pulpcore 3.122.2__tar.gz → 3.123.1__tar.gz

{pulpcore-3.122.2 → pulpcore-3.123.1}/CHANGES.md

@@ -8,6 +8,59 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.123.1 (2026-10-23) {: #3.123.1 }
+
+### REST API {: #3.123.1-rest-api }
+
+#### Bugfixes {: #3.123.1-rest-api-bugfix }
+
+- Fixed responses for a distribution being cached from the previous repository version, and served until the cache entry expired, when they were requested while a new version was being created.
+  [#8246](https://github.com/pulp/pulpcore/issues/8246)
+
+### Plugin API {: #3.123.1-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.123.1-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.123.1-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.123.0 (2026-10-21) {: #3.123.0 }
+
+### REST API {: #3.123.0-rest-api }
+
+#### Bugfixes {: #3.123.0-rest-api-bugfix }
+
+- Fixed a foreign key error when a first-time pull-through download fails digest validation; the content app now reports the intended checksum error and closes the connection.
+- Fixed repository version serialization failing with `LookupError` when the version contains a content type that has no registered viewset.
+
+#### Removals {: #3.123.0-rest-api-removal }
+
+- Removed SFTP storage support because it was unreliable and could corrupt files; it also did not support object-storage redirects or on-demand downloads.
+
+### Plugin API {: #3.123.0-plugin-api }
+
+#### Features {: #3.123.0-plugin-api-feature }
+
+- `SigningService.sign()` and `asign()` now accept an optional `pubkey_fingerprint` to sign with a key other than the one the signing service was created with.
+  [#7942](https://github.com/pulp/pulpcore/issues/7942)
+
+### Pulp File {: #3.123.0-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.123.0-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.122.2 (2026-10-15) {: #3.122.2 }
 
 ### REST API {: #3.122.2-rest-api }
@@ -303,6 +356,26 @@ No significant changes.
 
 ---
 
+## 3.118.3 (2026-10-15) {: #3.118.3 }
+
+### REST API {: #3.118.3-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.118.3-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.118.3-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.118.3-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.118.2 (2026-10-13) {: #3.118.2 }
 
 ### REST API {: #3.118.2-rest-api }
@@ -1456,6 +1529,51 @@ No significant changes.
 
 ---
 
+## 3.105.23 (2026-10-15) {: #3.105.23 }
+
+### REST API {: #3.105.23-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.105.23-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.105.23-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.105.23-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.105.22 (2026-10-14) {: #3.105.22 }
+
+### REST API {: #3.105.22-rest-api }
+
+#### Bugfixes {: #3.105.22-rest-api-bugfix }
+
+- Fixed an issue where users were able to list (but not modify) uploads they didn't have permissions to view.
+- Fixed vulnerability report rescans to update existing reports.
+- Optimized `scope_queryset` SQL queries when using a domain scoped endpoint.
+- Repeated object lookups in a single API request now reuse the retrieved object.
+
+### Plugin API {: #3.105.22-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.105.22-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.105.22-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.105.21 (2026-10-01) {: #3.105.21 }
 
 ### REST API {: #3.105.21-rest-api }
@@ -2944,6 +3062,30 @@ No significant changes.
 
 ---
 
+## 3.85.32 (2026-10-14) {: #3.85.32 }
+
+### REST API {: #3.85.32-rest-api }
+
+#### Bugfixes {: #3.85.32-rest-api-bugfix }
+
+- Fixed directory listings for published content displaying publication time instead of repository added date.
+- Fixed vulnerability report rescans to update existing reports.
+- Removed parent directory sizes and fixed wrong last modified timestamp in content app listings.
+
+### Plugin API {: #3.85.32-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.85.32-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.85.32-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.85.31 (2026-09-23) {: #3.85.31 }
 
 ### REST API {: #3.85.31-rest-api }

{pulpcore-3.122.2 → pulpcore-3.123.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.122.2
+Version: 3.123.1
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later
@@ -46,7 +46,7 @@ Requires-Dist: opentelemetry-api<1.46,>=1.27.0
 Requires-Dist: opentelemetry-sdk<1.46,>=1.27.0
 Requires-Dist: opentelemetry-exporter-otlp-proto-http<1.46,>=1.27.0
 Requires-Dist: protobuf<8.0,>=4.21.1
-Requires-Dist: pulp-glue<0.41,>=0.35.0
+Requires-Dist: pulp-glue<0.42,>=0.35.0
 Requires-Dist: PyOpenSSL<27.0,>=26.3.0
 Requires-Dist: pygtrie<2.7,>=2.5
 Requires-Dist: psycopg[binary]<3.4,>=3.3.4
@@ -59,8 +59,6 @@ Requires-Dist: url-normalize<3.1,>=1.4.3
 Requires-Dist: uuid6<=2025.0.1,>=2023.5.2
 Requires-Dist: whitenoise<6.13.0,>=5.0
 Requires-Dist: yarl<1.26,>=1.12.0
-Provides-Extra: sftp
-Requires-Dist: django-storages[sftp]==1.14.6; extra == "sftp"
 Provides-Extra: s3
 Requires-Dist: django-storages[boto3]==1.14.6; extra == "s3"
 Provides-Extra: google
@@ -73,7 +71,7 @@ Provides-Extra: saml2
 Requires-Dist: djangosaml2<1.13,>=1.12.0; extra == "saml2"
 Provides-Extra: kafka
 Requires-Dist: cloudevents==1.11.0; extra == "kafka"
-Requires-Dist: confluent-kafka<2.16.0,>=2.4.0; extra == "kafka"
+Requires-Dist: confluent-kafka<2.17.0,>=2.4.0; extra == "kafka"
 Provides-Extra: diagnostics
 Requires-Dist: pyinstrument~=5.0; extra == "diagnostics"
 Requires-Dist: memray~=1.17; extra == "diagnostics"

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.122.2"
+    version = "3.123.1"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.122.2"
+    version = "3.123.1"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulp_file/tests/functional/api/test_download_policies.py

@@ -54,8 +54,6 @@ def test_download_policy(
 ):
     """Test that "on_demand" and "streamed" download policies work as expected."""
     settings = pulp_settings
-    if download_policy == "on_demand" and "SFTP" in settings.STORAGES["default"]["BACKEND"]:
-        pytest.skip("This storage technology is not properly supported.")
 
     remote = file_remote_ssl_factory(
         manifest_path=range_header_manifest_path, policy=download_policy

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/app/apps.py

@@ -238,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.122.2"
+    version = "3.123.1"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/app/models/content.py

@@ -814,7 +814,7 @@ class SigningService(BaseModel):
             env.update(env_vars)
         return {**os.environ, **env}
 
-    def sign(self, filename, env_vars=None):
+    def sign(self, filename, env_vars=None, pubkey_fingerprint=None):
         """
         Signs the file provided via 'filename' by invoking an external script (or executable).
 
@@ -825,6 +825,8 @@ class SigningService(BaseModel):
         Args:
             filename (str): A relative path to a file which is intended to be signed.
             env_vars (dict): dictionary of environment variables
+            pubkey_fingerprint (str): fingerprint of the key to sign with. Defaults to the
+                signing service's own key.
 
         Raises:
             RuntimeError: If the return code of the script is not equal to 0.
@@ -832,6 +834,9 @@ class SigningService(BaseModel):
         Returns:
             A dictionary as validated by the validate() method.
         """
+        if pubkey_fingerprint:
+            env_vars = {**(env_vars or {}), "PULP_SIGNING_KEY_FINGERPRINT": pubkey_fingerprint}
+
         completed_process = subprocess.run(
             [self.script, filename],
             env=self._env_variables(env_vars),
@@ -849,8 +854,11 @@ class SigningService(BaseModel):
 
         return return_value
 
-    async def asign(self, filename, env_vars=None):
+    async def asign(self, filename, env_vars=None, pubkey_fingerprint=None):
         """Async version of sign."""
+        if pubkey_fingerprint:
+            env_vars = {**(env_vars or {}), "PULP_SIGNING_KEY_FINGERPRINT": pubkey_fingerprint}
+
         process = await asyncio.create_subprocess_exec(
             self.script,
             filename,

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/app/models/repository.py

@@ -198,8 +198,6 @@ class Repository(MasterModel):
                 resource = CreatedResource(content_object=version)
                 resource.save()
 
-            self.invalidate_cache()
-
             return version
 
     def initialize_new_version(self, new_version):
@@ -1534,6 +1532,7 @@ class RepositoryVersion(BaseModel):
                         self.repository.save()
                         self.save()
                         self._compute_counts()
+                    transaction.on_commit(self.repository.invalidate_cache)
                     self.repository.cleanup_old_versions()
                     repository.on_new_version(self)
             except Exception:

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/app/models/storage.py

@@ -99,31 +99,6 @@ class FileSystem(FileSystemStorage):
         return str(name).replace("\\", "/")
 
 
-try:
-    from storages.backends.sftpstorage import SFTPStorage
-
-    class PulpSFTPStorage(SFTPStorage):
-        """Upstream class is missing the file_overwrite option."""
-
-        def get_available_name(self, name, max_length=None):
-            """
-            Returns a filename for the file even if it already exists.
-
-            Content adressable storage must be saved with the expected filename.
-
-            Args:
-                name (string): Requested file name
-                max_length (int): Maximum length of the filename. Not used in this implementation.
-
-            Returns:
-                Name of the file.
-            """
-            return name
-
-except ImportError:
-    pass
-
-
 class DomainStorage:
     """Storage class for FileFields to use that allows for uploading to a domain's storage."""
 

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/app/serializers/domain.py

@@ -21,7 +21,6 @@ from pulpcore.app.util import get_prn
 
 BACKEND_CHOICES = (
     ("pulpcore.app.models.storage.FileSystem", "Use local filesystem as storage"),
-    # ("pulpcore.app.models.storage.PulpSFTPStorage", "Use SFTP server as storage"),
     ("storages.backends.s3boto3.S3Boto3Storage", "Use Amazon S3 as storage [deprecated]"),
     ("storages.backends.s3.S3Storage", "Use Amazon S3 as storage"),
     ("storages.backends.azure_storage.AzureStorage", "Use Azure Blob as storage"),
@@ -107,36 +106,6 @@ class FileSystemSettingsSerializer(BaseSettingsClass):
     directory_permissions_mode = serializers.IntegerField(allow_null=True, default=None)
 
 
-class SFTPSettingsSerializer(BaseSettingsClass):
-    """A Serializer for SFTP storage settings."""
-
-    STORAGE_CLASS = "pulpcore.app.models.storage.PulpSFTPStorage"
-    SETTING_MAPPING = {
-        "sftp_storage_host": "host",
-        "sftp_storage_params": "params",
-        "sftp_storage_interactive": "interactive",
-        "sftp_storage_file_mode": "file_mode",
-        "sftp_storage_dir_mode": "dir_mode",
-        "sftp_storage_uid": "uid",
-        "sftp_storage_gid": "gid",
-        "sftp_known_host_file": "known_host_file",
-        "sftp_storage_root": "root_path",
-        "media_url": "base_url",
-        "sftp_base_url": "base_url",
-    }
-
-    host = serializers.CharField(required=True)
-    root_path = serializers.CharField(required=True)
-    params = serializers.DictField(default={}, write_only=True)
-    file_mode = serializers.IntegerField(allow_null=True, default=None)
-    dir_mode = serializers.IntegerField(allow_null=True, default=None)
-    uid = serializers.CharField(allow_null=True, default=None)
-    gid = serializers.CharField(allow_null=True, default=None)
-    base_url = serializers.CharField(allow_null=True, default=None)
-    interactive = serializers.HiddenField(default=False)
-    known_host_file = serializers.HiddenField(default=None)
-
-
 class TransferConfigSerializer(serializers.Serializer):
     """A Serializer for the boto3.S3 Transfer Config object."""
 
@@ -342,7 +311,6 @@ class StorageSettingsSerializer(serializers.Serializer):
 
     STORAGE_MAPPING = {
         "pulpcore.app.models.storage.FileSystem": FileSystemSettingsSerializer,
-        "pulpcore.app.models.storage.PulpSFTPStorage": SFTPSettingsSerializer,
         "storages.backends.s3.S3Storage": AmazonS3SettingsSerializer,
         "storages.backends.s3boto3.S3Boto3Storage": AmazonS3SettingsSerializer,
         "storages.backends.azure_storage.AzureStorage": AzureSettingsSerializer,
@@ -509,19 +477,6 @@ class DomainSerializer(BackendSettingsValidator, ModelSerializer):
         storage_class = data.get("storage_class") or self.instance.storage_class
         storage_settings = data.get("storage_settings") or self.instance.storage_settings
         self._validate_storage_backend(storage_class, storage_settings)
-
-        redirect = data.get("redirect_to_object_storage", True)
-        if self.instance and "redirect_to_object_storage" not in data:
-            redirect = self.instance.redirect_to_object_storage
-
-        if redirect and storage_class == "pulpcore.app.models.storage.PulpSFTPStorage":
-            raise serializers.ValidationError(
-                detail={
-                    "redirect_to_object_storage": _(
-                        "This field does not support being used with the SFTP backend."
-                    )
-                }
-            )
         return data
 
     class Meta:

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/content/handler.py

@@ -1442,8 +1442,11 @@ class Handler:
                 extra_data={"disable_retry_list": (DigestValidationError,)}
             )
         except DigestValidationError:
-            remote_artifact.failed_at = timezone.now()
-            await remote_artifact.asave()
+            # First-time pull-through RAs point at an unsaved ContentArtifact, so saving would
+            # violate the foreign key.
+            if not remote_artifact.content_artifact._state.adding:
+                remote_artifact.failed_at = timezone.now()
+                await remote_artifact.asave()
             close_tcp_connection(request.transport._sock)
             REMOTE_CONTENT_FETCH_FAILURE_COOLDOWN = settings.REMOTE_CONTENT_FETCH_FAILURE_COOLDOWN
             raise RuntimeError(

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/tests/functional/api/test_crud_domains.py

@@ -195,7 +195,6 @@ def test_special_domain_creation(pulpcore_bindings, gen_object_with_cleanup, pul
     # This test needs to account for which environment it is running in
     storage_types = {
         "pulpcore.app.models.storage.FileSystem",
-        # "pulpcore.app.models.storage.PulpSFTPStorage",
         "storages.backends.s3boto3.S3Boto3Storage",
         "storages.backends.s3.S3Storage",
         "storages.backends.azure_storage.AzureStorage",
@@ -204,14 +203,6 @@ def test_special_domain_creation(pulpcore_bindings, gen_object_with_cleanup, pul
 
     storage_settings = {
         "pulpcore.app.models.storage.FileSystem": {"media_root": ""},
-        "pulpcore.app.models.storage.PulpSFTPStorage": {
-            "SFTP_STORAGE_HOST": "sftp-storage-host",
-            "SFTP_STORAGE_ROOT": "/storage/",
-            "SFTP_STORAGE_PARAMS": {
-                "username": "foo",
-                "key_filename": "/etc/pulp/certs/storage_id_ed25519",
-            },
-        },
         "storages.backends.s3.S3Storage": {
             "AWS_ACCESS_KEY_ID": "random",
             "AWS_SECRET_ACCESS_KEY": "random",
@@ -247,8 +238,6 @@ def test_special_domain_creation(pulpcore_bindings, gen_object_with_cleanup, pul
             "storage_class": backend,
             "storage_settings": storage_settings[backend],
         }
-        if backend == "pulpcore.app.models.storage.PulpSFTPStorage":
-            body["redirect_to_object_storage"] = False
         try:
             domain = gen_object_with_cleanup(pulpcore_bindings.DomainsApi, body)
         except ApiException as e:

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/tests/unit/content/test_handler.py

@@ -20,6 +20,7 @@ from pulpcore.content.handler import (
     PathNotResolved,
     _current_distribution,
 )
+from pulpcore.exceptions import DigestValidationError
 from pulpcore.plugin.models import (
     Artifact,
     Content,
@@ -788,3 +789,78 @@ async def test_async_pull_through_add(ca1, monkeypatch, app_status):
         await repo.adelete()
         if task:
             await task.adelete()
+
+
+@pytest.fixture
+def digest_failure_downloader(monkeypatch):
+    class FailingDownloader:
+        path = None
+
+        async def handle_data(self, data):
+            pass
+
+        async def finalize(self):
+            pass
+
+        async def run(self, extra_data=None):
+            raise DigestValidationError("actual", "expected", url="https://123/c123")
+
+    monkeypatch.setattr(Remote, "get_downloader", lambda self, **kwargs: FailingDownloader())
+    close_mock = Mock()
+    monkeypatch.setattr("pulpcore.content.handler.close_tcp_connection", close_mock)
+    return close_mock
+
+
+def _failing_stream_args():
+    request = Mock(match_info={"path": "c123"}, http_range=Mock(start=None, stop=None))
+    response = web.StreamResponse()
+    response.write_eof = AsyncMock()
+    return request, response
+
+
+def _assert_not_completed_cleanly(close_mock, request, response):
+    """The connection is force-closed and the response is never finished for the client."""
+    close_mock.assert_called_once_with(request.transport._sock)
+    response.write_eof.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+@pytest.mark.django_db
+async def test_pull_through_digest_failure_new_content_artifact(digest_failure_downloader):
+    """A failed digest on a first-time pull-through raises the checksum error, not IntegrityError."""
+    remote = await create_remote()
+    ca = ContentArtifact(relative_path="c123")
+    ra = RemoteArtifact(remote=remote, url="https://123/c123", content_artifact=ca, sha256="bad")
+    request, response = _failing_stream_args()
+
+    try:
+        with pytest.raises(RuntimeError, match="failed checksum validation"):
+            await Handler()._stream_remote_artifact(request, response, ra, save_artifact=True)
+        _assert_not_completed_cleanly(digest_failure_downloader, request, response)
+        assert ra.failed_at is None
+        assert not await RemoteArtifact.objects.filter(url="https://123/c123").aexists()
+    finally:
+        await remote.adelete()
+
+
+@pytest.mark.asyncio
+@pytest.mark.django_db
+async def test_pull_through_digest_failure_existing_content_artifact(digest_failure_downloader):
+    """A failed digest on an existing ContentArtifact still records failed_at."""
+    content = await create_content()
+    ca = await create_content_artifact(content)
+    remote = await create_remote()
+    ra = await RemoteArtifact.objects.acreate(
+        remote=remote, url="https://123/c123", content_artifact=ca, sha256="bad"
+    )
+    request, response = _failing_stream_args()
+
+    try:
+        with pytest.raises(RuntimeError, match="failed checksum validation"):
+            await Handler()._stream_remote_artifact(request, response, ra, save_artifact=True)
+        _assert_not_completed_cleanly(digest_failure_downloader, request, response)
+        await ra.arefresh_from_db()
+        assert ra.failed_at is not None
+    finally:
+        await content.adelete()
+        await remote.adelete()

pulpcore-3.122.2/pulpcore/tests/unit/models/test_publication_retention.py → pulpcore-3.123.1/pulpcore/tests/unit/models/test_caching_and_retention.py

@@ -614,3 +614,44 @@ class TestCacheInvalidationOnPublicationDelete:
         assert cache_key(dist_repo.base_path) not in invalidated, (
             "repo dist should NOT be invalidated (pub2 still latest)"
         )
+
+
+@pytest.mark.django_db
+class TestCacheInvalidationOnRepositoryVersionCreate:
+    """
+    While a new repository version is being created, the repository's distributions are still
+    served from the previous one, and a response computed then can be put into the cache.
+    Clearing the cache only when the version is started would leave that response there until
+    it expires, so the cache must be cleared once the new version is complete.
+    """
+
+    def test_invalidates_once_new_version_is_complete(
+        self, settings, django_capture_on_commit_callbacks
+    ):
+        """Creating a repository version invalidates the cache after the version is complete."""
+        settings.CACHE_ENABLED = True
+        repo = FileRepository.objects.create(name=f"repo-{uuid.uuid4().hex[:8]}")
+        dist = dist_factory(repo=repo)
+        complete_at_invalidation = []
+
+        def record(*args, base_key=None, **kwargs):
+            if base_key is not None and cache_key(dist.base_path) in base_key:
+                complete_at_invalidation.append(repo.versions.latest("number").complete)
+
+        with mock.patch("pulpcore.app.models.repository.Cache") as mock_cache:
+            mock_cache.return_value.delete.side_effect = record
+            with django_capture_on_commit_callbacks(execute=True):
+                version = create_version(repo, add=["some-file.txt"])
+        assert version.complete
+        assert True in complete_at_invalidation
+
+    def test_ignores_version_without_changes(self, settings, django_capture_on_commit_callbacks):
+        """A new version that changes nothing is discarded and leaves the cache alone."""
+        settings.CACHE_ENABLED = True
+        repo = FileRepository.objects.create(name=f"repo-{uuid.uuid4().hex[:8]}")
+        dist_factory(repo=repo)
+        with mock.patch("pulpcore.app.models.repository.Cache") as mock_cache:
+            with django_capture_on_commit_callbacks(execute=True):
+                with repo.new_version():
+                    pass
+        mock_cache.return_value.delete.assert_not_called()

{pulpcore-3.122.2 → pulpcore-3.123.1}/pulpcore/tests/unit/serializers/test_domain.py

@@ -4,7 +4,6 @@ import pytest
 from rest_framework import serializers
 
 from pulpcore.app.serializers.domain import (
-    # SFTPSettingsSerializer,
     AmazonS3SettingsSerializer,
     AzureSettingsSerializer,
     # GoogleSettingsSerializer,
@@ -244,17 +243,6 @@ def test_hidden_settings(storage_class, serializer_class, all_settings):
         assert hidden_fields[field] == is_set, field
 
 
-# class TestDomainSFTPSettingsSerializer(DomainSettingsBaseMixin, TestCase):
-#     storage_class = "pulpcore.app.models.storage.PulpSFTPStorage"
-#     serializer_class = SFTPSettingsSerializer
-#     required_settings = {"host": "http://testing", "root_path": "/storage_sftp/"}
-#
-#     @classmethod
-#     def setUpClass(cls):
-#         super().setUpClass()
-#         cls.min_domain_settings["redirect_to_object_storage"] = False
-
-
 # class TestDomainGoogleSettingsSerializer(DomainSettingsBaseMixin, TestCase):
 #     storage_class = "storages.backends.gcloud.GoogleCloudStorage"
 #     serializer_class = GoogleSettingsSerializer

pulpcore-3.123.1/pulpcore/tests/unit/test_signing_service.py

@@ -0,0 +1,39 @@
+import os
+
+import pytest
+
+from pulpcore.app.models.content import AsciiArmoredDetachedSigningService
+
+
+@pytest.fixture
+def signing_service(tmp_path):
+    """A signing service whose script reports the fingerprint and env vars it was invoked with."""
+    script = tmp_path / "echo_env.sh"
+    script.write_text(
+        '#!/bin/sh\nprintf \'{"fingerprint": "%s", "extra": "%s"}\''
+        ' "$PULP_SIGNING_KEY_FINGERPRINT" "$EXTRA"\n'
+    )
+    script.chmod(0o755)
+    return AsciiArmoredDetachedSigningService(
+        name="echo-env",
+        public_key="public-key",
+        pubkey_fingerprint="SERVICE_KEY",
+        script=str(script),
+    )
+
+
+def test_sign_defaults_to_service_key(signing_service):
+    assert signing_service.sign(os.devnull)["fingerprint"] == "SERVICE_KEY"
+
+
+def test_sign_override_replaces_key_and_keeps_env_vars(signing_service):
+    return_value = signing_service.sign(
+        os.devnull, env_vars={"EXTRA": "kept"}, pubkey_fingerprint="OTHER_KEY"
+    )
+    assert return_value == {"fingerprint": "OTHER_KEY", "extra": "kept"}
+
+
+@pytest.mark.asyncio
+async def test_asign_override_replaces_key(signing_service):
+    return_value = await signing_service.asign(os.devnull, pubkey_fingerprint="OTHER_KEY")
+    assert return_value["fingerprint"] == "OTHER_KEY"