Set Ubuntu dependencies for PPA via API

[Timothy R. Chavez]

OEM needs the ability to programmatically set the Ubuntu dependencies (e.g. basic, security, default, proposed, backports) for PPAs. Currently this is only doable (AFAICT) from the PPA's Edit PPA dependencies web view

[William Grant (wgrant)]

ArchiveDependency is already exported read-only. Making it writable shouldn't be extremely difficult.

[Francis J. Lacoste (flacoste)]

Escalated by Steve Magoun on the stakeholders list.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r13157 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/13157>.

[William Grant (wgrant)]

This bypasses the browser safeguards that prevent addition of a dependency on arbitrary private PPAs. Normally launchpad.View is checked, but that's clearly not the case here:

>>> lp = Launchpad.login_with('fwefw', 'qastaging', version='devel')
>>> a = lp.me.archive
>>> a.addArchiveDependency(dependency='/~ubuntu-security/+archive/ppa', pocket='Release')
<archive_dependency at https://api.qastaging.launchpad.net/devel/~wgrant/+archive/ppa/+dependency/3017>

[Aaron Bentley (abentley)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11-06-03 12:57 PM, William Grant wrote:
> This bypasses the browser safeguards that prevent addition of a
> dependency on arbitrary private PPAs. Normally launchpad.View is
> checked, but that's clearly not the case here:
>
>>>> lp = Launchpad.login_with('fwefw', 'qastaging', version='devel')
>>>> a = lp.me.archive
>>>> a.addArchiveDependency(dependency='/~ubuntu-security/+archive/ppa', pocket='Release')
> <archive_dependency at https://api.qastaging.launchpad.net/devel/~wgrant/+archive/ppa/+dependency/3017>

I don't think this is specific to addArchiveDependency:

>>> lp = Launchpad.login_with('fwefw', 'qastaging', version='devel')
>>> print lp.load('/~ubuntu-security/+archive/ppa').description
Private Security Build PPA

Also, I can't find any browser code that checks the appropriateness of
the archive for addArchiveDependency.

So if this is broken, I think we were broken already.

Aaron
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk3pOpQACgkQ0F+nu1YWqI2k3QCfUho5tyfrNec1SyOXZZxPqSNz
CBYAn0LHK0KFfbQaMrPpzX+eGn5Sdh6g
=w331
-----END PGP SIGNATURE-----

[William Grant (wgrant)]

On 04/06/11 05:48, Aaron Bentley wrote:
> On 11-06-03 12:57 PM, William Grant wrote:
>> This bypasses the browser safeguards that prevent addition of a
>> dependency on arbitrary private PPAs. Normally launchpad.View is
>> checked, but that's clearly not the case here:
>
>>>>> lp = Launchpad.login_with('fwefw', 'qastaging', version='devel')
>>>>> a = lp.me.archive
>>>>> a.addArchiveDependency(dependency='/~ubuntu-security/+archive/ppa', pocket='Release')
>> <archive_dependency at https://api.qastaging.launchpad.net/devel/~wgrant/+archive/ppa/+dependency/3017>
>
> I don't think this is specific to addArchiveDependency:

Some data about private PPAs is public, so we can show package origin.

>>>> lp = Launchpad.login_with('fwefw', 'qastaging', version='devel')
>>>> print lp.load('/~ubuntu-security/+archive/ppa').description
> Private Security Build PPA
>
> Also, I can't find any browser code that checks the appropriateness of
> the archive for addArchiveDependency.

ArchiveEditDependenciesView.validate() still has the check.

> So if this is broken, I think we were broken already.

We were broken, but I reported it and it was fixed a couple of years ago.

[Aaron Bentley (abentley)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11-06-03 08:33 PM, William Grant wrote:
> Some data about private PPAs is public, so we can show package origin.

This seems like a disclosure bug. If P3As were un-traversable for
non-privileged users like most of our private objects, I don't think we
would have this issue.

> ArchiveEditDependenciesView.validate() still has the check.

Thanks.

Aaron
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk3tCe8ACgkQ0F+nu1YWqI2NFACfa8XHageX+Xvn6k1DjQXJpfDo
wNYAoIK49/25h40QdCSLW62xM7iHfy5O
=zC0Q
-----END PGP SIGNATURE-----

[William Grant (wgrant)]

It is not quite that simple. Packages are frequently copied out of private PPAs into public archives. eg. ppa:ubuntu-security/ppa into the Ubuntu primary archive. It's handy to show the origin in that case.

[Robert Collins (lifeless)]

On Tue, Jun 7, 2011 at 1:14 PM, William Grant <email address hidden> wrote:
> It is not quite that simple. Packages are frequently copied out of
> private PPAs into public archives. eg. ppa:ubuntu-security/ppa into the
> Ubuntu primary archive. It's handy to show the origin in that case.

mmmm - this sounds surprising, and hard for users to reason about.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r13204 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/13204>.

[Julian Edwards (julian-edwards)]

On Tuesday 07 June 2011 05:04:14 you wrote:
> mmmm - this sounds surprising, and hard for users to reason about.

The previously private package is now public. What's hard to understand? :)

[William Grant (wgrant)]

Seems fine except for the fix in https://code.launchpad.net/~abentley/launchpad/ppa-api-errors/+merge/64425, which I don't think should block deployment.