infra/tickets

Fork 1

Remove users from distgit and IPA groups #12935

New issue

Closed

opened 2025-11-25 07:55:28 +00:00 by lenkaseg · 9 comments

lenkaseg commented

2025-11-25 07:55:28 +00:00

Member

Describe what you would like us to do:

The toddler cleaning_packager_groups checks for users who are not packagers anymore and removes them from distgit and IPA groups. However, the toddler cannot remove users, who are groups creators. The group creator probably needs to be set to a different user, releng perhaps? This needs to be done manually.

The following users could not be removed automatically because they are group creators:

dotnet-sig: rhea
modularity-wg: karsten
openstack-sig: hguemar
sssd-maintainers: mzidek

Please remove these users manually or transfer group ownership.

When do you need this to be done by? (YYYY/MM/DD)

no hurry

# Describe what you would like us to do: ---- The toddler cleaning_packager_groups checks for users who are not packagers anymore and removes them from distgit and IPA groups. However, the toddler cannot remove users, who are groups creators. The group creator probably needs to be set to a different user, releng perhaps? This needs to be done manually. The following users could not be removed automatically because they are group creators: dotnet-sig: rhea modularity-wg: karsten openstack-sig: hguemar sssd-maintainers: mzidek Please remove these users manually or transfer group ownership. # When do you need this to be done by? (YYYY/MM/DD) ---- no hurry

zlopez commented

2025-11-25 10:02:59 +00:00

Owner

Metadata Update from @zlopez:

Issue priority set to: Waiting on Assignee (was: Needs Review)
Issue tagged with: low-gain, low-trouble, ops

**Metadata Update from @zlopez**: - Issue priority set to: Waiting on Assignee (was: Needs Review) - Issue tagged with: low-gain, low-trouble, ops

kevin commented

2025-12-03 19:24:06 +00:00

Owner

So, to clarify here, these need to be removed on src.fedoraproject.org as 'group creator' ?

I am not sure how to do that. I guess direct in the db?
I assume some user must be set as creator? or can we just unset it?

I do not see them in ipa at all.

So, to clarify here, these need to be removed on src.fedoraproject.org as 'group creator' ? I am not sure how to do that. I guess direct in the db? I assume _some_ user must be set as creator? or can we just unset it? I do not see them in ipa at all.

lenkaseg commented

2025-12-09 12:04:25 +00:00

Author

Member

Yes, the users have to be removed from group creator on src.fedoraproject.org. When this happens, the toddler will finish the purging of the user from the groups.
I would assume there has to be some group creator for the group as well.
With @abompard we were thinking whether we could use releng user or some other admin or maintenance user for that?
The toddler can and does remove the users from the IPA side, so this only affects the src side.

Yes, the users have to be removed from `group creator` on src.fedoraproject.org. When this happens, the toddler will finish the purging of the user from the groups. I would assume there has to be some group creator for the group as well. With @abompard we were thinking whether we could use `releng` user or some other admin or maintenance user for that? The toddler can and does remove the users from the IPA side, so this only affects the src side.

kevin commented

2025-12-10 00:04:46 +00:00

Owner

I guess releng would work... or could we use 'nobody' ? That user has their emails go to /dev/null

lenkaseg commented

2026-01-19 09:25:21 +00:00

Author

Member

I suppose nobody would work as well.

I suppose `nobody` would work as well.

abompard commented

2026-01-29 12:03:00 +00:00

Member

I wrote this script so we don't have to touch the Pagure DB manually, we could put it on the pagure servers and the manually transfer the groups with it when necessary:

# -*- coding: utf-8 -*-

from __future__ import print_function, unicode_literals, absolute_import

import argparse
import logging
import os

import pagure.config
import pagure.exceptions
import pagure.lib.model_base
import pagure.lib.query


def parse_arguments():
    """ Set-up the argument parsing. """
    parser = argparse.ArgumentParser()
    parser.add_argument("group_name", help="Name of the group")
    parser.add_argument(
        "new_creator",
        help="Name of the user that will be the new creator of the group",
    )
    return parser.parse_args()


def transfer_group(session, args):
    # Validate user
    if not args.new_creator:
        raise pagure.exceptions.PagureException(
            "An username must be provided to associate with the group"
        )
    user = pagure.lib.query.get_user(session, args.new_creator)
    # Validate group
    group = pagure.lib.query.search_groups(session, group_name=args.group_name)
    if not group:
        raise pagure.exceptions.PagureException(
            "The group %r does not exist" % args.group_name
        )

    if group.user_id == user.id:
        raise pagure.exceptions.PagureException(
            "The group %r was already created by user %r" % (args.group_name, args.new_creator)
        )

    previous_creator = group.creator.username
    group.user_id = user.id
    session.commit()
    print("Group %r was transfered from %r to %r." % (args.group_name, previous_creator, args.new_creator))


def main():
    # Parse the arguments
    args = parse_arguments()
    if "PAGURE_CONFIG" not in os.environ and os.path.exists(
        "/etc/pagure/pagure.cfg"
    ):
        print("Using configuration file `/etc/pagure/pagure.cfg`")
        os.environ["PAGURE_CONFIG"] = "/etc/pagure/pagure.cfg"
    _config = pagure.config.reload_config()
    session = pagure.lib.model_base.create_session(_config["DB_URL"])
    try:
        transfer_group(session, args)
    finally:
        session.remove()


if __name__ == "__main__":
    main()

I wrote this script so we don't have to touch the Pagure DB manually, we could put it on the pagure servers and the manually transfer the groups with it when necessary: ```py # -*- coding: utf-8 -*- from __future__ import print_function, unicode_literals, absolute_import import argparse import logging import os import pagure.config import pagure.exceptions import pagure.lib.model_base import pagure.lib.query def parse_arguments(): """ Set-up the argument parsing. """ parser = argparse.ArgumentParser() parser.add_argument("group_name", help="Name of the group") parser.add_argument( "new_creator", help="Name of the user that will be the new creator of the group", ) return parser.parse_args() def transfer_group(session, args): # Validate user if not args.new_creator: raise pagure.exceptions.PagureException( "An username must be provided to associate with the group" ) user = pagure.lib.query.get_user(session, args.new_creator) # Validate group group = pagure.lib.query.search_groups(session, group_name=args.group_name) if not group: raise pagure.exceptions.PagureException( "The group %r does not exist" % args.group_name ) if group.user_id == user.id: raise pagure.exceptions.PagureException( "The group %r was already created by user %r" % (args.group_name, args.new_creator) ) previous_creator = group.creator.username group.user_id = user.id session.commit() print("Group %r was transfered from %r to %r." % (args.group_name, previous_creator, args.new_creator)) def main(): # Parse the arguments args = parse_arguments() if "PAGURE_CONFIG" not in os.environ and os.path.exists( "/etc/pagure/pagure.cfg" ): print("Using configuration file `/etc/pagure/pagure.cfg`") os.environ["PAGURE_CONFIG"] = "/etc/pagure/pagure.cfg" _config = pagure.config.reload_config() session = pagure.lib.model_base.create_session(_config["DB_URL"]) try: transfer_group(session, args) finally: session.remove() if __name__ == "__main__": main() ```

kevin commented

2026-01-29 21:18:52 +00:00

Owner

Sounds good. Can you stick it in ansible to deploy on the pkgs/src servers and then we can run it on stg to test and if all looks good, run it in prod?

zlopez commented

2026-02-03 09:08:20 +00:00

Owner

Found this e-mail in my inbox today, I assume the script is still not in place.

veector40 referenced this issue from a commit

2026-02-23 19:15:51 +00:00

distgit: deploy script to transfer pagure group ownership

veector40 referenced this issue from a commit

2026-02-23 19:31:47 +00:00

distgit: deploy script to transfer pagure group ownership

veector40 commented

2026-02-23 19:39:09 +00:00

I've added @abompard's group transfer script to the distgit role for deployment to /usr/local/bin/.

Pull Request: infra/ansible#3141

I've verified the script syntax and Ansible task formatting. Ready for review and a test run in staging

I've added @abompard's group transfer script to the distgit role for deployment to /usr/local/bin/. Pull Request: https://forge.fedoraproject.org/infra/ansible/pulls/3141 I've verified the script syntax and Ansible task formatting. Ready for review and a test run in staging

veector40 referenced this issue from a commit

2026-02-24 07:10:43 +00:00

distgit: deploy script to transfer pagure group ownership

veector40 referenced this issue from a commit

2026-02-24 07:17:02 +00:00

distgit: deploy script to transfer pagure group ownership

veector40 referenced this issue from a commit

2026-02-24 17:55:15 +00:00

distgit: deploy script to transfer pagure group ownership

veector40 referenced this issue from a commit

2026-02-24 17:57:10 +00:00

distgit: deploy script to transfer pagure group ownership