pulpcore 3.121.3__tar.gz → 3.122.0__tar.gz

{pulpcore-3.121.3 → pulpcore-3.122.0}/CHANGES.md

@@ -8,6 +8,49 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.122.0 (2026-10-14) {: #3.122.0 }
+
+### REST API {: #3.122.0-rest-api }
+
+#### Features {: #3.122.0-rest-api-feature }
+
+- Added `ETag`/`If-None-Match` and `Last-Modified`/`If-Modified-Since` (`304 Not Modified`) support on content-app responses so edge caches can revalidate without re-downloading.
+  [#7929](https://github.com/pulp/pulpcore/issues/7929)
+- Added a `pulpcore-manager clear-cache` command to clear cached content responses globally or by repository, distribution, or base path.
+  [#8165](https://github.com/pulp/pulpcore/issues/8165)
+- Added `UpstreamPulp.remote_policy` so remotes created during replication can use `on_demand` or `streamed` instead of defaulting to `immediate`.
+- Added an authentication backend for SAML2 attribute based authorization.
+
+#### Bugfixes {: #3.122.0-rest-api-bugfix }
+
+- Use repository-version summaries to speed unfiltered content-list pagination counts.
+  [#PULP-1996](https://github.com/pulp/pulpcore/issues/PULP-1996)
+- Fixed a bug where filesystem export trying to use local on demand files can be tricked breaking out of `ALLOWED_IMPORT_PATHS`.
+- Fixed an issue where users were able to list (but not modify) uploads they didn't have permissions to view.
+- Fixed directory listings for published content displaying publication time instead of repository added date.
+- Optimized `scope_queryset` SQL queries when using a domain scoped endpoint.
+- Orphan cleanup with `content_hrefs` now deletes only artifacts associated with the selected content.
+- Removed parent directory sizes and fixed wrong last modified timestamp in content app listings.
+- Repeated object lookups in a single API request now reuse the retrieved object.
+- Reverted support for returning 304 responses to content requests with conditional headers
+  because of a breaking change in the internal plugin's API.
+
+### Plugin API {: #3.122.0-plugin-api }
+
+#### Features {: #3.122.0-plugin-api-feature }
+
+- Made `add_and_remove` and `aadd_and_remove` return the serialized newly created repository version as the task result.
+
+### Pulp File {: #3.122.0-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.122.0-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.121.3 (2026-10-09) {: #3.121.3 }
 
 ### REST API {: #3.121.3-rest-api }
@@ -218,6 +261,34 @@ No significant changes.
 
 ---
 
+## 3.118.2 (2026-10-13) {: #3.118.2 }
+
+### REST API {: #3.118.2-rest-api }
+
+#### Bugfixes {: #3.118.2-rest-api-bugfix }
+
+- Avoid loading repository version content IDs when serving fallback content during the grace period.
+- Fixed an issue where users were able to list (but not modify) uploads they didn't have permissions to view.
+- Fixed directory listings for published content displaying publication time instead of repository added date.
+- Fixed vulnerability report rescans to update existing reports.
+- Optimized `scope_queryset` SQL queries when using a domain scoped endpoint.
+- Removed parent directory sizes and fixed wrong last modified timestamp in content app listings.
+- Repeated object lookups in a single API request now reuse the retrieved object.
+
+### Plugin API {: #3.118.2-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.118.2-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.118.2-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.118.1 (2026-09-17) {: #3.118.1 }
 
 ### REST API {: #3.118.1-rest-api }

{pulpcore-3.121.3 → pulpcore-3.122.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.121.3
+Version: 3.122.0
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later
@@ -27,7 +27,7 @@ Requires-Dist: click<8.6,>=8.1.0
 Requires-Dist: cryptography<51.0,>=49.0.0
 Requires-Dist: pyjwt<3,>=2.4
 Requires-Dist: Django<5.3,>=5.2.0
-Requires-Dist: django-filter<=26.1,>=24.3
+Requires-Dist: django-filter<=26.2,>=24.3
 Requires-Dist: django-guid<3.7,>=3.4.0
 Requires-Dist: django-import-export<5.0,>=2.9
 Requires-Dist: django-lifecycle<=1.3.0,>=1.0
@@ -78,7 +78,7 @@ Provides-Extra: diagnostics
 Requires-Dist: pyinstrument~=5.0; extra == "diagnostics"
 Requires-Dist: memray~=1.17; extra == "diagnostics"
 Provides-Extra: uvloop
-Requires-Dist: uvloop<0.22,>=0.20; extra == "uvloop"
+Requires-Dist: uvloop<0.24,>=0.20; extra == "uvloop"
 Dynamic: license-file
 
 

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.121.3"
+    version = "3.122.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.121.3"
+    version = "3.122.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/apps.py

@@ -238,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.121.3"
+    version = "3.122.0"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

pulpcore-3.122.0/pulpcore/app/management/commands/clear-cache.py

@@ -0,0 +1,108 @@
+from gettext import gettext as _
+
+from django.conf import settings
+from django.core.management import BaseCommand, CommandError
+from django.db.models import Q
+from rest_framework.exceptions import ValidationError
+
+from pulpcore.app.models import Distribution, Repository
+from pulpcore.app.util import cache_key, resolve_prn
+from pulpcore.cache import Cache
+
+
+def resolve_resources(resources, model):
+    """Resolve resource names and PRNs to a queryset filter."""
+    pks = []
+    names = []
+    for resource in resources:
+        if resource.startswith("prn:"):
+            try:
+                resource_model, pk = resolve_prn(resource)
+            except ValidationError as exc:
+                raise CommandError(str(exc))
+            if not issubclass(resource_model, model):
+                raise CommandError(f"{resource} is not a {model.__name__} PRN.")
+            pks.append(pk)
+        else:
+            names.append(resource)
+    return Q(pk__in=pks) | Q(name__in=names)
+
+
+class Command(BaseCommand):
+    """Clear cached content responses."""
+
+    help = "Clear cached content responses, optionally for repositories or distributions."
+
+    def add_arguments(self, parser):
+        """Set up arguments."""
+        parser.add_argument(
+            "--repository",
+            action="append",
+            help=_("Repository name or PRN to clear. May be specified more than once."),
+        )
+        parser.add_argument(
+            "--distribution",
+            action="append",
+            help=_("Distribution name or PRN to clear. May be specified more than once."),
+        )
+        parser.add_argument(
+            "--base-path",
+            action="append",
+            help=_("Base path to clear directly. May be specified more than once."),
+        )
+        parser.add_argument(
+            "--domain",
+            help=_("Domain name to clear or use with resource names."),
+        )
+
+    def handle(self, *args, **options):
+        """Clear the selected content cache entries."""
+        if not settings.CACHE_ENABLED:
+            raise CommandError("Content caching is not enabled.")
+
+        repositories = options["repository"]
+        distributions = options["distribution"]
+        base_paths = options["base_path"]
+        if isinstance(repositories, str):
+            repositories = [repositories]
+        if isinstance(distributions, str):
+            distributions = [distributions]
+        if isinstance(base_paths, str):
+            base_paths = [base_paths]
+        domain = options["domain"]
+        distribution_queryset = Distribution.objects.all()
+        if base_paths:
+            if settings.DOMAIN_ENABLED and not domain:
+                raise CommandError(
+                    "--domain is required with --base-path when domains are enabled."
+                )
+            base_keys = cache_key(base_paths, domain=domain)
+        elif repositories:
+            selected_repositories = Repository.objects.filter(
+                resolve_resources(repositories, Repository)
+            )
+            distribution_queryset = distribution_queryset.filter(
+                Q(repository__in=selected_repositories)
+                | Q(repository_version__repository__in=selected_repositories)
+                | Q(publication__repository_version__repository__in=selected_repositories)
+            )
+        elif distributions:
+            distribution_queryset = distribution_queryset.filter(
+                resolve_resources(distributions, Distribution)
+            )
+
+        if not base_paths:
+            if domain:
+                distribution_queryset = distribution_queryset.filter(pulp_domain__name=domain)
+            if settings.DOMAIN_ENABLED:
+                base_keys = [
+                    cache_key(distribution.base_path, domain=distribution.pulp_domain)
+                    for distribution in distribution_queryset.select_related("pulp_domain")
+                ]
+            else:
+                base_keys = list(distribution_queryset.values_list("base_path", flat=True))
+
+        cleared_entries = Cache().delete(base_key=base_keys) if base_keys else 0
+        self.stdout.write(
+            f"Cleared {cleared_entries} cache entr{'y' if cleared_entries == 1 else 'ies'}."
+        )

pulpcore-3.122.0/pulpcore/app/migrations/0161_upstreampulp_remote_policy.py

@@ -0,0 +1,34 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("core", "0160_envvarheadercontentguard"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="upstreampulp",
+            name="remote_policy",
+            field=models.TextField(
+                choices=[
+                    ("immediate", "When syncing, download all metadata and content now."),
+                    (
+                        "on_demand",
+                        "When syncing, download metadata, but do not download content now. "
+                        "Instead, download content as clients request it, and save it in Pulp "
+                        "to be served for future client requests.",
+                    ),
+                    (
+                        "streamed",
+                        "When syncing, download metadata, but do not download content now. "
+                        "Instead,download content as clients request it, but never save it in "
+                        "Pulp. This causes future requests for that same content to have to be "
+                        "downloaded again.",
+                    ),
+                ],
+                null=True,
+            ),
+        ),
+    ]

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/models/publication.py

@@ -868,7 +868,7 @@ class Distribution(MasterModel):
 
     def get_fallback_ca(self, path):
         """
-        Return a ContentArtifact for path from the grace-period publication history, or None.
+        Return the ContentArtifact and RepositoryVersion for path from publication history, or None.
 
         Iterates DistributedPublication records for this distribution from newest to oldest,
         trying each publication until the path is found.  Handles both pass-through and
@@ -894,7 +894,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if ca is not None:
-                    return ca
+                    return ca, pub.repository_version
             else:
                 pa = (
                     pub.published_artifact.select_related(
@@ -905,7 +905,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if pa is not None:
-                    return pa.content_artifact
+                    return pa.content_artifact, pub.repository_version
         return None
 
     @hook(BEFORE_CREATE)

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/models/replica.py

@@ -11,6 +11,8 @@ from django.db import models
 from pulpcore.app.util import get_domain_pk
 from pulpcore.plugin.models import AutoAddObjPermsMixin, BaseModel, EncryptedTextField
 
+from .repository import Remote
+
 
 class UpstreamPulp(BaseModel, AutoAddObjPermsMixin):
     ALL = "all"
@@ -59,6 +61,7 @@ class UpstreamPulp(BaseModel, AutoAddObjPermsMixin):
     sock_read_timeout = models.FloatField(
         null=True, validators=[MinValueValidator(0.0, "Timeout must be >= 0")]
     )
+    remote_policy = models.TextField(choices=Remote.POLICY_CHOICES, null=True)
 
     q_select = models.TextField(null=True)
     policy = models.TextField(choices=POLICY_CHOICES, default=ALL)

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/models/repository.py

@@ -983,6 +983,41 @@ class RepositoryVersion(BaseModel):
         get_latest_by = "number"
         ordering = ("number",)
 
+    def _summary_counts(self):
+        """Return cached summary counts, loading all rows at most once."""
+        if not hasattr(self, "_repository_version_summary_counts"):
+            self._repository_version_summary_counts = {
+                (item.content_type, item.count_type): item.count for item in self.counts.all()
+            }
+        return self._repository_version_summary_counts
+
+    def _get_count(self, content_type, count_type):
+        """Return a count for one content type or sum counts across all types."""
+        counts = self._summary_counts()
+        if content_type is not None:
+            return counts.get((content_type, count_type), 0)
+        return sum(
+            value
+            for (item_type, item_count_type), value in counts.items()
+            if item_count_type == count_type
+        )
+
+    def has_count(self, content_type, count_type):
+        """Return whether a persisted summary exists for a content type and count type."""
+        return (content_type, count_type) in self._summary_counts()
+
+    def count(self, content_type=None):
+        """Return the number of present content units, optionally by type."""
+        return self._get_count(content_type, RepositoryVersionContentDetails.PRESENT)
+
+    def added_count(self, content_type=None):
+        """Return the number of content units added, optionally by type."""
+        return self._get_count(content_type, RepositoryVersionContentDetails.ADDED)
+
+    def removed_count(self, content_type=None):
+        """Return the number of content units removed, optionally by type."""
+        return self._get_count(content_type, RepositoryVersionContentDetails.REMOVED)
+
     def _content_relationships(self):
         """
         Returns a set of repository_content for a repository version

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/serializers/replica.py

@@ -3,7 +3,7 @@ from gettext import gettext as _
 from rest_framework import serializers
 from rest_framework.validators import UniqueValidator
 
-from pulpcore.app.models import UpstreamPulp
+from pulpcore.app.models import Remote, UpstreamPulp
 from pulpcore.app.serializers import (
     HiddenFieldsMixin,
     IdentityField,
@@ -122,6 +122,16 @@ class UpstreamPulpSerializer(ModelSerializer, HiddenFieldsMixin):
         ),
         min_value=0.0,
     )
+    remote_policy = serializers.ChoiceField(
+        choices=Remote.POLICY_CHOICES,
+        help_text=_(
+            "Download policy for remotes created during replication. One of 'immediate', "
+            "'on_demand', or 'streamed'. Distinct from 'policy', which controls how replicate "
+            "manages local objects. Defaults to the Remote default ('immediate') when unset."
+        ),
+        required=False,
+        allow_null=True,
+    )
 
     pulp_last_updated = serializers.DateTimeField(
         help_text="Timestamp of the most recent update of the remote.", read_only=True
@@ -178,6 +188,7 @@ class UpstreamPulpSerializer(ModelSerializer, HiddenFieldsMixin):
             "connect_timeout",
             "sock_connect_timeout",
             "sock_read_timeout",
+            "remote_policy",
             "pulp_last_updated",
             "hidden_fields",
             "q_select",

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/settings.py

@@ -616,7 +616,7 @@ def saml2_settings_hook(settings):
     if "SAML_CONFIG" in settings:
         data["INSTALLED_APPS"] = ["djangosaml2"]
         data["MIDDLEWARE"] = ["djangosaml2.middleware.SamlSessionMiddleware"]
-        data["AUTHENTICATION_BACKENDS"] = ["djangosaml2.backends.Saml2Backend"]
+        data["AUTHENTICATION_BACKENDS"] = ["pulpcore.saml2.backends.PulpSaml2Backend"]
         if "LOGIN_URL" not in settings:
             data["LOGIN_URL"] = "/saml2/login/"
         if "SESSION_COOKIE_SECURE" not in settings:

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/tasks/export.py

@@ -7,7 +7,7 @@ import tarfile
 from gettext import gettext as _
 from glob import glob
 from pathlib import Path
-from urllib.parse import unquote, urlparse
+from urllib.parse import urlparse
 
 from django.conf import settings
 
@@ -97,7 +97,12 @@ def _validate_fs_export(content_artifacts):
 def _local_path_from_file_url(url):
     """Convert a file:// URL to an absolute local filesystem path."""
     parsed = urlparse(url)
-    return os.path.abspath(os.path.join(parsed.netloc, unquote(parsed.path)))
+    if parsed.netloc not in ["", "localhost"]:
+        raise UnexportableArtifactException()
+    path = Path(parsed.path).resolve()
+    if not any(path.is_relative_to(allowed) for allowed in settings.ALLOWED_IMPORT_PATHS):
+        raise UnexportableArtifactException()
+    return str(path)
 
 
 def _file_url_local_paths(content_artifacts):

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/tasks/orphan.py

@@ -8,6 +8,7 @@ from django.utils import timezone
 from pulpcore.app.models import (
     Artifact,
     Content,
+    ContentArtifact,
     ProgressReport,
     PublishedMetadata,
     PulpTemporaryFile,
@@ -47,9 +48,19 @@ def orphan_cleanup(
     This task removes Artifact files from the filesystem as well.
 
     Kwargs:
-        content_pks (list): A list of content pks. If specified, only remove these orphans.
+        content_pks (list): If specified, only remove these orphan content units and their orphaned
+            artifacts.
 
     """
+    artifact_pks = None
+    if content_pks:
+        # Content deletion removes these memberships, so capture the artifacts first.
+        artifact_pks = list(
+            ContentArtifact.objects.filter(content_id__in=content_pks, artifact__isnull=False)
+            .values_list("artifact_id", flat=True)
+            .distinct()
+        )
+
     content = Content.objects.orphaned(orphan_protection_time, content_pks).exclude(
         pulp_type=PublishedMetadata.get_pulp_type()
     )
@@ -86,6 +97,8 @@ def orphan_cleanup(
 
     # delete the artifacts that don't belong to any content
     artifacts = Artifact.objects.orphaned(orphan_protection_time)
+    if artifact_pks is not None:
+        artifacts = artifacts.filter(pk__in=artifact_pks)
 
     skipped_artifact = 0
     with ProgressReport(

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/tasks/replica.py

@@ -53,6 +53,25 @@ def _ssl_temp_files(server):
                 pass
 
 
+def _build_remote_settings(server):
+    """Build fields copied onto remotes created during replication."""
+    remote_settings = {
+        "ca_cert": server.ca_cert,
+        "tls_validation": server.tls_validation,
+        "client_cert": server.client_cert,
+        "client_key": server.client_key,
+        "download_concurrency": server.download_concurrency,
+        "max_retries": server.max_retries,
+        "total_timeout": server.total_timeout,
+        "connect_timeout": server.connect_timeout,
+        "sock_connect_timeout": server.sock_connect_timeout,
+        "sock_read_timeout": server.sock_read_timeout,
+    }
+    if server.remote_policy is not None:
+        remote_settings["policy"] = server.remote_policy
+    return remote_settings
+
+
 def replicate_distributions(server_pk, q_select=None, **kwargs):
     server = UpstreamPulp.objects.get(pk=server_pk)
     with _ssl_temp_files(server) as ssl_files:
@@ -76,18 +95,7 @@ def replicate_distributions(server_pk, q_select=None, **kwargs):
             }
         )
 
-        remote_settings = {
-            "ca_cert": server.ca_cert,
-            "tls_validation": server.tls_validation,
-            "client_cert": server.client_cert,
-            "client_key": server.client_key,
-            "download_concurrency": server.download_concurrency,
-            "max_retries": server.max_retries,
-            "total_timeout": server.total_timeout,
-            "connect_timeout": server.connect_timeout,
-            "sock_connect_timeout": server.sock_connect_timeout,
-            "sock_read_timeout": server.sock_read_timeout,
-        }
+        remote_settings = _build_remote_settings(server)
         try:
             task_group = TaskGroup.current()
             supported_replicators = []

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/tasks/repository.py

@@ -10,6 +10,7 @@ from django.db import transaction
 
 from pulpcore.app import models
 from pulpcore.app.models import ProgressReport
+from pulpcore.app.serializers import RepositoryVersionSerializer
 from pulpcore.app.util import get_domain
 from pulpcore.exceptions.base import RepositoryVersionDeleteError
 
@@ -198,6 +199,14 @@ def repair_all_artifacts(verify_checksums, **kwargs):
     loop.run_until_complete(_repair_artifacts_for_content(verify_checksums=verify_checksums))
 
 
+def _serialize_version(version):
+    """Serialize `version` if it was created (i.e. not discarded as a no-op) else return None."""
+    if not version.complete:
+        return None
+    # The hyperlinked fields require the "request" key in the context, but hrefs are relative.
+    return RepositoryVersionSerializer(version, context={"request": None}).data
+
+
 def add_and_remove(
     repository_pk,
     add_content_units,
@@ -220,6 +229,10 @@ def add_and_remove(
             as the initial set of content for our new RepositoryVersion
         overwrite (bool): When False, raise ContentOverwriteError if any content being added
             conflicts with existing content based on repo_key_fields. Defaults to True.
+
+    Returns:
+        dict: The serialized newly created RepositoryVersion, or None if nothing changed and no
+            version was created.
     """
     repository = models.Repository.objects.get(pk=repository_pk).cast()
 
@@ -247,11 +260,13 @@ def add_and_remove(
         new_version.remove_content(models.Content.objects.filter(pk__in=remove_content_units))
         new_version.add_content(models.Content.objects.filter(pk__in=add_content_units))
 
+    return _serialize_version(new_version)
+
 
 async def aadd_and_remove(
     repository_pk, add_content_units, remove_content_units, base_version_pk=None, **kwargs
 ):
-    """Aynsc version of add_and_remove."""
+    """Async version of add_and_remove."""
     repository = await models.Repository.objects.aget(pk=repository_pk)
     repository = await repository.acast()
 
@@ -271,5 +286,6 @@ async def aadd_and_remove(
         with repository.new_version(base_version=base_version) as new_version:
             new_version.remove_content(models.Content.objects.filter(pk__in=remove_content_units))
             new_version.add_content(models.Content.objects.filter(pk__in=add_content_units))
+        return _serialize_version(new_version)
 
-    await sync_to_async(add_to_repository)()
+    return await sync_to_async(add_to_repository)()

{pulpcore-3.121.3 → pulpcore-3.122.0}/pulpcore/app/util.py

@@ -17,6 +17,8 @@ from django.apps import apps
 from django.conf import settings
 from django.db import connection
 from django.db.models import Model, UUIDField
+from django.urls import Resolver404, resolve
+from django.utils.http import parse_http_date
 from rest_framework.reverse import reverse as drf_reverse
 from rest_framework.serializers import ValidationError
 
@@ -164,6 +166,18 @@ def resolve_prn(prn):
     return model, pk
 
 
+def resolve_repository_version_href(uri):
+    """Return route parameters from a numbered repository-version href."""
+    try:
+        kwargs = resolve(urlparse(uri).path).kwargs
+    except Resolver404:
+        raise ValidationError(detail=_("URI not valid: {u}").format(u=uri))
+    if "repository_pk" not in kwargs or "number" not in kwargs:
+        raise ValidationError(detail=_("URI not valid: {u}").format(u=uri))
+    kwargs["number"] = int(kwargs["number"])
+    return kwargs
+
+
 def extract_pk(uri, only_prn=False):
     """
     Resolve a resource URI or PRN to a simple PK value.
@@ -467,9 +481,9 @@ def gpg_verify(public_keys, signature, detached_data=None):
             result = verify(file=detached_data, store=store, signature=sig)
         else:
             result = verify(bytes=sig_data, store=store)
-    except Exception:
-        message = _("The signature is not valid.")
-        raise InvalidSignatureError(message, verified=VerifyResult(status=message)) from None
+    except Exception as e:
+        message = _("The signature is not valid: {}").format(e)
+        raise InvalidSignatureError(message, verified=VerifyResult(status=message))
 
     return VerifyResult(result)
 
@@ -679,14 +693,15 @@ def set_domain(new_domain):
     return new_domain
 
 
-def cache_key(base_path):
-    """Returns the base-key(s) used in the Cache for the passed base_path(s)."""
+def cache_key(base_path, domain=None):
+    """Return the cache base key or keys for the passed base path or paths."""
     if settings.DOMAIN_ENABLED:
-        domain = get_domain()
+        domain = domain or get_domain()
+        domain_name = domain if isinstance(domain, str) else domain.name
         if isinstance(base_path, str):
-            base_path = f"{domain.name}:{base_path}"
+            base_path = f"{domain_name}:{base_path}"
         else:
-            base_path = [f"{domain.name}:{path}" for path in base_path]
+            base_path = [f"{domain_name}:{path}" for path in base_path]
 
     return base_path
 
@@ -714,6 +729,25 @@ def normalize_http_status(status):
         return ""
 
 
+def check_request_was_modified(request, last_modified, etag=None):
+    if_none_match = request.headers.get("If-None-Match")
+    if_modified_since = request.headers.get("If-Modified-Since")
+
+    if not if_none_match and not (last_modified and if_modified_since):
+        return True
+
+    if if_none_match:
+        client_etags = [etag == client_etag.strip() for client_etag in if_none_match.split(",")]
+        return not any(client_etags)
+
+    try:
+        last_modified_ts = parse_http_date(last_modified)
+        if_modified_ts = parse_http_date(if_modified_since)
+        return last_modified_ts > if_modified_ts
+    except (TypeError, ValueError):
+        return True
+
+
 class HashingFileWriter(RawIOBase):
     """
     A file-like object that handles writing data to disk with simultaneous