This repository has been archived by the owner on Oct 13, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 28
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ART-997: Sweep (or don't sweep) bugs into correct advisory (#142)
* ART-997: Sweep (or don't sweep) bugs into correct advisory 3.y: Sweep all bugs into the rpm advisory. 4.y: Sweep optional operator bugs into extras advisory and other bugs into main image advisory. For simplicity, the operator-related bugs are determined by a hardcoded list of bug components. Also filter by a hardcoded list of source repos that ART should leave alone.
- Loading branch information
Showing
4 changed files
with
151 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,30 +1,24 @@ | ||
| from __future__ import absolute_import, print_function, unicode_literals | ||
| from future import standard_library | ||
| standard_library.install_aliases() | ||
| from multiprocessing import Lock | ||
| from multiprocessing.dummy import Pool as ThreadPool | ||
| import atexit | ||
| import datetime | ||
| import logging | ||
| import os | ||
| import re | ||
| import shutil | ||
| import sys | ||
| import tempfile | ||
| import threading | ||
| import shutil | ||
| import atexit | ||
| import datetime | ||
| import re | ||
| import yaml | ||
| import click | ||
| import logging | ||
| import urllib.parse | ||
|
|
||
| from elliottlib import gitdata | ||
| from . import logutil | ||
| from . import assertion | ||
| from .imagecfg import ImageMetadata | ||
| from .model import Model, Missing | ||
| from multiprocessing import Lock | ||
| from . import brew | ||
| from . import constants | ||
| from multiprocessing.dummy import Pool as ThreadPool | ||
| from typing import Optional | ||
|
|
||
| import click | ||
| import yaml | ||
|
|
||
| from elliottlib import assertion, brew, constants, gitdata, logutil, util | ||
| from elliottlib.exceptions import ElliottFatalError | ||
| from elliottlib.imagecfg import ImageMetadata | ||
| from elliottlib.model import Missing, Model | ||
|
|
||
|
|
||
| def remove_tmp_working_dir(runtime): | ||
|
|
@@ -271,3 +265,46 @@ def resolve_metadata(self): | |
|
|
||
| except gitdata.GitDataException as ex: | ||
| raise ElliottFatalError(ex) | ||
|
|
||
| def get_public_upstream(self, remote_git: str) -> (str, Optional[str]): | ||
| """ | ||
| Some upstream repo are private in order to allow CVE workflows. While we | ||
| may want to build from a private upstream, we don't necessarily want to confuse | ||
| end-users by referencing it in our public facing image labels / etc. | ||
| In group.yaml, you can specify a mapping in "public_upstreams". It | ||
| represents private_url_prefix => public_url_prefix. Remote URLs passed to this | ||
| method which contain one of the private url prefixes will be translated | ||
| into a new string with the public prefix in its place. If there is not | ||
| applicable mapping, the incoming url will still be normalized into https. | ||
| :param remote_git: The URL to analyze for private repo patterns. | ||
| :return: tuple (url, branch) | ||
| - url: An https normalized remote address with private repo information replaced. | ||
| - branch: Optional public branch name if the public upstream source use a different branch name from the private upstream. | ||
| """ | ||
| remote_https = util.convert_remote_git_to_https(remote_git) | ||
|
|
||
| if self.group_config.public_upstreams: | ||
|
|
||
| # We prefer the longest match in the mapping, so iterate through the entire | ||
| # map and keep track of the longest matching private remote. | ||
| target_priv_prefix = None | ||
| target_pub_prefix = None | ||
| target_pub_branch = None | ||
| for upstream in self.group_config.public_upstreams: | ||
| priv = upstream["private"] | ||
| pub = upstream["public"] | ||
| # priv can be a full repo, or an organization (e.g. [email protected]:openshift) | ||
| # It will be treated as a prefix to be replaced | ||
| https_priv_prefix = util.convert_remote_git_to_https(priv) # Normalize whatever is specified in group.yaml | ||
| https_pub_prefix = util.convert_remote_git_to_https(pub) | ||
| if remote_https.startswith(f'{https_priv_prefix}/') or remote_https == https_priv_prefix: | ||
| # If we have not set the prefix yet, or if it is longer than the current contender | ||
| if not target_priv_prefix or len(https_priv_prefix) > len(target_pub_prefix): | ||
| target_priv_prefix = https_priv_prefix | ||
| target_pub_prefix = https_pub_prefix | ||
| target_pub_branch = upstream.get("public_branch") | ||
|
|
||
| if target_priv_prefix: | ||
| return (f'{target_pub_prefix}{remote_https[len(target_priv_prefix):]}', target_pub_branch) | ||
|
|
||
| return (remote_https, None) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters