Skip to content

Commit 3351c21

Browse files
gerrod3pedro-psb
gerrod3
authored and
pedro-psb
committed
Fix ALLOWED_CONTENT_CHECKSUMS check failing on settings import
Moved the check to separate Django check ran after database commands. Loosen the restrictions on Forbidden Checksums being present to just a warning. fixes: #7380 Generated by: claude-opus-4.6 (cherry picked from commit 1e4afec)
1 parent 116a096 commit 3351c21

3 files changed

Lines changed: 63 additions & 67 deletions

File tree

‎CHANGES/7380.bugfix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Moved artifact checksum validation from module-level settings code to a Django system check.

‎pulpcore/app/checks.py‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,16 @@
11
from pathlib import Path
22

33
from django.conf import settings
4-
from django.core.checks import Error as CheckError, Warning as CheckWarning, register
4+
from django.core.checks import (
5+
Debug as CheckDebug,
6+
Error as CheckError,
7+
Warning as CheckWarning,
8+
Tags,
9+
register,
10+
)
11+
from django.db.models import Q
12+
13+
from pulpcore import constants
514

615

716
@register(deploy=True)
@@ -56,3 +65,55 @@ def storage_paths(app_configs, **kwargs):
5665
)
5766

5867
return warnings
68+
69+
70+
@register(Tags.database)
71+
def check_artifact_checksums(app_configs, **kwargs):
72+
from pulpcore.app.models import Artifact, RemoteArtifact
73+
74+
messages = []
75+
allowed = set(settings.ALLOWED_CONTENT_CHECKSUMS)
76+
forbidden = set(constants.ALL_KNOWN_CONTENT_CHECKSUMS).difference(allowed)
77+
78+
try:
79+
for checksum in allowed:
80+
if Artifact.objects.filter(**{checksum: None}).exists():
81+
messages.append(
82+
CheckError(
83+
f"There have been identified artifacts missing checksum '{checksum}'. "
84+
"Run 'pulpcore-manager handle-artifact-checksums' first to populate "
85+
"missing artifact checksums.",
86+
id="pulpcore.E002",
87+
)
88+
)
89+
for checksum in forbidden:
90+
if Artifact.objects.exclude(**{checksum: None}).exists():
91+
messages.append(
92+
CheckWarning(
93+
f"There have been identified artifacts with forbidden checksum "
94+
f"'{checksum}'. Run 'pulpcore-manager handle-artifact-checksums' "
95+
"to unset forbidden checksums.",
96+
id="pulpcore.W004",
97+
)
98+
)
99+
100+
has_any_checksum = ~Q(**{c: None for c in constants.ALL_KNOWN_CONTENT_CHECKSUMS})
101+
missing_allowed = Q(**{c: None for c in allowed})
102+
if RemoteArtifact.objects.filter(has_any_checksum & missing_allowed).exists():
103+
messages.append(
104+
CheckWarning(
105+
"Detected remote content without allowed checksums. "
106+
"Run 'pulpcore-manager handle-artifact-checksums --report' to "
107+
"view this content.",
108+
id="pulpcore.W005",
109+
)
110+
)
111+
except Exception:
112+
messages.append(
113+
CheckDebug(
114+
"Skipping artifact checksum checks (table may not exist yet).",
115+
id="pulpcore.D001",
116+
)
117+
)
118+
119+
return messages

‎pulpcore/app/settings.py‎

Lines changed: 0 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818

1919
from cryptography.fernet import Fernet
2020
from django.core.exceptions import ImproperlyConfigured
21-
from django.db import connection
2221
from dynaconf import DjangoDynaconf, Dynaconf, Validator
2322

2423
from pulpcore import constants
@@ -558,71 +557,6 @@ def otel_middleware_hook(settings):
558557
ALLOWED_CONTENT_CHECKSUMS
559558
)
560559

561-
_SKIPPED_COMMANDS_FOR_CONTENT_CHECKS = [
562-
"handle-artifact-checksums",
563-
"migrate",
564-
"collectstatic",
565-
"openapi",
566-
]
567-
568-
if not (len(sys.argv) >= 2 and sys.argv[1] in _SKIPPED_COMMANDS_FOR_CONTENT_CHECKS):
569-
try:
570-
with connection.cursor() as cursor:
571-
for checksum in ALLOWED_CONTENT_CHECKSUMS:
572-
# can't import Artifact here so use a direct db connection
573-
cursor.execute(
574-
f"SELECT count(pulp_id) FROM core_artifact WHERE {checksum} IS NULL LIMIT 1"
575-
)
576-
row = cursor.fetchone()
577-
if row[0] > 0:
578-
raise ImproperlyConfigured(
579-
(
580-
"There have been identified artifacts missing checksum '{}'. "
581-
"Run 'pulpcore-manager handle-artifact-checksums' first to populate "
582-
"missing artifact checksums."
583-
).format(checksum)
584-
)
585-
for checksum in FORBIDDEN_CHECKSUMS:
586-
# can't import Artifact here so use a direct db connection
587-
cursor.execute(
588-
f"SELECT count(pulp_id) FROM core_artifact WHERE {checksum} IS NOT NULL LIMIT 1"
589-
)
590-
row = cursor.fetchone()
591-
if row[0] > 0:
592-
raise ImproperlyConfigured(
593-
(
594-
"There have been identified artifacts with forbidden checksum '{}'. "
595-
"Run 'pulpcore-manager handle-artifact-checksums' first to unset "
596-
"forbidden checksums."
597-
).format(checksum)
598-
)
599-
600-
# warn if there are remote artifacts with checksums but no allowed checksums
601-
cond = " AND ".join([f"{c} IS NULL" for c in constants.ALL_KNOWN_CONTENT_CHECKSUMS])
602-
no_checksum_query = f"SELECT pulp_id FROM core_remoteartifact WHERE {cond}"
603-
cond = " AND ".join([f"{c} IS NULL" for c in ALLOWED_CONTENT_CHECKSUMS])
604-
cursor.execute(
605-
f"SELECT count(pulp_id) FROM core_remoteartifact WHERE {cond} AND "
606-
f"pulp_id NOT IN ({no_checksum_query}) LIMIT 1"
607-
)
608-
row = cursor.fetchone()
609-
if row[0] > 0:
610-
_logger.warning(
611-
(
612-
"Warning: detected remote content without allowed checksums. "
613-
"Run 'pulpcore-manager handle-artifact-checksums --report' to "
614-
"view this content."
615-
)
616-
)
617-
618-
except ImproperlyConfigured as e:
619-
raise e
620-
except Exception:
621-
# our check could fail if the table hasn't been created yet or we can't get a db connection
622-
pass
623-
finally:
624-
connection.close()
625-
626560
if settings.API_ROOT_REWRITE_HEADER:
627561
api_root = "/<path:api_root>/"
628562
else:

0 commit comments

Comments
 (0)