pulpcore 3.120.0__tar.gz → 3.121.0__tar.gz

{pulpcore-3.120.0 → pulpcore-3.121.0}/CHANGES.md

@@ -8,6 +8,37 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.121.0 (2026-10-06) {: #3.121.0 }
+
+### REST API {: #3.121.0-rest-api }
+
+#### Features {: #3.121.0-rest-api-feature }
+
+- Added `ETag`/`If-None-Match` and `Last-Modified`/`If-Modified-Since` (`304 Not Modified`) support on content-app responses so edge caches can revalidate without re-downloading.
+  [#7929](https://github.com/pulp/pulpcore/issues/7929)
+
+#### Bugfixes {: #3.121.0-rest-api-bugfix }
+
+- Avoid loading repository version content IDs when serving fallback content during the grace period.
+- Fixed vulnerability report rescans to update existing reports.
+
+### Plugin API {: #3.121.0-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.121.0-pulp-file }
+
+#### Bugfixes {: #3.121.0-pulp-file-bugfix }
+
+- Fixed `optimize` in file sync to honor the value `False`.
+  [#8141](https://github.com/pulp/pulpcore/issues/8141)
+
+### Pulp Cert Guard {: #3.121.0-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.120.0 (2026-09-29) {: #3.120.0 }
 
 ### REST API {: #3.120.0-rest-api }
@@ -40,6 +71,30 @@ No significant changes.
 
 ---
 
+## 3.119.2 (2026-09-29) {: #3.119.2 }
+
+### REST API {: #3.119.2-rest-api }
+
+#### Bugfixes {: #3.119.2-rest-api-bugfix }
+
+- Improved the performance of the latest publication lookup when serving content
+  from a repository-backed distribution.
+  [#1995](https://github.com/pulp/pulpcore/issues/1995)
+
+### Plugin API {: #3.119.2-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.119.2-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.119.2-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.119.1 (2026-09-23) {: #3.119.1 }
 
 ### REST API {: #3.119.1-rest-api }
@@ -1218,6 +1273,28 @@ No significant changes.
 
 ---
 
+## 3.105.21 (2026-10-01) {: #3.105.21 }
+
+### REST API {: #3.105.21-rest-api }
+
+#### Bugfixes {: #3.105.21-rest-api-bugfix }
+
+- Preserve OpenPGP verification compatibility for failed signatures and fix key ID calculation for OpenPGP v6.
+
+### Plugin API {: #3.105.21-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.105.21-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.105.21-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.105.20 (2026-09-23) {: #3.105.20 }
 
 ### REST API {: #3.105.20-rest-api }

{pulpcore-3.120.0 → pulpcore-3.121.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.120.0
+Version: 3.121.0
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later
@@ -42,9 +42,9 @@ Requires-Dist: gunicorn<26.3.0,>=22.0
 Requires-Dist: jinja2<=3.1.6,>=3.1
 Requires-Dist: json_stream<2.6,>=2.3.2
 Requires-Dist: jq<1.13.0,>=1.6.0
-Requires-Dist: opentelemetry-api<1.45,>=1.27.0
-Requires-Dist: opentelemetry-sdk<1.45,>=1.27.0
-Requires-Dist: opentelemetry-exporter-otlp-proto-http<1.45,>=1.27.0
+Requires-Dist: opentelemetry-api<1.46,>=1.27.0
+Requires-Dist: opentelemetry-sdk<1.46,>=1.27.0
+Requires-Dist: opentelemetry-exporter-otlp-proto-http<1.46,>=1.27.0
 Requires-Dist: protobuf<8.0,>=4.21.1
 Requires-Dist: pulp-glue<0.41,>=0.35.0
 Requires-Dist: PyOpenSSL<27.0,>=26.3.0

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.120.0"
+    version = "3.121.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.120.0"
+    version = "3.121.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulp_file/app/tasks/synchronizing.py

@@ -7,7 +7,6 @@ from gettext import gettext as _
 from hashlib import sha256
 from urllib.parse import quote, urlparse, urlunparse
 
-from django.conf import settings
 from django.core.files import File
 
 from pulpcore.plugin.exceptions import SyncError
@@ -113,8 +112,6 @@ def synchronize(remote_pk, repository_pk, mirror, optimize=False, url=None, **kw
     remote = Remote.objects.get(pk=remote_pk).cast()
     repository = FileRepository.objects.get(pk=repository_pk)
 
-    optimize = optimize or settings.FILE_SYNC_OPTIMIZATION
-
     if not remote.url:
         raise SyncError(_("A remote must have a url specified to synchronize."))
 

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulpcore/app/apps.py

@@ -238,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.120.0"
+    version = "3.121.0"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulpcore/app/models/publication.py

@@ -868,7 +868,7 @@ class Distribution(MasterModel):
 
     def get_fallback_ca(self, path):
         """
-        Return a ContentArtifact for path from the grace-period publication history, or None.
+        Return the ContentArtifact and RepositoryVersion for path from publication history, or None.
 
         Iterates DistributedPublication records for this distribution from newest to oldest,
         trying each publication until the path is found.  Handles both pass-through and
@@ -883,6 +883,7 @@ class Distribution(MasterModel):
             .filter(distribution=self)
             .order_by("-pulp_created")
             .select_related("publication__repository_version")
+            .defer("publication__repository_version__content_ids")
         )
         for dp in recent_dp.iterator():
             pub = dp.publication
@@ -893,7 +894,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if ca is not None:
-                    return ca
+                    return ca, pub.repository_version
             else:
                 pa = (
                     pub.published_artifact.select_related(
@@ -904,7 +905,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if pa is not None:
-                    return pa.content_artifact
+                    return pa.content_artifact, pub.repository_version
         return None
 
     @hook(BEFORE_CREATE)

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulpcore/app/tasks/vulnerability_report.py

@@ -131,7 +131,9 @@ class VulnerabilityReportScanner:
         """
 
         vuln_report, created = await sync_to_async(VulnerabilityReport.objects.update_or_create)(
-            vulns=vulns, pulp_domain=get_domain(), content=content
+            pulp_domain=get_domain(),
+            content=content,
+            defaults={"vulns": vulns},
         )
         await vuln_report.repo_versions.aadd(repo_version)
 

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulpcore/app/util.py

@@ -17,6 +17,7 @@ from django.apps import apps
 from django.conf import settings
 from django.db import connection
 from django.db.models import Model, UUIDField
+from django.utils.http import parse_http_date
 from rest_framework.reverse import reverse as drf_reverse
 from rest_framework.serializers import ValidationError
 
@@ -714,6 +715,25 @@ def normalize_http_status(status):
         return ""
 
 
+def check_request_was_modified(request, last_modified, etag=None):
+    if_none_match = request.headers.get("If-None-Match")
+    if_modified_since = request.headers.get("If-Modified-Since")
+
+    if not if_none_match and not (last_modified and if_modified_since):
+        return True
+
+    if if_none_match:
+        client_etags = [etag == client_etag.strip() for client_etag in if_none_match.split(",")]
+        return not any(client_etags)
+
+    try:
+        last_modified_ts = parse_http_date(last_modified)
+        if_modified_ts = parse_http_date(if_modified_since)
+        return last_modified_ts > if_modified_ts
+    except (TypeError, ValueError):
+        return True
+
+
 class HashingFileWriter(RawIOBase):
     """
     A file-like object that handles writing data to disk with simultaneous

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulpcore/cache/cache.py

@@ -3,8 +3,8 @@ import json
 import time
 from functools import wraps
 
-from aiohttp.web import FileResponse, HTTPSuccessful, Request, Response, StreamResponse
-from aiohttp.web_exceptions import HTTPException, HTTPFound, HTTPNotFound
+from aiohttp.web import FileResponse, HTTPSuccessful, Request, Response
+from aiohttp.web_exceptions import HTTPException, HTTPFound, HTTPNotFound, HTTPNotModified
 from django.conf import settings
 from django.http import FileResponse as ApiFileResponse
 from django.http import HttpResponse, HttpResponseRedirect
@@ -18,6 +18,7 @@ from pulpcore.app.redis_connection import (
     get_async_redis_connection,
     get_redis_connection,
 )
+from pulpcore.app.util import check_request_was_modified
 from pulpcore.metrics import artifacts_size_counter
 from pulpcore.responses import ArtifactResponse
 
@@ -352,7 +353,7 @@ class AsyncContentCache(AsyncCache):
                 await self.auth(request, self, bk)
             key = self.make_key(request)
             # Check cache
-            response = await self.make_response(key, bk)
+            response = await self.make_response(key, bk, request)
             if response is None:
                 # Cache miss, create new entry
                 response = await self.make_entry(
@@ -373,7 +374,7 @@ class AsyncContentCache(AsyncCache):
             if isinstance(arg, Request):
                 return arg
 
-    async def make_response(self, key, base_key):
+    async def make_response(self, key, base_key, request=None):
         """Tries to find the cached entry and turn it into a proper response"""
         entry = await self.get(key, base_key)
         if not entry:
@@ -396,7 +397,16 @@ class AsyncContentCache(AsyncCache):
             # Bad entry, delete from cache
             await self.delete(key, base_key)
             return None
-        response = self.RESPONSE_TYPES[response_type](**entry)
+
+        headers = entry.get("headers", {})
+        if request and not check_request_was_modified(
+            request, last_modified=headers.get("Last-Modified"), etag=headers.get("ETag")
+        ):
+            response = HTTPNotModified(
+                headers={key: headers[key] for key in ("Cache-Control", "ETag") if key in headers}
+            )
+        else:
+            response = self.RESPONSE_TYPES[response_type](**entry)
         response.headers.update({"X-PULP-CACHE": "HIT"})
         return response
 
@@ -404,13 +414,12 @@ class AsyncContentCache(AsyncCache):
         """Gets the response for the request and try to turn it into a cacheable entry"""
         try:
             response = await handler(*args, **kwargs)
-        except (HTTPSuccessful, HTTPFound, HTTPNotFound) as e:
+        except (HTTPSuccessful, HTTPFound, HTTPNotFound, HTTPNotModified) as e:
             response = e
 
         original_response = response
-        if isinstance(response, StreamResponse):
-            if hasattr(response, "future_response"):
-                response = response.future_response
+        if hasattr(response, "future_response"):
+            response = response.future_response
 
         entry = {"headers": dict(response.headers), "status": response.status}
 

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulpcore/content/handler.py

@@ -18,10 +18,12 @@ from aiohttp.web_exceptions import (
     HTTPFound,
     HTTPMovedPermanently,
     HTTPNotFound,
+    HTTPNotModified,
     HTTPRequestRangeNotSatisfiable,
 )
 from asgiref.sync import sync_to_async
 from django.utils import timezone
+from django.utils.http import http_date
 from multidict import CIMultiDict
 from yarl import URL
 
@@ -57,6 +59,7 @@ from pulpcore.app.models import (  # noqa: E402
 )
 from pulpcore.app.util import (  # noqa: E402
     cache_key,
+    check_request_was_modified,
     get_domain,
 )
 from pulpcore.cache import AsyncContentCache  # noqa: E402
@@ -69,6 +72,12 @@ from pulpcore.metrics import artifacts_size_counter  # noqa: E402
 log = logging.getLogger(__name__)
 _current_distribution = ContextVar("current_distribution", default=None)
 
+# The "shared cache" (cdn/edge) should always ask pulp if their cache is still valid
+EDGE_CACHE_CONTROL = "public, max-age=0, must-revalidate"
+
+# Tell HTTP caches not to store redirects containing signed URLs.
+NO_STORE_EDGE_CACHE_CONTROL = "no-store"
+
 
 class PathNotResolved(HTTPNotFound):
     """
@@ -536,6 +545,8 @@ class Handler:
         if content_type:
             headers["Content-Type"] = content_type
 
+        headers["Cache-Control"] = EDGE_CACHE_CONTROL
+
         # Let plugin-Distribution set headers for this path if it wants.
         if distribution:
             headers.update(distribution.content_headers_for(path))
@@ -594,6 +605,48 @@ class Handler:
             sizes=sizes,
         )
 
+    @staticmethod
+    async def _set_last_modified_header(
+        headers,
+        last_modified: datetime | None = None,
+        ca=None,
+        rv=None,
+    ):
+        """Add the last-modified header to the response headers if not already present.
+
+        Pulp doesnt track "content served by a distribution" over time, so we need to use some
+        heuristics here. Lets call hypothesis 1 (H1) the common case where the distribution D is
+        serving content from RVs monotonically (either auto-publish, or something else) and that
+        the handler found a ContentArtifact (CA)  matching the path for a request.
+
+        If H1 is true, we can use the repository version history as the distributed content history.
+        In other words, we can use the following strategy for establishing last-modified for the
+        path/resource in the request with a matching CA/RV:
+
+            Given a CA is provided with its RepositoryVersion (RV_n), find the earliest version RV_k
+            such that CA is in RV_k and use that timestamp as last-modified.
+
+        If H1 is not true, (e.g the distribution rolled back the RV it serves, changed repository, etc)
+        then this can produce incorrect last_modified results (e.g, say resource dist/path/to/resource
+        was not modified, when in fact it was).
+        """
+
+        def _find_repo_add_time():
+            cpk = ca.content_id
+            rc = rv._content_relationships().filter(content_id=cpk).first()
+            return rc.pulp_created if rc else rv.pulp_created
+
+        if "Last-Modified" not in headers:
+            if last_modified is None and ca and rv:
+                last_modified = await sync_to_async(_find_repo_add_time)()
+
+            if last_modified is not None:
+                headers["Last-Modified"] = http_date(last_modified.timestamp())
+
+    @staticmethod
+    def _set_etag_headers(headers, sha):
+        headers["ETag"] = f'"{sha}"'
+
     async def list_directory(self, repo_version, publication, path):
         """
         Generate a set with directory listing of the path.
@@ -734,6 +787,13 @@ class Handler:
         content_handler_result = await sync_to_async(distro.content_handler)(original_rel_path)
         if content_handler_result is not None:
             if isinstance(content_handler_result, ContentArtifact):
+                # infer the RV which CA returned by content handler probably belongs to
+                __, rv_candidate, __ = await sync_to_async(
+                    distro.get_repository_publication_and_version
+                )()
+                await self._set_last_modified_header(
+                    headers, ca=content_handler_result, rv=rv_candidate
+                )
                 if content_handler_result.artifact:
                     return await self._serve_content_artifact(
                         content_handler_result, headers, request
@@ -769,6 +829,10 @@ class Handler:
                     raise HTTPMovedPermanently(f"{request.path}/")
                 original_rel_path = index_path
                 headers = self.response_headers(original_rel_path, distro)
+                # last-modified heuristic assumes distribution doesn't rollback to older publications
+                await self._set_last_modified_header(
+                    headers, last_modified=publication.pulp_created
+                )
             except ObjectDoesNotExist:
                 dir_list, dates, sizes = await self.list_directory(None, publication, rel_path)
                 dir_list.update(
@@ -798,6 +862,8 @@ class Handler:
             except ObjectDoesNotExist:
                 pass
             else:
+                publication_rv = publication.repository_version
+                await self._set_last_modified_header(headers, ca=ca, rv=publication_rv)
                 if ca.artifact:
                     return await self._serve_content_artifact(ca, headers, request)
                 else:
@@ -827,6 +893,8 @@ class Handler:
                 except ObjectDoesNotExist:
                     pass
                 else:
+                    publication_rv = publication.repository_version
+                    await self._set_last_modified_header(headers, ca=ca, rv=publication_rv)
                     if ca.artifact:
                         return await self._serve_content_artifact(ca, headers, request)
                     else:
@@ -836,8 +904,10 @@ class Handler:
 
         # Grace-period fallback: serve from a recently-superseded publication
         if distro.SERVE_FROM_PUBLICATION:
-            ca = await sync_to_async(distro.get_fallback_ca)(original_rel_path)
-            if ca is not None:
+            fallback = await sync_to_async(distro.get_fallback_ca)(original_rel_path)
+            if fallback is not None:
+                ca, fallback_rv = fallback
+                await self._set_last_modified_header(headers, ca=ca, rv=fallback_rv)
                 if ca.artifact:
                     return await self._serve_content_artifact(ca, headers, request)
                 else:
@@ -885,6 +955,7 @@ class Handler:
             except ObjectDoesNotExist:
                 pass
             else:
+                await self._set_last_modified_header(headers, ca=ca, rv=repo_version)
                 if ca.artifact:
                     return await self._serve_content_artifact(ca, headers, request)
                 else:
@@ -1130,6 +1201,12 @@ class Handler:
 
             return URL(storage_url, encoded=True)
 
+        def _build_redirect_response(**kwargs):
+            url = _build_url(**kwargs)
+            # Contains signed URL. Tell external caches to not store this
+            headers["Cache-Control"] = NO_STORE_EDGE_CACHE_CONTROL
+            return HTTPFound(url, headers=headers)
+
         artifact_file = content_artifact.artifact.file
         artifact_name = artifact_file.name
         domain = get_domain()
@@ -1147,12 +1224,12 @@ class Handler:
             "storages.backends.s3boto3.S3Boto3Storage",
             "storages.backends.s3.S3Storage",
         ):
-            return HTTPFound(_build_url(http_method=request.method), headers=headers)
+            return _build_redirect_response(http_method=request.method)
         elif domain.storage_class in (
             "storages.backends.azure_storage.AzureStorage",
             "storages.backends.gcloud.GoogleCloudStorage",
         ):
-            return HTTPFound(_build_url(), headers=headers)
+            return _build_redirect_response()
         else:
             raise NotImplementedError()
 
@@ -1177,8 +1254,10 @@ class Handler:
         Returns:
             The [aiohttp.web.FileResponse][] for the file.
         """
-        artifact_file = content_artifact.artifact.file
+        artifact = content_artifact.artifact
+        artifact_file = artifact.file
         content_length = artifact_file.size
+        self._set_etag_headers(headers, artifact.sha256)
 
         try:
             range_start, range_stop = request.http_range.start, request.http_range.stop
@@ -1192,9 +1271,20 @@ class Handler:
             size = artifact_file.size or "*"
             raise HTTPRequestRangeNotSatisfiable(headers={"Content-Range": f"bytes */{size}"})
 
+        response = self._build_response_from_content_artifact(content_artifact, headers, request)
+
+        if not check_request_was_modified(
+            request, last_modified=headers.get("Last-Modified"), etag=headers.get("ETag")
+        ):
+            nmod_response = HTTPNotModified(
+                headers={key: headers[key] for key in ("Cache-Control", "ETag") if key in headers}
+            )
+            if settings.CACHE_ENABLED:
+                nmod_response.future_response = response
+            raise nmod_response
+
         artifacts_size_counter.add(content_length)
 
-        response = self._build_response_from_content_artifact(content_artifact, headers, request)
         if isinstance(response, HTTPFound):
             raise response
         else:

{pulpcore-3.120.0 → pulpcore-3.121.0}/pulpcore/tests/functional/api/test_workers.py

@@ -127,7 +127,7 @@ def test_task_schedule(task_schedule, pulpcore_bindings):
 
 
 @pytest.mark.parallel
-def test_task_schedule_domain(domain_factory, pulpcore_bindings):
+def test_task_schedule_domain(domain_factory, pulpcore_bindings, monitor_task):
     """Test that a scheduled task dispatches in the TaskSchedule's domain, not the default."""
     domain = domain_factory()
     domain_name = domain.name
@@ -163,6 +163,7 @@ def test_task_schedule_domain(domain_factory, pulpcore_bindings):
         ts = task_schedules.results[0]
         assert f"/{domain_name}/" in ts.pulp_href
         assert f"/{domain_name}/" in ts.last_task
+        monitor_task(ts.last_task)
         task = pulpcore_bindings.TasksApi.read(ts.last_task)
         assert task.state == "completed"
         assert f"/{domain_name}/" in task.pulp_href