Skip to content

Commit 247d380

Browse files
gerrod3patchback[bot]
gerrod3
authored and
patchback[bot]
committed
Fix ALLOWED_CONTENT_CHECKSUMS check failing on settings import
Moved the check to separate Django check ran after database commands. Loosen the restrictions on Forbidden Checksums being present to just a warning. fixes: #7380 Generated by: claude-opus-4.6 (cherry picked from commit 1e4afec)
1 parent e24af92 commit 247d380

3 files changed

Lines changed: 63 additions & 67 deletions

File tree

‎CHANGES/7380.bugfix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Moved artifact checksum validation from module-level settings code to a Django system check.

‎pulpcore/app/checks.py‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,16 @@
11
from pathlib import Path
22

33
from django.conf import settings
4-
from django.core.checks import Error as CheckError, Warning as CheckWarning, register
4+
from django.core.checks import (
5+
Debug as CheckDebug,
6+
Error as CheckError,
7+
Warning as CheckWarning,
8+
Tags,
9+
register,
10+
)
11+
from django.db.models import Q
12+
13+
from pulpcore import constants
514

615

716
@register(deploy=True)
@@ -56,3 +65,55 @@ def storage_paths(app_configs, **kwargs):
5665
)
5766

5867
return warnings
68+
69+
70+
@register(Tags.database)
71+
def check_artifact_checksums(app_configs, **kwargs):
72+
from pulpcore.app.models import Artifact, RemoteArtifact
73+
74+
messages = []
75+
allowed = set(settings.ALLOWED_CONTENT_CHECKSUMS)
76+
forbidden = set(constants.ALL_KNOWN_CONTENT_CHECKSUMS).difference(allowed)
77+
78+
try:
79+
for checksum in allowed:
80+
if Artifact.objects.filter(**{checksum: None}).exists():
81+
messages.append(
82+
CheckError(
83+
f"There have been identified artifacts missing checksum '{checksum}'. "
84+
"Run 'pulpcore-manager handle-artifact-checksums' first to populate "
85+
"missing artifact checksums.",
86+
id="pulpcore.E002",
87+
)
88+
)
89+
for checksum in forbidden:
90+
if Artifact.objects.exclude(**{checksum: None}).exists():
91+
messages.append(
92+
CheckWarning(
93+
f"There have been identified artifacts with forbidden checksum "
94+
f"'{checksum}'. Run 'pulpcore-manager handle-artifact-checksums' "
95+
"to unset forbidden checksums.",
96+
id="pulpcore.W004",
97+
)
98+
)
99+
100+
has_any_checksum = ~Q(**{c: None for c in constants.ALL_KNOWN_CONTENT_CHECKSUMS})
101+
missing_allowed = Q(**{c: None for c in allowed})
102+
if RemoteArtifact.objects.filter(has_any_checksum & missing_allowed).exists():
103+
messages.append(
104+
CheckWarning(
105+
"Detected remote content without allowed checksums. "
106+
"Run 'pulpcore-manager handle-artifact-checksums --report' to "
107+
"view this content.",
108+
id="pulpcore.W005",
109+
)
110+
)
111+
except Exception:
112+
messages.append(
113+
CheckDebug(
114+
"Skipping artifact checksum checks (table may not exist yet).",
115+
id="pulpcore.D001",
116+
)
117+
)
118+
119+
return messages

‎pulpcore/app/settings.py‎

Lines changed: 0 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818

1919
from cryptography.fernet import Fernet
2020
from django.core.exceptions import ImproperlyConfigured
21-
from django.db import connection
2221
from dynaconf import DjangoDynaconf, Dynaconf, Validator
2322

2423
from pulpcore import constants
@@ -582,71 +581,6 @@ def otel_middleware_hook(settings):
582581
ALLOWED_CONTENT_CHECKSUMS
583582
)
584583

585-
_SKIPPED_COMMANDS_FOR_CONTENT_CHECKS = [
586-
"handle-artifact-checksums",
587-
"migrate",
588-
"collectstatic",
589-
"openapi",
590-
]
591-
592-
if not (len(sys.argv) >= 2 and sys.argv[1] in _SKIPPED_COMMANDS_FOR_CONTENT_CHECKS):
593-
try:
594-
with connection.cursor() as cursor:
595-
for checksum in ALLOWED_CONTENT_CHECKSUMS:
596-
# can't import Artifact here so use a direct db connection
597-
cursor.execute(
598-
f"SELECT count(pulp_id) FROM core_artifact WHERE {checksum} IS NULL LIMIT 1"
599-
)
600-
row = cursor.fetchone()
601-
if row[0] > 0:
602-
raise ImproperlyConfigured(
603-
(
604-
"There have been identified artifacts missing checksum '{}'. "
605-
"Run 'pulpcore-manager handle-artifact-checksums' first to populate "
606-
"missing artifact checksums."
607-
).format(checksum)
608-
)
609-
for checksum in FORBIDDEN_CHECKSUMS:
610-
# can't import Artifact here so use a direct db connection
611-
cursor.execute(
612-
f"SELECT count(pulp_id) FROM core_artifact WHERE {checksum} IS NOT NULL LIMIT 1"
613-
)
614-
row = cursor.fetchone()
615-
if row[0] > 0:
616-
raise ImproperlyConfigured(
617-
(
618-
"There have been identified artifacts with forbidden checksum '{}'. "
619-
"Run 'pulpcore-manager handle-artifact-checksums' first to unset "
620-
"forbidden checksums."
621-
).format(checksum)
622-
)
623-
624-
# warn if there are remote artifacts with checksums but no allowed checksums
625-
cond = " AND ".join([f"{c} IS NULL" for c in constants.ALL_KNOWN_CONTENT_CHECKSUMS])
626-
no_checksum_query = f"SELECT pulp_id FROM core_remoteartifact WHERE {cond}"
627-
cond = " AND ".join([f"{c} IS NULL" for c in ALLOWED_CONTENT_CHECKSUMS])
628-
cursor.execute(
629-
f"SELECT count(pulp_id) FROM core_remoteartifact WHERE {cond} AND "
630-
f"pulp_id NOT IN ({no_checksum_query}) LIMIT 1"
631-
)
632-
row = cursor.fetchone()
633-
if row[0] > 0:
634-
_logger.warning(
635-
(
636-
"Warning: detected remote content without allowed checksums. "
637-
"Run 'pulpcore-manager handle-artifact-checksums --report' to "
638-
"view this content."
639-
)
640-
)
641-
642-
except ImproperlyConfigured as e:
643-
raise e
644-
except Exception:
645-
# our check could fail if the table hasn't been created yet or we can't get a db connection
646-
pass
647-
finally:
648-
connection.close()
649-
650584
if settings.API_ROOT_REWRITE_HEADER:
651585
api_root = "/<path:api_root>/"
652586
else:

0 commit comments

Comments
 (0)