Skip to content

[PULP-1496] Add repository-specific package blocklist#1187

Open
jobselko wants to merge 1 commit intopulp:mainfrom
jobselko:1166
Open

[PULP-1496] Add repository-specific package blocklist#1187
jobselko wants to merge 1 commit intopulp:mainfrom
jobselko:1166

Conversation

@jobselko
Copy link
Copy Markdown
Contributor

@jobselko jobselko commented Apr 9, 2026

closes #1166

📜 Checklist

  • Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
  • A changelog entry or entries has been added for any significant changes
  • Follows the Pulp policy on AI Usage
  • (For new features) - User documentation and test coverage has been added

See: Pull Request Walkthrough

closes pulp#1166
Assisted By: Claude Opus 4.6
}
```

TODO: blocklist docs
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is still todo

Comment thread pulp_python/app/models.py
blocked.append(pkg.filename)
break
if blocked:
raise ValidationError(
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to be reworked to avoid the deprecations check

@jobselko jobselko marked this pull request as ready for review April 13, 2026 19:49
Comment thread pulp_python/app/models.py
Comment on lines +430 to +432
added_content = PythonPackageContent.objects.filter(
pk__in=new_version.added().values_list("pk", flat=True)
)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
added_content = PythonPackageContent.objects.filter(
pk__in=new_version.added().values_list("pk", flat=True)
)
added_content = PythonPackageContent.objects.filter(
pk__in=new_version.added().values_list("pk", flat=True)
).only("name_normalized", "version", "filename")

Comment thread pulp_python/app/models.py

blocked = []
for pkg in packages:
pkg_name_normalized = canonicalize_name(pkg.name) if pkg.name else ""
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
pkg_name_normalized = canonicalize_name(pkg.name) if pkg.name else ""

Use pkg.name_normalized, it's a required field.

Comment thread pulp_python/app/models.py
name = models.TextField(null=True, default=None)
version = models.TextField(null=True, default=None)
filename = models.TextField(null=True, default=None)
added_by = models.TextField(blank=True, default="")
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why have this one be blank=True, does that even do anything?

Comment on lines +817 to +820
pulp_href = _NestedIdentityField(
view_name="blocklist_entries-detail",
parent_lookup_kwargs={"repository_pk": "repository__pk"},
)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just do what you did for the repository's serializer field and make it a serializer method.

add_content_units = request.data.get("add_content_units", [])
if not add_content_units:
return None
content_ids = [extract_pk(x) for x in add_content_units]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's not rerun the extract_pk method multiple times. Find a way for this to already be calculated.

"""
Set the repository FK from the URL before saving the entry.
"""
serializer.save(repository=self.get_parent_object())
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The serializer should already have the repository set inside its context. In validate I would just set the field there and then this method wouldn't be needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature: package blocklist to prevent upload of yanked or malicious packages

2 participants