Enable ARM builders for PPA via API

Anyone looking at this, please do not be tempted to simply expose the necessary code on the API and rely on the horrendous lp.commercial permission to do it. That permission has been overused and allows too wide an access to all private PPAs.

We need a new permission type to handle self-admin of PPAs.

While I agree commercial has been overused, isn't that the current guard on doing it via the web form? If it is, and I think it is, then using it for the API is no worse than the current situation, and we should not conflate addressing this defect (cannot drive this programmatically) with the other issue (commercial is overused).

(More) - it may be you meant 'we do not want to grant commercial rights to the service that would want to use this facility' - if thats true, thats fine, but still a separate bug IMO.

> isn't that the current guard on doing it via the web form?

Yes, and it's crazy because lp.commercial lets that user see *any* private PPA and administer it. That's insane, and the reason it's grown is because people keep thinking "oh just one more action won't hurt", like you do here :)

We need to fix this *now* and not let it pervade. We need a new self-admin permission that we can give to trusted people/teams and restrict the size of the commercial team to people who need to debug problems (like me) and genuine commercial admins.

OK, so I agree its crazy, and we should schedule time to do it. OEM
are asking for this to be escalated to critical, and as long as we're
not expanding the set of people that can see all private PPA's, I
don't see a solid justification for combining these two separate (but
related) problems.

Escalated by Steve Magoun on the stakeholders list.

Fixed in stable r13293 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/13293>.

I just did QA for this bug and thought the transcript would be useful to those wishing to use the newly exported features.

# Using version 1.0 of the API on qastaging shows the new property is not exported.

/home/bac/launchpad/lp-branches/trunk> lp-shell qastaging
Connected to LP service "https://api.qastaging.launchpad.net/" with API version "1.0":
>>> lp.me
<person at https://api.qastaging.launchpad.net/1.0/~bac>
>>> lp.me.archive
<archive at https://api.qastaging.launchpad.net/1.0/~bac/+archive/ppa>
>>> lp.me.archive.enabled_restricted_families
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/usr/lib/python2.7/dist-packages/lazr/restfulclient/resource.py", line 673, in __getattr__
    return super(Entry, self).__getattr__(name)
  File "/usr/lib/python2.7/dist-packages/lazr/restfulclient/resource.py", line 319, in __getattr__
    % (self.__class__.__name__, attr))
AttributeError: 'Entry' object has no attribute 'enabled_restricted_families'

# Using version devel of the API on qastaging has the new properties as expected.

/home/bac/launchpad/lp-branches/trunk> lp-shell qastaging devel
Connected to LP service "https://api.qastaging.launchpad.net/" with API version "devel":
>>> lp.me
<person at https://api.qastaging.launchpad.net/devel/~bac>
>>> lp.me.archive
<archive at https://api.qastaging.launchpad.net/devel/~bac/+archive/ppa>
>>> list(lp.me.archive.enabled_restricted_families)
[]

# Accessing the default collection returns only the restricted families.

>>> list(lp.processor_families)
[<processor_family at https://api.qastaging.launchpad.net/devel/+processor-families/arm>]

# You can get a family by name.

>>> arm = lp.processor_families.getByName(name='arm')

# And then set it.

>>> lp.me.archive.enableRestrictedFamily(family=arm)
>>> list(lp.processor_families)
[<processor_family at https://api.qastaging.launchpad.net/devel/+processor-families/arm>]

# This works because I am a commercial admin.

>>> commercial_admins = lp.people['commercial-admins']
>>> lp.me in commercial_admins.members
True

# Let's try to set a restricted family on a distro, not a PPA (hint: it won't work).

>>> ubuntu = list(lp.distributions)[0]
>>> list(ubuntu.main_archive.enabled_restricted_families)
[<processor_family at https://api.qastaging.launchpad.net/devel/+processor-families/arm>]
>>> hppa = lp.processor_families.getByName(name='hppa')
>>> ubuntu.main_archive.enableRestrictedFamily(family=hppa)
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/usr/lib/python2.7/dist-packages/lazr/restfulclient/resource.py", line 558, in __call__
    url, in_representation, http_method, extra_headers=extra_headers)
  File "/usr/lib/python2.7/dist-packages/lazr/restfulclient/_browser.py", line 281, in _request
    raise error
ServerError: HTTP Error 500: Internal Server Error
...
Main archives can not be restricted to certain architectures

# Let's go back to my PPA and try to set hppa as an enabled restricted family.
>>> lp.me.archive.enableRestrictedFamily(family=hppa)

>>> list(lp.me.archive.enabled_restricted_families)
[<processor_family at https://api.qastaging.launchpad.net/devel/+processor-fami...

Great script, thanks Brad!

On Friday 24 June 2011 14:01:09 Brad Crittenden wrote:
> # Let's try to set a restricted family on a distro, not a PPA (hint: it
> won't work).

To clarify, it's a primary archive, not "a distro".

> >>> ubuntu = list(lp.distributions)[0]
> >>> list(ubuntu.main_archive.enabled_restricted_families)
>
> [<processor_family at
> https://api.qastaging.launchpad.net/devel/+processor-families/arm>]
>
> >>> hppa = lp.processor_families.getByName(name='hppa')
> >>> ubuntu.main_archive.enableRestrictedFamily(family=hppa)
>
> Traceback (most recent call last):
> File "<console>", line 1, in <module>
> File "/usr/lib/python2.7/dist-packages/lazr/restfulclient/resource.py",
> line 558, in __call__ url, in_representation, http_method,
> extra_headers=extra_headers) File
> "/usr/lib/python2.7/dist-packages/lazr/restfulclient/_browser.py", line
> 281, in _request raise error
> ServerError: HTTP Error 500: Internal Server Error
> ...
> Main archives can not be restricted to certain architectures

500 errors generate an OOPS, you should fix that. It's critical by our policy
:)