Add support to vuln report for pulp_python plugin #1273

git-hyagi · 2025-11-14T19:36:48Z

closes: #1272

gerrod3 · 2025-11-17T16:38:09Z

pulp-glue/pulp_glue/python/context.py

    NEEDS_PLUGINS = [PluginRequirement("python", specifier=">=3.1.0")]

+    def scan(self) -> t.Any:
+        return self.call("scan", parameters={self.HREF: self.pulp_href})
+


Suggested change

NEEDS_PLUGINS = [PluginRequirement("python", specifier=">=3.1.0")]

def scan(self) -> t.Any:

return self.call("scan", parameters={self.HREF: self.pulp_href})

NEEDS_PLUGINS = [PluginRequirement("python", specifier=">=3.1.0")]

CAPABILITIES = {"scan": [PluginRequirement("python", specifier=">=3.21.0")]}

def scan(self) -> t.Any:

self.needs_capability("scan")

return self.call("scan", parameters={self.HREF: self.pulp_href})

This feature of the CLI is very useful for implementing new endpoints that are shared, but unevenly supported across the plugins.

If scan is going to have the same signature on every repository that supports it, you can move the function up in the hierarchy that way.

I didn't mean all the way up to the base EntityContext.

gerrod3 · 2025-11-17T16:39:40Z

pulpcore/cli/core/vulnerability_report.py

+    needs_plugins: t.List[PluginRequirement] = [PluginRequirement("python", specifier=">=3.21.0")],
+) -> None:
+
+    # for now, vuln report is implemented for pulp_python only
+    if not isinstance(repository, PulpPythonRepositoryContext):
+        return


With the CAPABILITIES feature you won't need to check the context type. Just check the capable/needs_capability on the final repository version context to see if you can call scan.

mdellweg · 2025-11-18T07:27:16Z

pulpcore/cli/core/vulnerability_report.py

+    help=_("Version of the repository to scan. Leave blank for latest version."),
+)
+@pass_pulp_context
+def create(


I think, here we should follow the design of the api.
The repository version command group can have a scan subcommand whose sideeffect would be to create a report.

So this command should go away.

tests/scripts/pulpcore/test_vulnerability_report.sh

mdellweg · 2025-11-19T15:21:16Z

pulpcore/cli/core/vulnerability_report.py

+    help=_("Version of the repository to scan. Leave blank for latest version."),
+)
+@pass_pulp_context
+def create(


So this command should go away.

mdellweg · 2025-11-20T09:26:38Z

pulp-glue/pulp_glue/common/context.py

+    def scan(self) -> t.Any:
+        return self.call("scan", parameters={self.HREF: self.pulp_href})
+


What are the objects you can scan? And where did the capability check go?

mdellweg · 2025-12-05T14:08:29Z

tests/scripts/pulp_python/test_vulnerability_report.sh

@@ -0,0 +1,30 @@
+#!/bin/bash


This should move to pulp_python.

mdellweg · 2025-12-05T14:10:37Z

tests/scripts/pulpcore/test_vulnerability_report.sh

+pulp python repository sync --name python --remote python
+
+expect_succ pulp python repository version scan --repository python
+expect_succ pulp vulnerability-report list


Shouldn't we be able to request the very report we just created here?

mdellweg · 2025-12-05T14:11:40Z

tests/scripts/pulpcore/test_vulnerability_report.sh

+expect_succ pulp python repository version scan --repository python
+expect_succ pulp vulnerability-report list
+
+VULN_REPORT=$(pulp vulnerability-report list --field pulp_href --limit 1|jq .[0].pulp_href -r)


Please use the result variable from the previously tested command.

mdellweg · 2025-12-05T14:16:42Z

pulp-glue/pulp_glue/python/context.py

    NEEDS_PLUGINS = [PluginRequirement("python", specifier=">=3.1.0")]

+    def scan(self) -> t.Any:
+        return self.call("scan", parameters={self.HREF: self.pulp_href})
+


I didn't mean all the way up to the base EntityContext.

mdellweg · 2025-12-05T14:18:21Z

pulp_cli/generic.py

+        """
+        Scan a {entity}.
+        """
+        entity_ctx.needs_capability("scan")


This should be inside the ctx.scan function.

mdellweg · 2025-12-05T14:20:25Z

pulp_cli/generic.py

+        Scan a {entity}.
+        """
+        entity_ctx.needs_capability("scan")
+        entity_ctx.scan()


Isn't there some thing to tell the user about here?

closes: pulp#1272

git-hyagi requested review from gerrod3 and jobselko November 14, 2025 19:36

git-hyagi mentioned this pull request Nov 14, 2025

Implements the vulnerability report pulp/pulp_python#1013

Merged

git-hyagi force-pushed the add-vuln-report branch 5 times, most recently from 2cdad88 to a720b1e Compare November 14, 2025 20:07

mdellweg marked this pull request as draft November 17, 2025 09:43

gerrod3 requested changes Nov 17, 2025

View reviewed changes

git-hyagi force-pushed the add-vuln-report branch 2 times, most recently from 876b7cc to 609049f Compare November 17, 2025 18:13

mdellweg reviewed Nov 18, 2025

View reviewed changes

jobselko reviewed Nov 18, 2025

View reviewed changes

tests/scripts/pulpcore/test_vulnerability_report.sh Outdated Show resolved Hide resolved

git-hyagi force-pushed the add-vuln-report branch 6 times, most recently from 9672fae to 1154c06 Compare November 19, 2025 13:58

git-hyagi marked this pull request as ready for review November 19, 2025 14:32

git-hyagi requested review from gerrod3, jobselko and mdellweg November 19, 2025 14:32

mdellweg requested changes Nov 19, 2025

View reviewed changes

git-hyagi force-pushed the add-vuln-report branch 2 times, most recently from 75a552e to 3d9625a Compare November 19, 2025 15:58

mdellweg reviewed Nov 20, 2025

View reviewed changes

git-hyagi requested a review from mdellweg December 4, 2025 19:52

mdellweg reviewed Dec 5, 2025

View reviewed changes

Add support to vuln report for pulp_python plugin

c22a91e

closes: pulp#1272

git-hyagi force-pushed the add-vuln-report branch from 3d9625a to c22a91e Compare December 19, 2025 18:43

		def scan(self) -> t.Any:
		return self.call("scan", parameters={self.HREF: self.pulp_href})

Add support to vuln report for pulp_python plugin #1273

Are you sure you want to change the base?

Add support to vuln report for pulp_python plugin #1273

Uh oh!

Conversation

git-hyagi commented Nov 14, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants