From b816c8024e07cd58ca819aaa7de91fee0d6060ec Mon Sep 17 00:00:00 2001
From: Davide Principi <davide.principi@nethesis.it>
Date: Tue, 1 Oct 2024 11:58:24 +0200
Subject: [PATCH] Implement pinned tags (#41)

The optional pins.yml file can define tags to be forcibly added to the
resulting repodata.json file, ensuring that these tags are always
available for gradual upgrades.

Pin core 2.9.5 as bug workaround

Refs NethServer/dev#7047
---
 createrepo.py | 28 +++++++++++++++++++++++++++-
 createrepo.sh |  2 +-
 pins.yml      |  7 +++++++
 3 files changed, 35 insertions(+), 2 deletions(-)
 create mode 100644 pins.yml

diff --git a/createrepo.py b/createrepo.py
index 4f975a2..42841e5 100644
--- a/createrepo.py
+++ b/createrepo.py
@@ -35,6 +35,14 @@
 import subprocess
 import glob
 import urllib.request
+import yaml
+
+
+try:
+    pins = yaml.safe_load(open("pins.yml"))
+except Exception as ex:
+    print("[WARNING] while parsing pins.yml:", ex, file=sys.stderr)
+    pins = {}
 
 def is_pngfile(file_path):
     kind = filetype.guess(file_path)
@@ -162,7 +170,7 @@ def is_pngfile(file_path):
             "testing": semver_tag.prerelease is not None,
             "labels": image_labels,
         }
-        print("* Add version", tag, file=sys.stderr)
+        print("* Add registry version", tag, file=sys.stderr)
         metadata["versions"].append(image_version)
 
         if semver_tag.prerelease is None:
@@ -171,6 +179,24 @@ def is_pngfile(file_path):
         else:
             testing_found = True
 
+    for tag in pins.get(entry_name, []):
+        semver_tag = semver.parse_version_info(tag)
+        try:
+            # Fetch the pinned image labels
+            with subprocess.Popen(["skopeo", "inspect", f'docker://{metadata["source"]}:{tag}'], stdout=subprocess.PIPE, stderr=sys.stderr) as proc:
+                image_inspect = json.load(proc.stdout)
+            image_labels = image_inspect['Labels']
+        except Exception as ex:
+            print(f'[ERROR] cannot inspect {metadata["source"]}:{tag}', ex, file=sys.stderr)
+            continue
+
+        image_version = {
+            "tag": tag,
+            "testing": semver_tag.prerelease is not None,
+            "labels": image_labels,
+        }
+        print("* Add pinned version", tag, file=sys.stderr)
+        metadata["versions"].append(image_version)
 
     if metadata["versions"]:
         index.append(metadata)
diff --git a/createrepo.sh b/createrepo.sh
index 67973f0..3532f02 100644
--- a/createrepo.sh
+++ b/createrepo.sh
@@ -27,7 +27,7 @@ if ! buildah containers --format "{{.ContainerName}}" | grep -q repomd-builder;
     buildah from --name repomd-builder -v "${PWD}:/usr/src:Z" docker.io/library/python:3.11-alpine
     buildah run repomd-builder sh <<EOF
 python3 -mvenv /opt/pyenv --upgrade-deps
-/opt/pyenv/bin/pip3 install semver==3.0.1 filetype
+/opt/pyenv/bin/pip3 install semver==3.0.1 filetype PyYAML
 apk add skopeo
 EOF
 fi
diff --git a/pins.yml b/pins.yml
new file mode 100644
index 0000000..a0b043a
--- /dev/null
+++ b/pins.yml
@@ -0,0 +1,7 @@
+---
+# Since the introduction of the labels `org.nethserver.min-core` and
+# `org.nethserver.min-from` in core 2.10, we can pin specific image tags
+# to ensure they are always visible to clients, allowing for gradual
+# upgrades between breaking releases.
+core:
+  - 2.9.5 # See #7040 #7047