Package: errata-tool
Modern Python API to Red Hat’s Errata Tool.python-errata-tool is a Python library that wraps the Errata Tool’s REST API.
It usesrequests_gssapito authenticate and parses JSON responses intoErratumobjects. You can
use it to create new advisories, or read and update existing advisories. TheErratumConnectorclass also provides lower-level access to all of the
Errata Tool’s REST API.Example:fromerrata_toolimportErratume=Erratum(errata_id=1234)print(e.errata_state)# prints "NEW_FILES"print(e.url())# prints "https://errata.devel.redhat.com/advisory/1234"Creating a new bugfix advisory:e=Erratum(product='RHCEPH',release='rhceph-2.1',#errata_type='RHBA'         # Default; may be omittedsynopsis='Red Hat Ceph Storage 2.1 bug fix update',topic='An update for Red Hat Ceph 2.1 is now available.',description='This update contains the following fixes ...',solution='Before applying this update...',qe_email='someone@redhat.com',qe_group='RHC (Ceph) QE',owner_email='kdreyer@redhat.com',manager_email='ohno@redhat.com',)e.commit()print(e.url())Creating a new enhancement (feature) advisory:e=Erratum(product='RHCEPH',release='rhceph-2.1',errata_type='RHEA',# Set to RHEA for RHEAsynopsis='Red Hat Ceph Storage 2.1 enhancement update',topic='An update for Red Hat Ceph 2.1 is now available.',description='This update contains the following features ...',solution='Before applying this update...',qe_email='someone@redhat.com',qe_group='RHC (Ceph) QE',owner_email='kdreyer@redhat.com',manager_email='ohno@redhat.com',)e.commit()print(e.url())Creating a new security advisory. Note that RHSA (Security)
advisories are given one of four impacts (Low, Moderate,
Important, and Critical). See this link for more information:https://access.redhat.com/security/updates/classificatione=Erratum(product='RHCEPH',release='rhceph-2.1',errata_type='RHSA',# Set to RHSA for RHSAsecurity_impact='Moderate',# Required for RHSAsynopsis='Red Hat Ceph Storage 2.1 security update',topic='An update for Red Hat Ceph 2.1 is now available.',description='This update contains the following fixes ...',solution='Before applying this update...',qe_email='someone@redhat.com',qe_group='RHC (Ceph) QE',owner_email='kdreyer@redhat.com',manager_email='ohno@redhat.com',)e.commit()print(e.url())errata-tool command-line interfaceTheerrata-toolCLI is a thin wrapper around the classes. You can use it to
query information from the Errata Tool or create new releases (releng):errata-tool -h

usage: errata-tool [-h] [--stage] [--dry-run] {advisory,product,release} ...

positional arguments:
  {advisory,product,release}
    advisory            Get or create an advisory
    product             Get a product
    release             Get or create a release (RCM)

optional arguments:
  --stage               use staging ET instance
  --dry-run             show what would happen, but don't do iterrata-tool command-line interface examplesWaiting and conditionally pushing an advisory:As a release engineer one often checks the status of an advisory if it is ready
to be pushed. To avoid human polling of the state and to automate the advisory
push two options are provided under theerrata-tooladvisory pushoption:errata-tool advisory push --help
usage: errata-tool advisory push [-h] [--target {stage,live}]
[--wait-for-state {SHIPPED_LIVE,PUSH_READY}] [--push-when-ready]
[--verbose] errata_id

positional arguments:
  errata_id             advisory id, "12345"

optional arguments:
  -h, --help            show this help message and exit
  --target {stage,live}
                        stage (default) or live
  --wait-for-state {SHIPPED_LIVE,PUSH_READY}
                        state : PUSH_READY or SHIPPED_LIVE
  --push-when-ready     Push if the advisory enters state PUSH_READY
  --verbose             print current state of the advisoryThe--wait-for-stateoption polls at regular interval for the advisory to
enter one of the two desired states - PUSH_READY or SHIPPED_LIVEwhen the advisory reaches that state the polling stops and the script exits with
a successful exit code$? eq 0.Caveat: The script will wait forever until that state is reached or interrupted
by the user. The option to have a cap on the wait time was dropped to keep the
usage simple and for the lack of a compelling use case.The--push-when-readyoption pushes the advisory if it is in  PUSH_READY
state. The--push-when-readyoption can be used with--wait-for-stateoption to repeatedly poll the advisory until it reaches PUSH_READY state before
pushing it.
Here are some usecases:usecase 1: Push advisory if it is in state PUSH_READY stateerrata-tool--stageadvisorypush--targetlive--push-when-ready12345usecase 2: Wait for advisory to enter PUSH_READY state and push the advisoryerrata-tool--stageadvisorypush--targetlive--push-when-ready\--wait-for-statePUSH_READY12345usecase 3: Wait for advisory to enter SHIPPED_LIVE, push the advisory ifit enters PUSH_READY state while waiting.errata-tool--stageadvisorypush--targetlive--push-when-ready\--wait-for-stateSHIPPED_LIVE12345usecase 4: Push independent advisories before pushing those which aredependent on the independent advisoriesSee:https://issues.redhat.com/browse/SPMM-9887# Ship advisory 12346 after shipping 12345errata-tool--stageadvisorypush--targetlive--push-when-ready\--wait-for-stateSHIPPED_LIVE12345&&\errata-tool--stageadvisorypush--targetlive--push-when-ready\--wait-for-statePUSH_READY12346More Python ExamplesGetting an erratum’s name:e=Erratum(errata_id=22986)print(e.errata_name)# prints "RH*A-YYYY:NNNNN", for example "RHBA-2018:12345"Adding bugs:e=Erratum(errata_id=22986)e.addBugs([12345,123678])e.commit()# You can read the current list of bugs with the "e.errata_bugs" property.Removing bugs:e=Erratum(errata_id=22986)e.removeBugs([12345,123678])# You can simply call "commit()" without checking the return code, or check# it and use refresh() to refresh our local instance data for the errata# advisory.need_refresh=e.commit()ifneed_refresh:print('refreshing')e.refresh()Checking whether an advisory is embargoed:e=Erratum(errata_id=22986)ife.embargoed:# it's embargoedelse:# it's not embargoedChecking whether an advisory is text-only:e=Erratum(errata_id=24075)ife.text_only:# it's text-only# If it's an RHSA, you may want to get/set e.text_only_cpe here.else:# it's not text-onlyAdding builds:e=Erratum(errata_id=24075)# The "release" kwarg is the Errata Tools's "product version" in# composedb, for example "RHEL-7-CEPH-2".e.addBuilds(['ceph-10.2.3-17.el7cp'],release='RHEL-7-CEPH-2')Adding container builds:e=Erratum(errata_id=34279)# For non-RPM Brew builds, you must specify the file_types kwarg.# For container builds, this is "tar".e.addBuilds('rhceph-rhel7-container-3-9',release='RHEL-7-CEPH-3',file_types={'rhceph-rhel7-container-3-9':['tar']})Changing state:e=Erratum(errata_id=24075)e.setState('QE')e.commit()Changing docs reviewer:e=Erratum(errata_id=24075)e.changeDocsReviewer('kdreyer@redhat.com')Adding someone to the CC list:e=Erratum(errata_id=24075)e.addCC('kdreyer@redhat.com')Changing an advisory type:e=Erratum(errata_id=33840)e.update(errata_type='RHBA')e.commit()Reloading the all specific builds that lack product listings:e=Erratum(errata_id=24075)ife.missing_product_listings:# a (possibly-empty) list of build NVRsresult=e.reloadBuilds(no_rpm_listing_only=True)# result is a dict for this job trackerDetermining if an advisory has RPMs or containers:e=Erratum(errata_id=24075)content_types=e.content_types# result is a list, like ["rpm"], or ["docker"]Get active RPMDiff results for an advisory:e=Erratum(errata_id=24075)bad=[]forresultine.externalTests(test_type='rpmdiff'):ifresult['attributes']['status']notin('PASSED','WAIVED'):# See result['attributes']['external_id'] for the integer to pass# into RPMDiff's run API.bad.append(result)Set the CDN repos for a container advisory (only applies for advisories
containing Docker images):e=Erratum(errata_id=24075)assert'docker'ine.content_typese.metadataCdnRepos(enable=['rhel-7-server-rhceph-3-mon-rpms__x86_64'])Same thing, but for text-only advisories:e=Erratum(errata_id=24075)asserte.text_onlye.textOnlyRepos(enable=['rhel-7-server-rhceph-3-mon-rpms__x86_64'])Working with productsTheerrata_tool.product.Productclass can look up existing products.Looking up a product:fromerrata_tool.productimportProductp=Product('RHCEPH')print(p.id)# 104print(p.name)# "RHCEPH"print(p.description)# "Red Hat Ceph Storage"Working with releasesTheerrata_tool.release.Releaseclass can look up existing releases or
create new release entries.Looking up a release:fromerrata_tool.releaseimportReleaser=Release(name='rhceph-2.4')print(r.id)# 792print(r.name)# "rhceph-2.4"print(r.description)# "Red Hat Ceph Storage 2.4"print(r.type)# "QuarterlyUpdate"print(r.is_active)# Trueprint(r.enabled)# Trueprint(r.blocker_flags)# ['ceph-2.y', 'pm_ack', 'devel_ack', 'qa_ack']print(r.edit_url)# https://errata.devel.redhat.com/release/edit/792Finding all “NEW_FILES” advisories for a release:fromerrata_tool.releaseimportReleaserel=Release(name='rhceph-3.0')advisories=rel.advisories()new_files=[aforainadvisoriesifa['status']=='NEW_FILES']print(new_files)# prints the list of advisories' dataCreating a new release (this requires the “releng” role in the Errata Tool):fromerrata_tool.releaseimportReleaser=Release.create(name='rhceph-3.0',product='RHCEPH',product_versions=['RHEL-7-CEPH-3'],type='QuarterlyUpdate',program_manager='anharris',blocker_flags='ceph-3.0',default_brew_tag='ceph-3.0-rhel-7-candidate',)print('created new rhceph-3.0 release')print('visit%sto edit further'%r.edit_url)Using the staging serverTo use the staging Errata Tool environment without affecting production, set
theErrataConnector._urlmember variable to the staging URL.fromerrata_toolimportErrataConnector,ErratumErrataConnector._url='https://errata.stage.engineering.redhat.com/'# Now try something like creating an advisory, and it will not show up in# prod, or bother people with emails, etc.e=Erratum(product='RHCEPH',release='rhceph-2.1',synopsis='Red Hat Ceph Storage 2.1 bug fix update',...)e.commit()Debugging many Errata Tool API callsMaybe your application makes many API calls (lots of advisories, builds, etc),
When processing large numbers of errata from higher-level tools, it’s helpful
to understand where the time is spent to see if multiple calls can be avoided.SetErrataConnector.debug = True, and then your connector object will
record information about each call it makes.  Each GET/PUT/POST is recorded,
along with totals / mean / min / max.URL APIs are deduplicated based on their name, so two calls to different
errata on the same API is recorded as a single API.To extract the information and print it, one might use PrettyTable:e=Erratum(errata_id=24075)pt=PrettyTable()forcinErrataConnector.timings:foruinErrataConnector.timings[c]:pt.add_row([c,u,ErrataConnector.timings[c][u]['count'],ErrataConnector.timings[c][u]['total'],ErrataConnector.timings[c][u]['mean'],ErrataConnector.timings[c][u]['min'],ErrataConnector.timings[c][u]['max']])print(pt.get_string())SSL errorsThis library verifies the ET server’s HTTPS certificate by default. This is
more of a python-requests thing, but if you receive an SSL verification error,
it’s probably because you don’t have the Red Hat IT CA set up for your Python
environment. Particularly if you’re running this in a virtualenv, you’ll want
to set the following configuration variable:REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/source/anchors/RH-IT-Root-CA.crtWhere “RH-IT-Root-CA.crt” is the public cert that signed the ET server’s
HTTPS certificate.When using RHEL 7’s python-requests RPM, requests simply checks/etc/pki/tls/certs/ca-bundle.crt, so you’ll need to add the IT CA cert to
that big bundle file.If you’ve already added the Red Hat IT CA to your system-wide bundle, you can
have your Python code always use this file:if'REQUESTS_CA_BUNDLE'notinos.environ:os.environ['REQUESTS_CA_BUNDLE']='/etc/pki/tls/certs/ca-bundle.crt'This will make requests behave the same inside or outside your virtualenv. In
other words, with this code, your program will always validate the Red Hat IT
CA.Building RPMsInstall fedpkg, then use the Makefile:$ make srpmYou can then upload the SRPM to Copr. Or, to build RPMs on your local
computer, using mock:$ make rpmChangelogCheck out theCHANGELOG.