REST API {: #3.73.44-rest-api }
@@ -5822,6 +5976,28 @@ No significant changes.
 
 ---
 
+## 3.63.48 (2026-09-24) {: #3.63.48 }
+
+### REST API {: #3.63.48-rest-api }
+
+#### Bugfixes {: #3.63.48-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.63.48-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.63.48-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.63.48-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.63.47 (2026-09-02) {: #3.63.47 }
 
 ### REST API {: #3.63.47-rest-api }
@@ -7747,6 +7923,28 @@ No significant changes.
 
 ---
 
+## 3.49.71 (2026-09-24) {: #3.49.71 }
+
+### REST API {: #3.49.71-rest-api }
+
+#### Bugfixes {: #3.49.71-rest-api-bugfix }
+
+- Fixed file downloader path sanitation. CVE-2026-90959
+
+### Plugin API {: #3.49.71-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.49.71-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.49.71-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.49.70 (2026-09-02) {: #3.49.70 }
 
 ### REST API {: #3.49.70-rest-api }

{pulpcore-3.119.2 → pulpcore-3.121.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.119.2
+Version: 3.121.0
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later
@@ -25,6 +25,7 @@ Requires-Dist: asyncio-throttle<=1.0.2,>=1.0
 Requires-Dist: backoff<2.3,>=2.1.2
 Requires-Dist: click<8.6,>=8.1.0
 Requires-Dist: cryptography<51.0,>=49.0.0
+Requires-Dist: pyjwt<3,>=2.4
 Requires-Dist: Django<5.3,>=5.2.0
 Requires-Dist: django-filter<=26.1,>=24.3
 Requires-Dist: django-guid<3.7,>=3.4.0
@@ -41,9 +42,9 @@ Requires-Dist: gunicorn<26.3.0,>=22.0
 Requires-Dist: jinja2<=3.1.6,>=3.1
 Requires-Dist: json_stream<2.6,>=2.3.2
 Requires-Dist: jq<1.13.0,>=1.6.0
-Requires-Dist: opentelemetry-api<1.45,>=1.27.0
-Requires-Dist: opentelemetry-sdk<1.45,>=1.27.0
-Requires-Dist: opentelemetry-exporter-otlp-proto-http<1.45,>=1.27.0
+Requires-Dist: opentelemetry-api<1.46,>=1.27.0
+Requires-Dist: opentelemetry-sdk<1.46,>=1.27.0
+Requires-Dist: opentelemetry-exporter-otlp-proto-http<1.46,>=1.27.0
 Requires-Dist: protobuf<8.0,>=4.21.1
 Requires-Dist: pulp-glue<0.41,>=0.35.0
 Requires-Dist: PyOpenSSL<27.0,>=26.3.0

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.119.2"
+    version = "3.121.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.119.2"
+    version = "3.121.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulp_file/app/tasks/synchronizing.py

@@ -7,7 +7,6 @@ from gettext import gettext as _
 from hashlib import sha256
 from urllib.parse import quote, urlparse, urlunparse
 
-from django.conf import settings
 from django.core.files import File
 
 from pulpcore.plugin.exceptions import SyncError
@@ -113,8 +112,6 @@ def synchronize(remote_pk, repository_pk, mirror, optimize=False, url=None, **kw
     remote = Remote.objects.get(pk=remote_pk).cast()
     repository = FileRepository.objects.get(pk=repository_pk)
 
-    optimize = optimize or settings.FILE_SYNC_OPTIMIZATION
-
     if not remote.url:
         raise SyncError(_("A remote must have a url specified to synchronize."))
 

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/access_policy.py

@@ -1,6 +1,7 @@
 from copy import deepcopy
 
 from django.conf import settings
+from django.contrib.auth import get_user_model
 from rest_access_policy import AccessPolicy
 from rest_framework.exceptions import APIException
 
@@ -15,6 +16,17 @@ class DefaultAccessPolicy(AccessPolicy):
     An AccessPolicy that takes default statements from the view(set).
     """
 
+    def get_user_group_values(self, user):
+        """Read groups from the ORM only for real database users.
+
+        drf-access-policy assumes groups live in `django.contrib.auth` and prefetches them,
+        which does not work for a stateless principal. Any non-database user (a workload-identity
+        principal, or another one added later) supplies its groups via a `group_names` attribute.
+        """
+        if isinstance(user, get_user_model()):
+            return super().get_user_group_values(user)
+        return list(getattr(user, "group_names", []))
+
     @classmethod
     def get_access_policy(cls, view):
         """

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/apps.py

@@ -238,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.119.2"
+    version = "3.121.0"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/checks.py

@@ -123,3 +123,105 @@ def check_artifact_checksums(app_configs, **kwargs):
         )
 
     return messages
+
+
+_WORKLOAD_IDENTITY_BACKEND = "pulpcore.app.workload_identity.backend.WorkloadIdentityBackend"
+
+
+@register(deploy=True)
+def workload_identity_reserved_username(app_configs, **kwargs):
+    if _WORKLOAD_IDENTITY_BACKEND not in settings.AUTHENTICATION_BACKENDS:
+        return []
+
+    from pulpcore.app.workload_identity import config
+
+    messages = []
+    if not config.config():
+        return messages
+
+    username = config.basic_username()
+    try:
+        from django.contrib.auth import get_user_model
+
+        collides = get_user_model().objects.filter(username=username).exists()
+    except Exception:
+        return messages
+
+    if collides:
+        messages.append(
+            CheckWarning(
+                f"The WORKLOAD_IDENTITY basic_auth_username '{username}' is also a database user. "
+                "A token presented with this username over Basic auth is validated as a workload "
+                "identity token, not as that user's password. Set basic_auth_username to a name "
+                "that is not a real user to avoid ambiguity.",
+                id="pulpcore.W006",
+            )
+        )
+
+    return messages
+
+
+@register(deploy=True)
+def workload_identity_domain_scopes(app_configs, **kwargs):
+    if _WORKLOAD_IDENTITY_BACKEND not in settings.AUTHENTICATION_BACKENDS:
+        return []
+
+    from pulpcore.app.workload_identity import config
+
+    messages = []
+    if settings.DOMAIN_ENABLED or not config.config():
+        return messages
+
+    uses_domain = any(
+        grant.get("scope", {}).get("type") == "domain" or "domain" in grant.get("scope", {})
+        for provider in config.providers().values()
+        for rule in provider.get("rules", [])
+        for grant in rule.get("grants", [])
+    )
+    if uses_domain:
+        messages.append(
+            CheckWarning(
+                "WORKLOAD_IDENTITY has grant scopes that reference a domain, but DOMAIN_ENABLED is "
+                "False. Domain scoping has no effect while domains are disabled.",
+                id="pulpcore.W007",
+            )
+        )
+
+    return messages
+
+
+@register(deploy=True)
+def workload_identity_unqualified_name_scopes(app_configs, **kwargs):
+    if _WORKLOAD_IDENTITY_BACKEND not in settings.AUTHENTICATION_BACKENDS:
+        return []
+
+    from pulpcore.app.workload_identity import config
+
+    messages = []
+    if not settings.DOMAIN_ENABLED or not config.config():
+        return messages
+
+    risky = False
+    for provider in config.providers().values():
+        for rule in provider.get("rules", []):
+            for grant in rule.get("grants", []):
+                scope = grant.get("scope", {})
+                if (
+                    scope.get("type") == "object"
+                    and "name" in scope
+                    and "domain" not in scope
+                    and "prn" not in scope
+                ):
+                    risky = True
+
+    if risky:
+        messages.append(
+            CheckWarning(
+                "WORKLOAD_IDENTITY has object scopes matched by name only while DOMAIN_ENABLED is "
+                "True. A bare name matches that object in every domain, breaking domain isolation. "
+                "Add a 'domain' to the scope or use a 'prn'.",
+                id="pulpcore.W008",
+            )
+        )
+
+    return messages

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/models/publication.py

@@ -868,7 +868,7 @@ class Distribution(MasterModel):
 
     def get_fallback_ca(self, path):
         """
-        Return a ContentArtifact for path from the grace-period publication history, or None.
+        Return the ContentArtifact and RepositoryVersion for path from publication history, or None.
 
         Iterates DistributedPublication records for this distribution from newest to oldest,
         trying each publication until the path is found.  Handles both pass-through and
@@ -883,6 +883,7 @@ class Distribution(MasterModel):
             .filter(distribution=self)
             .order_by("-pulp_created")
             .select_related("publication__repository_version")
+            .defer("publication__repository_version__content_ids")
         )
         for dp in recent_dp.iterator():
             pub = dp.publication
@@ -893,7 +894,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if ca is not None:
-                    return ca
+                    return ca, pub.repository_version
             else:
                 pa = (
                     pub.published_artifact.select_related(
@@ -904,7 +905,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if pa is not None:
-                    return pa.content_artifact
+                    return pa.content_artifact, pub.repository_version
         return None
 
     @hook(BEFORE_CREATE)

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/role_util.py

@@ -173,6 +173,28 @@ def get_objects_for_user(
     accept_domain_perms=True,
     accept_global_perms=True,
 ):
+    if (
+        "pulpcore.app.workload_identity.backend.WorkloadIdentityBackend"
+        in settings.AUTHENTICATION_BACKENDS
+    ):
+        from pulpcore.app.workload_identity.principal import WorkloadIdentityPrincipal
+
+        if isinstance(user, WorkloadIdentityPrincipal):
+            from pulpcore.app.workload_identity.authz import grants_queryset
+
+            grants = user.grants
+            if isinstance(perms, str):
+                return grants_queryset(grants, perms, qs)
+            if any_perm:
+                result = qs.none()
+                for permission_name in perms:
+                    result |= grants_queryset(grants, permission_name, qs)
+                return result
+            result = qs.all()
+            for permission_name in perms:
+                result &= grants_queryset(grants, permission_name, qs)
+            return result
+
     new_qs = qs.none()
     replace = False
     if "pulpcore.backends.ObjectRolePermissionBackend" in settings.AUTHENTICATION_BACKENDS:

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/settings.py

@@ -317,6 +317,8 @@ AUTHENTICATION_JSON_HEADER = ""
 AUTHENTICATION_JSON_HEADER_JQ_FILTER = ""
 AUTHENTICATION_JSON_HEADER_OPENAPI_SECURITY_SCHEME = {}
 
+WORKLOAD_IDENTITY = {}
+
 ALLOWED_IMPORT_PATHS = []
 
 ALLOWED_EXPORT_PATHS = []

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/tasks/vulnerability_report.py

@@ -131,7 +131,9 @@ class VulnerabilityReportScanner:
         """
 
         vuln_report, created = await sync_to_async(VulnerabilityReport.objects.update_or_create)(
-            vulns=vulns, pulp_domain=get_domain(), content=content
+            pulp_domain=get_domain(),
+            content=content,
+            defaults={"vulns": vulns},
         )
         await vuln_report.repo_versions.aadd(repo_version)
 

{pulpcore-3.119.2 → pulpcore-3.121.0}/pulpcore/app/util.py

@@ -17,6 +17,7 @@ from django.apps import apps
 from django.conf import settings
 from django.db import connection
 from django.db.models import Model, UUIDField
+from django.utils.http import parse_http_date
 from rest_framework.reverse import reverse as drf_reverse
 from rest_framework.serializers import ValidationError
 
@@ -714,6 +715,25 @@ def normalize_http_status(status):
         return ""
 
 
+def check_request_was_modified(request, last_modified, etag=None):
+    if_none_match = request.headers.get("If-None-Match")
+    if_modified_since = request.headers.get("If-Modified-Since")
+
+    if not if_none_match and not (last_modified and if_modified_since):
+        return True
+
+    if if_none_match:
+        client_etags = [etag == client_etag.strip() for client_etag in if_none_match.split(",")]
+        return not any(client_etags)
+
+    try:
+        last_modified_ts = parse_http_date(last_modified)
+        if_modified_ts = parse_http_date(if_modified_since)
+        return last_modified_ts > if_modified_ts
+    except (TypeError, ValueError):
+        return True
+
+
 class HashingFileWriter(RawIOBase):
     """
     A file-like object that handles writing data to disk with simultaneous

pulpcore-3.121.0/pulpcore/app/workload_identity/__init__.py

@@ -0,0 +1,5 @@
+"""Workload identity authentication for CI clients.
+
+A short-lived OIDC token from a third-party provider (for example GitHub Actions) becomes a
+stateless principal whose grants are computed per request from the `WORKLOAD_IDENTITY` setting.
+"""

pulpcore-3.121.0/pulpcore/app/workload_identity/authentication.py

@@ -0,0 +1,100 @@
+"""DRF authentication that validates a third-party OIDC token against its provider's JWKS.
+
+The token arrives as a `Bearer` token, or as the password of a `Basic` header whose username
+is the reserved workload-identity name. On success its claims map to grants and a stateless
+`WorkloadIdentityPrincipal` is returned.
+"""
+
+import base64
+import binascii
+import logging
+
+import jwt
+from rest_framework.authentication import BaseAuthentication
+from rest_framework.exceptions import AuthenticationFailed
+
+from pulpcore.app.workload_identity import config, rules
+from pulpcore.app.workload_identity.principal import WorkloadIdentityPrincipal
+
+_logger = logging.getLogger("pulpcore.workload_identity")
+
+
+class WorkloadIdentityAuthentication(BaseAuthentication):
+    """Authenticate requests bearing a third-party OIDC token.
+
+    On success this returns a stateless `WorkloadIdentityPrincipal` whose permissions are
+    derived entirely from the grants earned by the token's claims. When the
+    request carries no token, or a token that is not meant for us, the
+    authenticator returns `None` so that other authenticators may run.
+    """
+
+    def _get_token(self, request):
+        """Return the token from the Authorization header, or None.
+
+        Accepts a `Bearer` token, or a token carried as the password of a `Basic` header whose
+        username is the reserved workload-identity name. Any other `Basic` header is left for the
+        regular authenticators.
+        """
+        header = request.META.get("HTTP_AUTHORIZATION", "")
+        parts = header.split()
+        if len(parts) != 2:
+            return None
+        scheme, value = parts
+        scheme = scheme.lower()
+        if scheme == "bearer":
+            return value
+        if scheme == "basic":
+            try:
+                decoded = base64.b64decode(value).decode("utf-8")
+            except (binascii.Error, ValueError, UnicodeDecodeError):
+                return None
+            username, sep, password = decoded.partition(":")
+            if not sep or username != config.basic_username():
+                return None
+            return password
+        return None
+
+    def authenticate(self, request):
+        """Validate the token and return `(principal, claims)`, or `None` if it is not ours."""
+        token = self._get_token(request)
+        if not token:
+            return None
+
+        try:
+            unverified = jwt.decode(token, options={"verify_signature": False})
+        except jwt.PyJWTError:
+            return None
+        issuer = unverified.get("iss")
+
+        provider = config.provider_for_issuer(issuer)
+        if provider is None:
+            return None
+
+        try:
+            signing_key = config.jwks_client(provider).get_signing_key_from_jwt(token)
+            claims = jwt.decode(
+                token,
+                signing_key.key,
+                algorithms=provider.get("algorithms", ["RS256"]),
+                issuer=provider["issuer"],
+                audience=provider["audience"],
+                options={"require": ["exp", "iss", "aud"]},
+            )
+        except jwt.PyJWTError as exc:
+            _logger.info("Rejecting OIDC token from %s: %s", issuer, exc)
+            raise AuthenticationFailed("Invalid OIDC token.")
+
+        grants = rules.grants_for(provider, claims)
+        if not grants:
+            _logger.info(
+                "No matching OIDC rule for sub=%r repository=%r",
+                claims.get("sub"),
+                claims.get("repository"),
+            )
+            raise AuthenticationFailed("No matching OIDC rule.")
+
+        return (WorkloadIdentityPrincipal(grants, username=""), claims)
+
+    def authenticate_header(self, request):
+        """Return the `WWW-Authenticate` value so failures are 401, not 403."""
+        return "Bearer"