Move signatures when moving collections

Issue: AAH-1181
env:LOCK_REQUIREMENTS=0
env:PULP_ANSIBLE_REVISION=main

docker/entrypoint.sh

@@ -119,7 +119,7 @@ setup_signing_service() {
     HAS_SIGNING=$(django-admin shell -c 'from pulpcore.app.models import SigningService;print(SigningService.objects.filter(name="ansible-default").count())' 2>/dev/null || true)
     if [[ "$HAS_SIGNING" -eq "0" ]]; then
         log_message "Creating signing service. using key ${KEY_ID}"
-        django-admin add-signing-service ansible-default /var/lib/pulp/scripts/collection_sign.sh ${KEY_ID}
+        django-admin add-signing-service ansible-default /var/lib/pulp/scripts/collection_sign.sh ${KEY_ID} 2>/dev/null || true
     else
         log_message "Signing service already exists."
     fi

galaxy_ng/app/tasks/promotion.py

@@ -1,21 +1,34 @@
 from pulpcore.plugin.tasking import dispatch
-from pulp_ansible.app.models import AnsibleRepository, CollectionVersion
+from pulp_ansible.app.models import (
+    AnsibleRepository,
+    CollectionVersion,
+    CollectionVersionSignature
+)
 from pulp_ansible.app.tasks.copy import copy_content
 
 
 def move_content(collection_version_pk, source_repo_pk, dest_repo_pk):
     """Move collection version from one repository to another"""
-    # Copy to the destination repo
+    # Copy to the destination repo including the content signatures
     source_repo = AnsibleRepository.objects.get(pk=source_repo_pk)
+    signatures = CollectionVersionSignature.objects.filter(
+        signed_collection=collection_version_pk,
+        pk__in=source_repo.content.values_list("pk", flat=True)
+    ).values_list("pk", flat=True)
+    content = [collection_version_pk]
+    if signatures:
+        content += signatures
+
     config = [{
         'source_repo_version': source_repo.latest_version().pk,
         'dest_repo': dest_repo_pk,
-        'content': [collection_version_pk],
+        'content': content,
     }]
+
     copy_content(config)
 
     # remove old content from source repo
-    _remove_content_from_repository(collection_version_pk, source_repo_pk)
+    _remove_content_from_repository(collection_version_pk, source_repo_pk, signatures)
 
 
 def call_move_content_task(collection_version, source_repo, dest_repo):
@@ -36,14 +49,18 @@ def call_move_content_task(collection_version, source_repo, dest_repo):
     )
 
 
-def _remove_content_from_repository(collection_version_pk, repository_pk):
+def _remove_content_from_repository(collection_version_pk, repository_pk, signatures_pk=None):
     """
     Remove a CollectionVersion from a repository.
     Args:
         collection_version_pk: The pk of the CollectionVersion to remove from repository.
         repository_pk: The pk of the AnsibleRepository to remove the CollectionVersion from.
+        signatures_pk: A list of pks of the CollectionVersionSignatures to remove from the repo.
     """
     repository = AnsibleRepository.objects.get(pk=repository_pk)
     qs = CollectionVersion.objects.filter(pk=collection_version_pk)
     with repository.new_version() as new_version:
         new_version.remove_content(qs)
+        if signatures_pk:
+            sigs = CollectionVersionSignature.objects.filter(pk__in=signatures_pk)
+            new_version.remove_content(sigs)

galaxy_ng/app/tasks/signing.py

@@ -3,7 +3,7 @@
 from pulpcore.plugin.tasking import dispatch
 from pulp_ansible.app.tasks.signature import sign
 from pulp_ansible.app.tasks.copy import copy_content
-from pulp_ansible.app.models import AnsibleRepository
+from pulp_ansible.app.models import AnsibleRepository, CollectionVersionSignature
 
 from .promotion import _remove_content_from_repository
 
@@ -18,17 +18,25 @@ def sign_and_move(signing_service_pk, collection_version_pk, source_repo_pk, des
         content_hrefs=[collection_version_pk],
         signing_service_href=signing_service_pk
     )
-    # Then copy to the destination repo
+
+    # Then copy to the destination repo including the new signature
     source_repo = AnsibleRepository.objects.get(pk=source_repo_pk)
+    signatures = CollectionVersionSignature.objects.filter(
+        signed_collection=collection_version_pk,
+        pk__in=source_repo.content.values_list("pk", flat=True)
+    ).values_list("pk", flat=True)
+    content = [collection_version_pk]
+    if signatures:
+        content += signatures
     config = [{
         'source_repo_version': source_repo.latest_version().pk,
         'dest_repo': dest_repo_pk,
-        'content': [collection_version_pk],
+        'content': content,
     }]
     copy_content(config)
 
     # remove old content from source repo
-    _remove_content_from_repository(collection_version_pk, source_repo_pk)
+    _remove_content_from_repository(collection_version_pk, source_repo_pk, signatures)
 
 
 def call_sign_and_move_task(signing_service, collection_version, source_repo, dest_repo):