unable to load plugins in Centos

[Juan Antonio Osorio Robles]

The certificate_manager module in barbican/plugins/interface creates an instance of _CertificateEventPluginManager whithin that same module. the _CertificateEventPluginManager in turn, imports the plugins, which import the certificate_manager module itself. So in Centos we see that this causes an error when trying to import the modules:

Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: cannot import name certificate_manager
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: Traceback (most recent call last):
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: File "/usr/lib/python2.7/site-packages/stevedore/extension.py", line 163, in _load_plugins
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: verify_requirements,
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: File "/usr/lib/python2.7/site-packages/stevedore/named.py", line 123, in _load_one_plugin
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: verify_requirements,
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: File "/usr/lib/python2.7/site-packages/stevedore/extension.py", line 184, in _load_one_plugin
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: plugin = ep.resolve()
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: File "/usr/lib/python2.7/site-packages/pkg_resources/__init__.py", line 2208, in resolve
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: module = __import__(self.module_name, fromlist=['__name__'], level=0)
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: File "/usr/lib/python2.7/site-packages/barbican/plugin/simple_certificate_manager.py", line 19, in <module>
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: from barbican.plugin.interface import certificate_manager as cert
Apr 11 15:33:31 centos-7-ovh-gra1-54094 gunicorn[25012]: ImportError: cannot import name certificate_manager

This is due to the circular dependency I mentioned above.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/305624
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=4c6704eda78bcac87b9bd17e6bd0e2f2c25d1429
Submitter: Jenkins
Branch: master

commit 4c6704eda78bcac87b9bd17e6bd0e2f2c25d1429
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Thu Apr 14 06:31:26 2016 +0000

    Fix circular dependency of certificate_manager module

    The certificate_manager module had a circular dependency that made it
    problematic to use for certain versions of the python interpreter.
    This was because we were initializing a singleton EVENT_PLUGIN_MANAGER
    that in turn loaded the plugins; The problem was that the plugins
    imported certificate_manger themselves and this caused the circular
    dependency. So instead of creating that class in the module, I
    created a function that should be called instead.

    Closes-Bug: #1570356
    Change-Id: I9cdb7c3ecc9c275ee561363f6ce13248259f88d0

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/306263

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/306263
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=ac981af71f6953bccb1d57b3d07bd8665d8b576c
Submitter: Jenkins
Branch: stable/mitaka

commit ac981af71f6953bccb1d57b3d07bd8665d8b576c
Author: Juan Antonio Osorio Robles <email address hidden>
Date: Thu Apr 14 06:31:26 2016 +0000

    Fix circular dependency of certificate_manager module

    The certificate_manager module had a circular dependency that made it
    problematic to use for certain versions of the python interpreter.
    This was because we were initializing a singleton EVENT_PLUGIN_MANAGER
    that in turn loaded the plugins; The problem was that the plugins
    imported certificate_manger themselves and this caused the circular
    dependency. So instead of creating that class in the module, I
    created a function that should be called instead.

    Closes-Bug: #1570356
    Change-Id: I9cdb7c3ecc9c275ee561363f6ce13248259f88d0
    (cherry picked from commit 4c6704eda78bcac87b9bd17e6bd0e2f2c25d1429)

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/barbican 3.0.0.0b2 development milestone.

[Corey Bryant (corey.bryant)]

Is barbican upstream planning to release a stable point release for mitaka which would include this?

[Corey Bryant (corey.bryant)]

For ubuntu mitaka, this needs to be cherry-picked from upstream stable/mitaka.

As a work-around you can use barbican on xenial from the latest ubuntu cloud archive (Newton):

sudo add-apt-repository cloud-archive:newton
sudo apt update

And that should get you to 3.0.0.

[Dmitrii Shcherbakov (dmitriis)]

Please review the attached debdiff.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "barbican_2.0.0-0ubuntu2.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Corey Bryant (corey.bryant)]

Ubuntu SRU fields:

[Description]
Fix circular dependency of certificate_manager module.

[Test case]
See bug description.

[Regression Potential]
Very little as this patch is cherry-picked from upstream's stable/mitaka branch.

[Brian Murray (brian-murray)]

Is this fixed in Zesty?

[James Page (james-page)]

Yes - this was fixed in the version of Barbican in Yakkety, so this only impacts on Xenial.

[Brian Murray (brian-murray)]

Hello Juan, or anyone else affected,

Accepted barbican into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/barbican/1:2.0.0-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Juan Antonio Osorio Robles (juan-osorio-robles)]

Thanks Brian!

[Dmitrii Shcherbakov (dmitriis)]

Hi Juan,

Do you have cycles to verify that this issue had been fixed in the package present in -proposed?

[Juan Antonio Osorio Robles (juan-osorio-robles)]

Dmitrii, so I encountered this bug on CentOS, which is why the title is as it is. I don't have any means to verify on Ubuntu :/

[Dmitrii Shcherbakov (dmitriis)]

Juan, ok thanks for the info. I'm going to figure something out.

[Dmitrii Shcherbakov (dmitriis)]

$ lxc launch ubuntu:xenial lp1570356
Creating lp1570356
Starting lp1570356

$ lxc exec lp1570356 bash
root@lp1570356:~#

root@lp1570356:~# apt install barbican-api

...

root@lp1570356:~# dpkg -l 'barbican*'
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-=======================================================-================================-================================-====================================================================================================================
ii barbican-api 1:2.0.0-0ubuntu1 all OpenStack Key Management Service - API Server
ii barbican-common 1:2.0.0-0ubuntu1 all OpenStack Key Management Service - common files

root@lp1570356:~# python
Python 2.7.12 (default, Nov 19 2016, 06:48:10)
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import barbican.plugin.interface.certificate_manager
Option "verbose" from group "DEFAULT" is deprecated for removal. Its value may be silently ignored in the future.
Could not load 'simple_certificate_event': cannot import name certificate_manager
cannot import name certificate_manager
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/stevedore/extension.py", line 163, in _load_plugins
    verify_requirements,
  File "/usr/lib/python2.7/dist-packages/stevedore/named.py", line 123, in _load_one_plugin
    verify_requirements,
  File "/usr/lib/python2.7/dist-packages/stevedore/extension.py", line 184, in _load_one_plugin
    plugin = ep.resolve()
  File "/usr/lib/python2.7/dist-packages/pkg_resources/__init__.py", line 2235, in resolve
    module = __import__(self.module_name, fromlist=['__name__'], level=0)
  File "/usr/lib/python2.7/dist-packages/barbican/plugin/simple_certificate_manager.py", line 19, in <module>
    from barbican.plugin.interface import certificate_manager as cert
ImportError: cannot import name certificate_manager

root@lp1570356:~# echo 'deb http://archive.ubuntu.com/ubuntu/ xenial-proposed restricted main multiverse universe' >> /etc/apt/sources.list
root@lp1570356:~# sudo apt update
Get:1 http://security.ubuntu.com/ubuntu xenial-security InRelease [102 kB]
Hit:2 http://archive.ubuntu.com/ubuntu xenial InRelease
Get:3 http://archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Get:4 http://archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]
Get:5 http://archive.ubuntu.com/ubuntu xenial-proposed InRelease [253 kB]
Get:6 http://archive.ubuntu.com/ubuntu xenial-proposed/main amd64 Packages [104 kB]
Get:7 http://archive.ubuntu.com/ubuntu xenial-proposed/main Translation-en [36,8 kB]
Get:8 http://archive.ubuntu.com/ubuntu xenial-proposed/multiverse amd64 Packages [1 024 B]
Ge...

[Launchpad Janitor (janitor)]

This bug was fixed in the package barbican - 1:2.0.0-0ubuntu1.1

---------------
barbican (1:2.0.0-0ubuntu1.1) xenial; urgency=medium

  [ Dmitrii Shcherbakov ]
  * d/p/backport-4c6704eda7.patch: Fix circular dependency of
    certificate_manager module (LP: #1570356).

 -- Dmitrii Shcherbakov <email address hidden> Mon, 09 Jan 2017 13:40:45 +0300

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for barbican has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.