From 8c41f408c4579c919fb1a76d5389cb0f4adeb7b4 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Nov 18 2020 19:31:39 +0000
Subject: Update PR #3564 backport with latest changes


Also drop a bit in the spec we don't seem to need any more -
mock build worked without that test removed.

---

diff --git a/0001-Do-handling-of-placeholders-after-_URL-variables-par.patch b/0001-Do-handling-of-placeholders-after-_URL-variables-par.patch
deleted file mode 100644
index d587bb7..0000000
--- a/0001-Do-handling-of-placeholders-after-_URL-variables-par.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-From 4af5f6d8e0c6ea739097da4e2b374aefb6215cce Mon Sep 17 00:00:00 2001
-From: Adam Williamson <awilliam@redhat.com>
-Date: Mon, 16 Nov 2020 15:09:28 -0800
-Subject: [PATCH 1/2] Do handling of placeholders after _URL variables parsed
-
-b3bc8ebf caused some problems by moving the parsing of `_URL`
-settings to after the call to `JobSettings::generate_settings`,
-which is where handling of placeholders (%FOO%), usually from the
-templates, is done. This broke the case where e.g. a template
-uses `%ISO%` in a value, and the job is posted with `ISO_URL` but
-no explicit `ISO` set. In that case the derived `ISO` setting
-should be used in the placeholder expansion, but this was broken.
-
-This fixes the problems by splitting up the "parse _URL settings"
-and "create download list" functions of `create_downloads_list`,
-and moving the parsing part into `generate_settings`, just before
-placeholder expansion happens. This is after we pull in settings
-from the templates, so the bug b3bc8ebf was trying to fix (POO
-62159) should still be fixed. Download list creation should still
-happen the same as currently, so POO #70687 should still be fixed.
-
-Signed-off-by: Adam Williamson <awilliam@redhat.com>
----
- lib/OpenQA/JobSettings.pm | 39 +++++++++++++++++++++++++++
- lib/OpenQA/Utils.pm       | 56 +++++++++++++++++----------------------
- t/api/02-iso-download.t   | 13 +++++++++
- 3 files changed, 77 insertions(+), 31 deletions(-)
-
-diff --git a/lib/OpenQA/JobSettings.pm b/lib/OpenQA/JobSettings.pm
-index 0d6c11811..b0e364c8c 100644
---- a/lib/OpenQA/JobSettings.pm
-+++ b/lib/OpenQA/JobSettings.pm
-@@ -17,6 +17,12 @@ package OpenQA::JobSettings;
- use strict;
- use warnings;
- 
-+use File::Basename;
-+use Mojo::URL;
-+use Mojo::Util 'url_unescape';
-+use OpenQA::Log 'log_debug';
-+use OpenQA::Utils 'get_url_short';
-+
- sub generate_settings {
-     my ($params) = @_;
-     my $settings = $params->{settings};
-@@ -53,6 +59,7 @@ sub generate_settings {
-         $settings->{JOB_DESCRIPTION} = $job_template->description if length $job_template->description;
-     }
- 
-+    parse_url_settings($settings);
-     handle_plus_in_settings($settings);
-     return expand_placeholders($settings);
- }
-@@ -104,4 +111,36 @@ sub handle_plus_in_settings {
-     }
- }
- 
-+# Given a hashref of settings, parse any whose names end in _URL
-+# to the short name, then if there is not already a setting with
-+# the short name, set it to the filename from the URL (with the
-+# compression extension removed in the case of _DECOMPRESS_URL).
-+# This has to happen *before* generate_jobs
-+sub parse_url_settings {
-+    my ($settings) = @_;
-+    for my $setting (keys %$settings) {
-+        my ($short, $do_extract) = get_url_short($setting);
-+        next unless ($short);
-+        next if ($settings->{$short});
-+        # As this comes in from an API call, URL will be URI-encoded
-+        # This obviously creates a vuln if untrusted users can POST
-+        $settings->{$setting} = url_unescape($settings->{$setting});
-+        my $url = $settings->{$setting};
-+        my $filename;
-+        $filename = Mojo::URL->new($url)->path->parts->[-1];
-+        if ($do_extract) {
-+            # if user wants to extract downloaded file, final filename
-+            # will have last extension removed
-+            $filename = fileparse($filename, qr/\.[^.]*/);
-+        }
-+        $settings->{$short} = $filename;
-+        if (!$settings->{$short}) {
-+            log_debug("Unable to get filename from $url. Ignoring $setting");
-+            delete $settings->{$short} unless $settings->{$short};
-+            next;
-+        }
-+    }
-+    return undef;
-+}
-+
- 1;
-diff --git a/lib/OpenQA/Utils.pm b/lib/OpenQA/Utils.pm
-index 4db65eaeb..40dc928b0 100644
---- a/lib/OpenQA/Utils.pm
-+++ b/lib/OpenQA/Utils.pm
-@@ -21,7 +21,6 @@ use Carp;
- use Cwd 'abs_path';
- use IPC::Run();
- use Mojo::URL;
--use Mojo::Util 'url_unescape';
- use Regexp::Common 'URI';
- use Try::Tiny;
- use Mojo::File 'path';
-@@ -62,6 +61,7 @@ our @EXPORT  = qw(
-   asset_type_from_setting
-   check_download_url
-   check_download_passlist
-+  get_url_short
-   create_downloads_list
-   human_readable_size
-   locate_asset
-@@ -499,42 +499,36 @@ sub check_download_passlist {
-     return ();
- }
- 
-+sub get_url_short {
-+    # Given a setting name, if it ends with _URL or _DECOMPRESS_URL
-+    # return the name with that string stripped, and a flag indicating
-+    # whether decompression will be needed. If it doesn't, returns
-+    # empty string and 0.
-+    my ($arg) = @_;
-+    return ('', 0) unless ($arg =~ /_URL$/);
-+    my $short;
-+    my $do_extract = 0;
-+    if ($arg =~ /_DECOMPRESS_URL$/) {
-+        $short      = substr($arg, 0, -15);
-+        $do_extract = 1;
-+    }
-+    else {
-+        $short = substr($arg, 0, -4);
-+    }
-+    return ($short, $do_extract);
-+}
-+
- sub create_downloads_list {
-     my ($args) = @_;
-     my %downloads = ();
-     for my $arg (keys %$args) {
--        next unless ($arg =~ /_URL$/);
--        # As this comes in from an API call, URL will be URI-encoded
--        # This obviously creates a vuln if untrusted users can POST
--        $args->{$arg} = url_unescape($args->{$arg});
--        my $url        = $args->{$arg};
--        my $do_extract = 0;
--        my $short;
-+        my $url = $args->{$arg};
-         my $filename;
--        # if $args{FOO_URL} or $args{FOO_DECOMPRESS_URL} is set but $args{FOO}
--        # is not, we will set $args{FOO} (the filename of the downloaded asset)
--        # to the URL filename. This has to happen *before*
--        # generate_jobs so the jobs have FOO set
--        if ($arg =~ /_DECOMPRESS_URL$/) {
--            $do_extract = 1;
--            $short      = substr($arg, 0, -15);    # remove whole _DECOMPRESS_URL substring
--        }
--        else {
--            $short = substr($arg, 0, -4);          # remove _URL substring
--        }
-+        my ($short, $do_extract) = get_url_short($arg);
-+        next unless ($short);
-         if (!$args->{$short}) {
--            $filename = Mojo::URL->new($url)->path->parts->[-1];
--            if ($do_extract) {
--                # if user wants to extract downloaded file, final filename
--                # will have last extension removed
--                $filename = fileparse($filename, qr/\.[^.]*/);
--            }
--            $args->{$short} = $filename;
--            if (!$args->{$short}) {
--                log_debug("Unable to get filename from $url. Ignoring $arg");
--                delete $args->{$short} unless $args->{$short};
--                next;
--            }
-+            log_debug("No target filename set for $url. Ignoring $arg");
-+            next;
-         }
-         else {
-             $filename = $args->{$short};
-diff --git a/t/api/02-iso-download.t b/t/api/02-iso-download.t
-index fcb3744f0..53b67ebf5 100644
---- a/t/api/02-iso-download.t
-+++ b/t/api/02-iso-download.t
-@@ -298,4 +298,17 @@ subtest 'download task only blocks the related job when test suites have differe
-     is scalar(@{$gru_dep_tasks->{$gru_task_ids[0]}}), 3, 'one download task was created and it blocked 3 jobs';
- };
- 
-+subtest 'placeholder expansions work with _URL-derived settings' => sub {
-+    $test_suites->find({name => 'kde'})->settings->create({key => 'FOOBAR', value => '%ISO%'});
-+    my $new_params = {%params, ISO_URL => 'http://localhost/openSUSE-13.1-DVD-i586-Build0091-Media.iso', TEST => 'kde'};
-+    $rsp = schedule_iso($new_params, 200);
-+    is $rsp->json->{count}, 1, 'one job was scheduled';
-+    my $expanderjob = get_job($rsp->json->{ids}->[0]);
-+    is(
-+        $expanderjob->{settings}->{FOOBAR},
-+        'openSUSE-13.1-DVD-i586-Build0091-Media.iso',
-+        '%ISO% in template is expanded by posted ISO_URL'
-+    );
-+};
-+
- done_testing();
--- 
-2.29.2
-
diff --git a/0001-Handle-placeholders-after-parsing-_URL-settings.patch b/0001-Handle-placeholders-after-parsing-_URL-settings.patch
new file mode 100644
index 0000000..2c23f6d
--- /dev/null
+++ b/0001-Handle-placeholders-after-parsing-_URL-settings.patch
@@ -0,0 +1,207 @@
+From fee60fdcc32ceadfba92736b518dd223de3f18b6 Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliam@redhat.com>
+Date: Mon, 16 Nov 2020 15:09:28 -0800
+Subject: [PATCH 1/4] Handle placeholders after parsing _URL settings
+
+b3bc8ebf caused some problems by moving the parsing of `_URL`
+settings to after the call to `JobSettings::generate_settings`,
+which is where handling of placeholders (%FOO%), usually from the
+templates, is done. This broke the case where e.g. a template
+uses `%ISO%` in a value, and the job is posted with `ISO_URL` but
+no explicit `ISO` set. In that case the derived `ISO` setting
+should be used in the placeholder expansion, but this was broken.
+
+This fixes the problems by splitting up the "parse _URL settings"
+and "create download list" functions of `create_downloads_list`,
+and moving the parsing part into `generate_settings`, just before
+placeholder expansion happens. This is after we pull in settings
+from the templates, so the bug b3bc8ebf was trying to fix (POO
+62159) should still be fixed. Download list creation should still
+happen the same as currently, so POO #70687 should still be fixed.
+
+Signed-off-by: Adam Williamson <awilliam@redhat.com>
+---
+ lib/OpenQA/JobSettings.pm | 39 ++++++++++++++++++++++++
+ lib/OpenQA/Utils.pm       | 63 +++++++++++++++++----------------------
+ t/api/02-iso-download.t   | 13 ++++++++
+ 3 files changed, 79 insertions(+), 36 deletions(-)
+
+diff --git a/lib/OpenQA/JobSettings.pm b/lib/OpenQA/JobSettings.pm
+index 0d6c11811..b0e364c8c 100644
+--- a/lib/OpenQA/JobSettings.pm
++++ b/lib/OpenQA/JobSettings.pm
+@@ -17,6 +17,12 @@ package OpenQA::JobSettings;
+ use strict;
+ use warnings;
+ 
++use File::Basename;
++use Mojo::URL;
++use Mojo::Util 'url_unescape';
++use OpenQA::Log 'log_debug';
++use OpenQA::Utils 'get_url_short';
++
+ sub generate_settings {
+     my ($params) = @_;
+     my $settings = $params->{settings};
+@@ -53,6 +59,7 @@ sub generate_settings {
+         $settings->{JOB_DESCRIPTION} = $job_template->description if length $job_template->description;
+     }
+ 
++    parse_url_settings($settings);
+     handle_plus_in_settings($settings);
+     return expand_placeholders($settings);
+ }
+@@ -104,4 +111,36 @@ sub handle_plus_in_settings {
+     }
+ }
+ 
++# Given a hashref of settings, parse any whose names end in _URL
++# to the short name, then if there is not already a setting with
++# the short name, set it to the filename from the URL (with the
++# compression extension removed in the case of _DECOMPRESS_URL).
++# This has to happen *before* generate_jobs
++sub parse_url_settings {
++    my ($settings) = @_;
++    for my $setting (keys %$settings) {
++        my ($short, $do_extract) = get_url_short($setting);
++        next unless ($short);
++        next if ($settings->{$short});
++        # As this comes in from an API call, URL will be URI-encoded
++        # This obviously creates a vuln if untrusted users can POST
++        $settings->{$setting} = url_unescape($settings->{$setting});
++        my $url = $settings->{$setting};
++        my $filename;
++        $filename = Mojo::URL->new($url)->path->parts->[-1];
++        if ($do_extract) {
++            # if user wants to extract downloaded file, final filename
++            # will have last extension removed
++            $filename = fileparse($filename, qr/\.[^.]*/);
++        }
++        $settings->{$short} = $filename;
++        if (!$settings->{$short}) {
++            log_debug("Unable to get filename from $url. Ignoring $setting");
++            delete $settings->{$short} unless $settings->{$short};
++            next;
++        }
++    }
++    return undef;
++}
++
+ 1;
+diff --git a/lib/OpenQA/Utils.pm b/lib/OpenQA/Utils.pm
+index 4db65eaeb..6dc3d0880 100644
+--- a/lib/OpenQA/Utils.pm
++++ b/lib/OpenQA/Utils.pm
+@@ -21,7 +21,6 @@ use Carp;
+ use Cwd 'abs_path';
+ use IPC::Run();
+ use Mojo::URL;
+-use Mojo::Util 'url_unescape';
+ use Regexp::Common 'URI';
+ use Try::Tiny;
+ use Mojo::File 'path';
+@@ -62,6 +61,7 @@ our @EXPORT  = qw(
+   asset_type_from_setting
+   check_download_url
+   check_download_passlist
++  get_url_short
+   create_downloads_list
+   human_readable_size
+   locate_asset
+@@ -499,45 +499,36 @@ sub check_download_passlist {
+     return ();
+ }
+ 
++sub get_url_short {
++    # Given a setting name, if it ends with _URL or _DECOMPRESS_URL
++    # return the name with that string stripped, and a flag indicating
++    # whether decompression will be needed. If it doesn't, returns
++    # empty string and 0.
++    my ($arg) = @_;
++    return ('', 0) unless ($arg =~ /_URL$/);
++    my $short;
++    my $do_extract = 0;
++    if ($arg =~ /_DECOMPRESS_URL$/) {
++        $short      = substr($arg, 0, -15);
++        $do_extract = 1;
++    }
++    else {
++        $short = substr($arg, 0, -4);
++    }
++    return ($short, $do_extract);
++}
++
+ sub create_downloads_list {
+     my ($args) = @_;
+     my %downloads = ();
+     for my $arg (keys %$args) {
+-        next unless ($arg =~ /_URL$/);
+-        # As this comes in from an API call, URL will be URI-encoded
+-        # This obviously creates a vuln if untrusted users can POST
+-        $args->{$arg} = url_unescape($args->{$arg});
+-        my $url        = $args->{$arg};
+-        my $do_extract = 0;
+-        my $short;
+-        my $filename;
+-        # if $args{FOO_URL} or $args{FOO_DECOMPRESS_URL} is set but $args{FOO}
+-        # is not, we will set $args{FOO} (the filename of the downloaded asset)
+-        # to the URL filename. This has to happen *before*
+-        # generate_jobs so the jobs have FOO set
+-        if ($arg =~ /_DECOMPRESS_URL$/) {
+-            $do_extract = 1;
+-            $short      = substr($arg, 0, -15);    # remove whole _DECOMPRESS_URL substring
+-        }
+-        else {
+-            $short = substr($arg, 0, -4);          # remove _URL substring
+-        }
+-        if (!$args->{$short}) {
+-            $filename = Mojo::URL->new($url)->path->parts->[-1];
+-            if ($do_extract) {
+-                # if user wants to extract downloaded file, final filename
+-                # will have last extension removed
+-                $filename = fileparse($filename, qr/\.[^.]*/);
+-            }
+-            $args->{$short} = $filename;
+-            if (!$args->{$short}) {
+-                log_debug("Unable to get filename from $url. Ignoring $arg");
+-                delete $args->{$short} unless $args->{$short};
+-                next;
+-            }
+-        }
+-        else {
+-            $filename = $args->{$short};
++        my $url = $args->{$arg};
++        my ($short, $do_extract) = get_url_short($arg);
++        next unless ($short);
++        my $filename = $args->{$short};
++        unless ($filename) {
++            log_debug("No target filename set for $url. Ignoring $arg");
++            next;
+         }
+         # We're only going to allow downloading of asset types. We also
+         # need this to determine the download location later
+diff --git a/t/api/02-iso-download.t b/t/api/02-iso-download.t
+index fcb3744f0..53b67ebf5 100644
+--- a/t/api/02-iso-download.t
++++ b/t/api/02-iso-download.t
+@@ -298,4 +298,17 @@ subtest 'download task only blocks the related job when test suites have differe
+     is scalar(@{$gru_dep_tasks->{$gru_task_ids[0]}}), 3, 'one download task was created and it blocked 3 jobs';
+ };
+ 
++subtest 'placeholder expansions work with _URL-derived settings' => sub {
++    $test_suites->find({name => 'kde'})->settings->create({key => 'FOOBAR', value => '%ISO%'});
++    my $new_params = {%params, ISO_URL => 'http://localhost/openSUSE-13.1-DVD-i586-Build0091-Media.iso', TEST => 'kde'};
++    $rsp = schedule_iso($new_params, 200);
++    is $rsp->json->{count}, 1, 'one job was scheduled';
++    my $expanderjob = get_job($rsp->json->{ids}->[0]);
++    is(
++        $expanderjob->{settings}->{FOOBAR},
++        'openSUSE-13.1-DVD-i586-Build0091-Media.iso',
++        '%ISO% in template is expanded by posted ISO_URL'
++    );
++};
++
+ done_testing();
+-- 
+2.29.2
+
diff --git a/0002-Don-t-set-FOO-from-FOO_URL-if-FOO-is-defined-but-fal.patch b/0002-Don-t-set-FOO-from-FOO_URL-if-FOO-is-defined-but-fal.patch
index 31a9e5d..8eec53e 100644
--- a/0002-Don-t-set-FOO-from-FOO_URL-if-FOO-is-defined-but-fal.patch
+++ b/0002-Don-t-set-FOO-from-FOO_URL-if-FOO-is-defined-but-fal.patch
@@ -1,7 +1,7 @@
-From 75df1142a6e10e6511bb047bc897cf44298d292f Mon Sep 17 00:00:00 2001
+From 0b2bb60efb0292764efe3c00ae19743b5165c5d8 Mon Sep 17 00:00:00 2001
 From: Adam Williamson <awilliam@redhat.com>
 Date: Tue, 17 Nov 2020 10:16:51 -0800
-Subject: [PATCH 2/2] Don't set FOO from FOO_URL if FOO is defined but false
+Subject: [PATCH 2/4] Don't set FOO from FOO_URL if FOO is defined but false
 
 If someone has explicitly set e.g. ISO to "" for some scenario,
 that's a clear signal they want the test in that scenario to run
diff --git a/0003-parse_url_settings-improve-filename-parse-check.patch b/0003-parse_url_settings-improve-filename-parse-check.patch
new file mode 100644
index 0000000..a7a4a8d
--- /dev/null
+++ b/0003-parse_url_settings-improve-filename-parse-check.patch
@@ -0,0 +1,39 @@
+From 5d04b8db3ce153540a71e65bf6bcfe6d82004d48 Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliam@redhat.com>
+Date: Wed, 18 Nov 2020 09:58:58 -0800
+Subject: [PATCH 3/4] parse_url_settings: improve filename parse check
+
+There's no need to set the value then delete it if it turns out
+we set it to an empty string; that's a hangover from when we did
+not assign `$filename` but set the value directly to the return
+of the `Mojo::URL` call. Let's just check if we managed to get a
+filename and bail before setting the value if not. This also
+reduces potential confusion around truthiness vs. defined checks.
+
+Signed-off-by: Adam Williamson <awilliam@redhat.com>
+---
+ lib/OpenQA/JobSettings.pm | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/lib/OpenQA/JobSettings.pm b/lib/OpenQA/JobSettings.pm
+index 0d438c0e4..c3c7d97c9 100644
+--- a/lib/OpenQA/JobSettings.pm
++++ b/lib/OpenQA/JobSettings.pm
+@@ -133,12 +133,11 @@ sub parse_url_settings {
+             # will have last extension removed
+             $filename = fileparse($filename, qr/\.[^.]*/);
+         }
+-        $settings->{$short} = $filename;
+-        if (!$settings->{$short}) {
++        if (!$filename) {
+             log_debug("Unable to get filename from $url. Ignoring $setting");
+-            delete $settings->{$short} unless $settings->{$short};
+             next;
+         }
++        $settings->{$short} = $filename;
+     }
+     return undef;
+ }
+-- 
+2.29.2
+
diff --git a/0004-parse_url_settings-don-t-parse-value-for-non-asset-t.patch b/0004-parse_url_settings-don-t-parse-value-for-non-asset-t.patch
new file mode 100644
index 0000000..e5d024b
--- /dev/null
+++ b/0004-parse_url_settings-don-t-parse-value-for-non-asset-t.patch
@@ -0,0 +1,83 @@
+From 0340774523d7b11bd54c59780e1504d12d697f3d Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliam@redhat.com>
+Date: Wed, 18 Nov 2020 10:02:08 -0800
+Subject: [PATCH 4/4] parse_url_settings: don't parse value for non-asset types
+
+If a test sets NOT_ASSET_URL: http://some/parseable.url , we don't
+actually want to parse that to NOT_ASSET: parseable.url , because
+we aren't going to download it later. We had this bug back in 2016
+and fixed it specifically in f54a18f , then regressed it again in
+391f95e3 because we needed to pass the parsed file name to the
+asset type check.
+
+When we split up `parse_url_settings` and `create_downloads_list`
+the asset type check wound up in `create_downloads_list`. To fix
+the bug we can't avoid duplicating it here - we do have to check
+it in both places, here to avoid setting $settings->{$short} if
+it's not an asset type, and there to avoid doing the download if
+somehow both NOT_ASSET_URL and NOT_ASSET wind up being set by
+templates or the scheduler. It's not worth splitting the check to
+a shared utility function as you still need flow control. I don't
+think the log message will ever be duplicated as we should never
+manage to reach and fail the check *both* times (only one or the
+other).
+
+Signed-off-by: Adam Williamson <awilliam@redhat.com>
+---
+ lib/OpenQA/JobSettings.pm | 13 +++++++++----
+ t/api/02-iso-download.t   |  1 +
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/lib/OpenQA/JobSettings.pm b/lib/OpenQA/JobSettings.pm
+index c3c7d97c9..335c8d1ef 100644
+--- a/lib/OpenQA/JobSettings.pm
++++ b/lib/OpenQA/JobSettings.pm
+@@ -21,7 +21,7 @@ use File::Basename;
+ use Mojo::URL;
+ use Mojo::Util 'url_unescape';
+ use OpenQA::Log 'log_debug';
+-use OpenQA::Utils 'get_url_short';
++use OpenQA::Utils qw(asset_type_from_setting get_url_short);
+ 
+ sub generate_settings {
+     my ($params) = @_;
+@@ -113,9 +113,9 @@ sub handle_plus_in_settings {
+ 
+ # Given a hashref of settings, parse any whose names end in _URL
+ # to the short name, then if there is not already a setting with
+-# the short name, set it to the filename from the URL (with the
+-# compression extension removed in the case of _DECOMPRESS_URL).
+-# This has to happen *before* generate_jobs
++# the short name and the setting is an asset type, set it to the
++# filename from the URL (with the compression extension removed
++# in the case of _DECOMPRESS_URL).
+ sub parse_url_settings {
+     my ($settings) = @_;
+     for my $setting (keys %$settings) {
+@@ -137,6 +137,11 @@ sub parse_url_settings {
+             log_debug("Unable to get filename from $url. Ignoring $setting");
+             next;
+         }
++        # We shouldn't set the short setting for non-asset types
++        unless (asset_type_from_setting($short, $filename)) {
++            log_debug("_URL downloading only allowed for asset types! $short is not an asset type");
++            next;
++        }
+         $settings->{$short} = $filename;
+     }
+     return undef;
+diff --git a/t/api/02-iso-download.t b/t/api/02-iso-download.t
+index 914d30552..a718ef154 100644
+--- a/t/api/02-iso-download.t
++++ b/t/api/02-iso-download.t
+@@ -158,6 +158,7 @@ check_job_setting($t, $rsp, 'KERNEL', 'callitvmlinuz',
+ $rsp = schedule_iso({%params, NO_ASSET_URL => 'http://localhost/nonexistent.iso'});
+ is($rsp->json->{count}, $expected_job_count, 'a regular ISO post creates the expected number of jobs');
+ check_download_asset('non-asset _URL');
++check_job_setting($t, $rsp, 'NO_ASSET', undef, 'NO_ASSET is not parsed from NO_ASSET_URL');
+ 
+ # Using asset _URL but without filename extractable from URL create warning in log file, jobs, but no gru job
+ $rsp = schedule_iso({%iso, ISO_URL => 'http://localhost'});
+-- 
+2.29.2
+
diff --git a/openqa.spec b/openqa.spec
index 32f353b..a61d5b2 100644
--- a/openqa.spec
+++ b/openqa.spec
@@ -86,7 +86,7 @@
 
 Name:           openqa
 Version:        %{github_version}
-Release:        58%{?github_date:.%{github_date}git%{shortcommit}}%{?dist}
+Release:        59%{?github_date:.%{github_date}git%{shortcommit}}%{?dist}
 Summary:        OS-level automated testing framework
 License:        GPLv2+
 Url:            http://os-autoinst.github.io/openQA/
@@ -113,8 +113,10 @@ Source4:        23-fedora-messaging.t
 Patch0:         0001-Fix-create_admin-by-not-expecting-ARGV-after-parsing.patch
 # Fix placeholder substitution and overrides for _URL-derived settings
 # https://github.com/os-autoinst/openQA/pull/3564
-Patch1:         0001-Do-handling-of-placeholders-after-_URL-variables-par.patch
+Patch1:         0001-Handle-placeholders-after-parsing-_URL-settings.patch
 Patch2:         0002-Don-t-set-FOO-from-FOO_URL-if-FOO-is-defined-but-fal.patch
+Patch3:         0003-parse_url_settings-improve-filename-parse-check.patch
+Patch4:         0004-parse_url_settings-don-t-parse-value-for-non-asset-t.patch
 
 BuildRequires:  %{python_scripts_requires}
 BuildRequires:  perl-generators
@@ -384,9 +386,6 @@ rm \
     t/25-cache-service.t \
     t/34-developer_mode-unit.t \
     t/44-scripts.t
-# XXX for mock builds, uncomment this: see
-# https://github.com/rpm-software-management/mock/issues/612
-#rm t/40-openqa-clone-job.t
 
 # "CI" set with longer timeouts as needed for higher performance variations
 # within CI systems, e.g. OBS. See t/lib/OpenQA/Test/TimeLimit.pm
@@ -642,6 +641,9 @@ fi
 %{_datadir}/openqa/lib/OpenQA/WebAPI/Plugin/FedoraUpdateRestart.pm
 
 %changelog
+* Wed Nov 18 2020 Adam Williamson <awilliam@redhat.com> - 4.6-59.20201103git91baf79
+- Update PR #3564 backport with latest changes
+
 * Tue Nov 17 2020 Adam Williamson <awilliam@redhat.com> - 4.6-58.20201103git91baf79
 - Backport PR #3564: improved fixes for placeholders/overrides