inconsistent refusal of bodhi override with maximum duration

[keszybz]

From https://bugzilla.redhat.com/show_bug.cgi?id=1761691:

$ fedpkg override create --duration=31 python-pytest-steps-1.6.2-1.fc31
Expiration date may not be longer than 31
Could not execute create_buildroot_override: Cannot create override.

Obviously the user is asking for a duration of 31 days which is not "longer than 31".

fedpkg-1.37-5.el8.1.noarch

Creating the update with --duration=30 works.

Looking at the code

bodhi/bodhi/server/validators.py

Lines 1207 to 1216 in b81c9fb

	now = datetime.utcnow()
	if expiration_date <= now:
	request.errors.add('body', 'expiration_date',
	'Expiration date in the past')
	return
	days = config.get('buildroot_limit')
	limit = now + timedelta(days=days)
	if expiration_date > limit:

it's a toctou issue: expiration_date is calculated first, and then when now + timedelta(days=config.get('buildroot_limit')) is calculated the result is tiny bit off, so the check fails.

[samyak-jn]

Hi,
Just a quick question with regards to bodhi overrides, I was testing bodhi in the vagrant, To reproduce the above issue wanted to run bodhi overrides save --duration=31 <pkgname> to test, but it asks for username and password I tried authenticating using fas account but failed to do so, is it right approach to test overrides, how can I use the bodhi overrides save command properly?

[samyak-jn]

Also, what is optimal buildroot_limit should be defined? What's the ideal duration for overrides that needs to be set?

Herewith reference to the source:

        'buildroot_limit': {
            'value': 31,
            'validator': int},

The issue talks about the inconsistency caused in the error message that 31 is no longer than 31, two things (the error message should be re-written (longer and equal to), also, if we have allowed the duration to 31 this should work right?)
I'm just new to bodhi, so might be asking some non-relevant doubts :)

CC: @keszybz

[mattiaverga]

Hi @samyak-jn ,
the vagrant Bodhi box uses staging accounts, you will need to register your account in https://accounts.stg.fedoraproject.org (seems that production accounts were not sync-ed to staging).
EDIT: the accounts are there, but you probably have to reset your password

About the time limit, just change the check so that it is not so pedantic... ;-)

[samyak-jn]

Thanks, @mattiaverga, will do the changes in the check and also update the error message so that it won't confuse the user.