From ed7141d7215b54e7474c00707f3fd3c7f4d74993 Mon Sep 17 00:00:00 2001
From: Jan Kaluza <jkaluza@redhat.com>
Date: Apr 18 2018 05:37:07 +0000
Subject: Add HANDLER_BUILD_BLACKLIST to allow setting blacklist on top of whitelisted images.


---

diff --git a/conf/config.py b/conf/config.py
index 7558da7..0630e68 100644
--- a/conf/config.py
+++ b/conf/config.py
@@ -137,6 +137,25 @@ class BaseConfiguration(object):
     #     },
     # }
 
+    # whitelist for handlers to decide whether an artifact
+    # allowed to be built by whitelist should be build.
+    #
+    # The syntax is the same as for HANDLER_BUILD_WHITELIST, but any matched
+    # artifact will *not* be rebuild.
+    #
+    # HANDLER_BUILD_BLACKLIST = {
+    #     "global": {
+    #         "image": all_(
+    #             {'advisory_name': 'RHSA-.*'
+    #              'advisory_state: 'SHIPPED_LIVE'},
+    #             any_(
+    #                 {'has_hightouch_bugs': True},
+    #                 {'severity': ['critical', 'important']}
+    #             )
+    #         )
+    #     },
+    # }
+
     # ODCS configs
     # URL to ODCS to call APIs
     ODCS_SERVER_URL = 'https://odcs.localhost/'
diff --git a/freshmaker/config.py b/freshmaker/config.py
index 92e3de1..4964ef5 100644
--- a/freshmaker/config.py
+++ b/freshmaker/config.py
@@ -217,6 +217,11 @@ class Config(object):
             'default': {},
             'desc': 'Whitelist for build targets of handlers',
         },
+        'handler_build_blacklist': {
+            'type': dict,
+            'default': {},
+            'desc': 'Blacklist for build targets of handlers',
+        },
         'image_extra_repo': {
             'type': dict,
             'default': {},
diff --git a/freshmaker/handlers/__init__.py b/freshmaker/handlers/__init__.py
index 6fa6655..aaaf692 100644
--- a/freshmaker/handlers/__init__.py
+++ b/freshmaker/handlers/__init__.py
@@ -338,14 +338,21 @@ class BaseHandler(object):
         """
         # Global rules
         whitelist_rules = conf.handler_build_whitelist.get("global", {})
+        blacklist_rules = conf.handler_build_blacklist.get("global", {})
 
         # This handler rules
         handler_name = self.name
         whitelist_rules.update(conf.handler_build_whitelist.get(handler_name, {}))
+        blacklist_rules.update(conf.handler_build_blacklist.get(handler_name, {}))
 
         try:
             whitelist = whitelist_rules.get(artifact_type.name.lower(), [])
             if self._match_allow_build_rule(criteria, whitelist):
+                blacklist = blacklist_rules.get(artifact_type.name.lower(), [])
+                if self._match_allow_build_rule(criteria, blacklist):
+                    self.log_debug('%r, type=%r is blacklisted.',
+                                   criteria, artifact_type.name.lower())
+                    return False
                 self.log_debug('%r, type=%r is whitelisted.',
                                criteria, artifact_type.name.lower())
                 return True
diff --git a/tests/test_handler.py b/tests/test_handler.py
index 19f6c56..bebef81 100644
--- a/tests/test_handler.py
+++ b/tests/test_handler.py
@@ -222,12 +222,16 @@ class TestGetRepoURLs(helpers.ModelsTestCase):
 class TestAllowBuildBasedOnWhitelist(helpers.FreshmakerTestCase):
     """Test BaseHandler.allow_build"""
 
-    @patch('freshmaker.handlers.conf')
-    def test_allow_build_in_whitelist(self, conf):
+    @patch.object(freshmaker.conf, 'handler_build_whitelist', new={
+        'MyHandler': {
+            'image': {
+                'name': 'test'
+            }
+        }
+    })
+    def test_allow_build_in_whitelist(self):
         """ Test if artifact is in the handlers whitelist """
-        whitelist_rules = {"image": any_({'name': "test"})}
         handler = MyHandler()
-        conf.handler_build_whitelist.get.return_value = whitelist_rules
         container = {"name": "test", "branch": "branch"}
 
         allow = handler.allow_build(ArtifactType.IMAGE,
@@ -235,12 +239,16 @@ class TestAllowBuildBasedOnWhitelist(helpers.FreshmakerTestCase):
                                     branch=container["branch"])
         assert allow
 
-    @patch('freshmaker.handlers.conf')
-    def test_allow_build_not_in_whitelist(self, conf):
+    @patch.object(freshmaker.conf, 'handler_build_whitelist', new={
+        'MyHandler': {
+            'image': {
+                'name': 'test1'
+            }
+        }
+    })
+    def test_allow_build_not_in_whitelist(self):
         """ Test if artifact is not in the handlers whitelist """
-        whitelist_rules = {"image": any_({'name': "test1"})}
         handler = MyHandler()
-        conf.handler_build_whitelist.get.return_value = whitelist_rules
         container = {"name": "test", "branch": "branch"}
 
         allow = handler.allow_build(ArtifactType.IMAGE,
@@ -248,13 +256,17 @@ class TestAllowBuildBasedOnWhitelist(helpers.FreshmakerTestCase):
                                     branch=container["branch"])
         assert not allow
 
-    @patch('freshmaker.handlers.conf')
-    def test_allow_build_regex_exception(self, conf):
+    @patch.object(freshmaker.conf, 'handler_build_whitelist', new={
+        'MyHandler': {
+            'image': {
+                'name': 'te(st'
+            }
+        }
+    })
+    def test_allow_build_regex_exception(self):
         """ If there is a regex error, method will raise UnprocessableEntity error """
 
-        whitelist_rules = {"image": any_({'name': "te(st"})}
         handler = MyHandler()
-        conf.handler_build_whitelist.get.return_value = whitelist_rules
         container = {"name": "test", "branch": "branch"}
 
         with self.assertRaises(UnprocessableEntity):
@@ -417,3 +429,23 @@ class TestAllowBuildBasedOnWhitelist(helpers.FreshmakerTestCase):
                                       has_hightouch_bugs=False,
                                       severity="critical")
         self.assertFalse(allowed)
+
+    @patch.object(freshmaker.conf, 'handler_build_whitelist', new={
+        'MyHandler': {
+            'image': {'advisory_name': 'RHSA-\d+:\d+'},
+        }
+    })
+    @patch.object(freshmaker.conf, 'handler_build_blacklist', new={
+        'MyHandler': {
+            'image': {'advisory_name': 'RHSA-2016:\d+'},
+        }
+    })
+    def test_blacklist(self):
+        handler = MyHandler()
+        allowed = handler.allow_build(
+            ArtifactType.IMAGE, advisory_name='RHSA-2017:1000')
+        self.assertTrue(allowed)
+
+        allowed = handler.allow_build(
+            ArtifactType.IMAGE, advisory_name='RHSA-2016:1000')
+        self.assertFalse(allowed)