pulpcore 3.84.0__tar.gz → 3.85.0__tar.gz

{pulpcore-3.84.0 → pulpcore-3.85.0}/CHANGES.md

@@ -8,6 +8,59 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.85.0 (2025-08-12) {: #3.85.0 }
+
+### REST API {: #3.85.0-rest-api }
+
+#### Features {: #3.85.0-rest-api-feature }
+
+- Added the ability to configure the openapi schema for remote user authentication via `REMOTE_USER_OPENAPI_SECURITY_SCHEME`.
+  Its type defaults to "mutualTLS" for cert based authentication.
+  [#5437](https://github.com/pulp/pulpcore/issues/5437)
+- Added the vulnerability report data model.
+  [#6773](https://github.com/pulp/pulpcore/issues/6773)
+- Added a new table to track all app status in a common place.
+
+#### Bugfixes {: #3.85.0-rest-api-bugfix }
+
+- Made a failure to update the heartbeat catastrophic, so we can actually rely on workers that claim to be "online".
+  [#heartbeat](https://github.com/pulp/pulpcore/issues/heartbeat)
+- Redirect checkpoint URLs without a trailing slash to add the slash.
+  [#6812](https://github.com/pulp/pulpcore/issues/6812)
+- Fixed worker emitting logs with wrong task's domain names.
+  [#6818](https://github.com/pulp/pulpcore/issues/6818)
+
+#### Removals {: #3.85.0-rest-api-removal }
+
+- Bumped the minimum required python version to 3.11.
+  [#6262](https://github.com/pulp/pulpcore/issues/6262)
+- Removed support for DEFAULT_FILE_STORAGE and it's corresponding storage options.
+  Use STORAGES instead:
+  <https://pulpproject.org/pulpcore/docs/admin/reference/settings/#storages>
+  [#6807](https://github.com/pulp/pulpcore/issues/6807)
+- Switch OpenAPI specification to use version 3.1.
+
+### Plugin API {: #3.85.0-plugin-api }
+
+#### Removals {: #3.85.0-plugin-api-removal }
+
+- Purged migrations that were squashed before.
+  Plugins need to rebase their migrations onto "core:0091_systemid".
+  Removed `BaseDistribution`.
+
+### Pulp File {: #3.85.0-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.85.0-pulp-cert-guard }
+
+#### Features {: #3.85.0-pulp-cert-guard-feature }
+
+- Replaced unmaintained rhsm `check_path` with local replacement. Dropped the optional dependency on `python-rhsm`.
+  [#6195](https://github.com/pulp/pulpcore/issues/6195)
+
+---
+
 ## 3.84.0 (2025-07-30) {: #3.84.0 }
 
 ### REST API {: #3.84.0-rest-api }
@@ -4692,6 +4745,18 @@ No significant changes.
 -   Starting from this release pulp_file will be shipped as part of the pulpcore package.
     [#4550](https://github.com/pulp/pulpcore/issues/4550)
 
+## 3.39.33 (2025-07-30) {: #3.39.33 }
+
+### REST API {: #3.39.33-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.39.33-plugin-api }
+
+No significant changes.
+
+---
+
 ## 3.39.32 (2025-05-27) {: #3.39.32 }
 
 ### REST API {: #3.39.32-rest-api }
@@ -5678,6 +5743,18 @@ No significant changes.
 
 -   [#3798](https://github.com/pulp/pulpcore/issues/3798)
 
+## 3.28.40 (2025-07-30) {: #3.28.40 }
+
+### REST API {: #3.28.40-rest-api }
+
+No significant changes.
+
+### Plugin API {: #3.28.40-plugin-api }
+
+No significant changes.
+
+---
+
 ## 3.28.39 (2025-05-27) {: #3.28.39 }
 
 ### REST API {: #3.28.39-rest-api }

{pulpcore-3.84.0 → pulpcore-3.85.0}/MANIFEST.in

@@ -15,3 +15,4 @@ include pulpcore/app/templates/rest_framework/api.html
 include manage.py
 include test_requirements.txt
 exclude releasing.md
+recursive-exclude pulpcore/tasking/task_trigger_demonstration *

{pulpcore-3.84.0 → pulpcore-3.85.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.84.0
+Version: 3.85.0
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org
@@ -14,54 +14,50 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Framework :: Django
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Requires-Python: >=3.9
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiodns<3.6,>=3.3.0
 Requires-Dist: aiofiles<=24.1.0,>=22.1
 Requires-Dist: aiohttp<3.13,>=3.8.3
 Requires-Dist: asyncio-throttle<=1.0.2,>=1.0
-Requires-Dist: async-timeout<4.0.4,>=4.0.3; python_version < "3.11"
 Requires-Dist: backoff<2.3,>=2.1.2
-Requires-Dist: click<8.2,>=8.1.0
-Requires-Dist: cryptography<46.0,>=38.0.1
+Requires-Dist: click<8.3,>=8.1.0
+Requires-Dist: cryptography<46.0,>=44.0.3
 Requires-Dist: Django~=4.2.0
 Requires-Dist: django-filter<=25.1,>=23.1
 Requires-Dist: django-guid<3.6,>=3.3.0
 Requires-Dist: django-import-export<3.4.0,>=2.9
 Requires-Dist: django-lifecycle<=1.2.4,>=1.0
-Requires-Dist: djangorestframework<=3.16.0,>=3.14.0
+Requires-Dist: djangorestframework<=3.16.1,>=3.14.0
 Requires-Dist: djangorestframework-queryfields<=1.1.0,>=1.0
 Requires-Dist: drf-access-policy<1.5.1,>=1.1.2
 Requires-Dist: drf-nested-routers<=0.94.2,>=0.93.4
 Requires-Dist: drf-spectacular==0.27.2
 Requires-Dist: dynaconf<3.3.0,>=3.2.5
 Requires-Dist: gunicorn<23.1.0,>=22.0
-Requires-Dist: importlib-metadata<=6.0.1,>=6.0.1
 Requires-Dist: jinja2<=3.1.6,>=3.1
 Requires-Dist: json_stream<2.4,>=2.3.2
 Requires-Dist: jq<1.11.0,>=1.6.0
 Requires-Dist: PyOpenSSL<26.0
-Requires-Dist: opentelemetry-api<1.36,>=1.27.0
-Requires-Dist: opentelemetry-sdk<1.36,>=1.27.0
-Requires-Dist: opentelemetry-exporter-otlp-proto-http<1.36,>=1.27.0
+Requires-Dist: opentelemetry-api<1.37,>=1.27.0
+Requires-Dist: opentelemetry-sdk<1.37,>=1.27.0
+Requires-Dist: opentelemetry-exporter-otlp-proto-http<1.37,>=1.27.0
 Requires-Dist: protobuf<6.0,>=4.21.1
-Requires-Dist: pulp-glue<0.35,>=0.28.0
+Requires-Dist: pulp-glue<0.36,>=0.28.0
 Requires-Dist: pygtrie<=2.5.0,>=2.5
 Requires-Dist: psycopg[binary]<3.3,>=3.1.8
 Requires-Dist: pyparsing<3.3,>=3.1.0
 Requires-Dist: python-gnupg<=0.5.4,>=0.5
 Requires-Dist: PyYAML<6.1,>=5.1.1
-Requires-Dist: redis<5.3,>=4.3.0
+Requires-Dist: redis<6.5,>=4.3.0
 Requires-Dist: tablib<3.6,>=3.5.0
 Requires-Dist: url-normalize<2.3,>=1.4.3
 Requires-Dist: uuid6<=2025.0.1,>=2023.5.2
 Requires-Dist: whitenoise<6.10.0,>=5.0
-Requires-Dist: yarl<1.21,>=1.8
+Requires-Dist: yarl<1.21,>=1.9.1
 Provides-Extra: sftp
 Requires-Dist: django-storages[sftp]==1.14.6; extra == "sftp"
 Provides-Extra: s3
@@ -70,12 +66,11 @@ Provides-Extra: google
 Requires-Dist: django-storages[google]==1.14.6; extra == "google"
 Provides-Extra: azure
 Requires-Dist: django-storages[azure]==1.14.6; extra == "azure"
-Requires-Dist: azure-storage-blob<12.26.0; extra == "azure"
 Provides-Extra: prometheus
 Requires-Dist: django-prometheus; extra == "prometheus"
 Provides-Extra: kafka
 Requires-Dist: cloudevents==1.11.0; extra == "kafka"
-Requires-Dist: confluent-kafka<2.11.0,>=2.4.0; extra == "kafka"
+Requires-Dist: confluent-kafka<2.12.0,>=2.4.0; extra == "kafka"
 Provides-Extra: diagnostics
 Requires-Dist: pyinstrument~=5.0; extra == "diagnostics"
 Requires-Dist: memray~=1.17; extra == "diagnostics"

{pulpcore-3.84.0 → pulpcore-3.85.0}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.84.0"
+    version = "3.85.0"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.84.0 → pulpcore-3.85.0}/pulp_certguard/app/models.py

@@ -6,16 +6,12 @@ from urllib.parse import unquote
 from django.conf import settings
 from django.db import models
 
+from cryptography import x509
 from OpenSSL import crypto as openssl
 
 from pulpcore.plugin.models import ContentGuard
 
-from pulp_certguard.app.utils import get_rhsm
-
-try:
-    from rhsm import certificate
-except ImportError:
-    pass
+from pulp_certguard import rhsm
 
 
 logger = getLogger(__name__)
@@ -139,11 +135,6 @@ class RHSMCertGuard(BaseCertGuard):
 
     TYPE = "rhsm"
 
-    def __init__(self, *args, **kwargs):
-        """Initialize a RHSMCertGuard and ensure this system has python-rhsm on it."""
-        get_rhsm()  # Validate that rhsm is installed
-        super().__init__(*args, **kwargs)
-
     class Meta:
         default_related_name = "%(app_label)s_%(model_name)s"
 
@@ -159,29 +150,19 @@ class RHSMCertGuard(BaseCertGuard):
                 certificate, or if the client certificate is not trusted from the CA certificated
                 stored as `ca_certificate`.
         """
-        get_rhsm()
+        # TODO use python cryptography and only parse the certificate once.
         unquoted_certificate = self._get_client_cert_header(request)
         self._ensure_client_cert_is_trusted(unquoted_certificate)
-        rhsm_cert = self._create_rhsm_cert_from_pem(unquoted_certificate)
+        cert = x509.load_pem_x509_certificate(unquoted_certificate.encode())
         content_path_prefix_without_trail_slash = settings.CONTENT_PATH_PREFIX.rstrip("/")
         len_prefix_to_remove = len(content_path_prefix_without_trail_slash)
         path_without_content_path_prefix = request.path[len_prefix_to_remove:]
-        self._check_paths(rhsm_cert, path_without_content_path_prefix)
-
-    @staticmethod
-    def _create_rhsm_cert_from_pem(unquoted_certificate):
-        try:
-            rhsm_cert = certificate.create_from_pem(unquoted_certificate)
-        except certificate.CertificateException:
-            msg = _("An error occurred while loading the client certificate data into python-rhsm.")
-            logger.warning(msg)
-            raise PermissionError(msg)
-        return rhsm_cert
+        self._check_paths(cert, path_without_content_path_prefix)
 
     @staticmethod
-    def _check_paths(rhsm_cert, path):
+    def _check_paths(cert, path):
         logger.debug(f"Checking that path {path} is allowed in client cert")
-        if rhsm_cert.check_path(path) is False:
+        if rhsm.check_path(cert, path) is False:
             logger.warning(f"Path {path} is *not* allowed in client cert")
             msg = _("Requested path is not a subpath of a path in the client certificate.")
             raise PermissionError(msg)

{pulpcore-3.84.0 → pulpcore-3.85.0}/pulp_certguard/app/serializers.py

@@ -6,7 +6,6 @@ from pulpcore.plugin.serializers import ContentGuardSerializer
 
 from rest_framework import serializers
 
-from pulp_certguard.app.utils import get_rhsm
 from .models import RHSMCertGuard, X509CertGuard
 
 
@@ -45,7 +44,6 @@ class RHSMCertGuardSerializer(BaseCertGuardSerializer):
     @staticmethod
     def validate_ca_certificate(ca_certificate):
         """Validates the given certificate."""
-        get_rhsm()  # Validate that rhsm is installed
         return BaseCertGuardSerializer.validate_ca_certificate(ca_certificate)
 
 

pulpcore-3.85.0/pulp_certguard/rhsm/__init__.py

@@ -0,0 +1,4 @@
+from .rhsm_check_path import check_path
+
+
+__all__ = ["check_path"]

pulpcore-3.85.0/pulp_certguard/rhsm/rhsm_check_path.py

@@ -0,0 +1,198 @@
+import typing as t
+from cryptography import x509
+from heapq import heappush, heappop
+import itertools
+import re
+import zlib
+
+
+RH_OID = "1.3.6.1.4.1.2312.9"
+RH_ORDER_NAME_OID = RH_OID + ".4.1"
+RH_VERSION_OID = RH_OID + ".6"
+RH_ENTITLEMENT_OID = RH_OID + ".7"
+V1_PATH_OID_REGEX = re.compile(rf"^{re.escape(RH_OID)}\.2\.\d+\.1\.6$")
+
+
+T = t.TypeVar("T")
+RecursiveDict = t.Dict[str, "RecursiveDict"]
+
+
+# Proper anntoation of generic classes was introduced in Python 3.12
+# class HuffmannNode[T]
+class HuffmannNode:
+    def __init__(
+        self,
+        left: "t.Self | T",
+        right: "t.Self | T",
+    ) -> None:
+        self.left: "t.Self | T" = left
+        self.right: "t.Self | T" = right
+
+    @classmethod
+    def build_tree(cls, items: t.Iterable[T]) -> "t.Self":
+        # This builds a special type of tree, where the weights are _always_ like 1,2,3,...
+        serial = itertools.count(1)  # Used to keep items of equal weight in order.
+        heap: list[tuple[int, int, "t.Self | T"]] = []
+        for value in items:
+            weight = next(serial)
+            # First item is the actual weight, second is the tiebreaker.
+            # Values are never compared.
+            heappush(heap, (weight, weight, value))
+        while True:
+            lw, _, left = heappop(heap)
+            try:
+                rw, _, right = heappop(heap)
+                node = cls(left=left, right=right)
+                heappush(heap, (lw + rw, next(serial), node))
+            except IndexError:
+                assert isinstance(left, cls)
+                return left
+
+    def decode(self, bitstream: t.Iterator[bool]) -> T:
+        node = self.right if next(bitstream) else self.left
+        if isinstance(node, self.__class__):
+            return node.decode(bitstream)
+        else:
+            return t.cast(T, node)
+
+
+def split_count(v: bytes) -> tuple[int, bytes]:
+    if v[0] & 128:
+        len_count = v[0] - 128
+        length = 0
+        for i in range(len_count):
+            length <<= 8
+            length += v[i + 1]
+    else:
+        len_count = 0
+        length = int(v[0])
+    return length, v[len_count + 1 :]
+
+
+def asn1_string(v: bytes) -> str:
+    assert v[0] == 12
+    length, rest = split_count(v[1:])
+    result = rest.decode()
+    assert len(result) == length
+    return result
+
+
+def asn1_bytes(v: bytes) -> bytes:
+    assert v[0] == 4
+    length, result = split_count(v[1:])
+    assert len(result) == length
+    return result
+
+
+def cert_version(cert: x509.Certificate) -> str:
+    return next(
+        (
+            asn1_string(ext.value.value)
+            for ext in cert.extensions
+            if ext.oid.dotted_string == RH_VERSION_OID
+        ),
+        "1.0",
+    )
+
+
+def is_v1_entitlement(cert: x509.Certificate) -> bool:
+    return any((ext for ext in cert.extensions if ext.oid.dotted_string == RH_ORDER_NAME_OID))
+
+
+def v1_paths(cert: x509.Certificate) -> t.Iterator[str]:
+    for ext in cert.extensions:
+        if V1_PATH_OID_REGEX.match(ext.oid.dotted_string):
+            yield asn1_string(ext.value.value)
+
+
+def check_path_v1(cert: x509.Certificate, normalized_path: str) -> bool:
+    assert is_v1_entitlement(cert)
+    for cert_path in v1_paths(cert):
+        # We build a regex here, nicely escaped, from the cert_path,
+        # that translates the '$variables' to regex wildcards.
+        path_regex = (
+            r"^"
+            + r"[^/]+".join(map(re.escape, re.split(r"\$[^/]*", cert_path.strip("/"))))
+            + r"($|/)"
+        )
+        if re.match(path_regex, normalized_path):
+            return True
+    return False
+
+
+def bitstream(data: bytes) -> t.Iterator[bool]:
+    for b in data:
+        for i in range(8):
+            yield (b << i) & 128 != 0
+
+
+class Entitlement:
+    def __init__(self, cert: x509.Certificate):
+        payload = self._read_payload(cert)
+        lex_data, node_count, path_data = self._split_payload(payload)
+        word_tree = self._build_word_tree(lex_data)
+        self._path_tree = self._build_path_tree(word_tree, node_count, path_data)
+
+    @staticmethod
+    def _read_payload(cert: x509.Certificate) -> bytes:
+        return asn1_bytes(
+            next(
+                ext.value.value
+                for ext in cert.extensions
+                if ext.oid.dotted_string == RH_ENTITLEMENT_OID
+            )
+        )
+
+    @staticmethod
+    def _split_payload(payload: bytes) -> tuple[bytes, int, bytes]:
+        decobj = zlib.decompressobj()
+        lex_data = decobj.decompress(payload)
+        node_count, path_data = split_count(decobj.unused_data)
+        return lex_data, node_count, path_data
+
+    @staticmethod
+    def _build_word_tree(lex_data: bytes) -> "HuffmannNode[str]":
+        words = [item.decode() for item in lex_data.split(b"\x00")]
+        assert len(words) > 1
+        return HuffmannNode.build_tree(words)
+
+    @staticmethod
+    def _build_path_tree(
+        word_tree: "HuffmannNode[str]", node_count: int, path_data: bytes
+    ) -> RecursiveDict:
+        path_nodes: list[RecursiveDict] = [{} for _ in range(node_count)]
+        address_tree: "HuffmannNode[RecursiveDict]" = HuffmannNode.build_tree(path_nodes[1:])
+        bitsource = bitstream(path_data)
+        for node in path_nodes:
+            while True:
+                word = word_tree.decode(bitsource)
+                if word == "":
+                    break
+                assert word not in node
+                node[word] = address_tree.decode(bitsource)
+        return path_nodes[0]
+
+    @classmethod
+    def _check_path_tree(cls, node: RecursiveDict, segments: t.List[str]) -> bool:
+        if len(node) == 0:
+            return True
+        if len(segments) == 0:
+            return False
+        segment = segments[0]
+        segments = segments[1:]
+        for key, child in node.items():
+            if (segment == key or key[0] == "$") and cls._check_path_tree(child, segments):
+                return True
+        return False
+
+    def check_path(self, normalized_path: str) -> bool:
+        segments = normalized_path.split("/")
+        return self._check_path_tree(self._path_tree, segments)
+
+
+def check_path(cert: x509.Certificate, path: str) -> bool:
+    normalized_path = re.sub(r"/+", "/", path.strip("/"))
+    if int(cert_version(cert).split(".")[0]) >= 3:
+        return Entitlement(cert).check_path(normalized_path)
+    else:
+        return check_path_v1(cert, normalized_path)