Merge remote-tracking branch 'origin/rawhide' into epel9

Currently, the latest symlink is never updated.

.gitignore

@@ -48,3 +48,8 @@ koji-1.4.0.tar.bz2
 /koji-1.32.0.tar.bz2
 /koji-1.32.1.tar.bz2
 /koji-1.33.0.tar.bz2
+/koji-1.33.1.tar.bz2
+/koji-1.34.0.tar.bz2
+/koji-1.34.1.tar.bz2
+/koji-1.35.0.tar.bz2
+/koji-1.35.1.tar.bz2

0001-repos-check-for-newer-create-event.patch

@@ -0,0 +1,25 @@
+From a0498970e73384a3bce62bc28f5f98f4feeabaff Mon Sep 17 00:00:00 2001
+From: Igor Raits <igor.raits@gmail.com>
+Date: Nov 05 2024 13:53:22 +0000
+Subject: repos: check for newer create event
+
+
+When the repo was just created, it has create_event that is the same as
+we are checking so the repo will never be considered latest.
+
+---
+
+diff --git a/kojihub/repos.py b/kojihub/repos.py
+index 5fc08ed..9a7fd03 100644
+--- a/kojihub/repos.py
++++ b/kojihub/repos.py
+@@ -333,7 +333,7 @@ def symlink_if_latest(repo):
+     clauses = [
+         ['tag_id', '=', repo['tag_id']],
+         ['state', '=', koji.REPO_READY],
+-        ['create_event', '>=', repo['create_event']]]
++        ['create_event', '>', repo['create_event']]]
+     if repo['dist']:
+         clauses.append(['dist', 'IS', True])
+     else:
+

koji.spec

@@ -8,16 +8,20 @@
 %{?!python3_pkgversion:%global python3_pkgversion 3}
 
 Name: koji
-Version: 1.33.0
-Release: 1%{?dist}
+Version: 1.35.1
+Release: 3%{?dist}
 # the included arch lib from yum's rpmUtils is GPLv2+
-License: LGPLv2 and GPLv2+
+# Automatically converted from old format: LGPLv2 and GPLv2+ - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2 AND GPL-2.0-or-later
 Summary: Build system tools
 URL: https://pagure.io/koji/
 Source0: https://releases.pagure.org/koji/koji-%{version}.tar.bz2
 
+Patch1: https://pagure.io/koji/pull-request/4258.patch#/0001-repos-check-for-newer-create-event.patch
+
 # Not upstreamable
-Patch1000: fedora-config.patch
+Patch100: fedora-config.patch
+Patch101: pr4228-wait-repo-current.patch
 
 BuildArch: noarch
 Requires: python%{python3_pkgversion}-%{name} = %{version}-%{release}
@@ -44,6 +48,7 @@ Requires: python%{python3_pkgversion}-requests
 Requires: python%{python3_pkgversion}-requests-gssapi
 Requires: python%{python3_pkgversion}-dateutil
 Requires: python%{python3_pkgversion}-six
+Requires: python%{python3_pkgversion}-defusedxml
 
 %description -n python%{python3_pkgversion}-%{name}
 Koji is a system for building and tracking RPMS.
@@ -51,7 +56,8 @@ This subpackage provides python functions and libraries.
 
 %package -n python%{python3_pkgversion}-%{name}-cli-plugins
 Summary: Koji client plugins
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: python%{python3_pkgversion}-%{name} = %{version}-%{release}
 
 %description -n python%{python3_pkgversion}-%{name}-cli-plugins
@@ -59,7 +65,8 @@ Plugins to the koji command-line interface
 
 %package hub
 Summary: Koji XMLRPC interface
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-hub-code
 %if 0%{?fedora} || 0%{?rhel} > 7
@@ -72,7 +79,8 @@ koji-hub is the XMLRPC interface to the koji database
 
 %package -n python%{python3_pkgversion}-%{name}-hub
 Summary: Koji XMLRPC interface
-License: LGPLv2 and GPLv2
+# Automatically converted from old format: LGPLv2 and GPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2 AND GPL-2.0-only
 # rpmdiff lib (from rpmlint) is GPLv2 (only)
 Requires: httpd
 Requires: python%{python3_pkgversion}-mod_wsgi
@@ -86,7 +94,8 @@ koji-hub is the XMLRPC interface to the koji database
 
 %package hub-plugins
 Summary: Koji hub plugins
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: %{name}-hub-plugins-code = %{version}-%{release}
 %if 0%{?fedora} || 0%{?rhel} > 7
 Suggests: python%{python3_pkgversion}-%{name}-hub-plugins
@@ -97,7 +106,8 @@ Plugins to the koji XMLRPC interface
 
 %package -n python%{python3_pkgversion}-%{name}-hub-plugins
 Summary: Koji hub plugins
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: python%{python3_pkgversion}-%{name}-hub = %{version}-%{release}
 Requires: python%{python3_pkgversion}-qpid-proton
 Requires: cpio
@@ -108,7 +118,8 @@ Plugins to the koji XMLRPC interface
 
 %package builder-plugins
 Summary: Koji builder plugins
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-builder = %{version}-%{release}
 
@@ -117,7 +128,8 @@ Plugins for the koji build daemon
 
 %package builder
 Summary: Koji RPM builder daemon
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: mock >= 0.9.14
 Requires(pre): /usr/sbin/useradd
 Requires: squashfs-tools
@@ -140,7 +152,8 @@ tasks that come through the Koji system.
 
 %package vm
 Summary: Koji virtual machine management daemon
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: %{name} = %{version}-%{release}
 Requires(post): systemd
 Requires(preun): systemd
@@ -156,7 +169,8 @@ virtual machine. This package is not required for most installations.
 
 %package utils
 Summary: Koji Utilities
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: %{name} = %{version}-%{release}
 Requires: python%{python3_pkgversion}-psycopg2
 Requires(post): systemd
@@ -168,7 +182,8 @@ Utilities for the Koji system
 
 %package web
 Summary: Koji Web UI
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-web-code = %{version}-%{release}
 %if 0%{?fedora} || 0%{?rhel} > 7
@@ -180,7 +195,8 @@ koji-web is a web UI to the Koji system.
 
 %package -n python%{python3_pkgversion}-%{name}-web
 Summary: Koji Web UI
-License: LGPLv2
+# Automatically converted from old format: LGPLv2 - review is highly recommended.
+License: LicenseRef-Callaway-LGPLv2
 %{?python_provide:%python_provide python%{python3_pkgversion}-%{name}-web}
 Requires: httpd
 Requires: python%{python3_pkgversion}-mod_wsgi
@@ -206,7 +222,7 @@ sed -e '/util\/koji/g' -e '/koji_cli_plugins/g' -i setup.py
 %py3_install_wheel %{name}-%{version}-py3-none-any.whl
 mkdir -p %{buildroot}/etc/koji.conf.d
 cp cli/koji.conf %{buildroot}/etc/koji.conf
-for D in kojihub builder plugins util www vm ; do
+for D in kojihub builder plugins util www vm schemas ; do
     pushd $D
     make DESTDIR=$RPM_BUILD_ROOT PYTHON=%{__python3} %{?install_opt} install
     popd
@@ -233,6 +249,7 @@ done
 
 %files
 %{_bindir}/*
+%{_datadir}/koji
 %config(noreplace) /etc/koji.conf
 %dir /etc/koji.conf.d
 %doc docs Authors COPYING LGPL
@@ -348,6 +365,63 @@ done
 %systemd_postun kojira.service
 
 %changelog
+* Thu Oct 24 2024 Mike McLean <mikem@redhat.com> - 1.35.1-2
+- Backport PR #4228: wait for a current repo by default
+
+* Tue Oct 08 2024 Kevin Fenzi <kevin@scrye.com> - 1.35.1-1
+- Update to 1.35.1. Fixes rhbz#2316304
+- Fixes CVE-2024-9427
+
+* Wed Sep 18 2024 Kevin Fenzi <kevin@scrye.com> - 1.35.0-1
+- Update to 1.35.0. Fixes rhbz#2312848
+
+* Mon Sep 02 2024 Miroslav Suchý <msuchy@redhat.com> - 1.34.1-6
+- convert license to SPDX
+
+* Mon Aug 26 2024 Adam Williamson <awilliam@redhat.com> - 1.34.1-5
+- Backport PR #4184 to support overriding version and releasever for Kiwi
+
+* Thu Aug 22 2024 Adam Williamson <awilliam@redhat.com> - 1.34.1-4
+- Backport PR #4157 to support overriding Kiwi image file name format
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.34.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 1.34.1-2
+- Rebuilt for Python 3.13
+
+* Wed Jun 05 2024 Kevin Fenzi <kevin@scrye.com> - 1.34.1-1
+- Upgrade to 1.34.1. Fixes rhbz#2283973
+
+* Fri Mar 22 2024 Kevin Fenzi <kevin@scrye.com> - 1.34.0-3
+- Add back in missing schema files. rhbz#2270743
+
+* Mon Mar 18 2024 Kevin Fenzi <kevin@scrye.com> - 1.34.0-2
+- Carry scm policy plugin for hub, it's already upstream
+- Use dnf5 compatible 'group install' command
+- Allow specifying with a tag value what arches noarch builds happen on.
+- Fix image-build to not pass units to oz (to avoid GB/GiB issues)
+- Fix a typo in scheduler (already upstreamed)
+- Add back index for rpminfo table that was mistakenly dropped.
+
+* Thu Jan 25 2024 Kevin Fenzi <kevin@scrye.com> - 1.34.0-1
+- Update to 1.34.0. Fixes rhbz#2260055
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.33.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.33.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.33.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Fri Jul 14 2023 Kevin Fenzi <kevin@scrye.com> - 1.33.1-1
+- Update to 1.31.1. Fixes rhbz#2222032
+
+* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 1.33.0-2
+- Rebuilt for Python 3.12
+
 * Wed May 24 2023 Kevin Fenzi <kevin@scrye.com> - 1.33.0-1
 - Update to 1.33.0. Fixes rhbz#2209371
 

pr4228-wait-repo-current.patch

@@ -0,0 +1,64 @@
+commit 9b08aad4f49a7dc432fa466e2361b111a9870a63 (from 57040f731336a77ef308e5101719c65ed2af765c)
+Merge: 57040f731 a9f92c503
+Author: Mike McLean <mikem@redhat.com>
+Date:   Thu Oct 24 08:13:45 2024 -0400
+
+    PR#4228: cli: wait-repo: wait for a current repo by default
+    
+    Merges #4228
+    https://pagure.io/koji/pull-request/4228
+    
+    Fixes: #4229
+    https://pagure.io/koji/issue/4229
+    cli: wait-repo can report an older repo
+    
+    Fixes: #4226
+    https://pagure.io/koji/issue/4226
+    koji wait-repo command behaviour change / regression in 1.35
+    
+    Relates: #4227
+    https://pagure.io/koji/issue/4227
+    koji 1.35: blocking a package from a tag does not seem to cause newRepo tasks
+
+diff --git a/cli/koji_cli/commands.py b/cli/koji_cli/commands.py
+index dece662c5..0df721c80 100644
+--- a/cli/koji_cli/commands.py
++++ b/cli/koji_cli/commands.py
+@@ -7360,8 +7360,14 @@ def anon_handle_wait_repo(options, session, args):
+             error('' if suboptions.quiet else msg)
+         return
+ 
++    if builds:
++        # we're waiting for a repo with these builds, not necessarily a current one
++        min_event = None
++    else:
++        # wait for a current repo
++        min_event = "last"
+     watcher = _get_watcher(options, suboptions, session, tag['id'], nvrs=suboptions.builds,
+-                           min_event=None)
++                           min_event=min_event)
+ 
+     try:
+         repoinfo = watcher.waitrepo(anon=anon)
+diff --git a/tests/test_cli/test_wait_repo.py b/tests/test_cli/test_wait_repo.py
+index 2f2714ec5..bbd222665 100644
+--- a/tests/test_cli/test_wait_repo.py
++++ b/tests/test_cli/test_wait_repo.py
+@@ -206,7 +206,7 @@ class TestWaitRepo(utils.CliTestCase):
+ 
+         expected = "%(name)s is not a build tag for any target" % self.TAG + "\n"
+         self.assert_console_message(stderr, expected)
+-        self.RepoWatcher.assert_called_with(self.session, self.TAG['id'], nvrs=[], min_event=None, logger=self.wait_logger)
++        self.RepoWatcher.assert_called_with(self.session, self.TAG['id'], nvrs=[], min_event="last", logger=self.wait_logger)
+ 
+         # Cas 2. dest is matched, show suggestion
+         self.RepoWatcher.reset_mock()
+@@ -222,7 +222,7 @@ class TestWaitRepo(utils.CliTestCase):
+         expected = "%(name)s is not a build tag for any target" % self.TAG + "\n"
+         expected += "Suggested tags: build-tag-1, build-tag-2, build-tag-3\n"
+         self.assert_console_message(stderr, expected)
+-        self.RepoWatcher.assert_called_with(self.session, self.TAG['id'], nvrs=[], min_event=None, logger=self.wait_logger)
++        self.RepoWatcher.assert_called_with(self.session, self.TAG['id'], nvrs=[], min_event="last", logger=self.wait_logger)
+ 
+     def test_anon_handle_wait_repo_help(self):
+         """Test anon_handle_wait_repo help message"""

sources

@@ -1 +1 @@
-SHA512 (koji-1.33.0.tar.bz2) = 63557ee2bd4581c32547f3f3ca513a77410415216494370d84436d10e527e828fbb70fe41d8f36d42e61085b0bed34f4bc97c51d27a6b680db52484635c15bf3
+SHA512 (koji-1.35.1.tar.bz2) = b4909e95768e397ac424825ab772613baffe4ee46446bcf7e90105610907b75838eb9b5a67cc534e1efb05754847689d5540c5a9ae053e9b75de1c9d7e03f91e