#!/usr/bin/python3 # koji-gc: a garbage collection tool for Koji # Copyright (c) 2007-2014 Red Hat, Inc. # # Authors: # Mike McLean import datetime import fcntl import fnmatch import optparse import os import pprint import smtplib import sys import time from email.mime import text as MIMEText from string import Template import requests import koji import koji.policy from koji.util import LazyDict, LazyValue, to_list def get_options(): """process options from command line and config file""" usage = "%prog [options]" parser = optparse.OptionParser(usage=usage) parser.add_option("-c", "--config-file", metavar="FILE", default='/etc/koji-gc/koji-gc.conf', help="use alternate configuration file") parser.add_option("--keytab", help="specify a Kerberos keytab to use") parser.add_option("--principal", help="specify a Kerberos principal to use") parser.add_option("--runas", metavar="USER", help="run as the specified user (requires special privileges)") parser.add_option("--user", help="specify user") parser.add_option("--password", help="specify password") parser.add_option("--noauth", action="store_true", default=False, help="do not authenticate") parser.add_option("--network-hack", action="store_true", default=False, help=optparse.SUPPRESS_HELP) # no longer used parser.add_option("--cert", help="Client SSL certificate file for authentication") parser.add_option("--serverca", help="CA cert file that issued the hub certificate") parser.add_option("-n", "--test", action="store_true", default=False, help="test mode") parser.add_option("-d", "--debug", action="store_true", default=False, help="show debug output") parser.add_option("--debug-xmlrpc", action="store_true", default=False, help="show xmlrpc debug output") parser.add_option("--smtp-host", metavar="HOST", default='localhost', help="specify smtp server for notifications") parser.add_option("--smtp-user", dest="smtp_user", metavar="USER", help="specify smtp username for notifications") parser.add_option("--smtp-pass", dest="smtp_pass", metavar="PASSWORD", help=optparse.SUPPRESS_HELP) # do not allow passwords on a command line parser.add_option("--no-mail", action='store_false', default=True, dest="mail", help="don't send notifications") parser.add_option("--send-mail", action='store_true', dest="mail", help="send notifications") parser.add_option("--email-domain", default="fedoraproject.org", help="Email domain appended to Koji username for notifications") parser.add_option("--from-addr", default="Koji Build System ", help="From address for notifications") parser.add_option("--cc-addr", help="CC address for notifications (multiple)", action="append", metavar="EMAIL_ADDRESS") parser.add_option("--bcc-addr", help="BCC address for notifications (multiple)", action="append", metavar="EMAIL_ADDRESS") parser.add_option("--email-template", default="/etc/koji-gc/email.tpl", help="notification template") parser.add_option("--action", help="action(s) to take") parser.add_option("--delay", metavar="INTERVAL", default='5 days', help="time before eligible builds are placed in trashcan") parser.add_option("--grace-period", default='4 weeks', metavar="INTERVAL", help="time that builds are held in trashcan") parser.add_option("--skip-main", action="store_true", default=False, help="don't actually run main") parser.add_option("--unprotected-keys", metavar="KEYS", help="allow builds signed with these keys to be deleted") parser.add_option("--tag-filter", "--tag", metavar="PATTERN", action="append", help="Process only tags matching PATTERN when pruning") parser.add_option("--ignore-tags", metavar="PATTERN", action="append", help="Ignore tags matching PATTERN when pruning") parser.add_option("--pkg-filter", "--pkg", "--package", metavar="PATTERN", action='append', help="Process only packages matching PATTERN") parser.add_option("--bypass-locks", metavar="PATTERN", action="append", help="Bypass locks for tags matching PATTERN") parser.add_option("--purge", action="store_true", default=False, help="When pruning, attempt to delete the builds that are untagged") parser.add_option("--trashcan-tag", default='trashcan', metavar="TAG", help="specify an alternate trashcan tag") parser.add_option("--weburl", default="http://localhost/koji", metavar="URL", help="url of koji web server (for use in notifications)") parser.add_option("-s", "--server", help="url of koji XMLRPC server") parser.add_option("--lock-file", help="koji-gc will wait while specified file exists. " "Default path is /run/user//koji-gc.lock. " "For service usage /var/lock/koji-gc.lock is " "recommended.") parser.add_option("--exit-on-lock", action="store_true", help="quit if --lock-file exists, don't wait") parser.add_option("--ccache", default="/var/tmp/koji-gc.ccache", help="Path to Kerberos credentials cache") # parse once to get the config file (options, args) = parser.parse_args() defaults = parser.get_default_values() cf = getattr(options, 'config_file') config = koji.read_config_files(cf) # List of values read from config file to update default parser values cfgmap = [ # name, alias, type ['test', None, 'boolean'], ['debug', None, 'boolean'], ['keytab', None, 'string'], ['principal', None, 'string'], ['runas', None, 'string'], ['user', None, 'string'], ['password', None, 'string'], ['noauth', None, 'boolean'], ['cert', None, 'string'], ['serverca', None, 'string'], ['server', None, 'string'], ['weburl', None, 'string'], ['smtp_host', None, 'string'], ['smtp_user', None, 'string'], ['smtp_pass', None, 'string'], ['from_addr', None, 'string'], ['cc_addr', None, 'list'], ['bcc_addr', None, 'list'], ['email_template', None, 'string'], ['email_domain', None, 'string'], ['mail', None, 'boolean'], ['delay', None, 'string'], ['unprotected_keys', None, 'string'], ['tag_filter', None, 'list'], ['ignore_tags', None, 'list'], ['pkg_filter', None, 'list'], ['bypass_locks', None, 'list'], ['grace_period', None, 'string'], ['trashcan_tag', None, 'string'], ['purge', None, 'boolean'], ['no_ssl_verify', None, 'boolean'], ['timeout', None, 'integer'], ['lock_file', None, 'string'], ['exit_on_lock', None, 'boolean'], ['ccache', None, 'string'], ] for name, alias, type in cfgmap: if alias is None: alias = ('main', name) if config.has_option(*alias): if options.debug: print("Using option %s from config file" % (alias,)) if type == 'integer': setattr(defaults, name, config.getint(*alias)) elif type == 'boolean': setattr(defaults, name, config.getboolean(*alias)) elif type == 'list': val = config.get(*alias) if val is not None: val = val.split(',') setattr(defaults, name, val) else: setattr(defaults, name, config.get(*alias)) # parse again with defaults (options, args) = parser.parse_args(values=defaults) options.config = config if args: parser.error("This command doesn't take any arguments.") # figure out actions actions = ('prune', 'trash', 'delete', 'salvage') if options.action: if not isinstance(options.action, str): raise koji.ParameterError('Invalid type of action: %s' % type(options.action)) options.action = options.action.lower().replace(',', ' ').split() for x in options.action: if x not in actions: parser.error("Invalid action: %s" % x) else: options.action = ('delete', 'prune', 'trash') # split patterns for unprotected keys if options.unprotected_keys: if not isinstance(options.unprotected_keys, str): raise koji.ParameterError('Invalid type of unprotected_keys: %s' % type(options.unprotected_keys)) options.unprotected_key_patterns = options.unprotected_keys.replace(',', ' ').split() else: options.unprotected_key_patterns = [] # parse key aliases options.key_aliases = {} try: if config.has_option('main', 'key_aliases'): for line in config.get('main', 'key_aliases').splitlines(): parts = line.split() if len(parts) < 2: continue options.key_aliases[parts[0].upper()] = parts[1] except ValueError as e: print(e) parser.error("Invalid key alias data in config: %s" % config.get('main', 'key_aliases')) # parse time intervals for key in ('delay', 'grace_period'): try: value = getattr(options, key) value = parse_duration(value) setattr(options, key, value) if options.debug: print("%s: %s seconds" % (key, value)) except ValueError: parser.error("Invalid time interval: %s" % value) # special handling for cert defaults cert_defaults = { 'cert': '/etc/koji-gc/client.crt', 'serverca': '/etc/koji-gc/serverca.crt', } for name in cert_defaults: if getattr(options, name, None) is None: fn = cert_defaults[name] if os.path.exists(fn): setattr(options, name, fn) template = getattr(options, 'email_template', None) if not template or not os.access(template, os.F_OK): parser.error("No such file: %s" % template) return options, args def check_perms(required, granted): """Check that the 'granted' permissions are sufficient with regard to the 'required' permissions. :param required: a permission name. :param granted: a list of granted permissions. :returns: True if required permissions are met and False if not. """ # Nothing required if required is None or not required: return True # Nothing granted elif granted is None or not granted: return False elif required in granted: return True return False def check_tag(name): """Check tag name against options and determine if we should process it The ignore option takes priority here. Returns True if we should process the tag, False otherwise """ if options.ignore_tags: if not isinstance(options.ignore_tags, list): raise koji.ParameterError('Invalid type of ignore_tags: %s' % type(options.ignore_tags)) for pattern in options.ignore_tags: if fnmatch.fnmatch(name, pattern): return False if options.tag_filter: if not isinstance(options.tag_filter, list): raise koji.ParameterError('Invalid type of tag_filter: %s' % type(options.tag_filter)) for pattern in options.tag_filter: if fnmatch.fnmatch(name, pattern): return True # doesn't match any pattern in filter return False else: # not ignored and no filter specified return True def check_package(name): """Check package name against options and determine if we should process it Returns True if we should process the package, False otherwise """ if options.pkg_filter: if not isinstance(options.pkg_filter, list): raise koji.ParameterError('Invalid type of pkg_filter: %s' % type(options.pkg_filter)) for pattern in options.pkg_filter: if fnmatch.fnmatch(name, pattern): return True # doesn't match any pattern in filter return False else: # no filter specified return True time_units = { 'second': 1, 'minute': 60, 'hour': 3600, 'day': 86400, 'week': 604800, } time_unit_aliases = [ # [unit, alias, alias, ...] ['week', 'weeks', 'wk', 'wks'], ['hour', 'hours', 'hr', 'hrs'], ['day', 'days'], ['minute', 'minutes', 'min', 'mins'], ['second', 'seconds', 'sec', 'secs', 's'], ] def parse_duration(str): """Parse time duration from string, returns duration in seconds""" ret = 0 n = None unit = None def parse_num(s): try: return int(s) except ValueError: pass try: return float(s) except ValueError: pass return None for x in str.split(): if n is None: n = parse_num(x) if n is not None: continue # perhaps the unit is appended w/o a space for names in time_unit_aliases: for name in names: if x.endswith(name): n = parse_num(x[:-len(name)]) if n is None: continue unit = names[0] # combined at end break if unit: break else: raise ValueError("Invalid time interval: %s" % str) if unit is None: x = x.lower() for names in time_unit_aliases: for name in names: if x == name: unit = names[0] break if unit: break else: raise ValueError("Invalid time interval: %s" % str) ret += n * time_units[unit] n = None unit = None return ret def error(msg=None, code=1): if msg: sys.stderr.write(msg + "\n") sys.stderr.flush() sys.exit(code) def warn(msg): sys.stderr.write(msg + "\n") sys.stderr.flush() def ensure_connection(session): try: ret = session.getAPIVersion() except requests.exceptions.ConnectionError: error("Error: Unable to connect to server") if ret != koji.API_VERSION: warn("WARNING: The server is at API version %d and the client is at %d" % (ret, koji.API_VERSION)) def activate_session(session): """Test and login the session is applicable""" global options if options.noauth: # skip authentication pass elif options.cert is not None and os.path.isfile(options.cert): # authenticate using SSL client cert session.ssl_login(options.cert, None, options.serverca, proxyuser=options.runas) elif options.user: # authenticate using user/password session.login() elif koji.reqgssapi: session.gssapi_login(principal=options.principal, keytab=options.keytab, proxyuser=options.runas, ccache=options.ccache) if not options.noauth and not session.logged_in: error("Error: unable to log in, no authentication methods available") ensure_connection(session) if options.debug: print("successfully connected to hub") def send_warning_notice(owner_name, builds): if not options.mail: return if not builds: print("Warning: empty build list. No notice sent") return with open(options.email_template, 'rt', encoding='utf-8') as f: tpl = Template(f.read()) fmt = """\ Build: %%(name)s-%%(version)s-%%(release)s %s/buildinfo?buildID=%%(id)i""" % options.weburl middle = '\n\n'.join([fmt % b for b in builds]) msg = MIMEText.MIMEText(tpl.safe_substitute( owner=owner_name, builds=middle, )) if len(builds) == 1: msg['Subject'] = "1 build marked for deletion" else: msg['Subject'] = "%i builds marked for deletion" % len(builds) if not isinstance(options.from_addr, str): raise koji.ParameterError('Invalid type of from_addr: %s' % type(options.from_addr)) msg['From'] = options.from_addr if not isinstance(options.email_domain, str): raise koji.ParameterError('Invalid type of email_domain: %s' % type(options.email_domain)) msg['To'] = "%s@%s" % (owner_name, options.email_domain) # XXX! emails = [msg['To']] if options.cc_addr: if not isinstance(options.cc_addr, list): raise koji.ParameterError('Invalid type of cc_addr: %s' % type(options.cc_addr)) msg['Cc'] = ','.join(options.cc_addr) emails += options.cc_addr if options.bcc_addr: if not isinstance(options.bcc_addr, list): raise koji.ParameterError('Invalid type of bcc_addr: %s' % type(options.bcc_addr)) emails += options.bcc_addr msg['X-Koji-Builder'] = owner_name if options.test: if options.debug: print(str(msg)) else: print("Would have sent warning notice to %s" % emails) else: if options.debug: print("Sending warning notice to %s" % emails) try: s = smtplib.SMTP(options.smtp_host) if options.smtp_user is not None and options.smtp_pass is not None: s.login(options.smtp_user, options.smtp_pass) s.sendmail(msg['From'], emails, msg.as_string()) s.quit() except Exception: print("FAILED: Sending warning notice to %s" % emails) def main(args): activate_session(session) if not session.getTag(options.trashcan_tag, strict=False): error("Trashcan tag %s doesn't exist" % options.trashcan_tag) for x in options.action: globals()['handle_' + x]() def handle_trash(): print("Getting untagged builds...") untagged = session.untaggedBuilds() print("...got %i builds" % len(untagged)) min_age = options.delay trashcan_tag = options.trashcan_tag # Step 1: place unreferenced builds into trashcan i = 0 N = len(untagged) to_trash = [] print("1st pass: package filter") continuing = [] for binfo in untagged: i += 1 nvr = "%(name)s-%(version)s-%(release)s" % binfo binfo['nvr'] = nvr if not check_package(binfo['name']): if options.debug: print("[%i/%i] Skipping package: %s" % (i, N, nvr)) continue continuing.append(binfo) print("2nd pass: references") i = 0 mcall = koji.MultiCallSession(session, batch=10) for binfo in continuing: mcall.buildReferences(binfo['id'], limit=10, lazy=True) for binfo, [refs] in zip(continuing, mcall.call_all()): i += 1 nvr = binfo['nvr'] # XXX - this is more data than we need # also, this call takes waaaay longer than it should if refs.get('tags'): # must have been tagged just now print("[%i/%i] Build is tagged [?]: %s" % (i, N, nvr)) continue if refs.get('rpms'): if options.debug: print("[%i/%i] Build has %i rpm references: %s" % (i, N, len(refs['rpms']), nvr)) # pprint.pprint(refs['rpms']) continue if refs.get('archives'): if options.debug: print("[%i/%i] Build has %i archive references: %s" % (i, N, len(refs['archives']), nvr)) # pprint.pprint(refs['archives']) continue if refs.get('component_of'): if options.debug: print("[%i/%i] Build is a component of archives: %s" % (i, N, nvr)) continue ts = refs['last_used'] if ts: # work around server bug if isinstance(ts, list): ts = ts[0] # XXX - should really check time server side if options.debug: print("[%i/%i] Build has been used in a buildroot: %s" % (i, N, nvr)) print("Last_used: %s" % datetime.datetime.fromtimestamp(ts).isoformat()) age = time.time() - ts if age < min_age: continue # see how long build has been untagged history = session.queryHistory(build=binfo['id'])['tag_listing'] age = None binfo2 = None if not history: # never tagged, we'll have to use the build create time binfo2 = session.getBuild(binfo['id']) ts = binfo2.get('creation_ts') if ts is None: # older api with no good way to get a proper timestamp for # a build, so we have the following hack task_id = binfo2.get('task_id') if task_id: tinfo = session.getTaskInfo(task_id) if tinfo['completion_ts']: age = time.time() - tinfo['completion_ts'] else: age = time.time() - ts else: tagged = False last = history[0] for h in history: if not h['revoke_event']: tagged = True break if h['revoke_event'] > last['revoke_event']: last = h if tagged: # this might happen if the build was tagged just now print("[%i/%i] Warning: build not untagged: %s" % (i, N, nvr)) continue age = time.time() - last['revoke_ts'] if age is not None and age < min_age: if options.debug: print("[%i/%i] Build untagged only recently: %s" % (i, N, nvr)) continue # check build signatures keys = get_build_sigs(binfo['id'], cache=True) if keys and options.debug: print("Build: %s, Keys: %s" % (nvr, keys)) if protected_sig(keys): print("Skipping build %s. Keys: %s" % (nvr, keys)) continue # ok, go ahead add it to the list if binfo2 is None: binfo2 = session.getBuild(binfo['id']) print("[%i/%i] Adding build to trash list: %s" % (i, N, nvr)) to_trash.append(binfo2) # process to_trash # group by owner so we can reduce the number of notices by_owner = {} for binfo in to_trash: by_owner.setdefault(binfo['owner_name'], []).append(binfo) owners = sorted(to_list(by_owner.keys())) mcall = koji.MultiCallSession(session, batch=100) for owner_name in owners: builds = sorted([(b['nvr'], b) for b in by_owner[owner_name]]) send_warning_notice(owner_name, [x[1] for x in builds]) for nvr, binfo in builds: if options.test: print("Would have moved to trashcan: %s" % nvr) else: if options.debug: print("Moving to trashcan: %s" % nvr) # figure out package owner count = {} for pkg in session.listPackages(pkgID=binfo['name']): count.setdefault(pkg['owner_id'], 0) count[pkg['owner_id']] += 1 if not count: print("Warning: no owner for %s, using build owner" % nvr) # best we can do currently owner = binfo['owner_id'] else: owner = max([(n, k) for k, n in count.items()])[1] mcall.packageListAdd(trashcan_tag, binfo['name'], owner) mcall.tagBuildBypass(trashcan_tag, binfo['id'], force=True) # run all packageListAdd/tagBuildBypass finally mcall.call_all() def protected_sig(keys): """Check list of keys and see if any are protected returns True if ANY are protected (not on unprotected list) returns False if ALL are unprotected """ for key in keys: if not key: continue if not sigmatch(key, options.unprotected_key_patterns): # this key is protected return True return False def handle_salvage(): """Reclaim builds from trashcan Check builds in trashcan for new tags or references and salvage them (remove trashcan tag) if appropriate. The delete action also does this, but this is for when you want to run this action only.""" return handle_delete(just_salvage=True) def salvage_build(binfo): """Removes trashcan tag from a build and prints a message""" if options.test: print("Would have untagged from trashcan: %(nvr)s" % binfo) else: if options.debug: print("Untagging from trashcan: %(nvr)s" % binfo) session.untagBuildBypass(options.trashcan_tag, binfo['id'], force=True) def handle_delete(just_salvage=False): """Delete builds that have been in the trashcan for long enough If just_salvage is True, goes into salvage mode. In salvage mode it only reclaims referenced builds from the trashcan, it does not perform any deletes """ print("Getting list of builds in trash...") trashcan_tag = options.trashcan_tag grace_period = options.grace_period # using history makes for a smaller query that listTagged history = session.queryHistory(tables=['tag_listing'], tag=trashcan_tag, active=True, before=time.time() - grace_period) # simulate needed binfo fields binfos = history['tag_listing'] for binfo in binfos: binfo['nvr'] = '%(name)s-%(version)s-%(release)s' % binfo binfo['id'] = binfo['build_id'] to_check = {b['nvr']: b for b in binfos} print(f"...got {len(to_check)} builds to check") print("1st pass: package filter") for nvr in sorted(to_check): binfo = to_check[nvr] if not check_package(binfo['name']): if options.debug: print(f"Skipping package: {nvr}") del to_check[nvr] print(f"{len(to_check)} builds remaining") print("2nd pass: tags") with session.multicall(batch=100) as m: tags = {nvr: m.listTags(build=binfo['id'], perms=False) for nvr in to_check} for nvr in sorted(to_check): # see if build has been tagged elsewhere binfo = to_check[nvr] btags = [t['name'] for t in tags[nvr].result if t['name'] != trashcan_tag] if btags: print(f"Build {nvr} tagged elsewhere: {btags}") salvage_build(binfo) del to_check[nvr] print(f"{len(to_check)} builds remaining") print("3rd pass: signatures") for nvr in sorted(to_check): # check build signatures binfo = to_check[nvr] keys = get_build_sigs(binfo['id'], cache=False) if keys and options.debug: print(f"Build: {nvr}, Keys: {keys}") if protected_sig(keys): print(f"Salvaging signed build {nvr}. Keys: {keys}") salvage_build(binfo) del to_check[nvr] print(f"{len(to_check)} builds remaining") if just_salvage: print("Salvage mode. Skipping deletes.") return print("4th pass: deletion") if options.test: for nvr in sorted(to_check): binfo = to_check[nvr] print(f"Would have deleted build from trashcan: {nvr}") else: # go ahead and delete with session.multicall(batch=100) as m: untags = {nvr: m.untagBuildBypass(trashcan_tag, to_check[nvr]['id']) for nvr in to_check} deletes = {nvr: m.deleteBuild(to_check[nvr]['id']) for nvr in to_check} for nvr in sorted(to_check): # check multicall results try: untags[nvr].result except koji.GenericError as e: print(f"Failed to untag {nvr} from trashcan: {e}") try: deletes[nvr].result except koji.GenericError as e: print(f"Warning: deletion failed for {nvr}: ({e})") continue print(f"Deleted build: {nvr}") class TagPruneTest(koji.policy.MatchTest): name = 'tag' field = 'tagname' class PackagePruneTest(koji.policy.MatchTest): name = 'package' field = 'pkgname' class VolumePruneTest(koji.policy.MatchTest): name = 'volume' field = 'volname' class SigPruneTest(koji.policy.BaseSimpleTest): name = 'sig' def run(self, data): # true if any of the keys match any of the patterns patterns = self.str.split()[1:] for key in data['keys']: if sigmatch(key, patterns): return True return False def sigmatch(key, patterns): """Test whether a key id matches any of the given patterns Supports key aliases """ if not isinstance(patterns, (tuple, list)): patterns = (patterns,) for pat in patterns: if fnmatch.fnmatch(key, pat): return True alias = options.key_aliases.get(key.upper()) if alias is not None and fnmatch.fnmatch(alias, pat): return True return False class OrderPruneTest(koji.policy.CompareTest): name = 'order' field = 'order' allow_float = False class AgePruneTest(koji.policy.BaseSimpleTest): name = 'age' cmp_idx = koji.policy.CompareTest.operators def __init__(self, str): """Read the test parameters from string""" super(AgePruneTest, self).__init__(str) self.cmp, value = str.split(None, 2)[1:] self.func = self.cmp_idx.get(self.cmp, None) if self.func is None: raise Exception("Invalid comparison in test: %s" % str) self.span = parse_duration(value) def run(self, data): return self.func(time.time() - data['ts'], self.span) class HasTagPruneTest(koji.policy.BaseSimpleTest): name = 'hastag' def run(self, data): patterns = self.str.split()[1:] for tag in data['tags']: for pattern in patterns: if fnmatch.fnmatch(tag['name'], pattern): return True return False def read_policies(fn=None): """Read tag gc policies from file The expected format as follows test [params] [&& test [params] ...] :: (keep|untag|skip) """ fo = open(fn, 'rt', encoding='utf-8') tests = koji.policy.findSimpleTests(globals()) ret = koji.policy.SimpleRuleSet(fo, tests) fo.close() return ret def scan_policies(str): """Read tag gc policies from a string The expected format as follows test [params] [&& test [params] ...] :: (keep|untag|skip) """ tests = koji.policy.findSimpleTests(globals()) return koji.policy.SimpleRuleSet(str.splitlines(), tests) build_sig_cache = {} def get_build_sigs(build, cache=False): if cache and build in build_sig_cache: return build_sig_cache[build] rpms = session.listRPMs(buildID=build) keys = {} if not rpms: # for non-rpm builds we have no easy way of checking signatures ret = build_sig_cache[build] = [] return ret else: # TODO - multicall helps, but it might be good to have a more robust server-side call session.multicall = True for rpminfo in rpms: session.queryRPMSigs(rpm_id=rpminfo['id']) for rpminfo, [sigs] in zip(rpms, session.multiCall()): for sig in sigs: if sig['sigkey']: keys.setdefault(sig['sigkey'], 1) ret = build_sig_cache[build] = to_list(keys.keys()) return ret def handle_prune(): """Untag old builds according to policy If purge is True, will also attempt to delete the pruned builds afterwards """ # read policy if not options.config or not options.config.has_option('prune', 'policy'): print("Skipping prune step. No policies available.") return # policies = read_policies(options.policy_file) policies = scan_policies(options.config.get('prune', 'policy')) for action in policies.all_actions(): if action not in ("keep", "untag", "skip"): raise Exception("Invalid action: %s" % action) if options.debug: pprint.pprint(policies.ruleset) # get user info user_perms = session.getPerms() user = session.getLoggedInUser() username = user['name'] # get tags tags = session.listTags(perms=True, queryOpts={'order': 'name'}) is_admin = session.hasPerm('admin') untagged = {} build_ids = {} for taginfo in tags: tagname = taginfo['name'] if tagname == options.trashcan_tag: if options.debug: print("Skipping trashcan tag: %s" % tagname) continue if not check_tag(tagname): # if options.debug: # print("skipping tag due to filter: %s" % tagname) continue bypass = False if taginfo['locked']: if options.bypass_locks: if not isinstance(options.bypass_locks, list): raise koji.ParameterError('Invalid type of bypass_locks: %s' % type(options.bypass_locks)) for pattern in options.bypass_locks: if fnmatch.fnmatch(tagname, pattern): bypass = True break if bypass: print("Bypassing lock on tag: %s" % tagname) else: if options.debug: print("skipping locked tag: %s" % tagname) continue perm = taginfo['perm'] # Fail early if required permissions are missing. has_tag_specific_perm = check_perms(perm, user_perms) has_global_tag_perm = check_perms('tag', user_perms) if ( not has_tag_specific_perm and not has_global_tag_perm and not is_admin ): required_perms = '"{}"{}'.format( perm if perm is not None else 'tag', ' or "admin"' if not is_admin and perm != "admin" else '') print("Skipping tag " "'{}' which requires {} but not found for user '{}'".format( taginfo['name'], required_perms, username)) continue if options.debug: print("Pruning tag: %s" % tagname) # get builds history = session.queryHistory(tag=taginfo['id'], active=True)['tag_listing'] history = sorted(history, key=lambda x: -x['create_ts']) if not history: if options.debug: print("No history for %s" % tagname) continue pkghist = {} for h in history: if taginfo['maven_include_all'] and h.get('maven_build_id'): pkghist.setdefault(h['name'] + '-' + h['version'], []).append(h) else: pkghist.setdefault(h['name'], []).append(h) pkgs = sorted(to_list(pkghist.keys())) for pkg in pkgs: if not check_package(pkg): # if options.debug: # print("skipping package due to filter: %s" % pkg) continue if options.debug: print(pkg) hist = pkghist[pkg] # these are the *active* history entries for tag/pkg skipped = 0 for order, entry in enumerate(hist): # get sig data nvr = "%(name)s-%(version)s-%(release)s" % entry data = { 'tagname': tagname, 'pkgname': pkg, 'order': order - skipped, 'ts': entry['create_ts'], 'nvr': nvr, } data = LazyDict(data) data['keys'] = LazyValue(get_build_sigs, (entry['build_id'],), {'cache': True}) data['volname'] = LazyValue(lambda x: session.getBuild(x).get('volume_name'), (entry['build_id'],), cache=True) data['tags'] = LazyValue(session.listTags, (entry['build_id'],), cache=True) build_ids[nvr] = entry['build_id'] action = policies.apply(data) if action is None: if options.debug: print("No policy for %s (%s)" % (nvr, tagname)) if action == 'skip': skipped += 1 if options.debug: print(policies.last_rule()) print("%s: %s (%s, %i)" % (action, nvr, tagname, order)) if action == 'untag': if options.test: print("Would have untagged %s from %s" % (nvr, tagname)) untagged.setdefault(nvr, {})[tagname] = 1 else: print("Untagging build %s from %s" % (nvr, tagname)) try: session.untagBuildBypass(taginfo['id'], entry['build_id'], force=bypass or is_admin) untagged.setdefault(nvr, {})[tagname] = 1 except (koji.xmlrpcplus.Fault, koji.GenericError) as e: print("Warning: untag operation failed: %s" % e) pass # if action == 'keep' do nothing if options.purge and untagged: print("Attempting to purge %i builds" % len(untagged)) for nvr in untagged: build_id = build_ids[nvr] tags = [t['name'] for t in session.listTags(build_id, perms=False)] if options.test: # filted out the tags we would have dropped above tags = [t for t in tags if t not in untagged[nvr]] if tags: # still tagged somewhere print("Skipping %s, still tagged: %s" % (nvr, tags)) continue # check cached sigs first to save a little time if build_id in build_sig_cache: keys = build_sig_cache[build_id] if protected_sig(keys): print("Skipping %s, signatures: %s" % (nvr, keys)) continue # recheck signatures in case build was signed during run keys = get_build_sigs(build_id, cache=False) if protected_sig(keys): print("Skipping %s, signatures: %s" % (nvr, keys)) continue if options.test: print("Would have deleted build: %s" % nvr) else: print("Deleting untagged build: %s" % nvr) try: session.deleteBuild(build_id, strict=True) except (koji.xmlrpcplus.Fault, koji.GenericError) as e: print("Warning: deletion failed: %s" % e) # server issue pass if __name__ == "__main__": options, args = get_options() session_opts = koji.grab_session_options(options) session = koji.ClientSession(options.server, session_opts) rv = 0 try: lock_fd = None if not options.lock_file: options.lock_file = '/run/user/%d/koji-gc.lock' % os.getuid() # acquire lock file while not lock_fd: # fail, if it is completely inaccessible lock_fd = os.open(options.lock_file, os.O_CREAT | os.O_RDWR) try: fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB) break except (IOError, OSError): if options.exit_on_lock: try: session.logout() except Exception: pass sys.exit(1) os.close(lock_fd) lock_fd = None if options.debug: print("Waiting on lock: %s" % options.lock_file) time.sleep(10) if not options.skip_main: rv = main(args) if not rv: rv = 0 if lock_fd: # release lock file fcntl.flock(lock_fd, fcntl.LOCK_UN) os.close(lock_fd) except KeyboardInterrupt: pass except SystemExit: rv = 1 # except: # if options.debug: # raise # else: # exctype, value = sys.exc_info()[:2] # rv = 1 # print("%s: %s" % (exctype, value)) try: session.logout() except Exception: pass if not options.skip_main: sys.exit(rv)