fedpkg request-branch should be able to circumvent Prevent creating new branches by git push hook #12416

New issue

Open

opened 2024-10-23 18:25:54 +00:00 by churchyard · 5 comments

churchyard commented

2024-10-23 18:25:54 +00:00

Member

Describe the issue

I have the Prevent creating new branches by git push hook activated in many of the packages I maintain. This prevents some from accidentally pushing feature branches to distgit instead of my fork.

When requesting new branches via fedpkg request-branch @releng-bot errors with:

Traceback (most recent call last):
  File "/code/toddlers/plugins/scm_request_processor.py", line 189, in process
    self.process_ticket(issue)
  File "/code/toddlers/plugins/scm_request_processor.py", line 301, in process_ticket
    self.create_new_branch(issue, issue_body)
  File "/code/toddlers/plugins/scm_request_processor.py", line 780, in create_new_branch
    self.dist_git.new_branch(
  File "/code/toddlers/utils/pagure.py", line 496, in new_branch
    raise PagureError(
toddlers.exceptions.pagure_error.PagureError: Couldn't create branch in project 'rpms/python-u-msgpack-python'

Request to 'https://src.fedoraproject.org/api/0/rpms/python-u-msgpack-python/git/branch':
{'branch': 'epel10', 'from_commit': 'bde80a2f71ca8f8d734a3dedcac875192e2a04ac'}

Response:
{'error': 'Remote hook declined the push: Creating a new reference/branch is not allowed in this project.', 'error_code': 'ENOCODE'}

Status code: 400

See e.g. https://pagure.io/releng/fedora-scm-requests/issue/69055 cc @tdawson

However, when new Fedora is branched, this is not an issue. That means releng has the means to create branches in distgit even when the Prevent creating new branches by git push hook is active.

Please, make fedpkg request-branch work even with the active hook. Thanks.

When do you need this? any time
When is this no longer needed or useful? when we ditch pagure
If we cannot complete your request, what is the impact? wasted time and effort by mostly EPEL packagers

Thank you

* Describe the issue I have the *Prevent creating new branches by git push* hook activated in many of the packages I maintain. This prevents some from accidentally pushing feature branches to distgit instead of my fork. When requesting new branches via `fedpkg request-branch` @releng-bot errors with: ``` Traceback (most recent call last): File "/code/toddlers/plugins/scm_request_processor.py", line 189, in process self.process_ticket(issue) File "/code/toddlers/plugins/scm_request_processor.py", line 301, in process_ticket self.create_new_branch(issue, issue_body) File "/code/toddlers/plugins/scm_request_processor.py", line 780, in create_new_branch self.dist_git.new_branch( File "/code/toddlers/utils/pagure.py", line 496, in new_branch raise PagureError( toddlers.exceptions.pagure_error.PagureError: Couldn't create branch in project 'rpms/python-u-msgpack-python' Request to 'https://src.fedoraproject.org/api/0/rpms/python-u-msgpack-python/git/branch': {'branch': 'epel10', 'from_commit': 'bde80a2f71ca8f8d734a3dedcac875192e2a04ac'} Response: {'error': 'Remote hook declined the push: Creating a new reference/branch is not allowed in this project.', 'error_code': 'ENOCODE'} Status code: 400 ``` See e.g. https://pagure.io/releng/fedora-scm-requests/issue/69055 cc @tdawson However, when new Fedora is branched, this is not an issue. That means releng has the means to create branches in distgit even when the *Prevent creating new branches by git push* hook is active. Please, make `fedpkg request-branch` work even with the active hook. Thanks. * When do you need this? any time * When is this no longer needed or useful? when we ditch pagure * If we cannot complete your request, what is the impact? wasted time and effort by mostly EPEL packagers Thank you

phsmoura commented

2024-10-23 19:10:56 +00:00

Metadata Update from @phsmoura:

Issue tagged with: medium-gain, medium-trouble, ops

**Metadata Update from @phsmoura**: - Issue tagged with: medium-gain, medium-trouble, ops

carlwgeorge commented

2025-02-26 00:17:23 +00:00

Member

Came here from this bug, and just wanted to add some quick observations.

Mass branching is performed by the mass-branching-git.py script on the pkgs01 machine. It shells out to run git branch <branch> <ref> in each dist-git repo, which isn't blocked by that hook.
Branch requests are performed by the scm_request_processor.py toddler, which uses the pagure API to create a new branch.

I suspect running scm_request_processor.py on the pkgs01 machine is probably not desirable, so the question becomes whether that hook is supposed to block API requests to create branches. My assumption from the name is that it would only block them from a literal git push, not from an API call.

Came here from [this bug](https://bugzilla.redhat.com/show_bug.cgi?id=2347190#c4), and just wanted to add some quick observations. * Mass branching is performed by the [mass-branching-git.py script](https://pagure.io/fedora-infra/ansible/blob/main/f/roles/distgit/files/mass-branching-git.py) on the pkgs01 machine. It shells out to run `git branch <branch> <ref>` in each dist-git repo, which isn't blocked by that hook. * Branch requests are performed by the [scm_request_processor.py toddler](https://pagure.io/fedora-infra/toddlers/blob/main/f/toddlers/plugins/scm_request_processor.py), which uses the [pagure API to create a new branch](https://pagure.io/fedora-infra/toddlers/blob/main/f/toddlers/utils/pagure.py#_472-486). I suspect running scm_request_processor.py on the pkgs01 machine is probably not desirable, so the question becomes whether that hook is supposed to block API requests to create branches. My assumption from the name is that it would only block them from a literal `git push`, not from an API call.

churchyard commented

2025-02-26 12:12:20 +00:00

Author

Member

I agree with the assumption that the hook should only block branch creating by git push.

ngompa commented

2025-02-26 12:20:08 +00:00

Member

It should also block API requests unless the API user is using an admin token (which can only be created by the pagure admin). Otherwise regular users can easily circumvent it.