Add certificates handling to Tier0Handler

[JanChyczynski]

PR description:

This PR adds providing certificates for curl requests done to https://cmsweb.cern.ch/t0wmadatasvc/prod/.
The paths to the certificate and the key are meant to be specified in X509_USER_CERT and X509_USER_KEY.

The certs became obligatory for accessing this API after migration of cmsweb from CC7 and this functionality is required by the conddb command and some O2Os (EcalLaser_prompt_run3, SiStripDetVOff_prompt, possibly also EcalLaser_prompt_hlt, ESGain_prompt, SIntercalibConstants_prompt, SRecHitRatioCuts_prompt, STimeSampleWeights_prompt)

The PR also introduces a way of overriding the hardcoded T0 API URL by setting the TIER0_API_URL env variable (eg. for test purposes).

PR validation:

Tested by running python3 tier0.py which is running the test for it.

Backport

We need backports to 14_1_X and 14_0_X

FYI @perrotta @francescobrivio @PonIlya

[cmsbuild]

cms-bot internal usage

[cmsbuild]

+code-checks

Logs: https://cmssdt.cern.ch/SDT/code-checks/cms-sw-PR-45779/41502

[cmsbuild]

A new Pull Request was created by @JanChyczynski for master.

It involves the following packages:

• CondCore/Utilities (db)

@cmsbuild, @consuegs, @francescobrivio, @perrotta, @saumyaphor4252 can you please review it and eventually sign? Thanks.
@JanChyczynski, @PonIlya, @mmusich, @rsreds, @yuanchao this is something you requested to watch as well.
@antoniovilela, @mandrenguyen, @rappoccio, @sextonkennedy you are the release manager for this.

cms-bot commands are listed here

[cmsbuild]

+code-checks

Logs: https://cmssdt.cern.ch/SDT/code-checks/cms-sw-PR-45779/41503

[cmsbuild]

Pull request #45779 was updated. @cmsbuild, @consuegs, @francescobrivio, @perrotta, @saumyaphor4252 can you please check and sign again.

[cmsbuild]

+code-checks

Logs: https://cmssdt.cern.ch/SDT/code-checks/cms-sw-PR-45779/41510

[cmsbuild]

Pull request #45779 was updated. @cmsbuild, @consuegs, @francescobrivio, @perrotta, @saumyaphor4252 can you please check and sign again.

[perrotta]

please test

[cmsbuild]

+1

Size: This PR adds an extra 12KB to repository
Summary: https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-7ab232/41183/summary.html
COMMIT: 3fa2860
CMSSW: CMSSW_14_2_X_2024-08-28-1100/el8_amd64_gcc12
User test area: For local testing, you can use /cvmfs/cms-ci.cern.ch/week0/cms-sw/cmssw/45779/41183/install.sh to create a dev area with all the needed externals and cmssw changes.

Comparison Summary

Summary:

• You potentially added 1 lines to the logs
• Reco comparison results: 4 differences found in the comparisons
• DQMHistoTests: Total files compared: 44
• DQMHistoTests: Total histograms compared: 3328202
• DQMHistoTests: Total failures: 3
• DQMHistoTests: Total nulls: 0
• DQMHistoTests: Total successes: 3328179
• DQMHistoTests: Total skipped: 20
• DQMHistoTests: Total Missing objects: 0
• DQMHistoSizes: Histogram memory added: 0.0 KiB( 43 files compared)
• Checked 193 log files, 163 edm output root files, 44 DQM output files
• TriggerResults: no differences found

[perrotta]

+db

• Let have this merged in master, so that the backport PRs can be tested in the production machines

[cmsbuild]

This pull request is fully signed and it will be integrated in one of the next master IBs (tests are also fine). This pull request will now be reviewed by the release team before it's merged. @rappoccio, @sextonkennedy, @mandrenguyen, @antoniovilela (and backports should be raised in the release meeting by the corresponding L2)

[mandrenguyen]

+1

[mmusich]

@JanChyczynski @perrotta

I am wondering how the lambda alca/db tools user is supposed to setup the environment after this PR is integrated and the cmsweb API-s are rolled back to require authentication.
I went into the latest IB and applied the following change:

diff --git a/CondCore/Utilities/python/tier0.py b/CondCore/Utilities/python/tier0.py
index ba807914ee1..04be67586b1 100644
--- a/CondCore/Utilities/python/tier0.py
+++ b/CondCore/Utilities/python/tier0.py
@@ -11,7 +11,7 @@ import subprocess
 
 import pycurl
 
-tier0Url = os.getenv('TIER0_API_URL', 'https://cmsweb.cern.ch/t0wmadatasvc/prod/')
+tier0Url = os.getenv('TIER0_API_URL', 'https://cmsweb-preprod.cern.ch/t0wmadatasvc/prod/')
 
 class Tier0Error(Exception):
     '''Tier0 exception.

Which (IIUC) should point the API to use a version of the service which is already requiring the certificate.

Then I issued the following command:

$ conddb showFCSR
[2024-09-02 17:11:38,712] INFO: Connecting to pro [frontier://PromptProd/cms_conditions]
[2024-09-02 17:11:39,401] INFO: Found fcsr for hlt: 385198
[2024-09-02 17:11:39,401] WARNING: No certificate provided for Tier0 access
[2024-09-02 17:11:39,481] ERROR: ValueError for firstConditionSafeRun from Tier-0 Expecting value: line 1 column 1 (char 0) 
[2024-09-02 17:11:39,482] ERROR: Error setting up Tier-0 data service: Invalid firstConditionSafeRun from Tier-0

How am I supposed to pass certificates and / or setup the environment?

[JanChyczynski]

How am I supposed to pass certificates and / or setup the environment?

The paths to the certificate and the key are meant to be specified in X509_USER_CERT and X509_USER_KEY environment variables

[mmusich]

The paths to the certificate and the key are meant to be specified in X509_USER_CERT and X509_USER_KEY environment variables

does it makes sense to make the command print information on how to set this up when these variables are not set, instead of leaving the user scratching their heads instead?

[JanChyczynski]

The paths to the certificate and the key are meant to be specified in X509_USER_CERT and X509_USER_KEY environment variables

does it makes sense to make the command print information on how to set this up when these variables are not set, instead of leaving the user scratching their heads instead?

Indeed good idea, It's exactly what I thought now, my bad I didn't think of it when writing it

[JanChyczynski]

The paths to the certificate and the key are meant to be specified in X509_USER_CERT and X509_USER_KEY environment variables

does it makes sense to make the command print information on how to set this up when these variables are not set, instead of leaving the user scratching their heads instead?

@mmusich Implemented in #45943