repo_config gpgcheck value lost ? (mirror_complete option)

[olwins]

Version
{
"component": "core",
"version": "3.49.0",
"package": "pulpcore",
"module": "pulpcore.app",
"domain_compatible": true

{
  "component": "rpm",
  "version": "3.25.1",
  "package": "pulp-rpm",
  "module": "pulp_rpm.app",
  "domain_compatible": true
},

Describe the bug

(first time user, so i hope it's a real bug, and not a mistake of my part)

I have created a rpm repository for redhat, using the new option "repo_config", to activate the gpgcheck value to 1
That seems to work

But later, when I sync (mirror_complete option), the publication that is automatically created has a repo_config param with gpgcheck set to 0

Same in the distribution, if i use the generate_repo_config option, gpgcheck it is set to 0

Is that wanted ?
I expected the publication/distribution to inherit the value set at the repository level.
As I'm using the mirror_complete option, the publication is automatically created during the sync, I can't specify the value there.

To Reproduce
pulp rpm remote create --name TEST --url https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os --policy on_demand --ca-cert @/opt/pulp3/settings/sslcacert-redhat.pem --client-key @/opt/pulp3/settings/sslclientkey-redhat.pem --client-cert @/opt/pulp3/settings/sslclientcert-redhat.pem

pulp rpm repository create --name TEST --remote TEST --retain-repo-versions 3 --repo-config '{ "gpgcheck":1,"repo_gpgcheck":0 }'

Return
"repo_config": {
"gpgcheck": 1,
"repo_gpgcheck": 0
},

pulp rpm repository sync --name TEST --sync-policy mirror_complete

"created_resources": [
"/pulp/api/v3/repositories/rpm/rpm/018e2fc5-faa7-73d2-9ff3-a60800e1666d/versions/1/",
"/pulp/api/v3/publications/rpm/rpm/018e2fc7-2d04-7059-91e1-4724e8dbf285/"
],

pulp rpm publication show --href /pulp/api/v3/publications/rpm/rpm/018e2fc7-2d04-7059-91e1-4724e8dbf285/

"repo_config": {
"gpgcheck": 0,
"repo_gpgcheck": false
},

Expected behavior
for the publication that is automatically created with the mirror_complete option, I expected the repo_config value to be the same than the one define for the repository

Additional context

[pedro-psb]

The mirror_complete option implies that the user shouldn't customize the publication, otherwise, the publication would risk not being "mirror complete". But still, something is odd.

I found that Pulp uses the following defaults for when it has to mirror the metadata on the sync task:

pulp_rpm/pulp_rpm/app/tasks/synchronizing.py

Line 160 in 8d5a773

publication.repo_config = {"repo_gpgcheck": has_repomd_signature, "gpgcheck": 0}

In your case, the remote repository doesn't contain a .repo file to be mirrored, so from a mirror perspective its not clear what to set there. Maybe in this case the user option could take precedence.

[dralley]

gpgcheck means "check the GPG signatures of packages" whereas repo_gpgcheck means "check the GPG signatures of repository metadata"

Like @pedro-psb mentioned, mirror_complete mode means "sync the repo exactly as it is and make no changes", so it's really just filling in the values with what it can infer directly from the sync rather than setting them from the user-provided repoconfig.

Since there's no reasonable way to infer gpgcheck from the sync though, we should probably just pull it directly from the user-provided repoconfig (the state of it at the moment of the sync).