pulp / pulp/pulpcore

Export of a maven repository is granted

Open
#5,297 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Issue
Dominant language
Python
Stars
598
Forks
168
Avg merge
1d 4h
Merged PRs (30d)
86

Description

Version
Pulp-in-one-container used here.

$ pulp status
{
  "versions": [
    {
      "component": "core",
      "version": "3.49.1",
      "package": "pulpcore",
      "module": "pulpcore.app",
      "domain_compatible": true
    },
    {
      "component": "ansible",
      "version": "0.21.3",
      "package": "pulp-ansible",
      "module": "pulp_ansible.app",
      "domain_compatible": false
    },
    {
      "component": "container",
      "version": "2.19.2",
      "package": "pulp-container",
      "module": "pulp_container.app",
      "domain_compatible": false
    },
    {
      "component": "deb",
      "version": "3.2.0",
      "package": "pulp_deb",
      "module": "pulp_deb.app",
      "domain_compatible": false
    },
    {
      "component": "gem",
      "version": "0.5.0",
      "package": "pulp-gem",
      "module": "pulp_gem.app",
      "domain_compatible": true
    },
    {
      "component": "maven",
      "version": "0.8.0",
      "package": "pulp-maven",
      "module": "pulp_maven.app",
      "domain_compatible": false
    },
    {
      "component": "ostree",
      "version": "2.3.0",
      "package": "pulp-ostree",
      "module": "pulp_ostree.app",
      "domain_compatible": true
    },
    {
      "component": "python",
      "version": "3.11.0",
      "package": "pulp-python",
      "module": "pulp_python.app",
      "domain_compatible": false
    },
    {
      "component": "rpm",
      "version": "3.25.1",
      "package": "pulp-rpm",
      "module": "pulp_rpm.app",
      "domain_compatible": true
    },
    {
      "component": "certguard",
      "version": "3.49.1",
      "package": "pulpcore",
      "module": "pulp_certguard.app",
      "domain_compatible": true
    },
    {
      "component": "file",
      "version": "3.49.1",
      "package": "pulpcore",
      "module": "pulp_file.app",
      "domain_compatible": true
    }

Describe the bug
The Export process is happy to export things that can’t be Imported.

To Reproduce
Populate a Maven repository.
Export thus produces the necessary files that can be verified through import-checker but cannot be imported, the import process is successful but the following task is failed.

Expected behavior
If the import is impossible so must be the export...

Additional context
https://github.com/pulp/pulpcore/blob/main/pulpcore/app/importexport.py#L173
https://discourse.pulpproject.org/t/import-operation-impossible-due-to-cve-2007-4559/1202/6

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at pulpcore/app/importexport.py around line 173 and reproduce the failure with a populated Maven repository. Compare export behavior with the import-checker result and the subsequent failed import task. Done means export refuses repositories that cannot be imported, with the existing Maven reproduction covered by an appropriate test.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.