Project

Profile

Help

Task #7537

Pulp - Task #7960: FIPS and support for ALLOWED_CONTENT_CHECKSUMS

Add support for ALLOWED_CONTENT_CHECKSUMS

Added by daviddavis 7 months ago. Updated 24 days ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
High
Assignee:
Sprint/Milestone:
Start date:
Due date:
% Done:

100%

Estimated time:
(Total: 0:00 h)
Platform Release:
Groomed:
No
Sprint Candidate:
No
Tags:
Sprint:
Sprint 90
Quarter:

Description

The pulp_rpm should honor ALLOWED_CONTENT_CHECKSUMS. Some areas that might be affected (that I know of) include syncing (and verifying content), upload, and when publishing content.

Test these repos

All repos need to be tested with md5 only being disallowed, and then again with both 'md5' and 'sha1' being disallowed.

https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/extras/os
https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/supplementary/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/extras/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/rhscl/1/os
http://mirror.centos.org/centos-7/7/extras/x86_64/
http://mirror.centos.org/centos-7/7/sclo/x86_64/sclo/
https://cdn.redhat.com/content/eus/rhel/server/6/6.6/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.7/x86_64/kickstart
https://cdn.redhat.com/content/dist/rhel8/8.0/x86_64/baseos/kickstart
https://mirrors.kernel.org/fedora-epel/7/x86_64/
https://cdn.redhat.com/content/dist/rhel/server/6/6.7/x86_64/kickstart
https://cdn.redhat.com/content/eus/rhel/server/6/6.6/x86_64/rhscl/1/os
https://cdn.redhat.com/content/eus/rhel/server/6/6.6/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.3/x86_64/kickstart
https://cdn.redhat.com/content/dist/rhel8/8.0/x86_64/appstream/kickstart
https://cdn.redhat.com/content/eus/rhel/server/7/7.3/x86_64/optional/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.3/x86_64/supplementary/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.3/x86_64/rhscl/1/os
http://mirror.centos.org/centos-6/6/os/x86_64/
https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/ansible/2.5/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhgs-server-nfs/3.1/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.6/x86_64/kickstart
https://cdn.redhat.com/content/dist/rhel/workstation/7/7.5/x86_64/kickstart
https://mirrors.kernel.org/fedora-epel/8/Everything/x86_64/
https://cdn.redhat.com/content/dist/rhel/workstation/7/7Workstation/x86_64/insights/3/os
https://cdn.redhat.com/content/dist/rhel/workstation/7/7Workstation/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/workstation/7/7Workstation/x86_64/rh-common/os
https://cdn.redhat.com/content/dist/rhel/workstation/7/7Workstation/x86_64/os
https://cdn.redhat.com/content/dist/rhel/workstation/7/7Workstation/x86_64/extras/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rh-gluster-samba/3.1/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhgs-server/3.1/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.10/x86_64/kickstart
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhgs-nagios/3.1/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhscon-agent/2/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhscon-installer/2/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhscon-main/2/os
http://mirror.centos.org/centos-6/6/updates/x86_64/
https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/rhs-client/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhs-client/os
http://mirror.centos.org/centos-7/7/sclo/x86_64/rh/
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/supplementary/os
https://cdn.redhat.com/content/dist/rhel/workstation/7/7Workstation/x86_64/rhscl/1/os
https://cdn.redhat.com/content/dist/rhel/workstation/7/7.6/x86_64/kickstart
http://mirror.centos.org/centos-7/7/updates/x86_64/
https://cdn.redhat.com/content/dist/rhel/server/6/6.8/x86_64/kickstart
https://cdn.redhat.com/content/dist/rhel/server/6/6.9/x86_64/kickstart
https://cdn.redhat.com/content/eus/rhel/server/6/6.6/x86_64/sat-tools/6.2/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhscl/1/os
http://mirror.centos.org/centos-7/7/os/x86_64/
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/ansible/2.7/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.3/x86_64/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.6/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.4/x86_64/kickstart
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/sat-maintenance/6/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.5/x86_64/kickstart
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhgs-server-bigdata/3.1/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhgs-server-splunk/3.1/os
https://cdn.redhat.com/content/dist/rhel/workstation/7/7Workstation/x86_64/supplementary/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/ansible/2.6/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/dotnet/1/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.10/x86_64/optional/os
https://cdn.redhat.com/content/eus/rhel/server/7/7Server/x86_64/sat-tools/6.5/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.5/x86_64/sat-tools/6.5/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.7/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.4/x86_64/optional/os
https://cdn.redhat.com/content/eus/rhel/server/6/6.7/x86_64/supplementary/os
https://cdn.redhat.com/content/eus/rhel/server/6/6.7/x86_64/optional/os
https://cdn.redhat.com/content/eus/rhel/server/6/6.7/x86_64/rhscl/1/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.5/x86_64/rhscl/1/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.5/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.7/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.10/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.8/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.6/x86_64/os
https://cdn.redhat.com/content/eus/rhel/server/6/6.7/x86_64/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.5/x86_64/supplementary/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.5/x86_64/sat-tools/6.4/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.5/x86_64/optional/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.3/x86_64/sat-tools/6.4/os
https://cdn.redhat.com/content/dist/rhel8/8/x86_64/appstream/os
https://cdn.redhat.com/content/dist/rhel8/8/x86_64/baseos/os
https://cdn.redhat.com/content/dist/rhel8/8/x86_64/supplementary/os
https://cdn.redhat.com/content/dist/rhel8/8/x86_64/baseos/kickstart
https://cdn.redhat.com/content/dist/rhel8/8/x86_64/appstream/kickstart
https://mirrors.kernel.org/fedora-epel/6Server/x86_64/
https://cdn.redhat.com/content/dist/rhel/server/7/7.6/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.3/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.9/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.8/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.7/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/6/6.9/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.5/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.2/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.6/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.5/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.3/x86_64/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.6/x86_64/sat-tools/6.5/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.6/x86_64/optional/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/sat-capsule/6.6/os
https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/sat-tools/6.6/os
https://cdn.redhat.com/content/dist/layered/rhel8/x86_64/sat-tools/6.6/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/ansible/2.8/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.6/x86_64/sat-tools/6.6/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.7/x86_64/os
https://cdn.redhat.com/content/dist/rhel8/8.1/x86_64/appstream/kickstart
https://cdn.redhat.com/content/dist/rhel/server/7/7.4/x86_64/os
https://cdn.redhat.com/content/dist/rhel/server/7/7.2/x86_64/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.6/x86_64/supplementary/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.6/x86_64/rhscl/1/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/sat-tools/6.6/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.5/x86_64/sat-tools/6.6/os
https://cdn.redhat.com/content/dist/rhel8/8.1/x86_64/baseos/kickstart
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/highavailability/os
https://packages.vmware.com/tools/releases/10.3.5/rhel6/x86_64/
https://cdn.redhat.com/content/dist/rhel/server/7/7.8/x86_64/kickstart
https://cdn.redhat.com/content/eus/rhel/server/7/7.7/x86_64/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.7/x86_64/supplementary/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.7/x86_64/rhscl/1/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.7/x86_64/optional/os
https://cdn.redhat.com/content/eus/rhel/server/7/7.7/x86_64/sat-tools/6.6/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/sat-capsule/6.7/os
https://cdn.redhat.com/content/dist/rhel/server/6/6Server/x86_64/sat-tools/6.7/os
https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/sat-tools/6.7/os
https://cdn.redhat.com/content/dist/layered/rhel8/x86_64/sat-tools/6.7/os
https://cdn.redhat.com/content/dist/rhel8/8.2/x86_64/appstream/kickstart
https://cdn.redhat.com/content/dist/rhel8/8.2/x86_64/baseos/kickstart
http://mirror.centos.org/centos-8/8/BaseOS/x86_64/os/
http://mirror.centos.org/centos-8/8/AppStream/x86_64/os/

Subtasks

Story #7855: FIPS: Serializer needs to build checksum-algorithm-choice from Artifact.DIGEST_FIELDS, not its own constantsCLOSED - CURRENTRELEASEppicka

Actions

Related issues

Related to Pulp - Story #5216: As a user, I can configure which checksum types I want to use in PulpCLOSED - CURRENTRELEASE

<a title="Actions" class="icon-only icon-actions js-contextmenu" href="#">Actions</a>
Related to Pulp - Story #3778: [Epic] As a user, I can run Pulp 3 in a FIPS-enabled environmentCLOSED - CURRENTRELEASE

<a title="Actions" class="icon-only icon-actions js-contextmenu" href="#">Actions</a>
Related to Pulp - Issue #7836: Import fails when ArtifactResource.json has blank checksumsCLOSED - CURRENTRELEASE<a title="Actions" class="icon-only icon-actions js-contextmenu" href="#">Actions</a>
Has duplicate RPM Support - Story #5188: As a user, I can run Pulp 3 with pulp_rpm in FIPS modeCLOSED - DUPLICATE

<a title="Actions" class="icon-only icon-actions js-contextmenu" href="#">Actions</a>

Associated revisions

Revision ea9dc379 View on GitHub
Added by ggainey 2 months ago

Added repo-workflow tests for MANY repositories.

closes #7537

History

#1 Updated by ipanova@redhat.com 7 months ago

  • Project changed from Migration Plugin to RPM Support

#2 Updated by daviddavis 7 months ago

I noticed this morning that while we have validation for checksums when initializing Artifacts:

https://github.com/pulp/pulpcore/blob/1926df8cdb4abc157d48dbc37e26221ad5745ea5/pulpcore/app/models/content.py#L193-L210

pulp_rpm may not hit this validation during syncing as it's using setattr:

https://github.com/pulp/pulp_rpm/blob/0a341101a0640b42a500f11ee22222c3b9e87733/pulp_rpm/app/tasks/synchronizing.py#L592

Which could obviously be a problem.

#3 Updated by daviddavis 7 months ago

  • Related to Story #5216: As a user, I can configure which checksum types I want to use in Pulp added

#4 Updated by ttereshc 7 months ago

  • Sprint set to Sprint 82

#5 Updated by ggainey 7 months ago

  • Status changed from NEW to ASSIGNED
  • Assignee set to ggainey

#6 Updated by rchan 7 months ago

  • Sprint changed from Sprint 82 to Sprint 83

#7 Updated by bmbouter 7 months ago

  • Description updated (diff)

#8 Updated by bmbouter 7 months ago

  • Description updated (diff)

#9 Updated by bmbouter 7 months ago

  • Related to Story #3778: [Epic] As a user, I can run Pulp 3 in a FIPS-enabled environment added

#10 Updated by bmbouter 7 months ago

  • Has duplicate Story #5188: As a user, I can run Pulp 3 with pulp_rpm in FIPS mode added

#11 Updated by ggainey 6 months ago

Test using this md5-only fixture : https://github.com/pulp/pulp-fixtures/pull/196

Add functional tests for the list of repos in the description (make sure they do NOT run 'always', the full list is large. THink about how to have access to proper certs for cdn.redhat.com access.)

#12 Updated by rchan 6 months ago

  • Sprint changed from Sprint 83 to Sprint 84

#13 Updated by rchan 6 months ago

  • Sprint changed from Sprint 84 to Sprint 85

#14 Updated by dalley 6 months ago

  • Priority changed from Normal to High

#15 Updated by rchan 5 months ago

  • Sprint changed from Sprint 85 to Sprint 86

#16 Updated by ggainey 5 months ago

pulp_rpm repositories sync, publish, and distribute successfully when checksums are missing from ALLOWED_CONTENT_CHECKSUMS.

Syncing an MD5-only repository like the one in #11 results in rpm.package entries with a checksum_type of md5 and a pkgId of the md5sum found in primary.xml. This is to be expected - it's all sync has to go on when building the Package entities. This doesn't impact sync/publish/distribute, either in immediate or on_demand mode.

See https://pulp.plan.io/issues/7836 for a problem that is caused by missing checksums, however.

#17 Updated by ggainey 5 months ago

  • Related to Issue #7836: Import fails when ArtifactResource.json has blank checksums added

#18 Updated by rchan 5 months ago

  • Sprint changed from Sprint 86 to Sprint 87

#19 Updated by daviddavis 4 months ago

  • Parent task set to #7960

#20 Updated by rchan 4 months ago

  • Sprint changed from Sprint 87 to Sprint 88

#21 Updated by rchan 3 months ago

  • Sprint changed from Sprint 88 to Sprint 89

#22 Updated by rchan 2 months ago

  • Sprint changed from Sprint 89 to Sprint 90

#23 Updated by pulpbot 2 months ago

  • Status changed from ASSIGNED to POST

#24 Updated by ggainey 2 months ago

  • Status changed from POST to MODIFIED

#25 Updated by dalley 24 days ago

  • Sprint/Milestone set to 3.10.0

#26 Updated by dalley 24 days ago

  • Status changed from MODIFIED to CLOSED - CURRENTRELEASE

Please register to edit this issue

Also available in: Atom PDF