[rpms/koji] epel10: Update to 1.36.0. Fixes rhbz#2450534

[rpms/koji] epel10: Update to 1.36.0. Fixes rhbz#2450534

[Kevin Fenzi]

            A new commit has been pushed.

            Repo   : rpms/koji
            Branch : epel10
            Commit : 4a8e277db56c289ab0d2119991dce6fdeef89f25
            Author : Kevin Fenzi <kevin@scrye.com>
            Date   : 2026-04-04T09:56:13-07:00
            Stats  : +66/-162 in 6 file(s)
            URL    : https://src.fedoraproject.org/rpms/koji/c/4a8e277db56c289ab0d2119991dce6fdeef89f25?branch=epel10

            Log:
            Update to 1.36.0. Fixes rhbz#2450534

Modernize spec some.
Enable tests
Drop upstreamed patches

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

---
diff --git a/.gitignore b/.gitignore
index 2d70c38..6fe9130 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,3 +55,4 @@ koji-1.4.0.tar.bz2
 /koji-1.35.1.tar.bz2
 /koji-1.35.2.tar.bz2
 /koji-1.35.3.tar.bz2
+/koji-1.36.0.tar.bz2

diff --git a/0001-download-build-allow-fallback-to-unsigned-with-key.patch b/0001-download-build-allow-fallback-to-unsigned-with-key.patch
deleted file mode 100644
index 65eaa79..0000000
--- a/0001-download-build-allow-fallback-to-unsigned-with-key.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 73b4f34bea6613e9bcc9acfe46761073cceaff5a Mon Sep 17 00:00:00 2001
-From: Adam Williamson <awilliam@redhat.com>
-Date: Fri, 14 Mar 2025 16:04:21 -0700
-Subject: [PATCH 1/2] download-build: allow fallback to unsigned with --key
-
-If you pass --key to download-build and signed packages aren't
-available, Koji will skip the unsigned package, or error out.
-This adds a modified behavior controlled by the new
---fallback-unsigned arg. If this is passed with --key, unsigned
-copies will be downloaded for packages for which no signed copy
-can be found.
-
-This is primarily intended to work with a proposed Bodhi feature:
-https://github.com/fedora-infra/bodhi/pull/5859 . That would
-make Bodhi's `bodhi updates download` command automatically try
-to download signed copies, but I think it would be best if it
-falls back to getting unsigned copies if that doesn't work. Just
-failing out entirely seems wrong for that case. Implementing the
-fallback in Bodhi itself is more awkward and messy than adding it
-in Koji, and it may be useful for others in Koji I guess.
-
-Note there are two distinct 'no signed copies' cases. In the
-simple one, queryRPMSigs tells us Koji has no record of the
-package ever being signed with the key in question. In this case
-we don't bother trying to download a signed copy. In the other
-case, queryRPMSigs tells us the package *has* been signed with
-the key, but it turns out that signed copy has been garbage-
-collected and we can no longer download it. In this case we have
-to catch the failure on the download attempt and retry the
-download with sigkey set to None.
-
-Signed-off-by: Adam Williamson <awilliam@redhat.com>
----
- cli/koji_cli/commands.py | 26 ++++++++++++++++++++++++--
- 1 file changed, 24 insertions(+), 2 deletions(-)
-
-diff --git a/cli/koji_cli/commands.py b/cli/koji_cli/commands.py
-index 29b6e0a6..73c586fc 100644
---- a/cli/koji_cli/commands.py
-+++ b/cli/koji_cli/commands.py
-@@ -19,6 +19,7 @@ from datetime import datetime
- from dateutil.tz import tzutc
- from optparse import SUPPRESS_HELP, OptionParser
- 
-+from requests.exceptions import HTTPError
- import six
- import six.moves.xmlrpc_client
- from six.moves import filter, map, range, zip
-@@ -6830,6 +6831,8 @@ def anon_handle_download_build(options, session, args):
-     parser.add_option("--task-id", action="store_true", help="Interperet id as a task id")
-     parser.add_option("--rpm", action="store_true", help="Download the given rpm")
-     parser.add_option("--key", help="Download rpms signed with the given key")
-+    parser.add_option("--fallback-unsigned", action="store_true",
-+                      help="When used with --key: download unsigned if signed packages not found")
-     parser.add_option("--topurl", metavar="URL", default=options.topurl,
-                       help="URL under which Koji files are accessible")
-     parser.add_option("--noprogress", action="store_true", help="Do not display progress meter")
-@@ -6912,6 +6915,7 @@ def anon_handle_download_build(options, session, args):
-                 continue
-             rpms.append(rpm)
- 
-+    unsigned = []
-     if suboptions.key:
-         with session.multicall() as m:
-             results = [m.queryRPMSigs(rpm_id=r['id'], sigkey=suboptions.key) for r in rpms]
-@@ -6921,14 +6925,32 @@ def anon_handle_download_build(options, session, args):
-                 nvra = "%(nvr)s-%(arch)s.rpm" % rpm
-                 warn("No such sigkey %s for rpm %s" % (suboptions.key, nvra))
-                 rpms.remove(rpm)
-+                if suboptions.fallback_unsigned:
-+                    unsigned.append(rpm)
- 
--    size = len(rpms) + len(archives)
-+    size = len(rpms) + len(unsigned) + len(archives)
-     number = 0
- 
-     # run the download
-     for rpm in rpms:
-         number += 1
--        download_rpm(info, rpm, suboptions.topurl, sigkey=suboptions.key, quiet=suboptions.quiet,
-+        try:
-+            download_rpm(info, rpm, suboptions.topurl, sigkey=suboptions.key, quiet=suboptions.quiet,
-+                         noprogress=suboptions.noprogress, num=number, size=size)
-+        except HTTPError as err:
-+            # this is necessary even with the 'unsigned' handling above
-+            # because sometimes queryRPMSigs will still tell us a
-+            # package was signed with a given key, but the signed copy
-+            # has been garbage-collected
-+            if suboptions.key and suboptions.fallback_unsigned and err.response.status_code == 404:
-+                warn("Signed copy not present, will download unsigned copy")
-+                download_rpm(info, rpm, suboptions.topurl, sigkey=None, quiet=suboptions.quiet,
-+                             noprogress=suboptions.noprogress, num=number, size=size)
-+            else:
-+                raise
-+    for rpm in unsigned:
-+        number += 1
-+        download_rpm(info, rpm, suboptions.topurl, sigkey=None, quiet=suboptions.quiet,
-                      noprogress=suboptions.noprogress, num=number, size=size)
-     for archive in archives:
-         number += 1
--- 
-2.52.0
-

diff --git a/0002-Fix-flake8-and-unit-test.patch b/0002-Fix-flake8-and-unit-test.patch
deleted file mode 100644
index 83c519b..0000000
--- a/0002-Fix-flake8-and-unit-test.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 7c0ec989b49a479309e2c1dff20621e037f9dd4c Mon Sep 17 00:00:00 2001
-From: Tomas Kopecek <tkopecek@redhat.com>
-Date: Tue, 29 Apr 2025 16:27:29 +0200
-Subject: [PATCH 2/2] Fix flake8 and unit test
-
----
- cli/koji_cli/commands.py              | 5 +++--
- tests/test_cli/test_download_build.py | 2 ++
- 2 files changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/cli/koji_cli/commands.py b/cli/koji_cli/commands.py
-index 73c586fc..c072ed43 100644
---- a/cli/koji_cli/commands.py
-+++ b/cli/koji_cli/commands.py
-@@ -6935,8 +6935,9 @@ def anon_handle_download_build(options, session, args):
-     for rpm in rpms:
-         number += 1
-         try:
--            download_rpm(info, rpm, suboptions.topurl, sigkey=suboptions.key, quiet=suboptions.quiet,
--                         noprogress=suboptions.noprogress, num=number, size=size)
-+            download_rpm(info, rpm, suboptions.topurl, sigkey=suboptions.key,
-+                         quiet=suboptions.quiet, noprogress=suboptions.noprogress, num=number,
-+                         size=size)
-         except HTTPError as err:
-             # this is necessary even with the 'unsigned' handling above
-             # because sometimes queryRPMSigs will still tell us a
-diff --git a/tests/test_cli/test_download_build.py b/tests/test_cli/test_download_build.py
-index 4c90aa9c..2495b189 100644
---- a/tests/test_cli/test_download_build.py
-+++ b/tests/test_cli/test_download_build.py
-@@ -297,6 +297,8 @@ Options:
-   --task-id             Interperet id as a task id
-   --rpm                 Download the given rpm
-   --key=KEY             Download rpms signed with the given key
-+  --fallback-unsigned   When used with --key: download unsigned if signed
-+                        packages not found
-   --topurl=URL          URL under which Koji files are accessible
-   --noprogress          Do not display progress meter
-   -q, --quiet           Suppress output
--- 
-2.52.0
-

diff --git a/koji.spec b/koji.spec
index 577d675..4738b4f 100644
--- a/koji.spec
+++ b/koji.spec
@@ -8,18 +8,15 @@
 %{?!python3_pkgversion:%global python3_pkgversion 3}
 
 Name: koji
-Version: 1.35.3
-Release: 9%{?dist}
+Version: 1.36.0
+Release: 1%{?dist}
 # the included arch lib from yum's rpmUtils is GPLv2+
 License: LGPL-2.1-only AND GPL-2.0-or-later
 Summary: Build system tools
 URL: https://pagure.io/koji/
 Source0: https://releases.pagure.org/koji/koji-%{version}.tar.bz2
-
-# https://pagure.io/koji/pull-request/4342
-# download-build: allow fallback to unsigned with --key
-Patch0: 0001-download-build-allow-fallback-to-unsigned-with-key.patch
-Patch1: 0002-Fix-flake8-and-unit-test.patch
+# ship a fedora specific tox file that doesn't run coverage/lint and only python3
+Source1: tox.ini-fedora
 
 # Not upstreamable
 Patch100: fedora-config.patch
@@ -32,6 +29,15 @@ BuildRequires: systemd
 BuildRequires: pkgconfig
 BuildRequires: sed
 
+# additional packages needed for tests
+BuildRequires: python3-rpm
+BuildRequires: python-unversioned-command
+BuildRequires: python3-pytest
+BuildRequires: python3-dnf
+BuildRequires: python3-librepo
+BuildRequires: python3-requests-mock
+BuildRequires: glibc-langpack-en
+
 %description
 Koji is a system for building and tracking RPMS.  The base package
 contains shared libraries and the command-line interface.
@@ -211,13 +217,23 @@ m kojibuilder mock
 EOF
 %endif
 
+# copy in our tox.ini for tests
+cp -a %{SOURCE1} tox.ini
+
+# We do not want a 'editable' setup for building
+sed -i -e '/\-e \./d' requirements.txt test-requirements.txt
+# There isn't a psycopg2-binary provide anymore.
+sed -i -e 's/psycopg2-binary/psycopg2/' requirements.txt test-requirements.txt
+
+%generate_buildrequires
+%pyproject_buildrequires -t
+
 %build
-%py3_build_wheel
+%pyproject_wheel
 
 %install
 %define make_with_dirs make DESTDIR=$RPM_BUILD_ROOT SBINDIR=%{_sbindir}
 
-%py3_install_wheel %{name}-%{version}-py3-none-any.whl
 mkdir -p %{buildroot}/etc/koji.conf.d
 cp cli/koji.conf %{buildroot}/etc/koji.conf
 for D in kojihub builder plugins util www vm schemas ; do
@@ -226,13 +242,7 @@ for D in kojihub builder plugins util www vm schemas ; do
     popd
 done
 
-# alter python interpreter in koji CLI
-scripts='%{_bindir}/koji %{_sbindir}/kojid %{_sbindir}/kojira %{_sbindir}/koji-shadow
-         %{_sbindir}/koji-gc %{_sbindir}/kojivmd %{_sbindir}/koji-sweep-db
-         %{_sbindir}/koji-sidetag-cleanup'
-for fn in $scripts ; do
-    sed -i 's|#!/usr/bin/python2|#!/usr/bin/python3|' $RPM_BUILD_ROOT$fn
-done
+%pyproject_install
 
 # handle extra byte compilation
 extra_dirs='
@@ -249,6 +259,11 @@ done
 install -m0644 -D koji.sysusers.conf %{buildroot}%{_sysusersdir}/koji.conf
 %endif
 
+%check
+export LC_ALL="C"
+PYTHONPATH=.:plugins/hub/.:plugins/builder/.:plugins/cli/.:cli/.:www/lib
+%pytest
+
 %files
 %{_bindir}/koji
 %{_datadir}/koji
@@ -367,6 +382,9 @@ install -m0644 -D koji.sysusers.conf %{buildroot}%{_sysusersdir}/koji.conf
 %systemd_postun kojira.service
 
 %changelog
+* Mon Mar 23 2026 Kevin Fenzi <kevin@scrye.com> - 1.36.0-1
+- Update to 1.36.0. Fixes rhbz#2450534
+
 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.35.3-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
 

diff --git a/sources b/sources
index 6a36f3a..8db8e52 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (koji-1.35.3.tar.bz2) = 2cd638a6f53419d7d15b4e9ebc2b2bd828445d0c66061664de9f34879d05fd1a364a81a94d634254db8fcaf4476c06871a11907ceeca37bd180652b3a443caf2
+SHA512 (koji-1.36.0.tar.bz2) = 8fe03302c1a0ef9746863d7a3f2c1530778d58c473b523c43592744141c935ff6f3505a7ce4aeb2c32c89531f29c133676c1f775a9ef2d07aa7b0087db838855

diff --git a/tox.ini-fedora b/tox.ini-fedora
new file mode 100644
index 0000000..f59af06
--- /dev/null
+++ b/tox.ini-fedora
@@ -0,0 +1,30 @@
+[tox]
+envlist = py3,bandit
+
+[testenv]
+deps =
+    -r{toxinidir}/requirements.txt
+# We need to access python-rpm, at least, and potentially more on EL6
+sitepackages = true
+setenv =
+    COLUMNS=80
+# Expected that python-rpm is installed on the host
+# If rpm's python bindings are missing, don't continue
+# Also, because coverage might be installed system-wide and it serves as our
+# entry point, let's make sure it's installed in the virtualenv.
+#
+# COLUMNS setting is propagated to optparse and ensures that formatted text
+# is same in the CLI output on all platforms
+commands_pre =
+    {envbindir}/python -c "import rpm"
+
+[testenv:py3]
+deps =
+    -r{toxinidir}/test-requirements.txt
+setenv = 
+    {[testenv]setenv}
+    PYTHONPATH=.:plugins/hub/.:plugins/builder/.:plugins/cli/.:cli/.:www/lib
+commands_pre =
+    {[testenv]commands_pre}
+commands = 
+    python -m pytest