Skip to content

[PR #1273/4acf7775 backport][3.27] Fix provenance sync for Pulp User publishers#1274

Open
patchback[bot] wants to merge 2 commits into
3.27from
patchback/backports/3.27/4acf7775bac47df59cf0a64e64912e5799e2c7a0/pr-1273
Open

[PR #1273/4acf7775 backport][3.27] Fix provenance sync for Pulp User publishers#1274
patchback[bot] wants to merge 2 commits into
3.27from
patchback/backports/3.27/4acf7775bac47df59cf0a64e64912e5799e2c7a0/pr-1273

Conversation

@patchback

@patchback patchback Bot commented Jul 14, 2026

Copy link
Copy Markdown

This is a backport of PR #1273 as merged into main (4acf777).

Summary

  • Import Provenance from pulp_python.app.provenance in the sync task instead of pypi_attestations, so sync accepts attestations with Pulp User publishers created during upload
  • Add a functional test that uploads attestations to one repository and syncs provenance from that distribution into another

Test plan

  • Added test_sync_pulp_created_provenance functional test
  • oci-env test functional -p python pulp_python/tests/functional/api/test_attestations.py::test_sync_pulp_created_provenance -v

Assisted-by: Cursor

Made with Cursor

* Fix provenance sync to use Pulp's extended Provenance model

Sync was validating provenance with pypi_attestations.Provenance, which
rejects Pulp User publishers created during upload. Use the extended model
from pulp_python.app.provenance instead.

(cherry picked from commit 4acf777)
gerrod3
gerrod3 previously approved these changes Jul 14, 2026
@gerrod3 gerrod3 enabled auto-merge (rebase) July 14, 2026 19:56
The 3.27 branch lacks the parallel package substitution tests from main,
but test_content_crud still uploads aiohttp bytes as shelf-reader-0.1.tar.gz
and leaves incorrect global content behind. Split that case into its own
non-parallel test with orphan cleanup, and run the brittle pypi JSON
assertions outside the parallel suite with delete_orphans_pre.

Assisted-by: Cursor
Co-authored-by: Cursor <cursoragent@cursor.com>
@github-actions github-actions Bot added multi-commit Add to bypass single commit lint check no-changelog labels Jul 14, 2026

@pytest.mark.parallel
def test_pypi_json(python_remote_factory, python_repo_with_sync, python_distribution_factory):
def test_pypi_json(

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add the fixes for test_pypi_json and test_pypi_json_content_app to other branches (or at least to the main) as well?

assert task.created_resources[0] == content.pulp_href

# Test upload same filename w/ different artifact
monitor_task(python_bindings.RepositoriesPythonApi.delete(repo.pulp_href).task)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need the change in test_content_crud? CI for the previous commit was failing only for test_pypi_json and test_pypi_json_content_app. Is this fix for sth else? If so, should it go at least into main?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

multi-commit Add to bypass single commit lint check no-changelog no-issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants