On Tue, Dec 20, 2022 at 07:58:14AM +0000, Mattia Verga wrote: > As you may have read in the announcement on the devel mailing list, I've > started a change proposal about bumping Pyramid to version 2.0 for F38. > I cross-announce here because Pyramid and its dependencies are mostly > maintained by infra-sig and I don't want to bypass main-admins, but I > think it's time to move forward (and I have some projects about using > pyramid-openapi3 to provide REST APIs in Bodhi which will need Pyramid 2). > > I intend to upgrade Pyramid and rebuild dependent packages also updating > spec files to latest packaging guidelines and possibly upgrade packages > to the latest versions. The list of packages is: > > * python-pyramid - Maintained by kevin / infra-sig > * bodhi-server - Maintained by humaton > * python-cornice - Maintained by hguemar / python-packagers-sig > * python-pyramid-fas-openid - Maintained by abompard / infra-sig > * python-pyramid-mako - Maintained by kevin / infra-sig > * python-pyramid-tm - Maintained by kevin / infra-sig > * python-pyramid_sawing - Maintained by abompard > > The dependent packages rebuild is not really needed, but it will ensure > that the tests will not fail with Pyramid 2.0. In fact, > python-pyramid-mako is the only one which needs an upgrade to be > compatible with Pyramid 2.0. > I have set up a COPR repository to test the upgrade: > https://copr.fedorainfracloud.org/coprs/mattia/Pyramid2/ > > Let me know if there's any objection to the proposal. No objection at all from me. ;) I have been very conservative in updating this stack since I don't want to break bodhi. If we can upgrade things and confirm bodhi is happy I am all for it. ;) kevin

> On Tue, Dec 20, 2022 at 07:58:14AM +0000, Mattia Verga wrote: > > No objection at all from me. ;) > > I have been very conservative in updating this stack since I don't want > to break bodhi. If we can upgrade things and confirm bodhi is happy I am > all for it. ;) > > kevin So, after Pyramid 2.0 was pushed to F38, Bodhi integration tests started to fail. It seems that, despite Pyramid docs say that legacy authentication should still work [1], bodhi-client authentication fail. devel/ci/integration/tests/test_bodhi_tasks.py::test_update_edit FAILED [100%] {"status": "error", "errors": [{"location": "body", "name": "HTTPForbidden", "description": "Unauthorized: new_update__POST failed permission check"}]}

I think we're still in time to retire the change proposal and fall back to Pyramid 1.x by untag everything related to the update, or we can proceed and work on updating / fixing Bodhi before F37 goes EOL and we're forced to upgrade to F38 or higher.

I'm not sure how hard could be upgrade the authentication/authorization to the new method.