From 12acc9242d572a60d875e73fafd0a3b2a84af96b Mon Sep 17 00:00:00 2001
From: Christopher O'Brien <cobrien@redhat.com>
Date: Nov 22 2019 12:41:16 +0000
Subject: allow koji tags to be created with a configurable permission. Fixes #1478


---

diff --git a/module_build_service/builder/KojiModuleBuilder.py b/module_build_service/builder/KojiModuleBuilder.py
index a95b4bf..534f2e4 100644
--- a/module_build_service/builder/KojiModuleBuilder.py
+++ b/module_build_service/builder/KojiModuleBuilder.py
@@ -528,11 +528,13 @@ class KojiModuleBuilder(GenericBuilder):
         # only if we are creating the build_tag for first time.
         build_tag_exists = self.koji_session.getTag(self.tag_name + "-build")
 
+        tag_perm = self.config.koji_tag_permission
+
         # Create or update individual tags
         # the main tag needs arches so pungi can dump it
-        self.module_tag = self._koji_create_tag(self.tag_name, self.arches, perm="admin")
+        self.module_tag = self._koji_create_tag(self.tag_name, self.arches, perm=tag_perm)
         self.module_build_tag = self._koji_create_tag(
-            self.tag_name + "-build", self.arches, perm="admin")
+            self.tag_name + "-build", self.arches, perm=tag_perm)
 
         buildopts = self.mmd.get_buildopts()
         if buildopts and buildopts.get_rpm_whitelist():
diff --git a/module_build_service/config.py b/module_build_service/config.py
index 3f8f651..ba702e2 100644
--- a/module_build_service/config.py
+++ b/module_build_service/config.py
@@ -164,6 +164,11 @@ class Config(object):
             "default": ["module", "scrmod"],
             "desc": "List of allowed koji tag prefixes.",
         },
+        "koji_tag_permission": {
+            "type": str,
+            "default": "admin",
+            "desc": "Permission name to require for newly created Koji tags.",
+        },
         "koji_tag_extra_opts": {
             "type": dict,
             "default": {