o Ki@s"ddlZddlZddlZddlZddlmZddlmZmZmZm Z m Z m Z m Z m Z ddlmZmZmZmZmZmZmZmZmZmZmZddlmZddlmZmZmZm Z m!Z!m"Z"m#Z#m$Z$ddl%m&Z&ddl'm(Z(dd l)m*Z*m+Z+e,Z-e.e/e0Z1Gd d d Z2Gd d d ej3dZ4dS)N)datetime)AnyDictListOptionalSetTupleTypeUnion) apiaptconfigcontract event_logger exceptionshttpmessagessnapsystemutil) _is_attached)ApplicabilityStatusApplicationStatusCanDisableFailureCanDisableFailureReasonCanEnableFailureCanEnableFailureReasonContractStatusUserFacingStatus) machine_token)status_cache_file)MessagingOperationsDictStaticAffordancec@s$eZdZdeddejfddZdS)EntitlementWithMessage entitlement UAEntitlement named_msgcCs||_||_dSN)r$r&)selfr$r&r)d?Zdeeee?ffdDdEZ@dFeAjBdeeeCde?fffdGdHZDdFeAjBdefdIdJZEdefdKdLZFdFeAjBdefdMdNZGdefdOdPZHejdFeAjBdefdQdRZIdee%fdSdTZJdefdUdVZKdFeAjBdeeeej ffdWdXZLdYdZZMd[d\ZNdFeAjBdeeeej ffd]d^ZO dd_edeeeePffd`daZQdFeAjBdeeeePffdbdcZRejdFeAjBdefdddeZSdefdfdgZTdee(dfdhdiZUdFeAjBdeeeej ffdjdkZVdefdldmZW ddnedoeddfdpdqZXdeeYeej ffdrdsZZde[fdtduZ\dee]eej ffdvdwZ^ejdee_eej ffdxdyZ`deeeej ffdzd{Zadeefd|d}Zbdefd~dZcde_fddZddeeefdeedefddZe  ddeeefdeeefdededef ddZfdFeAjBfddZgdS)r%NFr)TreturncCdS)z?The lowercase name of this entitlement, in case it is a variantr0r)r(r)r)r* variant_nameSzUAEntitlement.variant_namecCs$|jg}|j|jkr||j|S)z1The list of names this entitlement may be called.)namepresentation_nameappend)r( valid_namesr)r)r*r9Xs  zUAEntitlement.valid_namescCr2)z,The human readable title of this entitlementNr)r3r)r)r*title`zUAEntitlement.titlecCr2)z&A sentence describing this entitlementNr)r3r)r)r* descriptionfr;zUAEntitlement.descriptioncCs:|jr|jS|jjr|jdidid|jS|jS)z/The user-facing name shown for this entitlementr$ affordances presentedAs) is_variantr4machine_token_file is_presententitlement_cfggetr6r3r)r)r*r7ls  zUAEntitlement.presentation_nameplatform_checkcCr2)zVerify specific platform checks for a service. This should only be used if the service requires custom platform checks to check if it is available or not in the machine. TNr))r(rDr)r)r*verify_platform_checkszsz$UAEntitlement.verify_platform_checkscCsF|j}|jr!dd|jD}ddtjdg|}||7}|S)z$Help information for the entitlementcSsg|] \}}d||jqS)z * {}: {})formatr<).0r4 variant_clsr)r)r* s z+UAEntitlement.help_info.. z ) help_textvariantsitemsjoinrCLI_HELP_VARIANTS_HEADER)r(rL variant_items variant_textr)r)r* help_infoszUAEntitlement.help_info.cCr2)Nr)r)r3r)r)r*static_affordancesz UAEntitlement.static_affordancescC|jS)a  Return a list of packages that aren't compatible with the entitlement. When we are enabling the entitlement we can directly ask the user if those entitlements can be disabled before proceding. Overridden in livepatch and fips )_incompatible_servicesr3r)r)r*incompatible_servicesz#UAEntitlement.incompatible_servicescCrV)a Return a list of packages that must be active before enabling this service. When we are enabling the entitlement we can directly ask the user if those entitlements can be enabled before proceding. Overridden in ros and ros-updates. )_required_servicesr3r)r)r*required_servicesrYzUAEntitlement.required_servicescCrV)a Return a list of packages that depend on this service. We will use that list during disable operations, where a disable operation will also disable all of the services required by the original service Overriden in esm-apps and esm-infra )_dependent_servicesr3r)r)r*dependent_servicess z UAEntitlement.dependent_servicescCiSr'r)r3r)r)r* _get_variantsszUAEntitlement._get_variantscCsPt}|}|didg}|D]}|did}|r%||q|S)zV Fetch all available variants defined in the Contract Server response r$ overridesselectorvariant)set_base_entitlement_cfgrCadd)r(valid_variantsrBr`overriderbr)r)r*_get_contract_variantss z$UAEntitlement._get_contract_variantscCs`|}|}d|vrd|di}ni}t|D] }||vr%||||<qt|dkr.|SiS)Ngeneric)r_rhsortedlen)r(service_variantscontract_variantsrfrbr)r)r*_get_valid_variantss  z!UAEntitlement._get_valid_variantscCs|jriS|S)zf Return a list of services that are considered a variant of the main service. )r?ror3r)r)r*rMszUAEntitlement.variantscs$jsiSfddDS)zw On a variant, return the other variants of the main service. On a non-variant, returns empty. cs i|] \}}|jkr||qSr))r4)rHr6clsr3r)r* s  z0UAEntitlement.other_variants..)r?rorNr3r)r3r*other_variantss   zUAEntitlement.other_variantscCsR|jD]!}|jdkr q||j|j|jd}|\}}|tjkr&|SqdS)z On an enabled service class, return the variant that is enabled. Return None if no variants exist or none are enabled (e.g. access-only) ri)cfg called_name access_onlyN) rMvaluesr4rs _called_nameruapplication_statusrENABLED)r(rIrbstatus_r)r)r*enabled_variants   zUAEntitlement.enabled_variantcCr2)zt Only implemented on variant classes. Returns True if this variant should be auto-selected. Fr)r3r)r)r*variant_auto_select sz!UAEntitlement.variant_auto_selectcCst|j}|r |dSdS)z Cannot actually set the return type because https://github.com/python/typing/issues/266 affects xenial. :rtype: Optional[Type["UAEntitlement"]] rN)listrMrv)r(rMr)r)r*default_variants zUAEntitlement.default_variantcCr^r'r)r3r)r)r* messaging rUzUAEntitlement.messagingrsrtrupurge extra_argscCsT|st}||_t|_||_||_|dur||_ng|_||_ d|_ d|_ dS)z]Setup UAEntitlement instance @param config: Parsed configuration dictionary NF) r UAConfigrsrget_machine_token_filer@rurrrw_valid_service_is_sources_list_updated)r(rsrtrurrr)r)r*r+$s   zUAEntitlement.__init__cCst|j|jiSr')copydeepcopyr@ entitlementsrCr6r3r)r)r*rd>sz#UAEntitlement._base_entitlement_cfgcCs*|}|jr |s |Stj||jd|S)N) orig_accessrb)rdr?rapply_contract_overridesr4r(rBr)r)r*rBCs zUAEntitlement.entitlement_cfgcCr2)z The number of steps that are reported as progress while enabling this specific entitlement that are not shared with other entitlements. Nr)r3r)r)r* enable_stepsPzUAEntitlement.enable_stepscCr2)z The number of steps that are reported as progress while disabling this specific entitlement that are not shared with other entitlements. Nr)r3r)r)r* disable_stepsXrzUAEntitlement.disable_stepscCs|}|jdidid}|dur t|dkr |d7}|jdidid}|durEs z5UAEntitlement.handle_required_snaps..)keyr6classicConfinementSupportFchannel)r)rclassic_confinement_support)#rBrCris_snapd_installedrrINSTALLING_PACKAGESrG install_snapdis_snapd_installed_as_a_snap install_snaprProcessExecutionErrorrwarningEXECUTING_COMMAND_FAILEDrun_snapd_wait_cmd refresh_snapeventrrvalidate_proxyrsrPROXY_VALIDATION_SNAP_HTTP_URLrPROXY_VALIDATION_SNAP_HTTPS_URLconfigure_snap_proxySNAP_INSTALL_RETRIESrINSTALLING_REQUIRED_SNAPSrk get_snap_infoSnapNotInstalledError INSTALLING_REQUIRED_SNAP_PACKAGE) r(rrerrsnap_pkg snap_namerrr)r)r*rs        z#UAEntitlement.handle_required_snapscsP|jdidid}|sdSdd|D}ttfdd|DS)/install packages necessary to enable a service.r$rrTcSg|]}|dqSr6r)rHpackager)r)r*rJkzAUAEntitlement.are_required_packages_installed..csg|]}|vqSr)r))rHrequiredinstalled_packagesr)r*rJor)rBrCr get_installed_packages_namesall)r(r package_namesr)rr*are_required_packages_installed^s z-UAEntitlement.are_required_packages_installedcCsp|jdidid}|sdS||dd|D}td||tjjd |d t |dS) rr$rrTcSrrr)rr)r)r*rJrz:UAEntitlement.handle_required_packages..zInstalling packages %r r) rBrC_update_sources_listrrrrrrGrOr run_apt_install_command)r(rrrr)r)r*rrs    z&UAEntitlement.handle_required_packagescCs|jdidid}|sdSdd|D}t|dkr!dStd|d |}ttj j |d t |tj j |d dS) rr$rrTcSs g|] }|ddr|dqS)removeOnDisableFr6rrr)r)r*rJs  zCUAEntitlement.handle_removing_required_packages..rzUninstalling packages %rrr)rBrCrlrrrOrrrUNINSTALLING_PACKAGESrGr remove_packagesUNINSTALLING_PACKAGES_FAILED)r(rrpackage_names_strr)r)r*!handle_removing_required_packagess.     z/UAEntitlement.handle_removing_required_packagescCr2)a Enable specific entitlement. This should be implemented by subclasses. This method does the actual enablement, and does not check can_enable or handle pre_enable or post_enable messaging. @return: True on success, False otherwise. Nr)r(rr)r)r*rs zUAEntitlement._perform_enablecCsDg}|jD]}|j|jd\}}|tjtjfvr||q|S)zI :return: List of incompatible services that are enabled rs)rXr$rsrxrryWARNINGr8r(rservice ent_statusr{r)r)r*rs  z,UAEntitlement.blocking_incompatible_servicescCt|dkS)z Check for incompatible services. :return: True if there are incompatible services enabled False if there are no incompatible services enabled r)rlrr3r)r)r*rz*UAEntitlement.detect_incompatible_servicescCstj|jjdd}|D]=}||j}tjj|j|jd}|r'd|fS| dtj j|jd| |\}}|sJ||rE|j fSdfSq dS) a) Prompt user when incompatible services are found during enable. When enabling a service, we may find that there is an incompatible service already enable. In that situation, we can ask the user if the incompatible service should be disabled before proceeding. There are also different ways to configure that behavior: We can disable removing incompatible service during enable by adding the following lines into uaclient.conf: features: block_disable_on_enable: true z features.block_disable_on_enable)r path_to_value)service_being_enabledrFrr NrE) ris_config_value_truersrr$r#E_INCOMPATIBLE_SERVICE_STOPS_ENABLErGr:rDISABLING_INCOMPATIBLE_SERVICEdisabler)r(rcfg_block_disable_on_enabler ente_msgrrr)r)r*rs.   z*UAEntitlement.handle_incompatible_servicescCst|dkS)z Check if all required services are active :return: True if all required services are active False is at least one of the required services is disabled r)rlrr3r)r)r*rr z,UAEntitlement.check_required_services_activecCsBg}|jD]}||j\}}|tjtjfvr||q|S)zF :return: List of required services that are disabled )r[r$rsrxrryrr8r r)r)r*rs  z(UAEntitlement.blocking_required_servicescCs|D]>}|j|jd}|dtjj|jd||\}}|sBd}|r3|j r3|j j r3d|j j }tj j||jd}||fSqdS)a, Prompt user when required services are found during enable. When enabling a service, we may find that there are required services that must be enabled first. In that situation, we can ask the user if the required service should be enabled before proceeding. rrrr0rK)rr rE) rr$rsrrENABLING_REQUIRED_SERVICErGr:rrmsgERROR_ENABLING_REQUIRED_SERVICE)r(rrrrr error_msgrr)r)r*rs&    z'UAEntitlement._enable_required_servicesignore_dependent_servicescCs|\}}|tjkrdttjtjj|jddfS| \}}|j r(|t j kr7dttj tjj|jddfS|jrG|sG|rGdttjfS|js[|jr[dttjtjj|jdfSdS)zReport whether or not disabling is possible for the entitlement. :return: (True, None) if can disable (False, CanDisableFailure) if can't disable FrrrE)rxrrrrALREADY_DISABLEDrrGr:rrBrrNOT_APPLICABLECANNOT_DISABLE_NOT_APPLICABLEr]detect_dependent_servicesACTIVE_DEPENDENT_SERVICESsupports_purgerPURGE_NOT_SUPPORTEDDISABLE_PURGE_NOT_SUPPORTED)r(rrxr{rr)r)r* can_disable=sJ      zUAEntitlement.can_disablecCs|d|jd|\}}|s3|durdS|jtjkr/||\}}|s.||_d|fSnd|fS| |s:dS| s@dS|d|jddS)aDisable specific entitlement @param silent: Boolean set True to silence print/log of messages @return: tuple of (success, optional reason) (True, None) on success. (False, reason) otherwise. reason is only non-None if it is a populated CanDisableFailure reason. This may expand to include other types of reasons in the future. r pre_disableNrF post_disablerE) rrrCr%rrr!_disable_dependent_servicesr_perform_disabler)r(rr%rrrr)r)r*r|s(  zUAEntitlement.disablecCr2)a\ Disable specific entitlement. This should be implemented by subclasses. This method does the actual disable, and does not check can_disable or handle pre_disable or post_disable messaging. @param silent: Boolean set True to silence print/log of messages @return: True on success, False otherwise. Nr)rr)r)r*r)s zUAEntitlement._perform_disablecCr )z Check for depedent services. :return: True if there are dependent services enabled False if there are no dependent services enabled r)rlrr3r)r)r*r r z'UAEntitlement.detect_dependent_servicescCs:g}|jD]}||j\}}|tjkr||q|S)zo Return list of depedent services that must be disabled before disabling this service. )r]rsrxrryr8)r(blockingdependent_service_clsr r{r)r)r*rs   z)UAEntitlement.blocking_dependent_servicescCs|D]=}||jd}|dtjj|jd||\}}|sAd}|r2|jr2|jj r2d|jj }tj j||jd}d|fSqdS) ay Disable dependent services When performing a disable operation, we might have other services that depend on the original services. If that is true, we will alert the user about this and prompt for confirmation to disable these services as well. @param silent: Boolean set True to silence print/log of messages rr)rr0rK)rrFrE) rrsrrDISABLING_DEPENDENT_SERVICErGr:rrr"FAILED_DISABLING_DEPENDENT_SERVICE)r(rr+rrrrrr)r)r*r(s&     z)UAEntitlement._disable_dependent_servicescCr2)z=Check if system needs to be rebooted because of this service.Fr)r3r)r)r*_check_for_rebootrUzUAEntitlement._check_for_reboot operationsilentcCs,|r|sttjj|ddSdSdS)zCheck if user should be alerted that a reboot must be performed. @param operation: The operation being executed. @param silent: Boolean set True to silence print/log of messages )r/N)r.rrrENABLE_REBOOT_REQUIRED_TMPLrG)r(r/r0r)r)r*_check_for_reboot_msgs z#UAEntitlement._check_for_reboot_msgcCs*|j}|s tjtjfS|jD]\}}}||krtj|fSq|ddi}|dd}|jrR|durRt |vrRt |}tjtj j|jt d|dfS|dd}|jru|durut j|vrutjtjj|jt jdfSt } |d d} |d d} |jr| dur| j| vrtjtjj|j| jd| d fS|jr| r| jdur| jdurtjj|j| j| d } z| d \} }t | }t |}Wnt!yt"#d| tj| fYSw| j|krtj| fS| j|kr| j|krtj| fS|di}|$|\}}|stj|fStjdfS)aCheck all contract affordances to vet current platform Affordances are a list of support constraints for the entitlement. Examples include a list of supported series, architectures for kernel revisions. :return: tuple of (ApplicabilityStatus, NamedMessage). APPLICABLE if platform passes all defined affordances, INAPPLICABLE if it doesn't meet all of the provided constraints. r$r= architecturesNz, )r:archsupported_archesseries)r:r6 kernelFlavorsminKernelVersion)r:kernelsupported_kernels)r:r9 min_kernel.z$Could not parse minKernelVersion: %splatformChecks)%rBr APPLICABLEr"NO_ENTITLEMENT_AFFORDANCES_CHECKEDrTrrCaffordance_check_archr get_dpkg_archrdeduplicate_archesINAPPLICABLE_ARCHrGr:rOaffordance_check_seriesget_release_infor6INAPPLICABLE_SERIESpretty_versionget_kernel_infoaffordance_check_kernel_flavorflavorINAPPLICABLE_KERNEL uname_release#affordance_check_kernel_min_versionmajorminorINAPPLICABLE_KERNEL_VERsplitint ValueErrorrrrF)r(rB error_messagefunctorexpected_resultr=affordance_archesdeduplicated_archesaffordance_series kernel_infoaffordance_kernelsaffordance_min_kernel invalid_msg kernel_major kernel_minormin_kern_majormin_kern_minoraffordances_platform_checkrrr)r)r*rs                     z"UAEntitlement.applicability_statuscCs6t|jjs tjS|j}|r|ddrtjStjS)z=Return whether the user is entitled to the entitlement or notr$entitled)rrs is_attachedrrrBrCrrr)r)r*rms zUAEntitlement.contract_statuscCs|\}}|tjkrtj|fS|j}|s tjtjj |j dfS|d dddur5tjtjj |j dfS| \}}|t jkrEtj|fS|t jkrOtj|fS|\}}|r\tj|fStj|fS)z4Return (user-facing status, details) for entitlementrr$rcF)rrr>rrrB UNAVAILABLErSERVICE_NOT_ENTITLEDrGr:rCrxrrINACTIVErenabled_warning_statusACTIVE)r( applicabilityrrBrx explanationrwarn_msgr)r)r*user_facing_statusvs*           z UAEntitlement.user_facing_statuscCr2)z The current status of application of this entitlement :return: A tuple of (ApplicationStatus, human-friendly reason) Nr)r3r)r)r*rx z UAEntitlement.application_statuscCr2)z If the entitlment is enabled, are there any warnings? The message is displayed as a Warning Notice in status output :return: A tuple of (warning bool, human-friendly reason) rr)r3r)r)r*rhrnz$UAEntitlement.enabled_warning_statuscCsdSr'r)r3r)r)r*status_description_overrider5z)UAEntitlement.status_description_overridecCs4|jd}|s dSt|d}|tkrdSdS)zs  (4 (