Skip to content

pgAdmin 4 for UBI-9: SP1 node_modules tooling + SP2 local-npm-registry + SP3 Python 3.12 stack - #12

Open
rjd15372 wants to merge 89 commits into
mainfrom
pgadmin-sp1
Open

pgAdmin 4 for UBI-9: SP1 node_modules tooling + SP2 local-npm-registry + SP3 Python 3.12 stack#12
rjd15372 wants to merge 89 commits into
mainfrom
pgadmin-sp1

Conversation

@rjd15372

@rjd15372 rjd15372 commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

This PR carries the pgAdmin 4 for UBI-9 effort sub-project by sub-project so every step is exercised by the OBS PR check before the whole lands. Design: docs/superpowers/specs/2026-08-26-pgadmin4-tooling-design.md (includes the decomposition into SP2 local-npm-registry, SP3 python3.12-* stack ported from openSUSE:Factory, SP4 percona-pgadmin4). Plan for SP1: docs/superpowers/plans/2026-08-26-pgadmin4-tooling.md.

  • SP1 — tooling: make percona-obs (and the obs-tools CI image) work with the OBS node_modules source service, which vendors npm dependencies for offline builds, and create the empty ppg:devel:pgadmin OBS project that will hold every pgAdmin package.
  • SP2 — local-npm-registry: the offline npm registry RPM that percona-pgadmin4 will BuildRequires at build time.
  • SP3 — Python 3.12 stack: the 71 python3.12-* RPMs of pgAdmin 4's dependency closure in ppg:devel:pgadmin, plus a shared build-backend stack and a dnspython bump in ppg:common:deps.

SP1 — Changes

  • tools/obs-services/npm_lockfile (+ .service, README) — repo-owned, stdlib-only OBS-style service: unpacks the obs_scm archive, runs npm install --package-lock-only in --subdir, validates lockfileVersion >= 2, writes package-lock.json to --outdir. Declared mode="manual" ahead of node_modules, so percona-obs generates the lockfile at sync time (pgAdmin ships only yarn.lock). Params: archive, subdir, npm-flags.
  • percona_obs/services.py — .obscpio files produced by mode="manual" services (e.g. node_modules.obscpio) are kept for upload instead of being extracted/deleted; obs_scm archives are still extracted.
  • percona_obs/services.py / cmd_sync.py — the ignore_vendor special case (cargo_vendor → vendor.tar.*) becomes a table-driven drift_tolerant_patterns() that also covers node_modules outputs (node_modules.obscpio, node_modules.spec.inc, *package-lock.json): compared by presence only in the --branch-from content check, so registry-driven byte drift never promotes a package by itself. cargo_vendor behaviour unchanged.
  • obs-tools image — obs-service-node-modules (+ python3-lxml), Node.js 22 + npm (NodeSource; matches the nodejs:22 module the packages build against), cpio, and the npm_lockfile service; build-obs-image.yml also triggers on tools/obs-services/**.
  • root/ppg/devel/pgadmin/project.yaml — new ppg:devel:pgadmin project, UBI_9 only (path list mirrors staging's UBI_9 entry) with ExpandFlags: module:nodejs:22. No packages yet; root/README.md documents the version-independent devel project.
  • Docs — docs/PERCONA_OBS_TOOL.md (prerequisites, "Vendoring npm dependencies" section, drift-tolerant table), .github/copilot-instructions.md, CLAUDE.md.

SP2 — Changes

  • root/common/deps/build/local-npm-registry/ — new RPM-only, noarch build-dep package ported from openSUSE devel:languages:javascript/local-npm-registry (upstream openSUSE/npm-localhost-proxy v1.1.0, the latest release). Source is the upstream release tarball via download_url; dist/ and node_modules/ (runtime dep ssri) are pre-bundled, so nothing is built. EL9 port of the spec: Requires: nodejs >= 20 + npm (the nodejs:22 module stream; EL has no npm-default), same /usr/bin/local-npm-registry node launcher, %license COPYING.
  • root/macros.yaml — LOCAL_NPM_REGISTRY_VERSION: 1.1.0, following the pinned build-dep tool convention (bumps per "Bumping a Pinned Build-Dependency Tool Version" in PACKAGING_HOWTO.md).
  • UBI_9 only via package.yaml build: flags (pgAdmin 4 is a UBI-9-only product); root/README.md lists it under common/deps/build/.

SP3 — Changes

  • root/ppg/devel/pgadmin/python3-* (71 new) — pgAdmin 4 REL-9_9's Python 3.12 closure (cloud extras excluded), one EL spec template: PyPI sdist via download_url, pip wheel --no-build-isolation + pip install --root (legacy setup.py for 9 packages), import smoke test in %check, runtime deps doubled as BuildRequires. Build tools python3-cython 3.1.3, python3-poetry-core, python3-pdm-backend. bcrypt vendors its Rust crate with cargo_vendor.
  • root/ppg/common/deps/ — python3-dns bumped 1.15.0 → dnspython 2.8.0 (email-validator ≥ 2.0; name kept, python3-etcd/percona-patroni rebuilt by dep-cascade); new shared build-backend stack python3-flit-core 3.12.0, python3-packaging 25.0, python3-pathspec, python3-trove-classifiers, python3-hatchling 1.28.0 for EL8/EL9/UBI (RHEL's backends cannot build PEP 639 metadata; EL10/openSUSE use their distro ones via a spec conditional).
  • Version policy — reuse RHEL 9's python3.12-{cffi,cryptography 41,idna,pycparser,urllib3 1.26,setuptools 68} and common:deps' six/dateutil/psutil/click; pinned down where PEP 639 metadata would need setuptools ≥ 77 (keyring 25.2.1, jaraco.context 6.0.1, jaraco.functools 4.1.0, importlib-resources 6.5.2, Pillow 11.1.0), bidict 0.23.1, pyotp 2.9.0, ua-parser 0.18.0.
  • Docs — docs/PACKAGING_HOWTO.md "Python 3.12 packages (pyproject builds)"; root/README.md.
  • Design: docs/superpowers/specs/2026-08-26-pgadmin4-py312-stack-design.md.

Verification

SP1

  • pytest: 147 passed (23 new tests: service with a fake npm, _run_local_services with fake service binaries + real cpio archive, drift-tolerant patterns); black + pyright clean.
  • obs-tools image built locally; in-image check: node_modules, npm_lockfile, cpio, node v22.23.2, npm 10.9.8.
  • End-to-end on the real upstream: obs_scm (pgAdmin REL-9_9) → npm_lockfile → node_modules via sync push --dry-run (isv-pr profile), twice: 5-file upload set (node_modules.obscpio 197 MiB, node_modules.spec.inc 1 439 Source lines, package-lock.json lockfileVersion 3 / 1 550 packages, tarball, obsinfo), artifact set matches the drift-tolerant table exactly, second run fully cached. Details recorded in the spec's §10.
  • PR check run 32988024877 (head 30ce7a0, after the rebase onto main with percona-obs: never promote on content-check service failure; compare rendered referenced macros #13): synced to isv:percona:PR:pr-12 with 0 spurious promotes.

SP2

  • sync push --dry-run -P isv-pr common:deps:build local-npm-registry: download_url resolves; would-be upload is exactly local-npm-registry.spec + local_npm_registry-v1.1.0.tar.gz.
  • Rendered spec parses with rpmspec → local-npm-registry-1.1.0-1.el9.noarch.
  • Acceptance: the PR check builds isv:percona:PR:pr-12:common:deps:build/local-npm-registry on UBI_9.

SP3

  • Dry-runs before pushing (sync push --dry-run -P isv-pr, all sync successful (dry run)): python3-hatchling, python3-trove-classifiers, python3-dns (common:deps); python3-bcrypt (download_url + cargo_vendor, 3 files), python3-psycopg-c, python3-flask, python3-wtforms, python3-paramiko, python3-typer, python3-rich.
  • OBS end state in isv:percona:PR:pr-12 (UBI_9 only, per the PR's UBI_9 label): ppg:devel:pgadmin 142/142 succeeded (71 packages × x86_64 + aarch64); ppg:common:deps 12/12 succeeded (python3-flit-core, -packaging, -pathspec, -trove-classifiers, -hatchling, -dns, × 2 arches). Board settled 2026-08-27 16:04 UTC.
  • Build-loop fixes — 12 packages failed the first build (9 on x86_64: backports-zstd, bcrypt, flask-principal, greenlet, gssapi, markupsafe, psycopg-c, qrcode, secretstorage; 3 only on aarch64: psycopg, ua-parser, wsproto); fixed by 10 commits over 3 rounds, all reviewed:
    • Round 1: 52d93bc all 77 specs — %check imported the source tree instead of the buildroot (missing native extensions, e.g. gssapi No module named gssapi.raw.creds) → %{__ospython} -P -c "import ...". 176d706 python3-{alembic,backports-zstd,greenlet,mako,markupsafe,secretstorage,wsproto} — RHEL setuptools 68 rejects PEP 639 license = "…" + license-files → %prep sed to license = {text = "…"}, drop license-files (kept RHEL setuptools rather than shipping setuptools 80). 4441f17 python3-flask-principal — Flask/blinker missing from PyPI metadata → added as BuildRequires/Requires. 2b65469 python3-psycopg — pure-Python pq wrapper needs libpq at import → BuildRequires/Requires libpq. 3a385e0 python3-psycopg-c — psycopg_c refuses import unless psycopg is imported first → BuildRequires python3.12-psycopg, %check imports psycopg then psycopg_c. d8ade24 python3-qrcode — ambiguous #!/usr/bin/env python shebang in qrcode/console_scripts.py → removed in %prep. 9836542 python3-ua-parser — setup_requires=["pyyaml"] fetched from PyPI (offline build) → BuildRequires python3.12-pyyaml, drop setup_requires. fce0164 python3-bcrypt — cargo_vendor places vendor//.cargo/config.toml under src/_bcrypt/, not the sdist root → CARGO_HOME=$PWD/src/_bcrypt/.cargo.
    • Round 2: abdc615 python3-greenlet — wheel installs an unpackaged /usr/include/python3.12/greenlet/greenlet.h → added to %files.
    • Round 3: 5498b3e python3-wtforms — hatch build hook compiles translations with Babel (ModuleNotFoundError: babel during pip wheel) → BuildRequires python3.12-babel.
    • Operational: after the fixes, OBS rebuilt both PR projects three more times with _jobhistory reason "meta change" (download-on-demand path repos for Rocky 9 / EPEL 9 refreshing) on a slow x86_64 scheduler — roughly 4 hours from first push to a settled board; not caused by our pushes (every sync logged = project meta/config).
  • Open items (stated honestly, not resolved in this PR): the dnspython cascade (python3-etcd, percona-patroni) was not exercised in PR pgAdmin 4 for UBI-9: SP1 node_modules tooling + SP2 local-npm-registry + SP3 Python 3.12 stack #12 because it carries the no-dep-cascade label — the cascade rebuild happens on merge; and the ppg:common:deps packages were only built on UBI_9 in the PR — RockyLinux_8/9/10, UBI_8, and openSUSE builds happen after merge.

Notes / follow-ups

  • SP1 adds no packages; the rebuilt obs-tools image (with node_modules/npm) is only produced after merge (build-obs-image.yml triggers on main) and is needed before SP4's package lands.
  • sync push --project-only rejects a package-less project (targets.py), so ppg:devel:pgadmin is created on OBS when its first package syncs (SP3/SP4).
  • Found during SP1 verification, for SP4: npm does not use pgAdmin's yarn.lock as a resolution hint — the generated lockfile resolves newer caret-satisfying versions than upstream tested (4 of 5 sampled packages). SP4 has to decide between pinning and accepting the drift. The real ~200 MB upload timing check is also left to SP4's real package.
  • Deferred to SP4: chunked md5 / skip hashing drift-tolerant artifacts (cmd_sync.py, obs_api.py) once a ~200 MB artifact actually exists.

SP4 — percona-pgadmin4 (pgAdmin 4 9.17, server mode)

  • root/ppg/devel/pgadmin/percona-pgadmin4: spec ported from openSUSE to EL9/python3.12; sources via obs_scm (REL-9_17) → npm_lockfile → node_modules; webpack against local-npm-registry (git deps rewritten to the vendored file: tarball, dist-tag ranges pinned to the lockfile); wheel via upstream pkg/pip/setup_pip.py.
  • Subpackages: -gunicorn (launcher percona-pgadmin4-gunicorn + systemd unit, disabled; PGADMIN_CONFIG_* env → settings; the runtime for the container image), -httpd (mod_wsgi conf + percona-pgadmin4-setup-web), -doc (rst sources; Help menu links to the online manual).
  • Python stack for 9.17: bumps Flask-Security-Too 5.8.2, Flask-SocketIO 5.6.1, Flask-WTF 1.3.0, gssapi 1.11.1 (Cython 3.2.4), psycopg/psycopg-c 3.3.4, pytz 2026.3.post1, typer 0.26.8; new annotated-doc, certifi, libpass (replaces passlib), gunicorn; removed passlib, importlib-resources; _aggregates of click/six/dateutil/psutil/dns from ppg:common:deps.
  • cryptography 49 pivot: pgAdmin 9.17 needs cryptography.hazmat.decrepit (>= 43; RHEL ships 41), so the stack now builds python3-maturin 1.15.0 (PEP 517 backend; offline cargo build), python3-cffi 2.1.1 and python3-cryptography 49.0.0 (both Epoch 1, outranking the RHEL packages) — which also unblocks a future Authlib 1.7/joserfc bump.
  • Node.js 22.23.1 in common:deps:build, ported from the CentOS Stream 9 nodejs:22 module dist-git: EL9 repos on OBS expose only the nodejs 16 default stream and pgAdmin's webpack toolchain needs Node >= 20 (consumers now require nodejs >= 1:22 — EL9's nodejs carries Epoch 1, so a bare >= 20 matches 1:16).
  • Smoke test (UBI-9 container from this PR's published repo): install, PGADMIN_CONFIG_* env mapping, first-start setup from PGADMIN_DEFAULT_EMAIL/PASSWORD, GET /login → HTTP 200 identifying 9.17; httpd -t Syntax OK with mod_wsgi and setup-web completes. Final OBS state: 82/82 packages green on UBI_9 x86_64 + aarch64.
  • Login fix (post-delivery): pgAdmin 9.17 is incompatible with Flask-Security-Too 5.8.2, which inverted UserMixin.is_locked (issue #1212) — under 5.8.2 every login failed silently. Pinned python3-flask-security-too to 5.8.1 (within pgAdmin's 5.8.*); the smoke matrix gained a real-authentication check (T7: valid login reaches /browser/, wrong password returns to /login), now 7/7.
  • Try it: podman run --rm -p 8080:8080 -e PGADMIN_DEFAULT_EMAIL=admin@example.com -e PGADMIN_DEFAULT_PASSWORD=… -e PGADMIN_LISTEN_ADDRESS=0.0.0.0 -e PGADMIN_LISTEN_PORT=8080 <ubi9 image with percona-pgadmin4-gunicorn installed> percona-pgadmin4-gunicorn.

SP5 — percona-pgadmin4 container image

  • root/ppg/devel/pgadmin/containers/ → new OBS project ppg:devel:pgadmin:containers (repo ubi9, x86_64 + aarch64): percona-pgadmin4 image FROM percona-ubi-minimal, tags 9.17-<release> / 9.17 / latest, built from this PR's RPMs plus percona-postgresql{14..18} client tools wired into DEFAULT_BINARY_PATHS (Backup/Restore/Query Tool work against any supported server major).
  • Runtime "compatible where it counts" with dpage/pgadmin4: same env contract (PGADMIN_DEFAULT_EMAIL/PASSWORD incl. _FILE secrets, PGADMIN_CONFIG_*, PGADMIN_LISTEN_*), servers.json/preferences.json import, TLS via /certs + PGADMIN_ENABLE_TLS, OpenShift random-UID tolerance; differences: port 8080, fixed UID 5050, no postfix/capability tricks. Entrypoint layers over the RPM's percona-pgadmin4-gunicorn launcher.
  • Smoke matrix on the OBS-built image (9.17-2.1): 6/6 — login 200 + version marker, _FILE secrets (+ both-set error), servers.json import, TLS https (+ missing-certs error), pg_dump 14–18 + binary-path resolution, --user 12345:0 boot.
  • Note for PR checks: the containers project syncs only with the ubi9-images label (now set). Pull the PR-built image directly: podman pull registry.opensuse.org/isv/percona/pr/pr-12/ppg/devel/pgadmin/containers/ubi9/percona-pgadmin4:latest (the repository name is a path segment), or osc getbinaries … ubi9 x86_64 + podman load.
  • Try it: podman run --rm -p 8080:8080 -e PGADMIN_DEFAULT_EMAIL=admin@example.com -e PGADMIN_DEFAULT_PASSWORD=… percona-pgadmin4:9.17.

CVE version bumps (2026-09-04)

  • Cleared 15 HIGH CVEs the container scanner reported against percona-pgadmin4, all in three stack packages: pillow 11.1.0 → 12.3.0 (12 CVEs), cryptography 49.0.0 → 50.0.1 (CVE-2026-69247), jaraco.context 6.0.1 → 6.1.0 (CVE-2026-23949).
  • pillow 12 and jaraco.context 6.1 require setuptools>=77 (RHEL ships 68), so this adds a stack-wide python3-setuptools 80.10.2 (Epoch 1; not the newest 84.x, which drops pkg_resources) and python3-pybind11 2.13.6 (pillow 12's build backend). The ~35 setuptools-backed stack packages dep-cascade rebuilt on the new setuptools with zero failures, and the 11 SP4 PEP-639 %prep license seds were removed (native SPDX metadata now that setuptools ≥ 77 handles it).
  • Verified: full smoke matrix incl. real login (T1–T7 PASS) on the rebuilt image, and a scanner re-scan showing the image HIGH count 15 → 0 on both arches.

@rjd15372 rjd15372 added UBI_9 no-dep-cascade If used with `obs-sync*` labels, it prevents from packages that were not changed from being built obs-sync Trigger OBS sync push labels Aug 26, 2026
@github-actions

github-actions Bot commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown

OBS Build Check — ✅ Builds passed

Packages for this PR are being built at isv:percona:PR:pr-12.

Packages
Built from PR sources 0
Reused from main binaries 37
Repository ✔ Succeeded ✗ Failed ⛔ Broken ⚠ Unresolvable — Excluded
UBI_9 8 0 0 0 0
Total 8 0 0 0 0

Updated: 2026-09-04 23:08 UTC

@rjd15372 rjd15372 mentioned this pull request Aug 26, 2026
Merged
rjd15372 added a commit that referenced this pull request Aug 26, 2026
@rjd15372
percona-obs: never promote on content-check service failure; compare …
439a89c 
…rendered macros

Two --branch-from decision fixes (PR #12 CI analysis, 2026-08-26):

1. _content_matches_branch caught SystemExit from a failed local service
   run and returned False ("content differs"), so a transient obs_scm
   clone error (curl 56 Connection reset by peer) promoted an unrelated,
   unchanged package. A failed run says nothing about the content: the
   services are now retried once (_run_services_for_check) and a second
   failure aborts the whole sync with the service's error.

2. _macros_changed_since compared inherited macros.yaml at file level
   (git diff --name-only <sha>..HEAD). Commit 146694c moved macros
   between staging/17/extras, staging/17 and staging/macros.yaml with
   identical rendered values, which flagged every ppg/staging package as
   "inherited macros changed" and sent ~120 of them through the
   service-running content check on every PR run. The check now compares
   the rendered values of the %!{NAME} macros the package actually
   references (obs/, debian/, rpm/ files) between the synced SHA (via
   git show) and the working tree. load_macros is split into
   _macros_chain_files + resolve_macros so both trees resolve through
   the same parser. Against the legacy production SHA 6440e48 this drops
   ppg/staging from 315/315 flagged packages to 4, all genuine version
   bumps (pg_tde x3, 19/haproxy).

Tests: tests/test_content_check_retry.py, tests/test_macros_changed_since.py
(real temporary git repo, no git mocking).

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372 rjd15372 added obs-sync Trigger OBS sync push and removed obs-sync Trigger OBS sync push labels Aug 26, 2026
@rjd15372 rjd15372 changed the title percona-obs: support the OBS node_modules service (pgAdmin 4 tooling, SP1) pgAdmin 4 for UBI-9: SP1 node_modules tooling + SP2 local-npm-registry Aug 26, 2026
rjd15372 added a commit that referenced this pull request Aug 27, 2026
@rjd15372
docs: pgAdmin 4 UBI-9 SP3 design spec — Python 3.12 dependency stack
a67855e 
Design for the ~75 python3.12-* packages percona-pgadmin4 needs on UBI-9:
closure resolution, reuse policy (RHEL 9 + ppg:common:deps), dnspython
bump + shared hatchling build stack in ppg:common:deps, the shared EL
spec template (pyproject / setup.py / self-hosting families), inventory,
verification via PR #12, risks.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
rjd15372 added a commit that referenced this pull request Aug 27, 2026
@rjd15372
docs: implementation plan for the pgAdmin 4 Python 3.12 stack (SP3)
76f2450 
Six tasks: render the 77 python3-* package directories with a throwaway
scratchpad script (embedded as appendices with its data), commit them in
three bottom-up batches (ppg:common:deps backend stack + dnspython bump;
pgadmin build tools + leaves; dependents), document the Python 3.12 spec
template in PACKAGING_HOWTO, build everything in PR #12's OBS project
with a fix loop, and record outcomes in PR #12 and the spec.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372 rjd15372 changed the title pgAdmin 4 for UBI-9: SP1 node_modules tooling + SP2 local-npm-registry pgAdmin 4 for UBI-9: SP1 node_modules tooling + SP2 local-npm-registry + SP3 Python 3.12 stack Aug 27, 2026
rjd15372 added a commit that referenced this pull request Aug 28, 2026
@rjd15372
docs: pgAdmin 4 UBI-9 SP4 design spec — percona-pgadmin4 package (REL…
1aa3b1e 
…-9_17)

Package layout and spec design for percona-pgadmin4 with -gunicorn (container
runtime, systemd unit), -httpd (mod_wsgi conf + setup helper) and -doc (rst
sources) subpackages; obs_scm(REL-9_17) → npm_lockfile → node_modules source
chain; config_distro.py with Percona defaults and PGADMIN_CONFIG_* env
overrides; the SP3 stack changes for 9.17 (libpass replaces passlib, certifi,
annotated-doc, gunicorn, bumps; Authlib kept at 1.6.12); verification via
PR #12 plus a container smoke test with the OBS-built RPMs.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372 rjd15372 mentioned this pull request Aug 28, 2026
Merged
rjd15372 added a commit that referenced this pull request Aug 28, 2026
@rjd15372
obs-tools image: add the npm_lockfile service and Node.js 22
ffc1c7a 
Bake the repo-owned npm_lockfile OBS-style service (tools/obs-services/)
into ghcr.io/percona/obs-tools together with Node.js 22 + npm, cpio and
obs-service-node-modules, so percona-obs can generate package-lock.json
and vendor npm dependencies for packages whose upstream ships no npm
lockfile (pgAdmin 4). build-obs-image.yml now also rebuilds the image
when tools/obs-services/ changes.

Split out of the pgadmin-sp1 branch (PR #12): the PR check runs inside
obs-tools:latest, which is only rebuilt from main, so the service must
land on main before PR #12 can sync.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
rjd15372 added a commit that referenced this pull request Aug 28, 2026
@rjd15372
docs: pgAdmin 4 UBI-9 SP3 design spec — Python 3.12 dependency stack
ae23bc9 
Design for the ~75 python3.12-* packages percona-pgadmin4 needs on UBI-9:
closure resolution, reuse policy (RHEL 9 + ppg:common:deps), dnspython
bump + shared hatchling build stack in ppg:common:deps, the shared EL
spec template (pyproject / setup.py / self-hosting families), inventory,
verification via PR #12, risks.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
rjd15372 added a commit that referenced this pull request Aug 28, 2026
@rjd15372
docs: implementation plan for the pgAdmin 4 Python 3.12 stack (SP3)
8c66814 
Six tasks: render the 77 python3-* package directories with a throwaway
scratchpad script (embedded as appendices with its data), commit them in
three bottom-up batches (ppg:common:deps backend stack + dnspython bump;
pgadmin build tools + leaves; dependents), document the Python 3.12 spec
template in PACKAGING_HOWTO, build everything in PR #12's OBS project
with a fix loop, and record outcomes in PR #12 and the spec.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
rjd15372 added a commit that referenced this pull request Aug 28, 2026
@rjd15372
docs: pgAdmin 4 UBI-9 SP4 design spec — percona-pgadmin4 package (REL…
c5f086e 
…-9_17)

Package layout and spec design for percona-pgadmin4 with -gunicorn (container
runtime, systemd unit), -httpd (mod_wsgi conf + setup helper) and -doc (rst
sources) subpackages; obs_scm(REL-9_17) → npm_lockfile → node_modules source
chain; config_distro.py with Percona defaults and PGADMIN_CONFIG_* env
overrides; the SP3 stack changes for 9.17 (libpass replaces passlib, certifi,
annotated-doc, gunicorn, bumps; Authlib kept at 1.6.12); verification via
PR #12 plus a container smoke test with the OBS-built RPMs.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372 rjd15372 mentioned this pull request Aug 28, 2026
Merged
@rjd15372
docs: pgAdmin 4 UBI-9 tooling design spec (sub-project 1)
fb55f2e 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: implementation plan for pgAdmin 4 tooling (sub-project 1)
61652e3 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
gitignore: ignore .superpowers/ (SDD plan workspace scratch)
8a6f2b8 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
tools: add npm_lockfile OBS service (generate package-lock.json for n…
82b8920 
…ode_modules)

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
npm_lockfile: report missing cpio and lockfile copy failures as one-l…
2671e55 
…ine errors

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
services: keep .obscpio artifacts produced by manual services
55208c1 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
sync: generalise vendor drift tolerance to node_modules artifacts
92546b7 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
ppg:devel:pgadmin: add UBI_9-only project for pgAdmin 4 packages
1263c2e 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: describe npm vendoring flow (npm_lockfile + node_modules) and d…
0596452 
…rift-tolerant artifacts

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: authlib requires python3.12-requests (smoke test)
66f5d48 
With cryptography 49 in place the gunicorn smoke test got pgAdmin past
crypto and died at the next lazy import: authlib.integrations.flask_client
unconditionally imports ..requests_client, which imports requests —
not installed anywhere in the closure. RHEL 9 ships python3.12-requests
(2.28.2) in the repository path; add the explicit dependency edge to
python3-authlib (auto dist() requires are excluded stack-wide).

Verified in a UBI-9 container: with python3.12-requests installed,
gunicorn boots and GET /login returns HTTP 200 with the pgAdmin 4
login page (ver=91700 = 9.17.0).

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: SP4 outcomes (OBS fix rounds, smoke test)
54569fc 
Spec section 9 gains the executed outcomes: the ten OBS fix rounds and
their causes (obs-tools image, ssh clone routing, psycopg-c ext-modules,
the EL9 rpm 4.16 %install-in-comment parse error, npm dist-tags, the
react-data-grid git dependency, the nodejs 22 CS9 port with the epoch
gotcha, rich-form dist() requires, the cryptography 49 pivot with
maturin/cffi, authlib's requests edge), final result counts (82/82 on
both arches, repo published), the smoke-test tokens with log locations,
and the two decisions changed during execution. Sections 2.2, 3, 5.1,
9 (react-data-grid risk row) and 10 amended so the spec no longer
contradicts the delivered tree (cryptography is a stack package at
49.0.0, not reused RHEL 41; Authlib 1.7/joserfc is now unblocked and
deferred).

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: SP4 plan — all six tasks completed
59184d0 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: pgAdmin 4 container image design spec (SP5)
5f1859f 
ppg:devel:pgadmin:containers — UBI-9 image from the SP1-SP4 RPMs,
'compatible where it counts' with dpage/pgadmin4 (env contract incl.
_FILE secrets, servers.json/preferences import, TLS via /certs,
OpenShift random-UID tolerance; port 8080, fixed UID 5050, no capped
python/PUID/postfix), bundling percona-postgresql 14-18 clients wired
into DEFAULT_BINARY_PATHS. Entrypoint layered over the RPM launcher
(approach A); one small -gunicorn launcher TLS passthrough.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: SP5 plan — pgAdmin 4 container image (project, Dockerfile, entr…
21f7f5c 
…ypoint, OBS loop, smoke gate)

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: containers project + percona-pgadmin4 image Dockerfile (SP5)
e92c66a 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: container entrypoint (secrets, imports, TLS pre-flight, Open…
ef122ab 
…Shift fixup)

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: fix entrypoint replace-servers EMAIL guard and external-DB d…
01ec8a1 
…ouble-init

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372 rjd15372 added ubi9-images obs-sync Trigger OBS sync push and removed obs-sync Trigger OBS sync push labels Sep 2, 2026
@rjd15372
pgadmin: make the container entrypoint executable (image smoke)
afcd74f 
COPY preserves the non-executable mode 644 from the OBS payload source
file, causing crun to refuse execution of the entrypoint. Add explicit
chmod 0755 RUN layer after COPY to make the file executable in the
image, and chmod +x the source file to track the correct mode in git
(belt and braces).

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: SP5 outcomes (image build, smoke matrix)
7c5f40a 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: final-review fixes — TLS truthiness, probe failure handling,…
1966c09 
… docs

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: SP5 outcomes addendum — final fix wave and 9.17-3.1 matrix re-run
88c46e5 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: SP5 — the OBS registry does serve PR images (path includes the …
8e866a7 
…repository segment)

The outcomes note claimed PR-project images are not pushed to
registry.opensuse.org; the probe had simply omitted the repository name
from the path. Correct pull reference:
registry.opensuse.org/isv/percona/pr/pr-12/ppg/devel/pgadmin/containers/ubi9/percona-pgadmin4:latest

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: pin flask-security-too to 5.8.1 (login broken on 5.8.2)
9c733f8 
Every login on the container failed silently — POST /authenticate/login
redirected back to /login with no flash. Root cause: FS-too 5.8.2 fixed
issue #1212 by INVERTING UserMixin.is_locked semantics — LoginForm.validate
changed from 'if not self.user.is_locked(): return False' (5.8.1, True =
not-locked/proceed) to 'if self.user.is_locked(): return False' (5.8.2,
True = locked/fail). pgAdmin 9.17's User.is_locked still returns the
pre-inversion value (True for a non-locked user), so under 5.8.2 the
LoginForm treats every non-locked user as locked and fails validation
after the password already verified — hence the silent bounce.

pgAdmin pins Flask-Security-Too==5.8.*; 5.8.1 is the newest release that
matches pgAdmin 9.17's is_locked convention. Verified end to end: with
5.8.1 overlaid on the built image, POST /authenticate/login redirects to
/browser/ (success) instead of /login.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: SP5 — login fix (flask-security-too 5.8.1) + smoke T7 real-auth…
dae3900 
… check

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372 rjd15372 added the keep-pr-build Ensures that the OBS PR project built for this PR is never deleted by the stale PR deletion bot. label Sep 3, 2026
@rjd15372
docs: CVE version-bump design (cryptography 50, pillow 12, jaraco.con…
555cffa 
…text 6.1)

Fixes 15 HIGH CVEs in the percona-pgadmin4 image. cryptography 50.0.1 is a
mechanical maturin bump; pillow 12.3.0 and jaraco.context 6.1.0 both require
setuptools>=77, so the design adds a stack-wide python3-setuptools 80.10.2
(Epoch 1) plus python3-pybind11 for pillow. All three builds verified in an
EL9 container. Lands on pgadmin-sp1 / PR #12.

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: CVE spec — include PEP-639 sed cleanup, justify setuptools 80.1…
0ea6a89 
…0.2 (84 drops pkg_resources)

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: CVE spec — pin pybind11 2.13.6 (setuptools-backed; 3.x needs sc…
377a648 
…ikit-build-core)

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: CVE version-bump implementation plan (10 tasks)
ddb2cac 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: add python3-setuptools 80.10.2 (stack-wide, Epoch 1) for set…
5c36383 
…uptools>=77 packages

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: add python3-pybind11 2.13.6 (pillow 12 build dependency)
d984897 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: cryptography 49.0.0 -> 50.0.1 (CVE-2026-69247)
f80ce0c 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: pillow 11.1.0 -> 12.3.0 (12 CVEs; +pybind11 BuildRequires)
be2ad76 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: jaraco.context 6.0.1 -> 6.1.0 (CVE-2026-23949)
efcd9aa 
Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
pgadmin: drop the PEP-639 license seds (native metadata under setupto…
63d8ab7 
…ols 80.10.2)

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
@rjd15372
docs: CVE bump outcomes (setuptools 80.10.2 clean, 15->0 HIGH, smoke …
c6dde57 
…T1-T7)

Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

keep-pr-build Ensures that the OBS PR project built for this PR is never deleted by the stale PR deletion bot. no-dep-cascade If used with `obs-sync*` labels, it prevents from packages that were not changed from being built obs-sync Trigger OBS sync push ubi9-images UBI_9

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rjd15372