U lHJe/@sddlZddlZddlZddlZddlmZddlmZmZmZm Z m Z m Z m Z m Z ddlmZmZmZmZmZmZmZmZmZmZddlmZddlmZmZmZmZm Z m!Z!m"Z"m#Z#ddl$m%Z%m&Z&ddl'm(Z(e)Z*e+e,e-Z.Gd d d Z/Gd d d ej0d Z1dS)N)datetime)AnyDictListOptionalSetTupleTypeUnion) aptconfigcontract event_logger exceptionshttpmessagessnapsystemutil) _is_attached)ApplicabilityStatusApplicationStatusCanDisableFailureCanDisableFailureReasonCanEnableFailureCanEnableFailureReasonContractStatusUserFacingStatus)MessagingOperationsDictStaticAffordance)is_config_value_truec@s"eZdZedejdddZdS)IncompatibleService UAEntitlement entitlement named_msgcCs||_||_dSNr#)selfr$r%r(edd=d>Z?edd?d@Z@eddAdBZAejdyeed:dCdDZBeddEdFZCdGdHZDee'ddIdJZEeddKdLZFeee e!j"fddMdNZGeee e!j"fddOdPZHdzeeee eIfdQdRdSZJd{eeee eIfd:dTdUZKejd|eed:dVdWZLeeee e!j"fd:dXdYZMeddZd[ZNd}eedd\d]d^ZOeePe e!j"fdd_d`ZQeRddadbZSeeTe e!j"fddcddZUejeeVe e!j"fddedfZWeee e!j"fddgdhZXe eddidjZYeddkdlZZeVddmdnZ[eeefe eedodpdqZ\d~eeefeeefeedrdsdtZ]dudvZ^dS)r"NFr(T)returncCsdS)z&The lowercase name of this entitlementNr(r'r(r(r)nameTszUAEntitlement.namecCsdS)z?The lowercase name of this entitlement, in case it is a variantr/r(r1r(r(r) variant_nameZszUAEntitlement.variant_namecCs$|jg}|j|jkr ||j|S)z1The list of names this entitlement may be called.)r2presentation_nameappend)r' valid_namesr(r(r)r6_s  zUAEntitlement.valid_namescCsdS)z,The human readable title of this entitlementNr(r1r(r(r)titlegszUAEntitlement.titlecCsdS)z&A sentence describing this entitlementNr(r1r(r(r) descriptionmszUAEntitlement.descriptioncCs@|jr |jS|jjjr6|jdidid|jS|jSdS)z/The user-facing name shown for this entitlementr$ affordancesZ presentedAsN) is_variantr3cfgmachine_token_fileZ is_presententitlement_cfggetr2r1r(r(r)r4ss zUAEntitlement.presentation_name)platform_checkr0cCsdS)zVerify specific platform checks for a service. This should only be used if the service requires custom platform checks to check if it is available or not in the machine. TNr()r'r?r(r(r)verify_platform_checkssz$UAEntitlement.verify_platform_checkscCsF|j}|jrBdd|jD}ddtjdg|}||7}|S)z$Help information for the entitlementcSsg|]\}}d||jqS)z * {}: {})formatr8).0r3 variant_clsr(r(r) sz+UAEntitlement.help_info.. z ) help_textvariantsitemsjoinrZCLI_HELP_VARIANTS_HEADER)r'rGZ variant_itemsZ variant_textr(r(r) help_infoszUAEntitlement.help_info.cCsdS)Nr(r(r1r(r(r)static_affordancessz UAEntitlement.static_affordancescCs|jS)a  Return a list of packages that aren't compatible with the entitlement. When we are enabling the entitlement we can directly ask the user if those entitlements can be disabled before proceding. Overridden in livepatch and fips )_incompatible_servicesr1r(r(r)incompatible_servicessz#UAEntitlement.incompatible_servicescCs|jS)a Return a list of packages that must be active before enabling this service. When we are enabling the entitlement we can directly ask the user if those entitlements can be enabled before proceding. Overridden in ros and ros-updates. )_required_servicesr1r(r(r)required_servicesszUAEntitlement.required_servicescCs|jS)a Return a list of packages that depend on this service. We will use that list during disable operations, where a disable operation will also disable all of the services required by the original service Overriden in esm-apps and esm-infra )_dependent_servicesr1r(r(r)dependent_servicess z UAEntitlement.dependent_servicescCsiSr&r(r1r(r(r) _get_variantsszUAEntitlement._get_variantscCsPt}|}|didg}|D]$}|did}|r&||q&|S)zV Fetch all available variants defined in the Contract Server response r$ overridesZselectorvariant)set_base_entitlement_cfgr>add)r'valid_variantsr=rToverriderUr(r(r)_get_contract_variantss z$UAEntitlement._get_contract_variantscCs`|}|}d|kr&d|di}ni}t|D]}||kr2||||<q2t|dkr\|SiS)Ngeneric)rSr[sortedlen)r'Zservice_variantsZcontract_variantsrYrUr(r(r)_get_valid_variantss z!UAEntitlement._get_valid_variantscCs|jr iS|S)zf Return a list of services that are considered a variant of the main service. )r:r`r1r(r(r)rHszUAEntitlement.variantscs$js iSfddDS)zw On a variant, return the other variants of the main service. On a non-variant, returns empty. cs i|]\}}|jkr||qSr()r3)rCr2clsr1r(r) s z0UAEntitlement.other_variants..)r:r`rIr1r(r1r)other_variantss   zUAEntitlement.other_variantscCsZ|jD]J}|jdkrq ||j|j|j|j|jd}|\}}|t j kr |Sq dS)z On an enabled service class, return the variant that is enabled. Return None if no variants exist or none are enabled (e.g. access-only) r\)r; assume_yes allow_beta called_name access_onlyN) rHvaluesr3r;rdre _called_namergapplication_statusrENABLED)r'rDrUstatus_r(r(r)enabled_variants    zUAEntitlement.enabled_variantcCsiSr&r(r1r(r(r) messagingszUAEntitlement.messaging)r;rdrerfrgpurge extra_argsr0cCsV|s t}||_||_||_||_||_|dk r:||_ng|_||_d|_ d|_ dS)z]Setup UAEntitlement instance @param config: Parsed configuration dictionary NF) r UAConfigr;rdrergrprqri_valid_service_is_sources_list_updated)r'r;rdrerfrgrprqr(r(r)r*szUAEntitlement.__init__cCs.|jdkr(|j p$|jp$t|jjd|_|jS)z2Check if the service is marked as valid (non-beta)Nzfeatures.allow_beta)rsis_betarer r;r1r(r(r) valid_service5s  zUAEntitlement.valid_servicecCst|jjj|jiSr&)copydeepcopyr;r<Z entitlementsr>r2r1r(r(r)rWAsz#UAEntitlement._base_entitlement_cfgcCs*|}|jr|s|Stj||jd|S)N) orig_accessrU)rWr:r apply_contract_overridesr3r'r=r(r(r)r=Fs zUAEntitlement.entitlement_cfgcCs&|r"td|jt|j|tj ksNdt t j t jj|jddfS|\}}|tjkrdt t jt jj|jddfS|jsdt t jfS|\}}|tjkrdt t j|dfS|jr|rdt t jfS|jr|sdt t jfS|j s"|j!r"dt t j"t j#j|jdfSdS)z Report whether or not enabling is possible for the entitlement. :return: (True, None) if can enable (False, CanEnableFailure) if can't enable z(Updating contract on service '%s' expiryFr7messager@)$is_access_expiredLOGdebugr2r Zrefreshr;contract_statusrENTITLEDrrZ NOT_ENTITLEDr UNENTITLEDrBr7rjrDISABLEDZALREADY_ENABLEDrvZIS_BETAapplicability_statusr INAPPLICABLErNdetect_incompatible_servicesINCOMPATIBLE_SERVICErPcheck_required_services_activeINACTIVE_REQUIRED_SERVICESsupports_access_onlyrgZACCESS_ONLY_NOT_SUPPORTEDZ ENABLE_ACCESS_ONLY_NOT_SUPPORTED)r'rjrmrdetailsr(r(r) can_enableSsh       zUAEntitlement.can_enable)silentr0c Cs|jdg}t|sdS|\}}|s|dkr8dS|jtjkrd|\}}|s||_ d|fSn4|jtj kr| \}}|s||_ d|fSnd|fS|jdg}t|sdS|j s| sdS|sdS|j|d}|sdS|jdg}t|sdSdS) aNEnable specific entitlement. @return: tuple of (success, optional reason) (True, None) on success. (False, reason) otherwise. reason is only non-None if it is a populated CanEnableFailure reason. This may expand to include other types of reasons in the future. Zpre_can_enableFNNFZ pre_enablerZ post_enabler@)ror>rhandle_message_operationsrreasonrrhandle_incompatible_servicesr~r_enable_required_servicesrghandle_required_snapshandle_required_packages_perform_enable) r'rmsg_opsrfailZ incompat_reterrorZreq_retretr(r(r)enablesH           zUAEntitlement.enablec Cs|jdidid}|dkr(dStsLttjjddt t sttjjddzt dWnFt j k r}z&tjd |d ttjjd d W5d}~XYnXttd |jjtj}td|jjtj}tj||tjd|rttjt|dddD]p}|d}zt|WnRt jk r|dd}|d}ttjj|dtj |||dYnXq"dS)z. "install snaps necessary to enable a service.r$ directivesZ requiredSnapsNTZsnapdZpackagesz snapd snapz!Failed to install snapd as a snap)exc_infozsnap install snapd)ZcommandrZhttps) http_proxy https_proxyZ retry_sleepscSs |dS)Nr2r>)xr(r(r)z5UAEntitlement.handle_required_snaps..)keyr2ZclassicConfinementSupportFchannel)r)rclassic_confinement_support) r=r>rZis_snapd_installedeventinforINSTALLING_PACKAGESrBZ install_snapdZis_snapd_installed_as_a_snapZ install_snaprZProcessExecutionErrorrwarningZEXECUTING_COMMAND_FAILEDZrun_snapd_wait_cmdrZvalidate_proxyr;rZPROXY_VALIDATION_SNAP_HTTP_URLrZPROXY_VALIDATION_SNAP_HTTPS_URLZconfigure_snap_proxyZSNAP_INSTALL_RETRIESZINSTALLING_REQUIRED_SNAPSr^Z get_snap_infoZSnapNotInstalledErrorZ INSTALLING_REQUIRED_SNAP_PACKAGE) r'Zrequired_snapserrZsnap_pkgZ snap_namerrr(r(r)rs   z#UAEntitlement.handle_required_snapscCsn|jdidid}|s$dS|dd|D}td|ttjj d |d t |dS) /install packages necessary to enable a service.r$rrequiredPackagesTcSsg|] }|dqSr2r(rCpackager(r(r)rE8sz:UAEntitlement.handle_required_packages..zInstalling packages %r r) r=r>_update_sources_listrrrrrrrBrJr Zrun_apt_install_command)r'required_packages package_namesr(r(r)r)s&  z&UAEntitlement.handle_required_packagescCsv|jdidid}|s$dSdd|D}td|d|}ttjj |d t |tj j |d dS) rr$rrTcSs g|]}|ddr|dqS)ZremoveOnDisableFr2rrr(r(r)rEPs zCUAEntitlement.handle_removing_required_packages..zUninstalling packages %rrr) r=r>rrrJrrrZUNINSTALLING_PACKAGESrBr Zremove_packagesZUNINSTALLING_PACKAGES_FAILED)r'rrZpackage_names_strr(r(r)!handle_removing_required_packagesCs0   z/UAEntitlement.handle_removing_required_packagescCsdS)a Enable specific entitlement. This should be implemented by subclasses. This method does the actual enablement, and does not check can_enable or handle pre_enable or post_enable messaging. @return: True on success, False otherwise. Nr(r'rr(r(r)rcs zUAEntitlement._perform_enablecCs2|jD]&}||j\}}|tjkrdSqdS)z Check for depedent services. :return: True if there are dependent services enabled False if there are no dependent services enabled TF)rRr;rjrrk)r'dependent_service_cls ent_statusrmr(r(r)detect_dependent_servicesns   z'UAEntitlement.detect_dependent_servicescCs2|jD]&}||j\}}|tjkrdSqdS)z Check if all required services are active :return: True if all required services are active False is at least one of the required services is disabled FT)rPr;rjrrk)r'required_service_clsrrmr(r(r)rs   z,UAEntitlement.check_required_services_activecCs<g}|jD],}||j\}}|tjkr ||q |S)zI :return: List of incompatible services that are enabled )rNr$r;rjrrkr5)r'rservicerrmr(r(r)blocking_incompatible_servicess    z,UAEntitlement.blocking_incompatible_servicescCst|dkS)z Check for incompatible services. :return: True if there are incompatible services enabled False if there are no incompatible services enabled r)r_rr1r(r(r)rsz*UAEntitlement.detect_incompatible_servicescCstj|jjdd}|D]}|j|jdd}tjj|j|jd}tj j|j|jd}|rfd|fStj ||j dsd|fSt tjj|jd|jdd }|s|d fSqd S) a) Prompt user when incompatible services are found during enable. When enabling a service, we may find that there is an incompatible service already enable. In that situation, we can ask the user if the incompatible service should be disabled before proceeding. There are also different ways to configure that behavior: We can disable removing incompatible service during enable by adding the following lines into uaclient.conf: features: block_disable_on_enable: true z features.block_disable_on_enable)r Z path_to_valueT)rd)service_being_enabledZincompatible_serviceFmsgrdrrNr@)rr r;rr$rrrBr7Z!INCOMPATIBLE_SERVICE_STOPS_ENABLEprompt_for_confirmationrdrrZDISABLING_INCOMPATIBLE_SERVICEdisable)r'Zcfg_block_disable_on_enablerentuser_msge_msgrr(r(r)rs<    z*UAEntitlement.handle_incompatible_servicesc Cs|jD]}||jdd}|dtjk}|rtjj|j|jd}tj j|j|jd}t j ||j dsrd|fSt tjj|jd|jdd\}}|sd }|r|jr|jjrd |jj}tjj||jd } || fSqd S) a, Prompt user when required services are found during enable. When enabling a service, we may find that there are required services that must be enabled first. In that situation, we can ask the user if the required service should be enabled before proceeding. T)rer)rrequired_servicerFrrr/rF)rrr@)rPr;rjrrrZREQUIRED_SERVICErBr7ZREQUIRED_SERVICE_STOPS_ENABLErrrdrrZENABLING_REQUIRED_SERVICErr~rZERROR_ENABLING_REQUIRED_SERVICE) r'rrZis_service_disabledrrrr error_msgrr(r(r)rsD   z'UAEntitlement._enable_required_services)ignore_dependent_servicesr0cCs|\}}|tjkr4dttjtjj|jddfS|j rT|sT| rTdttj fS|j s||j r|dttjtjj|jdfSdS)zReport whether or not disabling is possible for the entitlement. :return: (True, None) if can disable (False, CanDisableFailure) if can't disable Fr|r}r@)rjrrrrZALREADY_DISABLEDrrBr7rRrACTIVE_DEPENDENT_SERVICESsupports_purgerpZPURGE_NOT_SUPPORTEDZDISABLE_PURGE_NOT_SUPPORTED)r'rrjrmr(r(r) can_disable s2     zUAEntitlement.can_disablecCs|jdg}t|sdS|\}}|sp|dkr8dS|jtjkrh|j|d\}}|sp||_ d|fSnd|fS|j |dsdS| sdS|jdg}t|sdS|j d|dd S) aDisable specific entitlement @param silent: Boolean set True to silence print/log of messages @return: tuple of (success, optional reason) (True, None) on success. (False, reason) otherwise. reason is only non-None if it is a populated CanDisableFailure reason. This may expand to include other types of reasons in the future. Z pre_disablerNrFZ post_disablezdisable operation) operationrr@) ror>rrrrrr_disable_dependent_servicesr~_perform_disabler_check_for_reboot_msg)r'rrrrrrr(r(r)r7s8      zUAEntitlement.disablecCsdS)a\ Disable specific entitlement. This should be implemented by subclasses. This method does the actual disable, and does not check can_disable or handle pre_disable or post_disable messaging. @param silent: Boolean set True to silence print/log of messages @return: True on success, False otherwise. Nr(rr(r(r)rhs zUAEntitlement._perform_disablec Cs|jD]}||jdd}|dtjk}|rtjj|j|jd}tj j|j|jd}t j ||j dsrd|fS|st tjj|jd|jdd \}}|sd } |r|jr|jjrd |jj} tjj| |jd } d| fSqd S)ay Disable dependent services When performing a disable operation, we might have other services that depend on the original services. If that is true, we will alert the user about this and prompt for confirmation to disable these services as well. @param silent: Boolean set True to silence print/log of messages T)r;rdr)dependent_serviceservice_being_disabled)rrrF)rrr/rF)rrr@)rRr;rjrrkrZDEPENDENT_SERVICErBr7ZDEPENDENT_SERVICE_STOPS_DISABLErrrdrrZDISABLING_DEPENDENT_SERVICErr~rZ"FAILED_DISABLING_DEPENDENT_SERVICE) r'rrrZis_service_enabledrrrrrrr(r(r)rusF   z)UAEntitlement._disable_dependent_servicescCstS)z%Check if system needs to be rebooted.)rZ should_rebootr1r(r(r)_check_for_rebootszUAEntitlement._check_for_reboot)rrr0cCs$|r |s ttjj|ddS)zCheck if user should be alerted that a reboot must be performed. @param operation: The operation being executed. @param silent: Boolean set True to silence print/log of messages )rN)rrrrZENABLE_REBOOT_REQUIRED_TMPLrB)r'rrr(r(r)rs  z#UAEntitlement._check_for_reboot_msgcCsB|j}|stjtjfS|jD]"\}}}||krtj|fSq|ddi}|dd}|jr|dk rt |krt |}tjtj j|jt d|dfS|dd}|jr|dk rt j|krtjtjj|jt jdfSt } |d d} |d d} |jrJ| dk rJ| j| krJtjtjj|j| jd| d fS|jr| r| jdk r| jdk rtjj|j| j| d } z"| d \} }t | }t |}Wn,t!k rt"#d| tj| fYSX| j|krtj| fS| j|kr| j|krtj| fS|di}|$|\}}|s8tj|fStjdfS)aCheck all contract affordances to vet current platform Affordances are a list of support constraints for the entitlement. Examples include a list of supported series, architectures for kernel revisions. :return: tuple of (ApplicabilityStatus, NamedMessage). APPLICABLE if platform passes all defined affordances, INAPPLICABLE if it doesn't meet all of the provided constraints. r$r9Z architecturesNz, )r7ZarchZsupported_archesseries)r7rZ kernelFlavorsZminKernelVersion)r7kernelZsupported_kernels)r7rZ min_kernel.z$Could not parse minKernelVersion: %sZplatformChecks)%r=r APPLICABLErZ"NO_ENTITLEMENT_AFFORDANCES_CHECKEDrLrr>affordance_check_archrZ get_dpkg_archrZdeduplicate_archesZINAPPLICABLE_ARCHrBr7rJaffordance_check_seriesZget_release_inforZINAPPLICABLE_SERIESZpretty_versionZget_kernel_infoaffordance_check_kernel_flavorZflavorZINAPPLICABLE_KERNELZ uname_release#affordance_check_kernel_min_versionmajorminorZINAPPLICABLE_KERNEL_VERsplitint ValueErrorrrrA)r'r=Z error_messageZfunctorZexpected_resultr9Zaffordance_archesZdeduplicated_archesZaffordance_seriesZ kernel_infoZaffordance_kernelsZaffordance_min_kernelZ invalid_msgZ kernel_majorZ kernel_minorZmin_kern_majorZmin_kern_minorZaffordances_platform_checkrrr(r(r)rs                z"UAEntitlement.applicability_statuscCs6t|jjstjS|j}|r0|ddr0tjStjS)z=Return whether the user is entitled to the entitlement or notr$entitled)rr;Z is_attachedrrr=r>rr{r(r(r)r*s  zUAEntitlement.contract_statuscCs|\}}|tjkr tj|fS|j}|s@tjtjj |j dfS|d dddkrjtjtjj |j dfS| \}}|t jkrtj|fS|\}}|rtj|fStj|fS)z4Return (user-facing status, details) for entitlementr|r$rF)rrrrrr=Z UNAVAILABLErZSERVICE_NOT_ENTITLEDrBr7r>rjrrZINACTIVEenabled_warning_statusZWARNINGZACTIVE)r'Z applicabilityrr=rjZ explanationrZwarn_msgr(r(r)user_facing_status3s&        z UAEntitlement.user_facing_statuscCsdS)z The current status of application of this entitlement :return: A tuple of (ApplicationStatus, human-friendly reason) Nr(r1r(r(r)rjRs z UAEntitlement.application_statuscCsdS)z If the entitlment is enabled, are there any warnings? The message is displayed as a Warning Notice in status output :return: A tuple of (warning bool, human-friendly reason) rr(r1r(r(r)r^s z$UAEntitlement.enabled_warning_statuscCsdSr&r(r1r(r(r)status_description_overridejsz)UAEntitlement.status_description_overridecCs4|jd}|sdSt|d}|tkr0dSdS)zrstrptimeZutcnow)r'Z expire_strZexpiryr(r(r)ros   zUAEntitlement.is_access_expiredcCsl|jd}|dkrtjS|dg}|D]:}|d|jkr*|d}|dkrZtjStjSq*tjS)z6Check on the state of application on the status cache. status-cacheNservicesr2rlenabled)r; read_cacherrr>r2rk)r' status_cacheZservices_status_listrZservice_statusr(r(r)"_check_application_status_on_cachezs     z0UAEntitlement._check_application_status_on_cache) obligations resourceTokenr0cCst|do|S)NZenableByDefault)boolr>)r'rrr(r(r)_should_enable_by_defaultsz'UAEntitlement._should_enable_by_default)rydeltas allow_enabler0cCs|sdS|di}|di}|jd}t|tjk}|sr|rTt||d}|rrd|krr|ddtjfk}|r|r|r|}n | \}} |t j kr| rt d|d|j} ttjj|jd n t d ttjj|jd |jd |jdS|d } | s0|d } |d i} || | } | rTd|_|\}} |r| r|rtjj|jd} tj| tjd|n tjj|jd} tj| tjddSdS)auProcess any contract access deltas for this entitlement. :param orig_access: Dictionary containing the original resourceEntitlement access details. :param deltas: Dictionary which contains only the changed access keys and values. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :return: True when delta operations are processed; False when noop. :raise: UbuntuProError when auto-enable fails unexpectedly. Tr$rrrFz3Disabling %s after refresh transition to unentitledz.Due to contract refresh, '{}' is now disabled.rz8Cannot disable %s after refresh transition to unentitledzmachine-access-{}rrr)Z file_type) r>r;rrrZ DROPPED_KEYr rzrrjrrrrrrrBr2rrZDISABLE_DURING_CONTRACT_REFRESHrZ)UNABLE_TO_DISABLE_DURING_CONTRACT_REFRESHZdelete_cache_keyrrerZENABLE_BY_DEFAULT_TMPLsysstderrrZENABLE_BY_DEFAULT_MANUAL_TMPL)r'ryrrZdelta_entitlementZdelta_directivesrZtransition_to_unentitledrjrmrrZdelta_obligationsZenable_by_defaultrr(r(r)process_contract_deltass              z%UAEntitlement.process_contract_deltascCs2|jr dSttjjddtdd|_dS)Nzstandard Ubunturz/etc/apt/sources.listT)rtrrrZAPT_UPDATING_LISTrBr Zupdate_sources_listr1r(r(r)rs  z"UAEntitlement._update_sources_list)NFFr/FFN)F)F)F)F)F)F)F)_r+r,r-Z help_doc_urlrdrurrrGrMrOrQrrrrr:propertyabcabstractmethodstrr2r3rr6r7r8r4rrrrrrr.rArKrrLr!rNr rPrRrSrr[r`rHrcrnrror rrr*rvrWr=rrr rrrrrrrrrrrrrrrrrrrrrrrrrrjrrrrrrrr(r(r(r)r"0s           O AH     8 4 + 1  9  i           cr") metaclass)2rrwZloggingrrtypingrrrrrrr r Zuaclientr r r rrrrrrrZ(uaclient.api.u.pro.status.is_attached.v1rZ(uaclient.entitlements.entitlement_statusrrrrrrrrZuaclient.typesrrZ uaclient.utilr Zget_event_loggerrZ getLoggerZreplace_top_level_logger_namer+rr!ABCMetar"r(r(r(r)s (0 (