Re-enable code for testing arbitrary yum repos

[majamassarini]

We (the Packit team) would like to automate reverse-dependencies checks for our users.
We would like the checks to be triggered both by upstream pull requests and by downstream releases.
This Koshei feature could solve us much of the problem and for this reason we would like to have it re-enabled.

Thank you!

[mizdebsk]

The Copr plugin was removed in commit 7d686de
I will see what needs to be done to bring it back.

[mizdebsk]

The Copr plugin was re-added, but there is an API change in Copr Python API.
The plugin fails with:

AttributeError: module 'copr' has no attribute 'client'

Porting the code to a newer Copr Python API will be required.

[xsuchy]

Can you point me to code in Koschei that uses this API?

Edit: It is here https://github.com/fedora-infra/koschei/tree/acc8eddd6751e17104b5dd6bbe5cb013ad7290c6/koschei/plugins/copr_plugin

[xsuchy]

And the code utilize fedmsg. This needs to be migrated to fedora-messaging too. https://fedora-messaging.readthedocs.io/en/stable/tutorial/conversion.html

[xsuchy]

The migration of Copr api is documented here https://fedora-copr.github.io/posts/api3-migration-helper

[FrostyX]

The migration of Copr api is documented here

Also here: https://python-copr.readthedocs.io/en/latest/client_v3/migration.html#migration

[mizdebsk]

I attempted a port to v3 API, my WiP code is at mizdebsk@a40673f (not tested at all yet).

[mizdebsk]

The port is now complete. Koschei Copr plugin has been enabled in staging.

[majamassarini]

Hi @mizdebsk thanks a lot for having worked on this!

I am trying to test the new code for triggering a rebuild and I think I have hit an "issue".

The commands to reproduce it are the following

---

I am able to retrieve authenticated content from Koschei using httpie and initializing packit's kerberos:

python -m venv koschei
source koschei/bin/activate
pip install httpie
pip install httpie-negotiate

# you can't log in as a packit user but you can choose another user :)
fkinit -u packit --staging 

With the above environment settled up I can retrieve authenticated content from Koschei

# Look for the **ipsilon_transaction_id** in this response
http --session=./koschei.json --follow --all https://koschei.stg.fedoraproject.org/login?next=https%3A%2F%2Fkoschei.stg.fedoraproject.org%2F

# Substitute the **ipsilon_transaction_id** and submit for get authenticated content
http --session=./koschei.json --auth-type negotiate --auth : --follow --all https://id.stg.fedoraproject.org/login/gssapi/negotiate?ipsilon_transaction_id=748b7fc9-f14d-4d95-8f47-0d94a6ef2369

I try something similar to trigger a new reverse dependencie re-build

rm koschei.json # always clean up old sessions

# Look for the **ipsilon_transaction_id** in this response
http --session=./koschei.json --follow --all https://koschei.stg.fedoraproject.org/login?next=https%3A%2F%2Fkoschei.stg.fedoraproject.org%2Frebuild-request%2Fnew

# Substitute the **ipsilon_transaction_id** and submit for get authenticated content
http --session=./koschei.json --auth-type negotiate --auth : --follow --all https://id.stg.fedoraproject.org/login/gssapi/negotiate?ipsilon_transaction_id=22f39a76-51db-4358-9893-cc0bf3f0ab65
# The result is a 405 - Method not allowed (probably because this command is making a GET to the rebuild-request/new route
# But now I should be able to call a POST on the same URL using the initialized session
http --session=./koschei.json --follow --all POST https://koschei.stg.fedoraproject.org/rebuild-request/new collection=org copr_usr=packit description=prova
# The result is a 403 - Forbidden

I think I get a 403 - Forbidden error as a result for the http --session=./koschei.json --follow --all POST https://koschei.stg.fedoraproject.org/rebuild-request/new collection=org copr_usr=packit description=prova command because I hit this check.
I double checked the ansible templates and I believe the check is enabled.

I don't know how to make the packit user an admin in Koschei. Could you change the packit role or disable the check?

I am not 100% sure this is the issue, since kerberos makes things really hard to test. But I am quite confident.

Next week I will be out of office, for this reason I will not reply you soon if there will be any follow up :)