.coveragerc3

@@ -5,10 +5,6 @@
 omit =
     /usr/*
     tests/*
-    hub/*
-    util/*
-    koji/daemon.py
-    koji/tasks.py
 
 [report]
 exclude_lines =

Makefile

@@ -2,6 +2,10 @@ NAME=koji
 SPECFILE = $(firstword $(wildcard *.spec))
 SUBDIRS = hub builder koji cli util www plugins vm
 
+ifndef PYTHON
+export PYTHON=python2
+endif
+
 ifdef DIST
 DIST_DEFINES := --define "dist $(DIST)"
 endif
@@ -65,21 +69,20 @@ git-clean:
 	@git clean -d -q -x
 
 test:
-	coverage erase
-	PYTHONPATH=hub/.:plugins/hub/.:plugins/builder/.:plugins/cli/.:cli/.:www/lib coverage run \
+	coverage2 erase
+	PYTHONPATH=hub/.:plugins/hub/.:plugins/builder/.:plugins/cli/.:cli/.:www/lib coverage2 run \
 	    --source . /usr/bin/nosetests
-	coverage report
-	coverage html
+	coverage2 report
+	coverage2 html
 	@echo Full coverage report in htmlcov/index.html
 
 test3:
-	coverage erase
-	PYTHONPATH=hub/.:plugins/hub/.:plugins/builder/.:plugins/cli/.:cli/. coverage3 run \
+	coverage3 erase
+	PYTHONPATH=hub/.:plugins/hub/.:plugins/builder/.:plugins/cli/.:cli/.:www/lib coverage3 run \
 	    --rcfile .coveragerc3 --source . \
-	    /usr/bin/nosetests-3 \
-	    tests/test_lib tests/test_cli
-	coverage report --rcfile .coveragerc3
-	coverage html --rcfile .coveragerc3
+	    /usr/bin/nosetests-3
+	coverage3 report --rcfile .coveragerc3
+	coverage3 html --rcfile .coveragerc3
 	@echo Full coverage report at file://${PWD}/htmlcov/index.html
 
 test-tarball:
@@ -109,7 +112,7 @@ pypi:
 	rm -rf dist
 	python setup.py sdist
 	# py2
-	virtualenv build_py2
+	virtualenv -p /usr/bin/python2 build_py2
 	build_py2/bin/pip install --upgrade pip setuptools wheel virtualenv
 	build_py2/bin/python setup.py bdist_wheel
 	rm -rf build_py2

cli/Makefile

 SUBDIRS=koji_cli
 
-PYTHON=python
 PACKAGE = $(shell basename `pwd`)
 PYVER := $(shell $(PYTHON) -c 'import sys; print("%.3s" %(sys.version))')
 PYSYSDIR := $(shell $(PYTHON) -c 'import sys; print(sys.prefix)')

cli/koji_cli/Makefile

 PYFILES = $(wildcard *.py)
 
-PYTHON=python
 PACKAGE = $(shell basename `pwd`)
 PYVER := $(shell $(PYTHON) -c 'import sys; print("%.3s" % (sys.version))')
 PYSYSDIR := $(shell $(PYTHON) -c 'import sys; print(sys.prefix)')

cli/koji_cli/lib.py

@@ -343,6 +343,21 @@ Running Tasks:
     return rv
 
 
+def write_to_stdout(contents):
+    """Helper function to write str/bytes to stdout
+
+    https://docs.python.org/3/library/sys.html#sys.displayhook
+    """
+    try:
+        sys.stdout.write(contents)
+    except UnicodeEncodeError:
+        bytes = contents.encode(sys.stdout.encoding, 'backslashreplace')
+        if hasattr(sys.stdout, 'buffer'):
+            sys.stdout.buffer.write(bytes)
+        else:
+            contents = bytes.decode(sys.stdout.encoding, 'strict')
+            sys.stdout.write(contents)
+
 def watch_logs(session, tasklist, opts, poll_interval):
     print("Watching logs (this may be safely interrupted)...")
 
@@ -391,10 +406,7 @@ def watch_logs(session, tasklist, opts, poll_interval):
                                 sys.stdout.write("\n")
                             sys.stdout.write("==> %s <==\n" % currlog)
                             lastlog = currlog
-                        if six.PY3:
-                            sys.stdout.buffer.write(contents)
-                        else:
-                            sys.stdout.write(contents)
+                        write_to_stdout(contents)
 
 
             if opts.follow:

docs/source/CVE-2018-1002161-FAQ.rst

+========================
+FAQ for CVE-2018-1002161
+========================
+
+Following are answers to some questions regarding CVE-2018-1002161
+for Koji. If you haven’t already, you should read the
+:doc:`announcement <CVE-2018-1002161>`.
+
+If you have questions not covered here or in the announcement, please
+ask them on the koji-devel mailing list.
+
+    https://lists.fedorahosted.org/archives/list/koji-devel@lists.fedorahosted.org/
+
+Q: Does this issue affect Koji clients or builders?
+
+    The issue only affects the Koji hub.
+
+Q: Which versions of Koji are affected?
+
+    All previous versions of Koji are affected, except for the legacy-py24
+    branch because it contains no hub code.
+
+Q: Where are the fixed versions?
+
+    | For Koji 1.11, 1.11.1 and higher include the fix
+    | For Koji 1.12, 1.12.2 and higher include the fix
+    | For Koji 1.13, 1.13.2 and higher include the fix
+    | For Koji 1.14, 1.14.2 and higher include the fix
+    | For Koji 1.15, 1.15.2 and higher include the fix
+    | For Koji 1.16.2 and higher include the fix
+
+    You can find all of these versions on our releases page:
+
+    https://pagure.io/koji/releases
+
+Q: What about older versions?
+
+    We have only backported the fix to Koji versions released in the past few
+    years. If you are still using a very old version of Koji, we strongly
+    recommend that you shut it down and migrate to a newer version.
+
+Q: What can be done with this exploit?
+
+    The attacker can directly manipulate the database as they see fit. This
+    would, among other things, allow them to gain the admin permission within
+    Koji. They could destroy or corrupt the database, add new builds, replace
+    existing builds, or any number of other things.
+
+Q: Can the attacker execute arbitrary code?
+
+    On the hub, not that we know of.
+
+    However, they could create arbitrary tasks, which would be run by the build
+    hosts.
+
+Q: Where can I get more help?
+
+    You can ask questions on the koji-devel mailing list
+    (`koji-devel@fedorahosted.org <mailto:koji-devel@fedorahosted.org>`_).
+
+    For real time communication, we have the #koji IRC channel on
+    `Freenode <https://freenode.net/>`_.
+    The best time to ask would be during the Koji devel team
+    “office hours”, which are held each Tuesday and Thursday from
+    10-11am eastern time.
+

docs/source/CVE-2018-1002161.rst

+================
+CVE-2018-1002161
+================
+
+SQL injection in multiple remote calls
+
+.. toctree::
+    :hidden:
+
+    CVE-2018-1002161-FAQ
+
+
+Summary
+-------
+
+This is a critical security bug.
+
+Multiple xmlrpc call handlers in Koji’s hub code contain SQL injection bugs. By
+passing carefully constructed arguments to these calls, an unauthenticated user
+can issue arbitrary SQL commands to Koji’s database. This gives the attacker
+broad ability to manipulate or destroy data.
+
+There is no known workaround. All Koji admins are encouraged to update to a
+fixed version as soon as possible.
+
+
+
+Bug fix
+-------
+
+Note: because code fixes can take time to deploy, we recommend
+that all admins shut down their Koji hub instances until the fix
+can be applied.
+
+We are releasing updates for several recent versions of Koji to fix this
+bug. The following `releases <https://pagure.io/koji/releases>`_ all
+contain the fix:
+
+-  1.16.2
+-  1.15.2
+-  1.14.2
+-  1.13.2
+-  1.12.2
+-  1.11.1
+
+Note: the legacy-py24 branch is unaffected since it
+is client-only (no hub).
+
+For users who have customized their Koji code, we recommend rebasing
+your work onto the appropriate update release. If this is not feasible,
+the patch should be very easy to apply. Please see `issue
+#1183 <https://pagure.io/koji/issue/1183>`_ for the code details.
+
+As with all changes to hub code, you must restart httpd for the changes
+to take effect.
+
+Links
+-----
+
+Fixed versions can be found at our releases page:
+
+    https://pagure.io/koji/releases
+
+Questions and answers about this issue
+
+    :doc:`CVE-2018-1002161-FAQ`

docs/source/CVEs.rst

@@ -5,5 +5,6 @@ Koji CVEs
 .. toctree::
     :titlesonly:
 
+    CVE-2018-1002161
     CVE-2018-1002150
     CVE-2017-1002153

docs/source/defining_hub_policies.rst

@@ -67,7 +67,7 @@ tests, negated tests, and nested tests. Consider the following example:
             operation move :: {
                 fromtag *-updates-candidate :: allow
                 fromtag *-updates-testing :: allow
-                all :: deny
+                all :: deny Tagging from some tags to *-updates is forbidden.
             }
             operation tag && hastag *-updates-candidate *-updates-testing :: deny
         }
@@ -84,6 +84,11 @@ only allowed if the move is coming from a tag matching ``*-updates-candidate``
 or ``*-updates-testing``. Conversely, a basic tag operation (not a move) is
 denied if the build also has such a tag (the policy requires a move instead).
 
+For denied operations some clarifying message is sent to user. If there is no
+specific message (everything after action keyword), only generic 'policy
+violation (policy_name)' is sent, so it could be helpful to specify such
+messages in more complicated cases.
+
 General format
 ==============
 The general form of a basic policy line is one of the following

docs/source/release_notes.rst

@@ -5,6 +5,8 @@ Release Notes
 .. toctree::
     :maxdepth: 1
 
+    release_notes_1.16.2
+    release_notes_1.16.1
     release_notes_1.16
     release_notes_1.15.1
     release_notes_1.15

docs/source/release_notes_1.16.1.rst

+Koji 1.16.1 Release Notes
+=========================
+
+Koji 1.16.1 is a point release for Koji 1.16. The major changes include:
+
+- Allow target info to be read for different type tasks in channel policy.
+- Create symlinks for builds imported onto non-default volumes.
+- Fix RPMdiff issues found in Koji 1.16.0.
+
+Please see: :doc:`release_notes_1.16`
+
+Issues fixed in 1.16.1
+----------------------
+
+- `Issue 847 <https://pagure.io/koji/issue/847>`_ --
+  spin-livecd failed with "Could not resolve host"
+
+- `Issue 932 <https://pagure.io/koji/issue/932>`_ --
+  Fix use_host_resolv with new mock version
+
+- `Issue 1010 <https://pagure.io/koji/issue/1010>`_ --
+  koji fails runroot because of `UnicodeDecodeError`
+
+- `Issue 998 <https://pagure.io/koji/issue/998>`_ --
+  cancel build doesn't work for images
+
+- `Issue 994 <https://pagure.io/koji/issue/994>`_ --
+  rpmdiff calculate wrong results
+
+- `Issue 1025 <https://pagure.io/koji/issue/1025>`_ --
+  missing default volume symlink for imported builds affected by volume policy
+
+- `Issue 1007 <https://pagure.io/koji/issue/1007>`_ --
+  decode_args() might result in --package parameter missing in runroot command
+
+- `Issue 150 <https://pagure.io/koji/issue/150>`_ --
+  no target info in channel policy for non-rpm tasks
+
+- `PR: 973 <https://pagure.io/koji/pull-request/973>`_ --
+  Check empty arches before spawning dist-repo
+
+- `Issue 958 <https://pagure.io/koji/issue/958>`_ --
+  Notification for tagBuildBypass is writing message untagged from, expected message tagged into
+
+- `Issue 968 <https://pagure.io/koji/issue/968>`_ --
+  Default enable python3 on RHEL8
+
+- `Issue 916 <https://pagure.io/koji/issue/916>`_ --
+  `clone-tag` doesn't preserve tagging order
+
+- `Issue 949 <https://pagure.io/koji/issue/949>`_ --
+  cli: [rpminfo] KeyError: 'license' for external RPM
+
+- `Issue 876 <https://pagure.io/koji/issue/876>`_ --
+  koji clone-tag raises "UnboundLocalError"
+
+- `Issue 945 <https://pagure.io/koji/issue/945>`_ --
+  Koji build fail due to ambiguous python shebang
+

docs/source/release_notes_1.16.2.rst

+Koji 1.16.2 Release Notes
+=========================
+
+Koji 1.16.2 is a bugfix release for Koji 1.16.
+The purpose of this release is address  :doc:`CVE-2018-1002161`.
+
+See also:
+
+- :doc:`release_notes_1.16.1`
+
+- :doc:`release_notes_1.16`
+
+
+Issues fixed in 1.16.2
+----------------------
+
+- `Issue 1183 <https://pagure.io/koji/issue/1183>`_ --
+  CVE-2018-1002161

docs/source/server_howto.rst

@@ -95,7 +95,6 @@ koji components.
 
 ::
 
-    <pre>
     HOME                    = .
     RANDFILE                = .rand
 
@@ -349,7 +348,7 @@ currently hard coded into the koji client.
     Used by the koji-web server during communications with the koji-hub. This
     is a user principal that will authenticate koji-web to Kerberos as
     "koji/kojiweb@EXAMPLE.COM". Koji-web will proxy the mod_auth_gssapi user
-    information to koji-hub (the <code>ProxyPrincipals</code> koji-hub config
+    information to koji-hub (the ``ProxyPrincipals`` koji-hub config
     option).
 
 ``koji/kojira@EXAMPLE.COM``
@@ -468,7 +467,7 @@ Authorize Koji-web and Koji-hub resources
         local   koji        koji                              trust
 
     .. note::
-        To enforce password based logins to the database, change <tt>trust</tt> to <tt>md5</tt>.
+        To enforce password based logins to the database, change ``trust`` to ``md5``.
 
     ::
 

hub/Makefile

-PYTHON=python
 PACKAGE = $(shell basename `pwd`)
 PYFILES = $(wildcard *.py)
 PYVER := $(shell $(PYTHON) -c 'import sys; print("%.3s" %(sys.version))')
@@ -22,8 +21,6 @@ install:
 		exit 1; \
 	fi
 
-	mkdir -p $(DESTDIR)/usr/libexec/koji-hub
-
 	mkdir -p $(DESTDIR)/etc/httpd/conf.d
 	install -p -m 644 httpd.conf $(DESTDIR)/etc/httpd/conf.d/kojihub.conf
 

hub/kojixmlrpc.py

@@ -51,7 +51,10 @@ class Marshaller(ExtendedMarshaller):
     def dump_datetime(self, value, write):
         # For backwards compatibility, we return datetime objects as strings
         value = value.isoformat(' ')
+        if six.PY2:
             self.dump_string(value, write)
+        else:
+            self.dump_unicode(value, write)
     dispatch[datetime.datetime] = dump_datetime
 
 
@@ -363,6 +366,8 @@ def offline_reply(start_response, msg=None):
     else:
         faultString = msg
     response = dumps(Fault(faultCode, faultString))
+    if six.PY3:
+        response = response.encode()
     headers = [
         ('Content-Length', str(len(response))),
         ('Content-Type', "text/xml"),
@@ -628,7 +633,7 @@ def setup_logging2(opts):
             name = 'koji' + name
         elif not name.startswith('koji'):
             name = 'koji.' + name
-        level_code = logging._levelNames[level]
+        level_code = logging.getLevelName(level)
         logging.getLogger(name).setLevel(level_code)
     logger = logging.getLogger("koji")
     # if KojiDebug is set, force main log level to DEBUG
@@ -699,6 +704,8 @@ def application(environ, start_response):
         ]
         start_response('405 Method Not Allowed', headers)
         response = "Method Not Allowed\nThis is an XML-RPC server. Only POST requests are accepted."
+        if six.PY3:
+            response = response.encode()
         headers = [
             ('Content-Length', str(len(response))),
             ('Content-Type', "text/plain"),
@@ -728,6 +735,8 @@ def application(environ, start_response):
                 response = h._wrap_handler(h.handle_upload, environ)
             else:
                 response = h._wrap_handler(h.handle_rpc, environ)
+            if six.PY3:
+                response = response.encode()
             headers = [
                 ('Content-Length', str(len(response))),
                 ('Content-Type', "text/xml"),

koji.spec

-# Enable Python 3 builds for Fedora/RHEL8
-%if 0%{?fedora} || 0%{?rhel} >= 8
 %bcond_without python3
-# If the definition isn't available for python3_pkgversion, define it
-%{?!python3_pkgversion:%global python3_pkgversion 3}
+%bcond_without python2
+%global _python_bytecompile_extra 0
+
+# We can build varying amounts of Koji for python2 and python3 based on
+# the py[23]_support macro values. Valid values are:
+#   undefined or 0 -- do not build
+#   1 -- build just the cli and lib
+#   2 -- build everything we can
+# For executable scripts, py3 wins if we build it
+# The following rules tweak these settings based on options and environment
+
+# Default to building both fully
+%define py2_support 2
+%define py3_support 2
+
+%if 0%{?rhel} >= 8
+# and no python2 on rhel8+
+%define py2_support 0
+%else
+%if 0%{?rhel}
+# No python3 for older rhel
+%define py3_support 0
+%endif
+%endif
+
+%if 0%{?fedora} >= 33
+# no py2 after F33
+%define py2_support 0
+%define py3_support 2
+%else
+%if 0%{?fedora} >= 30
+%define py2_support 1
+%define py3_support 2
 %else
-%bcond_with python3
+%if 0%{?fedora}
+# match what the older Fedoras already have
+%define py2_support 2
+%define py3_support 1
+%endif
+%endif
+%endif
+
+# Lastly enforce the bcond parameters
+%if %{without python2}
+%define py2_support 0
+%endif
+%if %{without python3}
+%define py3_support 0
+%endif
+
+%if ! %{py2_support}
+# use python3
+%define __python %{__python3}
 %endif
 
 # Compatibility with RHEL. These macros have been added to EPEL but
@@ -16,6 +63,9 @@
 %{!?py2_build: %global py2_build %{expand: CFLAGS="%{optflags}" %{__python2} setup.py %{?py_setup_args} build --executable="%{__python2} -s"}}
 %{!?py2_install: %global py2_install %{expand: CFLAGS="%{optflags}" %{__python2} setup.py %{?py_setup_args} install -O1 --skip-build --root %{buildroot}}}
 
+# If the definition isn't available for python3_pkgversion, define it
+%{?!python3_pkgversion:%global python3_pkgversion 3}
+
 %if 0%{?fedora} >= 21 || 0%{?rhel} >= 7
 %global use_systemd 1
 %else
@@ -33,14 +83,15 @@
 Name: koji
 Version: 1.16.0
 Release: %{release}%{?dist}
-License: LGPLv2
+License: LGPLv2 and GPLv2+
+# the included arch lib from yum's rpmUtils is GPLv2+
 Summary: Build system tools
 Group: Applications/System
 URL: https://pagure.io/koji
 Source: https://releases.pagure.org/koji/koji-%{version}.tar.bz2
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: noarch
-%if 0%{with python3}
+%if 0%{py3_support}
 Requires: python%{python3_pkgversion}-%{name} = %{version}-%{release}
 Requires: python%{python3_pkgversion}-libcomps
 %else
@@ -58,6 +109,7 @@ BuildRequires: pkgconfig
 Koji is a system for building and tracking RPMS.  The base package
 contains shared libraries and the command-line interface.
 
+%if 0%{py2_support}
 %package -n python2-%{name}
 Summary: Build system tools python library
 %{?python_provide:%python_provide python2-%{name}}
@@ -79,8 +131,9 @@ Requires: python-six
 
 %description -n python2-%{name}
 desc
+%endif
 
-%if 0%{with python3}
+%if 0%{py3_support}
 %package -n python%{python3_pkgversion}-%{name}
 Summary: Build system tools python library
 %{?python_provide:%python_provide python%{python3_pkgversion}-%{name}}
@@ -100,21 +153,23 @@ Requires: python%{python3_pkgversion}-six
 desc
 %endif
 
+%if 0%{py2_support}
 %package -n python2-%{name}-cli-plugins
 Summary: Koji client plugins
 Group: Applications/Internet
 License: LGPLv2
-Requires: %{name} = %{version}-%{release}
+Requires: python2-%{name} = %{version}-%{release}
 
 %description -n python2-%{name}-cli-plugins
 Plugins to the koji command-line interface
+%endif
 
-%if 0%{with python3}
+%if 0%{py3_support}
 %package -n python%{python3_pkgversion}-%{name}-cli-plugins
 Summary: Koji client plugins
 Group: Applications/Internet
 License: LGPLv2
-Requires: %{name} = %{version}-%{release}
+Requires: python%{python3_pkgversion}-%{name} = %{version}-%{release}
 
 %description -n python%{python3_pkgversion}-%{name}-cli-plugins
 Plugins to the koji command-line interface
@@ -123,6 +178,21 @@ Plugins to the koji command-line interface
 %package hub
 Summary: Koji XMLRPC interface
 Group: Applications/Internet
+License: LGPLv2
+Requires: %{name} = %{version}-%{release}
+Requires: %{name}-hub-code
+%if 0%{?fedora} || 0%{?rhel} > 7
+Suggests: python%{python3_pkgversion}-%{name}-hub
+Suggests: python%{python3_pkgversion}-%{name}-hub-plugins
+%endif
+
+%description hub
+koji-hub is the XMLRPC interface to the koji database
+
+%if 0%{py2_support} > 1
+%package -n python2-%{name}-hub
+Summary: Koji XMLRPC interface
+Group: Applications/Internet
 License: LGPLv2 and GPLv2
 # rpmdiff lib (from rpmlint) is GPLv2 (only)
 Requires: httpd
@@ -131,28 +201,74 @@ Requires: mod_wsgi
 Requires: mod_auth_gssapi
 %endif
 Requires: python-psycopg2
-Requires: %{name} = %{version}-%{release}
-# we need the python2 lib here
 Requires: python2-%{name} = %{version}-%{release}
+# py2 xor py3
+Provides: %{name}-hub-code = %{version}-%{release}
 
-%description hub
+%description -n python2-%{name}-hub
 koji-hub is the XMLRPC interface to the koji database
+%endif
+
+%if 0%{py3_support} > 1
+%package -n python%{python3_pkgversion}-%{name}-hub
+Summary: Koji XMLRPC interface
+Group: Applications/Internet
+License: LGPLv2 and GPLv2
+# rpmdiff lib (from rpmlint) is GPLv2 (only)
+Requires: httpd
+Requires: mod_wsgi
+%if 0%{?fedora} >= 21 || 0%{?rhel} >= 7
+Requires: mod_auth_gssapi
+%endif
+Requires: python-psycopg2
+Requires: python%{python3_pkgversion}-%{name} = %{version}-%{release}
+# py2 xor py3
+Provides: %{name}-hub-code = %{version}-%{release}
+
+%description -n python%{python3_pkgversion}-%{name}-hub
+koji-hub is the XMLRPC interface to the koji database
+%endif
 
 %package hub-plugins
 Summary: Koji hub plugins
 Group: Applications/Internet
 License: LGPLv2
-Requires: %{name} = %{version}-%{release}
-Requires: %{name}-hub = %{version}-%{release}
-Requires: python-qpid >= 0.7
-%if 0%{?rhel} >= 6
-Requires: python-qpid-proton
+Requires: %{name}-hub-plugins-code = %{version}-%{release}
+%if 0%{?fedora} || 0%{?rhel} > 7
+Suggests: python%{python3_pkgversion}-%{name}-hub-plugins
 %endif
-Requires: cpio
 
 %description hub-plugins
 Plugins to the koji XMLRPC interface
 
+%if 0%{py2_support} > 1
+%package -n python2-%{name}-hub-plugins
+Summary: Koji hub plugins
+Group: Applications/Internet
+License: LGPLv2
+Requires: python2-%{name}-hub = %{version}-%{release}
+Requires: python2-qpid-proton
+Requires: cpio
+Provides: %{name}-hub-plugins-code = %{version}-%{release}
+
+%description -n python2-%{name}-hub-plugins
+Plugins to the koji XMLRPC interface
+%endif
+
+%if 0%{py3_support} > 1
+%package -n python%{python3_pkgversion}-%{name}-hub-plugins
+Summary: Koji hub plugins
+Group: Applications/Internet
+License: LGPLv2
+Requires: python%{python3_pkgversion}-%{name}-hub = %{version}-%{release}
+Requires: python%{python3_pkgversion}-qpid-proton
+Requires: cpio
+Provides: %{name}-hub-plugins-code = %{version}-%{release}
+
+%description -n python%{python3_pkgversion}-%{name}-hub-plugins
+Plugins to the koji XMLRPC interface
+%endif
+
 %package builder-plugins
 Summary: Koji builder plugins
 Group: Applications/Internet
@@ -168,13 +284,9 @@ Summary: Koji RPM builder daemon
 Group: Applications/System
 License: LGPLv2 and GPLv2+
 #mergerepos (from createrepo) is GPLv2+
-Requires: %{name} = %{version}-%{release}
-# we need the python2 lib here
-Requires: python2-%{name} = %{version}-%{release}
 Requires: mock >= 0.9.14
 Requires(pre): /usr/sbin/useradd
 Requires: squashfs-tools
-Requires: python2-multilib
 %if %{use_systemd}
 Requires(post): systemd
 Requires(preun): systemd
@@ -188,9 +300,16 @@ Requires(preun): /sbin/service
 Requires: /usr/bin/cvs
 Requires: /usr/bin/svn
 Requires: /usr/bin/git
-Requires: python-cheetah
-%if 0%{?fedora} >= 9
 Requires: createrepo >= 0.9.2
+%if 0%{py3_support} > 1
+Requires: python%{python3_pkgversion}-%{name} = %{version}-%{release}
+Requires: python%{python3_pkgversion}-librepo
+Requires: python%{python3_pkgversion}-multilib
+Requires: python%{python3_pkgversion}-cheetah
+%else
+Requires: python2-%{name} = %{version}-%{release}
+Requires: python2-multilib
+Requires: python-cheetah
 %endif
 
 %description builder
@@ -201,7 +320,6 @@ tasks that come through the Koji system.
 Summary: Koji virtual machine management daemon
 Group: Applications/System
 License: LGPLv2
-Requires: %{name} = %{version}-%{release}
 # we need the python2 lib here
 Requires: python2-%{name} = %{version}-%{release}
 %if %{use_systemd}
@@ -228,8 +346,6 @@ Summary: Koji Utilities
 Group: Applications/Internet
 License: LGPLv2
 Requires: python-psycopg2
-Requires: %{name} = %{version}-%{release}
-# we need the python2 lib here
 Requires: python2-%{name} = %{version}-%{release}
 %if %{use_systemd}
 Requires(post): systemd
@@ -244,6 +360,21 @@ Utilities for the Koji system
 Summary: Koji Web UI
 Group: Applications/Internet
 License: LGPLv2
+Requires: %{name} = %{version}-%{release}
+Requires: %{name}-web-code = %{version}-%{release}
+%if 0%{?fedora} || 0%{?rhel} > 7
+Suggests: python%{python3_pkgversion}-%{name}-web
+%endif
+
+%description web
+koji-web is a web UI to the Koji system.
+
+%if 0%{py2_support} > 1
+%package -n python2-%{name}-web
+Summary: Koji Web UI
+Group: Applications/Internet
+License: LGPLv2
+%{?python_provide:%python_provide python2-%{name}-web}
 Requires: httpd
 Requires: mod_wsgi
 %if 0%{?fedora} >= 21 || 0%{?rhel} >= 7
@@ -254,12 +385,30 @@ Requires: python-krbV >= 1.0.13
 %endif
 Requires: python-psycopg2
 Requires: python-cheetah
-Requires: %{name} = %{version}-%{release}
-# we need the python2 lib here
 Requires: python2-%{name} = %{version}-%{release}
+Provides: %{name}-web-code = %{version}-%{release}
 
-%description web
+%description -n python2-%{name}-web
 koji-web is a web UI to the Koji system.
+%endif
+
+%if 0%{py3_support} > 1
+%package -n python%{python3_pkgversion}-%{name}-web
+Summary: Koji Web UI
+Group: Applications/Internet
+License: LGPLv2
+%{?python_provide:%python_provide python%{python3_pkgversion}-%{name}-web}
+Requires: httpd
+Requires: python%{python3_pkgversion}-mod_wsgi
+Requires: mod_auth_gssapi
+Requires: python%{python3_pkgversion}-psycopg2
+Requires: python%{python3_pkgversion}-cheetah
+Requires: python%{python3_pkgversion}-%{name} = %{version}-%{release}
+Provides: %{name}-web-code = %{version}-%{release}
+
+%description -n python%{python3_pkgversion}-%{name}-web
+koji-web is a web UI to the Koji system.
+%endif
 
 %prep
 %setup -q
@@ -268,16 +417,66 @@ koji-web is a web UI to the Koji system.
 
 %install
 rm -rf $RPM_BUILD_ROOT
-make DESTDIR=$RPM_BUILD_ROOT %{?install_opt} install
-%if 0%{with python3}
-cd koji
-make DESTDIR=$RPM_BUILD_ROOT PYTHON=python3 %{?install_opt} install
-cd ../cli
-make DESTDIR=$RPM_BUILD_ROOT PYTHON=python3 %{?install_opt} install
-cd ../plugins
-make DESTDIR=$RPM_BUILD_ROOT PYTHON=python3 %{?install_opt} install
+
+%if 0%{py2_support} < 2  &&  0%{py3_support} < 2
+echo "At least one python must be built with full support"
+exit 1
+%endif
+
+# python2 build
+%if 0%{py2_support} > 1
+make DESTDIR=$RPM_BUILD_ROOT PYTHON=%{__python2} %{?install_opt} install
+%else
+%if 0%{py2_support}
+for d in koji cli plugins ; do
+    pushd $d
+    make DESTDIR=$RPM_BUILD_ROOT KOJI_MINIMAL=1 PYTHON=%{__python2} %{?install_opt} install
+    popd
+done
+%endif
+%endif
+
+
+# python3 build
+%if 0%{py3_support} > 1
+make DESTDIR=$RPM_BUILD_ROOT PYTHON=%{__python3} %{?install_opt} install
 # alter python interpreter in koji CLI
-sed -i 's/\#\!\/usr\/bin\/python2/\#\!\/usr\/bin\/python3/' $RPM_BUILD_ROOT/usr/bin/koji
+scripts='%{_bindir}/koji %{_sbindir}/kojid %{_sbindir}/kojira %{_sbindir}/koji-shadow
+         %{_sbindir}/koji-gc %{_sbindir}/kojivmd'
+for fn in $scripts ; do
+    sed -i 's|#!/usr/bin/python2|#!/usr/bin/python3|' $RPM_BUILD_ROOT$fn
+done
+%else
+%if 0%{py3_support}
+# minimal
+for d in koji cli plugins ; do
+    pushd $d
+    make DESTDIR=$RPM_BUILD_ROOT KOJI_MINIMAL=1 PYTHON=%{__python3} %{?install_opt} install
+    popd
+done
+# alter python interpreter in koji CLI
+sed -i 's|#!/usr/bin/python2|#!/usr/bin/python3|' $RPM_BUILD_ROOT/usr/bin/koji
+%endif
+%endif
+
+%if 0%{?fedora} >= 28
+# handle extra byte compilation
+extra_dirs='
+    %{_prefix}/lib/koji-builder-plugins
+    %{_prefix}/koji-hub-plugins
+    %{_datadir}/koji-hub
+    %{_datadir}/koji-web/lib/kojiweb
+    %{_datadir}/koji-web/scripts'
+%if 0%{py2_support} > 1
+for fn in $extra_dirs ; do
+    %py_byte_compile %{__python2} %{buildroot}$fn
+done
+%endif
+%if 0%{py3_support} > 1
+for fn in $extra_dirs ; do
+    %py_byte_compile %{__python3} %{buildroot}$fn
+done
+%endif
 %endif
 
 %clean
@@ -290,25 +489,29 @@ rm -rf $RPM_BUILD_ROOT
 %dir /etc/koji.conf.d
 %doc docs Authors COPYING LGPL
 
+%if 0%{py2_support}
 %files -n python2-%{name}
 %defattr(-,root,root)
 %{python2_sitelib}/%{name}
 %{python2_sitelib}/koji_cli
+%endif
 
-%if 0%{with python3}
+%if 0%{py3_support}
 %files -n python%{python3_pkgversion}-koji
 %{python3_sitelib}/%{name}
 %{python3_sitelib}/koji_cli
 %endif
 
+%if 0%{py2_support}
 %files -n python2-%{name}-cli-plugins
 %defattr(-,root,root)
 %{python2_sitelib}/koji_cli_plugins
 # we don't have config files for default plugins yet
 #%%dir %%{_sysconfdir}/koji/plugins
 #%%config(noreplace) %%{_sysconfdir}/koji/plugins/*.conf
+%endif
 
-%if 0%{with python3}
+%if 0%{py3_support}
 %files -n python%{python3_pkgversion}-%{name}-cli-plugins
 %defattr(-,root,root)
 %{python3_sitelib}/koji_cli_plugins
@@ -319,26 +522,50 @@ rm -rf $RPM_BUILD_ROOT
 
 %files hub
 %defattr(-,root,root)
-%{_datadir}/koji-hub
-%dir %{_libexecdir}/koji-hub
 %config(noreplace) /etc/httpd/conf.d/kojihub.conf
 %dir /etc/koji-hub
 %config(noreplace) /etc/koji-hub/hub.conf
 %dir /etc/koji-hub/hub.conf.d
 
-%files hub-plugins
+%if 0%{py2_support} > 1
+%files -n python2-%{name}-hub
 %defattr(-,root,root)
-%dir %{_prefix}/lib/koji-hub-plugins
-%{_prefix}/lib/koji-hub-plugins/*.py*
+%{_datadir}/koji-hub/*.py*
+%endif
+
+%if 0%{py3_support} > 1
+%files -n python%{python3_pkgversion}-%{name}-hub
+%defattr(-,root,root)
+%{_datadir}/koji-hub/*.py
+%{_datadir}/koji-hub/__pycache__
+%endif
+
+%files hub-plugins
 %dir /etc/koji-hub/plugins
 %config(noreplace) /etc/koji-hub/plugins/*.conf
 
+%if 0%{py2_support} > 1
+%files -n python2-%{name}-hub-plugins
+%defattr(-,root,root)
+%{_prefix}/lib/koji-hub-plugins/*.py*
+%endif
+
+%if 0%{py3_support} > 1
+%files -n python%{python3_pkgversion}-%{name}-hub-plugins
+%defattr(-,root,root)
+%{_prefix}/lib/koji-hub-plugins/*.py
+%{_prefix}/lib/koji-hub-plugins/__pycache__
+%endif
+
 %files builder-plugins
 %defattr(-,root,root)
 %dir /etc/kojid/plugins
 %config(noreplace) /etc/kojid/plugins/*.conf
 %dir %{_prefix}/lib/koji-builder-plugins
 %{_prefix}/lib/koji-builder-plugins/*.py*
+%if 0%{py3_support} > 1
+%{_prefix}/lib/koji-builder-plugins/__pycache__
+%endif
 
 %files utils
 %defattr(-,root,root)
@@ -360,12 +587,23 @@ rm -rf $RPM_BUILD_ROOT
 
 %files web
 %defattr(-,root,root)
-%{_datadir}/koji-web
 %dir /etc/kojiweb
 %config(noreplace) /etc/kojiweb/web.conf
 %config(noreplace) /etc/httpd/conf.d/kojiweb.conf
 %dir /etc/kojiweb/web.conf.d
 
+%if 0%{py2_support} > 1
+%files -n python2-%{name}-web
+%defattr(-,root,root)
+%{_datadir}/koji-web
+%endif
+
+%if 0%{py3_support} > 1
+%files -n python%{python3_pkgversion}-%{name}-web
+%defattr(-,root,root)
+%{_datadir}/koji-web
+%endif
+
 %files builder
 %defattr(-,root,root)
 %{_sbindir}/kojid
@@ -442,7 +680,6 @@ if [ $1 = 0 ]; then
   /sbin/service kojivmd stop &> /dev/null
   /sbin/chkconfig --del kojivmd
 fi
-%endif
 
 %if %{use_systemd}
 
@@ -465,6 +702,7 @@ if [ $1 = 0 ]; then
   /sbin/chkconfig --del kojira
 fi
 %endif
+%endif
 
 %changelog
 * Tue May 15 2018 Mike McLean <mikem at redhat.com> - 1.16.0-1

koji/Makefile

-PYTHON=python
 PACKAGE = $(shell basename `pwd`)
-ifeq ($(PYTHON), python3)
-    # for python3 we fully support only basic library + CLI
-    PYFILES = __init__.py util.py plugin.py xmlrpcplus.py
-    PYSCRIPTS =
-    SUBDIRS =
-else
 PYFILES = $(wildcard *.py)
-    PYSCRIPTS = context.py
+PYSCRIPTS =
 SUBDIRS =
-endif
 PYVER := $(shell $(PYTHON) -c 'import sys; print("%.3s" % (sys.version))')
 PYSYSDIR := $(shell $(PYTHON) -c 'import sys; print(sys.prefix)')
 PYLIBDIR = $(PYSYSDIR)/lib/python$(PYVER)