• Describe the issue

Attempting to push to epel10 branches in dist-git fails.

❯ git push
Total 0 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)
remote: Unspecified ref refs/heads/epel10 is blocked
remote: Denied push for ref 'refs/heads/epel10' for user 'carlwgeorge'
remote: All changes have been rejected
To ssh://pkgs.fedoraproject.org/rpms/tinyproxy
 ! [remote rejected] epel10 -> epel10 (pre-receive hook declined)
error: failed to push some refs to 'ssh://pkgs.fedoraproject.org/rpms/tinyproxy'

I originally thought that this was some kind of problem related to requesting the branch with --no-git-branch (see #12235), but then I was able to reproduce the push error on another repo where I requested the branch normally.

I dug in and I think I've pinpointed the issue. The DistGitAuth.is_supported_branch method in pagure-dist-git queries bodhi for a release, using the branch name as the identifier. The result of this query determines if the branch is allowed to be pushed to.

https://pagure.io/pagure-dist-git/blob/9a2fd0835be06e6a994e32e3265e80e502331f50/f/dist_git_auth.py#_84-115

However, bodhi doesn't actually allow querying releases by branch. If I'm reading that code right, you have to request it by the name, long_name, or dist_tag properties.

https://github.com/fedora-infra/bodhi/blob/8.1.1/bodhi-server/bodhi/server/services/releases.py#L194
https://github.com/fedora-infra/bodhi/blob/8.1.1/bodhi-server/bodhi/server/models.py#L856

For previous EPEL branches, the branch name happened to align with the dist_tag property of the bodhi release. That meant a request such as https://bodhi.fedoraproject.org/releases/epel9
returned successfully, which in turn passed is_supported_branch. However, since EPEL 10 has minor versions, we've disrupted this accidental alignment. A request to https://bodhi.fedoraproject.org/releases/epel10 returns a 404. A request to https://bodhi.fedoraproject.org/releases/epel10.0 returns ok, but that isn't what is_supported_branch asks for based on a branch name of epel10. For anyone not up to speed on EPEL 10 plans, our intention is a setup like this at first:

epel10 dist-git branch -> epel10.0 in koji/bodhi

and then later:

epel10 dist-git branch -> epel10.1 in koji/bodhi
epel10.0 dist-git branch -> epel10.0 in koji/bodhi

and then continuing like that through the rest of the RHEL 10 minor versions.

I think there are two options we can take to resolve this.

Option 1: change pagure-dist-git to understand how to allow an epel10 branch when the bodhi release is epel10.0

Option 2: change bodhi to allow querying releases by the branch name

I'm going to attempt to create a PR to implement option 1 because I think that will be easier.

• When do you need this? (YYYY/MM/DD)

2024/08/09 (the EPEL 10 Hackfest at Flock)

• When is this no longer needed or useful? (YYYY/MM/DD)

It will always be needed.

• If we cannot complete your request, what is the impact?

This is a complete blocker for EPEL 10 as it is currently planned.