Launchpad allows debian sources to be copied to ubuntu PPAs via the API

Bug #386693 reported by Celso Providelo
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
High
Celso Providelo

Bug Description

The package copy related APIs (IArchive.{syncSource, syncSources}) erroneously allow copies of debian sources to ubuntu PPAs.

Example:

{{{
    debian = lp.distributions['debian']
    sid = debian.getSeries(name_or_version='sid')
    source = debian.main_archive.getPublishedSources(
        source_name='a2ps', distro_series=sid, exact_match=True)[0]
    lp.me.archive.syncSource(
        from_archive=debian.main_archive, source_name='a2ps',
        to_pocket='Release', version='1:4.14-1')
}}}

The copies will never be published and do not block anything, although they trigger PPA publication on every single publishing cycle.

Tags: api lp-soyuz ppa
Changed in soyuz:
milestone: pending → 2.2.7
Celso Providelo (cprov)
Changed in soyuz:
status: Triaged → In Progress
Revision history for this message
Celso Providelo (cprov) wrote :

r8710 (devel)

Changed in soyuz:
status: In Progress → Fix Committed
Celso Providelo (cprov)
Changed in soyuz:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.