From 27d001d6ed06801bdbd7f267d70f6bbb8e11b9ca Mon Sep 17 00:00:00 2001
From: David Davis <86290+daviddavis@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:40:01 +0000
Subject: [PATCH] Scope signed package components to repository

Prevent package signing from adding release-component associations belonging to other repositories.

fixes #1493

Assisted-by: GitHub Copilot
---
 CHANGES/1493.bugfix                           |  1 +
 pulp_deb/app/tasks/signing.py                 | 10 ++----
 .../functional/api/test_package_signing.py    | 32 +++++++++++++++++++
 3 files changed, 36 insertions(+), 7 deletions(-)
 create mode 100644 CHANGES/1493.bugfix

diff --git a/CHANGES/1493.bugfix b/CHANGES/1493.bugfix
new file mode 100644
index 000000000..14a5bb67a
--- /dev/null
+++ b/CHANGES/1493.bugfix
@@ -0,0 +1 @@
+Fixed a bug where signing a package shared by multiple repositories could add package release-component associations from other repositories to the repository being modified.
diff --git a/pulp_deb/app/tasks/signing.py b/pulp_deb/app/tasks/signing.py
index 491b0ef2d..353b9f44a 100644
--- a/pulp_deb/app/tasks/signing.py
+++ b/pulp_deb/app/tasks/signing.py
@@ -134,7 +134,7 @@ def sign_and_create(
     general_create(app_label, serializer_name, data=data, context=context, *args, **kwargs)
 
 
-def _sign_package(package, signing_service, signing_fingerprint, package_release_map):
+def _sign_package(package, signing_service, signing_fingerprint, prcs):
     """
     Sign a package or reuse an existing signed result.
 
@@ -155,11 +155,7 @@ def _sign_package(package, signing_service, signing_fingerprint, package_release
             return None
 
         # Collect PackageReleaseComponents that need to be updated
-        prcs_to_update = list(
-            PackageReleaseComponent.objects.filter(
-                package_id=package_id, _pulp_domain=package._pulp_domain
-            )
-        )
+        prcs_to_update = list(prcs.filter(package_id=package_id))
 
         # check if the package has been signed in the past with our fingerprint
         if existing_result := DebPackageSigningResult.objects.filter(
@@ -239,7 +235,7 @@ async def _bounded_sign(pkg_tuple):
                         pkg,
                         repo.package_signing_service,
                         fingerprint,
-                        package_release_map,
+                        prcs,
                     )
 
             return await asyncio.gather(*(_bounded_sign(pkg_tuple) for pkg_tuple in packages))
diff --git a/pulp_deb/tests/functional/api/test_package_signing.py b/pulp_deb/tests/functional/api/test_package_signing.py
index 20793a6a3..0206a2ece 100644
--- a/pulp_deb/tests/functional/api/test_package_signing.py
+++ b/pulp_deb/tests/functional/api/test_package_signing.py
@@ -411,6 +411,38 @@ def test_signed_repo_modify_overwrite_false_noop(
     assert [signed_package.pulp_href] == [pkg.pulp_href for pkg in results]
 
 
+def test_signing_does_not_add_package_components_from_other_repositories(
+    tmp_path,
+    add_package_to_repo,
+    deb_signing_key_primary,
+    deb_package_signing_service,
+    deb_repository_factory,
+    deb_package_factory,
+    apt_repository_api,
+    apt_package_release_components_api,
+):
+    """Ensure signing only replaces package components belonging to the target repository."""
+    package_file = shutil.copy(
+        get_local_package_absolute_path("frigg_1.0_ppc64.deb"),
+        tmp_path,
+    )
+    package = deb_package_factory(file=package_file)
+    other_repository = deb_repository_factory()
+    add_package_to_repo(other_repository, package.pulp_href)
+
+    repository = deb_repository_factory(
+        package_signing_service=deb_package_signing_service.pulp_href,
+        package_signing_fingerprint=deb_signing_key_primary.fingerprint,
+    )
+    release_component, _ = add_package_to_repo(repository, package.pulp_href)
+
+    repository = apt_repository_api.read(repository.pulp_href)
+    package_components = apt_package_release_components_api.list(
+        repository_version=repository.latest_version_href
+    ).results
+    assert [component.release_component for component in package_components] == [release_component]
+
+
 def test_already_signed_package(
     tmp_path,
     add_package_to_repo,