I don't think that package whitelisting/blacklisting is needed at the individual rule level. I think it is enough to have it at the top level of the policy.

For example, imagine we have a whitelist which works like the inverse of blacklist. If you had a policy with:

rules:
- !PassingTestCaseRule {test_case_name: dist.rpmdeplint}
- !PackageSpecificBuild {test_case_name: atomicci.something, repos: [avahi, systemd]}

that is equivalent to having two separate policies with the same decision context, product versions, and subject type (bear in mind that Greenwave enforces the union of all rules in all applicable policies):

rules:
- !PassingTestCaseRule {test_case_name: dist.rpmdeplint}
...
rules:
- !PassingTestCaseRule {test_case_name: atomicci.soimething}
whitelist:
- avahi
- systemd

Instead of blacklist and whitelist, it would be clearer if we had packages (list of package names the policy applies to) and excluded_packages (list of package names the policy does not apply to). Note that we are using "package" here in the exact same sense as Koji itself does. The packages and excluded_packages keys would be optional, mutually exclusive, and only valid on policies for subject type koji_build.

We could make this kind of change in a backwards-compatible way. Instead of loading the YAML directly and expecting it to produce a valid Policy object, we would load each policy into a dict first and then perform some post-processing to handle the various backwards compatibility transformations (like mapping blacklist to excluded_packages etc).

This also makes it easier to handle and validate optional attributes in the policy. Right now if the attribute is optional we have to do hasattr()/getattr() throughout our code which is not very nice.

This would also help with some other ideas I wrote up in #217, specifically it would allow us to remove the rule polymorphism which I think is unnecessarily complicated.

Sound good to me.

Recap:
- Add exclude_packages which works like blacklist but also handles globbing (e.g. python-*).
- Add packages - if used, it matches packages to which the rules in policy apply. [1]
- Deprecate blacklist and handle backwards compatibility.
- Remove PackageSpecificBuild.

This also makes it easier to handle and validate optional attributes in the policy.

I don't see how this would help it.

[1] exclude_packages should probably have higher priority than packges so that packages matching packages can be still excluded.

Part of this is addressed in:
https://pagure.io/greenwave/pull-request/368

The other part of this is addressed in:
https://pagure.io/greenwave/pull-request/369

This got fixed, but still pending release.

This change was released today.