Allow syncing custom repos without password

[vsedmik]

When a custom repository requires upstream_username only (no password), we should be able to proceed with the username only.

Closes #7425

📜 Checklist

• Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
• A changelog entry or entries has been added for any significant changes
• Follows the Pulp policy on AI Usage
• (For new features) - User documentation and test coverage has been added

See: Pull Request Walkthrough

[ggainey]

The error in the issue is passing '' as the password - can't you just "not set it", or pass None?

[vsedmik]

The error in the issue is passing '' as the password - can't you just "not set it", or pass None?

It looks like aiohttp does not buy it.. 😞

Mar  9 10:05:07 sat pulpcore-worker-4[2405]: pulp [06bb7313-ffa7-4b24-8f7c-3ebfa7806c19]: pulpcore.tasking.tasks:INFO:   File "/usr/lib/python3.12/site-packages/pulpcore/tasking/tasks.py", line 109, in _execute_task
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    func(*args, **kwargs)
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib/python3.12/site-packages/pulp_rpm/app/tasks/synchronizing.py", line 487, in synchronize
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    remote_url = fetch_remote_url(remote, url)
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib/python3.12/site-packages/pulp_rpm/app/tasks/synchronizing.py", line 277, in fetch_remote_url
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    get_repomd_file(remote, normalized_remote_url)
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib/python3.12/site-packages/pulp_rpm/app/tasks/synchronizing.py", line 232, in get_repomd_file
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    downloader = remote.get_downloader(url=urlpath_sanitize(url, "repodata/repomd.xml"))
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib/python3.12/site-packages/pulp_rpm/app/models/repository.py", line 115, in get_downloader
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    return super().get_downloader(remote_artifact=remote_artifact, url=url, **kwargs)
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib/python3.12/site-packages/pulpcore/app/models/repository.py", line 663, in get_downloader
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    return download_factory.build(url, **kwargs)
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib/python3.12/site-packages/pulpcore/download/factory.py", line 182, in build
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    return builder(download_class, url, **kwargs)
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib/python3.12/site-packages/pulpcore/download/factory.py", line 210, in _http_or_https
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    options["auth"] = aiohttp.BasicAuth(
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:                      ^^^^^^^^^^^^^^^^^^
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:  File "/usr/lib64/python3.12/site-packages/aiohttp/helpers.py", line 134, in __new__
Mar  9 10:05:07 sat pulpcore-worker-4[2405]:    raise ValueError("None is not allowed as password value")

[ggainey]

I set up a test-scenario removing as many variables as possible (e.g., just-pulp and its API ), reproduced the problem, and with this PR showed it was addressed. For future reference:

• Start with grabbing https://fixtures.pulpproject.org/file/ into /var/www/html/foo on my system.
• Create an httpd user, foo : sudo htpasswd -c /usr/local/apache/passwd/passwords foo. Give that user an empty password.
• In /etc/httpd/conf/httpd.conf add AllowOverride AuthConfig in <Directory "/var/www">
• Restart httpd : sudo systemctl restart httpd
• Now - show that empty string and no-password both work, without Pulp involved:

$ curl --user foo: http://192.168.122.1/foo/PULP_MANIFEST
1.iso,5614d40052ea4f554861309893e0d11256df3abc71f39c991be9c946a25aaba9,1024
2.iso,ce720a7e7d5eaabd25f564741ae0b2f1077aa1a08798cccfa6c95ec11dadbbf9,1024
3.iso,cc0b71d385d0bdd2d065c67b707d8e168ac73bb743cc1611ca5a6d4e515c54b1,1024

$ curl --user foo:'' http://192.168.122.1/foo/PULP_MANIFEST
1.iso,5614d40052ea4f554861309893e0d11256df3abc71f39c991be9c946a25aaba9,1024
2.iso,ce720a7e7d5eaabd25f564741ae0b2f1077aa1a08798cccfa6c95ec11dadbbf9,1024
3.iso,cc0b71d385d0bdd2d065c67b707d8e168ac73bb743cc1611ca5a6d4e515c54b1,1024
$ 

• Set up a Pulp file-repository and a remote that has a username, but no password.

$ pulp file remote create --name foo5 --url http://192.168.122.1/foo/PULP_MANIFEST --username foo
$ pulp file repository create --name foo --remote foo5

• Now sync. With pulp-main, it will fail with a 401. With this PR in place, it succeeds.

$ pulp file repository sync --name foo 

Note that, along the way, I discovered that you can set a Remote's password to None, but not to empty string:

$ http PATCH :5001/pulp/api/v3/remotes/file/file/019d028d-ab26-72d1-be3d-1825140b958f/ password=''
HTTP/1.1 400 Bad Request
{
    "password": [
        "This field may not be blank."
    ]
}

fails, but

$ http PATCH :5001/pulp/api/v3/remotes/file/file/019d028d-ab26-72d1-be3d-1825140b958f/ password=None
HTTP/1.1 202 Accepted
{
    "task": "/pulp/api/v3/tasks/019d029d-8993-7c39-9dd3-4d6da628afa4/"
}

succeeds.

With this fix, they are treated identically - which matches the curl behavior.

Finally, with respect to "password but no username may also be valid" - not that I can see from how BasicAuth actually works.

[patchback]

Backport to 3.63: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.63/2a4f88e8548096655a4954cf24698317d1e0878c/pr-7426

Backported as #7496

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.73: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.73/2a4f88e8548096655a4954cf24698317d1e0878c/pr-7426

Backported as #7500

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.105: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.105/2a4f88e8548096655a4954cf24698317d1e0878c/pr-7426

Backported as #7497

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.85: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.85/2a4f88e8548096655a4954cf24698317d1e0878c/pr-7426

Backported as #7498

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.