Ke2@sddlZddlmZmZmZmZddlmZmZm Z m Z m Z m Z m Z mZddlmZmZddlmZddlmZddgZd d d d iZejZejejeZGd ddeZddZdS)N)AnyDictOptionalTuple) event_logger exceptionshttp livepatchmessagessnapsystemutil)IncompatibleService UAEntitlement)ApplicationStatus)StaticAffordanceg?g?zUnknown Auth-Tokenz)Invalid Auth-Token provided to livepatch.zunsupported kernelz2Your running kernel is not supported by Livepatch.c s}eZdZejjZdZejZ ej Z ej Z dZdZdZdZeeedfdddZeeedfddd Zdeed d d Zddeeed ddZdddZeeeejfdddZeeeejfdddZ ddZ!de"e#e$fe"e#e$feedfddZ%S)LivepatchEntitlementr FT.)returncCsBddlm}ddlm}t|tjt|tjfS)Nr)FIPSEntitlement)RealtimeKernelEntitlement)uaclient.entitlements.fipsrZuaclient.entitlements.realtimerrr ZLIVEPATCH_INVALIDATES_FIPSZREALTIME_LIVEPATCH_INCOMPATIBLE)selfrrrA/usr/lib/python3/dist-packages/uaclient/entitlements/livepatch.pyincompatible_services+s z*LivepatchEntitlement.incompatible_servicescsddlm}||j}t|jdtjktjj d|j dddftj fdddffS)Nr)rtitlecSs tjS)N)r is_containerrrrrJsz9LivepatchEntitlement.static_affordances..FcsS)Nrr)is_fips_enabledrrrOs) rrcfgboolapplication_statusrENABLEDr Z"SERVICE_ERROR_INSTALL_ON_CONTAINERformatrZ!LIVEPATCH_ERROR_WHEN_FIPS_ENABLED)rrZfips_entr)rrstatic_affordances:s   z'LivepatchEntitlement.static_affordances)silentrc!Cstjs2tjtjjddtjtjstjtjjddytj dWnWt j k r}z4t j dd|tjtjjddWYdd}~XnXtjtjd |jjtj}tjd |jjtj}tjd |d |d tjtjstjtjjddytj dWn@t j k r}zt jdt|WYdd}~XnXtj|||jddddS)zYEnable specific entitlement. @return: True on success, False otherwise. ZpackagesZsnapdz snapd snapz!Failed to install snapd as a snapexc_infoZcommandzsnap install snapdNrZhttps http_proxy https_proxyZ retry_sleepszcanonical-livepatch snapzcanonical-livepatch error_msgprocess_directivesT process_token)r Zis_snapd_installedeventinfor ZINSTALLING_PACKAGESr#Z install_snapdZis_snapd_installed_as_a_snapZ install_snaprProcessExecutionErrorLOGZwarningZEXECUTING_COMMAND_FAILEDZrun_snapd_wait_cmdrZvalidate_proxyrr'ZPROXY_VALIDATION_SNAP_HTTP_URLr(ZPROXY_VALIDATION_SNAP_HTTPS_URLZconfigure_snap_proxyZSNAP_INSTALL_RETRIESr is_livepatch_installedZErrorInstallingLivepatchstrZconfigure_livepatch_proxysetup_livepatch_config)rr%er'r(rrr_perform_enableTsB          + z$LivepatchEntitlement._perform_enable)r*r+rc .CsX|jjjj|j}|ryt|Wngtjk r}zDtj t |d|t j t jjdt |dSWYdd}~XnX|rT|jd}|stjd|j|jjd}|j\}}|tjkrwtj dt j t jytjtjd gWnEtjk rv}z"tj t |d|dSWYdd}~XnXy#tjtjd |gd d Wntjk r7}zxt j}x7tjD])\} } | t |kr|| 7}PqW|t jkr|t |7}t j |dSWYdd}~XnXt j t jjd dd S)aProcesss configuration setup for livepatch directives. :param process_directives: Boolean set True when directives should be processsed. :param process_token: Boolean set True when token should be processsed. r&r)FN resourceTokenzHNo specific resourceToken present. Using machine token as %s credentialsZ machineTokenz&Disabling livepatch before re-enablingdisableenablecaptureTrzCanonical Livepatch)rZmachine_token_fileZ entitlementsgetnameprocess_config_directivesrr.r/errorr1r,r-r ZLIVEPATCH_UNABLE_TO_CONFIGUREr#debugrZ machine_tokenr!rDISABLEDZLIVEPATCH_DISABLE_REATTACHr subpr LIVEPATCH_CMDZLIVEPATCH_UNABLE_TO_ENABLE ERROR_MSG_MAPitemsZ ENABLED_TMPL) rr*r+Zentitlement_cfgr3Zlivepatch_tokenr!Z_detailsmsgZ error_messageZ print_messagerrrr2sX         z+LivepatchEntitlement.setup_livepatch_configcCs0tjsdStjtjdgdddS)zYDisable specific entitlement @return: True on success, False otherwise. Tr6r8)r r0r r?r@)rr%rrr_perform_disables z%LivepatchEntitlement._perform_disablecCsQtjdf}tjs+tjtjfStjdkrMtjtjfS|S)N) rr"r r0r>r ZLIVEPATCH_NOT_ENABLEDstatusZ+LIVEPATCH_APPLICATION_STATUS_CLIENT_FAILURE)rrErrrr!s  z'LivepatchEntitlement.application_statuscCstj}|tjjkrOtj}dtjjd|j d|j fS|tjj krtj}dtj jd|j d|j fS|tjj krdtjfSdS)NTversionZarchF)FN)r on_supported_kernelLivepatchSupport UNSUPPORTEDr Zget_kernel_infor ZLIVEPATCH_KERNEL_NOT_SUPPORTEDr#Z uname_releaseZuname_machine_archZ KERNEL_EOLZLIVEPATCH_KERNEL_EOLZKERNEL_UPGRADE_REQUIREDZ!LIVEPATCH_KERNEL_UPGRADE_REQUIRED)rZsupportZ kernel_inforrrenabled_warning_statuss"          z+LivepatchEntitlement.enabled_warning_statuscCs0tjtjjkr,tj r,tjSdS)N)r rGrHrIr rr Z*LIVEPATCH_KERNEL_NOT_SUPPORTED_DESCRIPTION)rrrrstatus_description_overrides   z0LivepatchEntitlement.status_description_override) orig_accessdeltas allow_enablerc s6tj|||rdS|jdi}|jdijdd}|rh|j\}}|S|j\}}|tjkrdS|jdi} tddg} t| j | } t|jd d} t | | gr2t j d t j tjjd |j|jd | d | SdS)a1Process any contract access deltas for this entitlement. :param orig_access: Dictionary containing the original resourceEntitlement access details. :param deltas: Dictionary which contains only the changed access keys and values. :param allow_enable: Boolean set True if allowed to perform the enable operation. When False, a message will be logged to inform the user about the recommended enabled service. :return: True when delta operations are processed; False when noop. T entitlementZ obligationsZenabledByDefaultF directivescaCerts remoteServerr5zANew livepatch directives or token. running setup_livepatch_configservicer*r+)superprocess_contract_deltasr9r7r!rr>setr intersectionanyr/r-r,r Z#SERVICE_UPDATING_CHANGED_DIRECTIVESr#r:r2) rrLrMrNZdelta_entitlementZprocess_enable_defaultZenable_success_r!Zdelta_directivesZsupported_deltasr*r+) __class__rrrU s4    z,LivepatchEntitlement.process_contract_deltas)&__name__ __module__ __qualname__r ZurlsZLIVEPATCH_HOME_PAGEZ help_doc_urlr:ZLIVEPATCH_TITLErZLIVEPATCH_DESCRIPTIONZ descriptionZLIVEPATCH_HELP_TEXTZ help_textZ#affordance_check_kernel_min_versionZaffordance_check_kernel_flavorZaffordance_check_seriesZaffordance_check_archpropertyrrrrr$r r4r2rDrrZ NamedMessager!rJrKrr1rrUrr)rZrrs,     ""6 < && rcCs|s dS|jdijdi}|jd}|retjtjddj|gdd|jd d }|jd r|dd}|rtjtjdd j|gdddS)aProcess livepatch configuration directives. We process caCerts before remoteServer because changing remote-server in the canonical-livepatch CLI performs a PUT against the new server name. If new caCerts were required for the new remoteServer, this canonical-livepatch client PUT could fail on unmatched old caCerts. @raises: ProcessExecutionError if unable to configure livepatch. NrOrPrQconfigz ca-certs={}r8TrR/zremote-server={})r9r r?r r@r#endswith)rrPZca_certsZ remote_serverrrrr;As& r;) ZloggingZtypingrrrrZuaclientrrrr r r r r Zuaclient.entitlements.baserrZ(uaclient.entitlements.entitlement_statusrZuaclient.typesrZLIVEPATCH_RETRIESrAZget_event_loggerr,Z getLoggerZreplace_top_level_logger_namer[r/rr;rrrrs ":    %