handle priorities in kernel updates

fixes: #770

Author: furlongm

hosts/models.py

@@ -401,18 +401,28 @@ def find_kernel_updates(self, kernel_packages, repo_packages):
         update_ids = []
         self.reboot_required = False
 
+        # build hostrepos for priority filtering (same as find_host_repo_updates)
+        hostrepos = None
+        if self.host_repos_only:
+            hostrepos_q = Q(repo__mirror__enabled=True,
+                            repo__mirror__refresh=True,
+                            repo__mirror__repo__enabled=True,
+                            host=self)
+            hostrepos = HostRepo.objects.select_related(
+                'host', 'repo').filter(hostrepos_q)
+
         deb_kernels = kernel_packages.filter(packagetype='D')
         rpm_kernels = kernel_packages.filter(packagetype='R')
         arch_kernels = kernel_packages.filter(packagetype='A')
 
-        update_ids.extend(self._find_rpm_kernel_updates(rpm_kernels, repo_packages))
-        update_ids.extend(self._find_deb_kernel_updates(deb_kernels, repo_packages))
-        update_ids.extend(self._find_arch_kernel_updates(arch_kernels, repo_packages))
+        update_ids.extend(self._find_rpm_kernel_updates(rpm_kernels, repo_packages, hostrepos))
+        update_ids.extend(self._find_deb_kernel_updates(deb_kernels, repo_packages, hostrepos))
+        update_ids.extend(self._find_arch_kernel_updates(arch_kernels, repo_packages, hostrepos))
 
         self.save(update_fields=['reboot_required'])
         return update_ids
 
-    def _find_rpm_kernel_updates(self, kernel_packages, repo_packages):
+    def _find_rpm_kernel_updates(self, kernel_packages, repo_packages, hostrepos):
 
         update_ids = []
 
@@ -436,9 +446,20 @@ def _find_rpm_kernel_updates(self, kernel_packages, repo_packages):
 
             pu_q = Q(name=package.name)
 
-            # find repo highest for this kernel name
+            # determine baseline priority from the installed package's repo
+            priority = None
+            if hostrepos is not None:
+                best_repo = find_best_repo(package, hostrepos)
+                if best_repo is not None:
+                    priority = best_repo.priority
+
+            # find repo highest for this kernel name, respecting priority
             repo_highest = None
             for pu in repo_packages.filter(pu_q):
+                if priority is not None:
+                    pu_best_repo = find_best_repo(pu, hostrepos)
+                    if not pu_best_repo or pu_best_repo.priority < priority:
+                        continue
                 if repo_highest is None or repo_highest.compare_version(pu) == -1:
                     repo_highest = pu
 
@@ -482,15 +503,26 @@ def _find_rpm_kernel_updates(self, kernel_packages, repo_packages):
 
         return update_ids
 
-    def _find_arch_kernel_updates(self, kernel_packages, repo_packages):
+    def _find_arch_kernel_updates(self, kernel_packages, repo_packages, hostrepos):
 
         update_ids = []
 
         for package in kernel_packages:
             pu_q = Q(name=package.name)
 
+            # determine baseline priority from the installed package's repo
+            priority = None
+            if hostrepos is not None:
+                best_repo = find_best_repo(package, hostrepos)
+                if best_repo is not None:
+                    priority = best_repo.priority
+
             repo_highest = None
             for rp in repo_packages.filter(pu_q):
+                if priority is not None:
+                    rp_best_repo = find_best_repo(rp, hostrepos)
+                    if not rp_best_repo or rp_best_repo.priority < priority:
+                        continue
                 if repo_highest is None or repo_highest.compare_version(rp) == -1:
                     repo_highest = rp
 
@@ -522,7 +554,7 @@ def _find_arch_kernel_updates(self, kernel_packages, repo_packages):
 
         return update_ids
 
-    def _find_deb_kernel_updates(self, kernel_packages, repo_packages):
+    def _find_deb_kernel_updates(self, kernel_packages, repo_packages, hostrepos):
 
         update_ids = []
         running_flavour = self._get_running_kernel_flavour()
@@ -535,6 +567,13 @@ def _find_deb_kernel_updates(self, kernel_packages, repo_packages):
                 running_kernel_pkg = package
                 break
 
+        # determine baseline priority from the running kernel's repo
+        priority = None
+        if hostrepos is not None and running_kernel_pkg is not None:
+            best_repo = find_best_repo(running_kernel_pkg, hostrepos)
+            if best_repo is not None:
+                priority = best_repo.priority
+
         processed_prefixes = set()
         for package in kernel_packages:
             pkg_name = package.name.name
@@ -563,9 +602,13 @@ def _find_deb_kernel_updates(self, kernel_packages, repo_packages):
             if running_flavour:
                 name_filter &= Q(name__name__endswith=f'-{running_flavour}')
 
-            # find repo highest for this prefix+flavour
+            # find repo highest for this prefix+flavour, respecting priority
             repo_highest = None
             for rp in repo_packages.filter(name_filter):
+                if priority is not None:
+                    rp_best_repo = find_best_repo(rp, hostrepos)
+                    if not rp_best_repo or rp_best_repo.priority < priority:
+                        continue
                 if repo_highest is None or repo_highest.compare_version(rp) == -1:
                     repo_highest = rp
 

hosts/tests/test_models.py

@@ -697,3 +697,202 @@ def test_arch_no_reboot_when_current(self):
 
         host.refresh_from_db()
         self.assertFalse(host.reboot_required)
+
+
+@override_settings(
+    CELERY_TASK_ALWAYS_EAGER=True,
+    CACHES={'default': {'BACKEND': 'django.core.cache.backends.locmem.LocMemCache'}}
+)
+class KernelPriorityTests(TestCase):
+    """Tests for kernel update priority filtering (backports)."""
+
+    def setUp(self):
+        self.m_arch = MachineArchitecture.objects.create(name='x86_64')
+        self.domain = Domain.objects.create(name='example.com')
+        self.os_release = OSRelease.objects.create(
+            name='Debian 12', codename='bookworm'
+        )
+        self.os_variant = OSVariant.objects.create(
+            name='Debian GNU/Linux 12', osrelease=self.os_release
+        )
+        self.pkg_arch = PackageArchitecture.objects.create(name='amd64')
+
+        # installed kernel (from main repo)
+        self.img_43_name = PackageName.objects.create(
+            name='linux-image-6.1.0-43-amd64'
+        )
+        self.img_43 = Package.objects.create(
+            name=self.img_43_name, arch=self.pkg_arch, epoch='',
+            version='6.1.162-1', release='', packagetype='D'
+        )
+
+        # backports kernel (newer version)
+        self.img_bp_name = PackageName.objects.create(
+            name='linux-image-6.12.73+deb13-amd64'
+        )
+        self.img_bp = Package.objects.create(
+            name=self.img_bp_name, arch=self.pkg_arch, epoch='',
+            version='6.12.73-1', release='', packagetype='D'
+        )
+
+        # main repo (high priority)
+        self.main_repo = Repository.objects.create(
+            name='bookworm', repotype='D', arch=self.m_arch,
+        )
+        self.main_mirror = Mirror.objects.create(
+            repo=self.main_repo,
+            url='http://deb.debian.org/debian',
+        )
+        self.main_mirror.packages.add(self.img_43)
+
+        # backports repo (low priority)
+        self.bp_repo = Repository.objects.create(
+            name='bookworm-backports', repotype='D', arch=self.m_arch,
+        )
+        self.bp_mirror = Mirror.objects.create(
+            repo=self.bp_repo,
+            url='http://deb.debian.org/debian-backports',
+        )
+        self.bp_mirror.packages.add(self.img_bp)
+
+    def _create_host(self, main_priority, bp_priority, host_repos_only=True):
+        host = Host.objects.create(
+            hostname='debian.example.com',
+            ipaddress='192.168.1.80',
+            osvariant=self.os_variant,
+            kernel='6.1.0-43-amd64',
+            arch=self.m_arch,
+            domain=self.domain,
+            lastreport=timezone.now(),
+            host_repos_only=host_repos_only,
+        )
+        host.packages.set([self.img_43])
+        HostRepo.objects.create(
+            host=host, repo=self.main_repo,
+            enabled=True, priority=main_priority,
+        )
+        HostRepo.objects.create(
+            host=host, repo=self.bp_repo,
+            enabled=True, priority=bp_priority,
+        )
+        return host
+
+    def test_deb_backports_lower_priority_no_update(self):
+        """DEB: backports kernel with lower priority should NOT be flagged."""
+        host = self._create_host(main_priority=500, bp_priority=100)
+        repo_packages = Package.objects.filter(
+            mirror__in=[self.main_mirror, self.bp_mirror]
+        )
+        kernel_packages = host.packages.filter(
+            name__name__startswith='linux-image-'
+        )
+
+        host.find_kernel_updates(kernel_packages, repo_packages)
+
+        self.assertEqual(host.updates.count(), 0)
+
+    def test_deb_backports_equal_priority_shows_update(self):
+        """DEB: backports kernel with equal priority SHOULD be flagged."""
+        host = self._create_host(main_priority=500, bp_priority=500)
+        repo_packages = Package.objects.filter(
+            mirror__in=[self.main_mirror, self.bp_mirror]
+        )
+        kernel_packages = host.packages.filter(
+            name__name__startswith='linux-image-'
+        )
+
+        host.find_kernel_updates(kernel_packages, repo_packages)
+
+        self.assertEqual(host.updates.count(), 1)
+
+    def test_deb_priority_zero_no_filtering(self):
+        """DEB: priority 0 (unset) means no filtering — backward compat."""
+        host = self._create_host(main_priority=0, bp_priority=0)
+        repo_packages = Package.objects.filter(
+            mirror__in=[self.main_mirror, self.bp_mirror]
+        )
+        kernel_packages = host.packages.filter(
+            name__name__startswith='linux-image-'
+        )
+
+        host.find_kernel_updates(kernel_packages, repo_packages)
+
+        self.assertEqual(host.updates.count(), 1)
+
+    def test_deb_host_repos_only_false_no_filtering(self):
+        """DEB: host_repos_only=False skips priority filtering entirely."""
+        host = self._create_host(
+            main_priority=500, bp_priority=100, host_repos_only=False,
+        )
+        repo_packages = Package.objects.filter(
+            mirror__in=[self.main_mirror, self.bp_mirror]
+        )
+        kernel_packages = host.packages.filter(
+            name__name__startswith='linux-image-'
+        )
+
+        host.find_kernel_updates(kernel_packages, repo_packages)
+
+        self.assertEqual(host.updates.count(), 1)
+
+    def test_rpm_backports_lower_priority_no_update(self):
+        """RPM: kernel from lower-priority repo should NOT be flagged."""
+        rpm_arch = PackageArchitecture.objects.create(name='x86_64_rpm')
+        kernel_name = PackageName.objects.create(name='kernel-core')
+        installed = Package.objects.create(
+            name=kernel_name, arch=rpm_arch, epoch='0',
+            version='5.14.0', release='362.el9', packagetype='R'
+        )
+        newer = Package.objects.create(
+            name=kernel_name, arch=rpm_arch, epoch='0',
+            version='5.14.0', release='503.el9', packagetype='R'
+        )
+
+        base_repo = Repository.objects.create(
+            name='baseos', repotype='R', arch=self.m_arch,
+        )
+        base_mirror = Mirror.objects.create(
+            repo=base_repo, url='http://repo.example.com/baseos',
+        )
+        base_mirror.packages.add(installed)
+
+        extra_repo = Repository.objects.create(
+            name='extras', repotype='R', arch=self.m_arch,
+        )
+        extra_mirror = Mirror.objects.create(
+            repo=extra_repo, url='http://repo.example.com/extras',
+        )
+        extra_mirror.packages.add(newer)
+
+        os_release = OSRelease.objects.create(
+            name='Rocky Linux 9', codename='rl9'
+        )
+        os_variant = OSVariant.objects.create(
+            name='Rocky Linux 9.4', osrelease=os_release
+        )
+        host = Host.objects.create(
+            hostname='rocky.example.com',
+            ipaddress='192.168.1.90',
+            osvariant=os_variant,
+            kernel='5.14.0-362.el9',
+            arch=self.m_arch,
+            domain=self.domain,
+            lastreport=timezone.now(),
+            host_repos_only=True,
+        )
+        host.packages.set([installed])
+        HostRepo.objects.create(
+            host=host, repo=base_repo, enabled=True, priority=500,
+        )
+        HostRepo.objects.create(
+            host=host, repo=extra_repo, enabled=True, priority=100,
+        )
+
+        repo_packages = Package.objects.filter(
+            mirror__in=[base_mirror, extra_mirror]
+        )
+        kernel_packages = host.packages.filter(name=kernel_name)
+
+        host.find_kernel_updates(kernel_packages, repo_packages)
+
+        self.assertEqual(host.updates.count(), 0)