Merge pull request #1117 from gerrod3/no-tuf-ref

Turn off TUF metadata update on provenance verification

Author: gerrod3

pulp_python/app/provenance.py

@@ -58,7 +58,7 @@ class Provenance(BaseModel):
     attestation_bundles: list[AttestationBundle]
 
 
-def verify_provenance(filename, sha256, provenance, offline=False):
+def verify_provenance(filename, sha256, provenance, offline=True):
     """Verify the provenance object is valid for the package."""
     dist = Distribution(name=filename, digest=sha256)
     for bundle in provenance.attestation_bundles:

pulp_python/app/serializers.py

@@ -352,7 +352,7 @@ def validate_attestations(self, value):
             raise serializers.ValidationError(_("Invalid attestations: {}".format(e)))
         return attestations
 
-    def handle_attestations(self, filename, sha256, attestations, offline=False):
+    def handle_attestations(self, filename, sha256, attestations, offline=True):
         """Handle converting attestations to a Provenance object."""
         user = get_current_authenticated_user()
         publisher = AnyPublisher(kind="Pulp User", prn=get_prn(user))