Launchpad itself

Merge ~twom/launchpad:oci-policy-tags-hang-off-branches into launchpad:master

Proposed by Tom Wardill on 2021-01-11

Status:	Superseded
Proposed branch:	~twom/launchpad:oci-policy-tags-hang-off-branches
Merge into:	launchpad:master
Prerequisite:	~twom/launchpad:oci-policy-use-distribution-credentials-in-upload
Diff against target:	1325 lines (+118/-684) 18 files modified dev/null (+0/-98) lib/lp/oci/browser/ocirecipe.py (+1/-28) lib/lp/oci/browser/tests/test_ocirecipe.py (+0/-42) lib/lp/oci/configure.zcml (+0/-12) lib/lp/oci/interfaces/ocirecipe.py (+4/-11) lib/lp/oci/model/ocipushrule.py (+0/-22) lib/lp/oci/model/ocirecipe.py (+13/-35) lib/lp/oci/model/ociregistryclient.py (+32/-28) lib/lp/oci/templates/ocirecipe-index.pt (+27/-40) lib/lp/oci/templates/ocirecipe-new.pt (+0/-5) lib/lp/oci/tests/test_ocirecipe.py (+17/-53) lib/lp/oci/tests/test_ociregistryclient.py (+20/-56) lib/lp/registry/browser/configure.zcml (+1/-1) lib/lp/registry/browser/distribution.py (+2/-115) lib/lp/registry/browser/tests/test_distribution_views.py (+1/-122) lib/lp/registry/configure.zcml (+0/-1) lib/lp/registry/interfaces/distribution.py (+0/-8) lib/lp/registry/model/distribution.py (+0/-7)
Related bugs:	Link a bug report

Reviewer	Date Requested	Status
Colin Watson (community)		Needs Information on 2021-01-14
Thiago F. Pappacena (community)	2021-01-11	Approve on 2021-01-11
Review via email: mp+396085@code.launchpad.net

This proposal has been superseded by a proposal from 2021-01-15.

Commit message

Extract tag names from branch names in distribution scenario

Description of the change

In the case of a distribution with registry credentials, we should use the git branch name as a tag.

The format for this is not enforced by this MP.

Revision history for this message

Thiago F. Pappacena (pappacena) wrote on 2021-01-11:

LGTM

review: Approve

Revision history for this message

Colin Watson (cjwatson) wrote on 2021-01-14:

I'd like to see this disconnected from the distribution credentials work if possible, by using the new tag format across the board as long as the branch name is suitable (for appropriate values of "suitable"). Do you have a sense of how far away from that we are with current production data?

review: Needs Information

~twom/launchpad:oci-policy-tags-hang-off-branches updated on 2021-01-15

4b5163f... by Tom Wardill on 2021-01-15: Rely on the branch format rather than distribution credentials

Unmerged commits

4b5163f... by Tom Wardill on 2021-01-15: Rely on the branch format rather than distribution credentials
5c57317... by Tom Wardill on 2021-01-11: Extract tag names from branch names in distribution scenario

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk

Subscribers

People subscribed via source and target branches

to all changes:

Canonical Launchpad Engineering

Christina A Reitbauer

Edson_g2020_ubuntuone Gomes

Jordan

Kevin bush

Maximiliano Bertacchini

Tom Wardill

noômen

to status/vote changes:

asimbol83

 diff --git a/database/schema/patch-2210-24-0.sql b/database/schema/patch-2210-24-0.sql
 deleted file mode 100644
 index 833fa88..0000000
 --- a/database/schema/patch-2210-24-0.sql
 +++ /dev/null
@@ -1,11 +0,0 @@
---- Copyright 2021 Canonical Ltd.  This software is licensed under the
---- GNU Affero General Public License version 3 (see the file LICENSE).
--
--SET client_min_messages=ERROR;
--
--ALTER TABLE Distribution
--    ADD COLUMN oci_credentials INTEGER REFERENCES OCIRegistryCredentials;
--
--COMMENT ON COLUMN Distribution.oci_credentials IS 'Credentials and URL to use for uploading all OCI Images in this distribution to a registry.';
--
--INSERT INTO LaunchpadDatabaseRevision VALUES (2210, 24, 0);
 diff --git a/lib/lp/oci/browser/ocirecipe.py b/lib/lp/oci/browser/ocirecipe.py
 index 0d3f5bc..a2543e6 100644
 --- a/lib/lp/oci/browser/ocirecipe.py
 +++ b/lib/lp/oci/browser/ocirecipe.py
@@ -742,15 +742,6 @@ class OCIRecipeFormMixin:
              build_args[k] = v
          data['build_args'] = build_args
--    @property
--    def use_distribution_credentials(self):
--        if hasattr(self.context, 'oci_project'):
--            project = self.context.oci_project
--        else:
--            project = self.context
--        distro = project.distribution
--        return bool(distro and distro.oci_registry_credentials)
--
  class OCIRecipeAddView(LaunchpadFormView, EnableProcessorsMixin,
                         OCIRecipeFormMixin):
@@ -784,14 +775,6 @@ class OCIRecipeAddView(LaunchpadFormView, EnableProcessorsMixin,
              "The architectures that this OCI recipe builds for. Some "
              "architectures are restricted and may only be enabled or "
              "disabled by administrators.")
--        if self.use_distribution_credentials:
--            self.form_fields += FormFields(TextLine(
--                __name__='image_name',
--                title=u"Image name",
--                description=(
--                    "Name to use for registry upload. "
--                    "Defaults to the name of the recipe."),
--                required=False, readonly=False))
      def setUpGitRefWidget(self):
          """Setup GitRef widget indicating the user to use the default
@@ -854,9 +837,7 @@ class OCIRecipeAddView(LaunchpadFormView, EnableProcessorsMixin,
              oci_project=self.context, git_ref=data["git_ref"],
              build_file=data["build_file"], description=data["description"],
              build_daily=data["build_daily"], build_args=data["build_args"],
--            build_path=data["build_path"], processors=data["processors"],
--            # image_name is only available if using distribution credentials.
--            image_name=data.get("image_name"))
++            build_path=data["build_path"], processors=data["processors"])
          self.next_url = canonical_url(recipe)
@@ -957,14 +938,6 @@ class OCIRecipeEditView(BaseOCIRecipeEditView, EnableProcessorsMixin,
              "The architectures that this OCI recipe builds for. Some "
              "architectures are restricted and may only be enabled or "
              "disabled by administrators.")
--        if self.use_distribution_credentials:
--            self.form_fields += FormFields(TextLine(
--                __name__='image_name',
--                title=u"Image name",
--                description=(
--                    "Name to use for registry upload. "
--                    "Defaults to the name of the recipe."),
--                required=False, readonly=False))
      def validate(self, data):
          """See `LaunchpadFormView`."""
 diff --git a/lib/lp/oci/browser/tests/test_ocirecipe.py b/lib/lp/oci/browser/tests/test_ocirecipe.py
 index 543d524..afea558 100644
 --- a/lib/lp/oci/browser/tests/test_ocirecipe.py
 +++ b/lib/lp/oci/browser/tests/test_ocirecipe.py
@@ -244,29 +244,6 @@ class TestOCIRecipeAddView(BaseTestOCIRecipeView):
              "Build-time\nARG variables:\nVAR1=10\nVAR2=20",
              MatchesTagText(content, "build-args"))
--    def test_create_new_recipe_with_image_name(self):
--        oci_project = self.factory.makeOCIProject()
--        credentials = self.factory.makeOCIRegistryCredentials()
--        with person_logged_in(oci_project.distribution.owner):
--            oci_project.distribution.oci_registry_credentials = credentials
--        [git_ref] = self.factory.makeGitRefs()
--        browser = self.getViewBrowser(
--            oci_project, view_name="+new-recipe", user=self.person)
--        browser.getControl(name="field.name").value = "recipe-name"
--        browser.getControl("Description").value = "Recipe description"
--        browser.getControl(name="field.git_ref.repository").value = (
--            git_ref.repository.identity)
--        browser.getControl(name="field.git_ref.path").value = git_ref.path
--
--        image_name = self.factory.getUniqueUnicode()
--        browser.getControl(name="field.image_name").value = image_name
--        browser.getControl("Create OCI recipe").click()
--
--        content = find_main_content(browser.contents)
--        self.assertThat(
--            "Registry image name\n{}".format(image_name),
--            MatchesTagText(content, "image-name"))
--
      def test_create_new_recipe_users_teams_as_owner_options(self):
          # Teams that the user is in are options for the OCI recipe owner.
          self.factory.makeTeam(
@@ -596,25 +573,6 @@ class TestOCIRecipeEditView(OCIConfigHelperMixin, BaseTestOCIRecipeView):
          IStore(recipe).reload(recipe)
          self.assertEqual({"VAR1": "xxx", "VAR2": "uu"}, recipe.build_args)
--    def test_edit_image_name(self):
--        self.setUpDistroSeries()
--        credentials = self.factory.makeOCIRegistryCredentials()
--        with person_logged_in(self.distribution.owner):
--            self.distribution.oci_registry_credentials = credentials
--        oci_project = self.factory.makeOCIProject(pillar=self.distribution)
--        recipe = self.factory.makeOCIRecipe(
--            registrant=self.person, owner=self.person, oci_project=oci_project)
--        browser = self.getViewBrowser(
--            recipe, view_name="+edit", user=recipe.owner)
--        image_name = self.factory.getUniqueUnicode()
--        field = browser.getControl(name="field.image_name")
--        field.value = image_name
--        browser.getControl("Update OCI recipe").click()
--        content = find_main_content(browser.contents)
--        self.assertThat(
--            "Registry image name\n{}".format(image_name),
--            MatchesTagText(content, "image-name"))
--
      def test_edit_with_invisible_processor(self):
          # It's possible for existing recipes to have an enabled processor
          # that's no longer usable with the current distroseries, which will
 diff --git a/lib/lp/oci/configure.zcml b/lib/lp/oci/configure.zcml
 index 86c235b..1f7a6c7 100644
 --- a/lib/lp/oci/configure.zcml
 +++ b/lib/lp/oci/configure.zcml
@@ -155,18 +155,6 @@
              interface="lp.oci.interfaces.ocipushrule.IOCIPushRuleSet"/>
      </securedutility>
--    <!-- OCIDistributionPushRule -->
--    <class class="lp.oci.model.ocipushrule.OCIDistributionPushRule">
--        <require
--            permission="launchpad.View"
--            interface="lp.oci.interfaces.ocipushrule.IOCIPushRuleView
--                       lp.oci.interfaces.ocipushrule.IOCIPushRuleEditableAttributes" />
--        <require
--            permission="launchpad.Edit"
--            interface="lp.oci.interfaces.ocipushrule.IOCIPushRuleEdit"
--            set_schema="lp.oci.interfaces.ocipushrule.IOCIPushRuleEditableAttributes" />
--    </class>
--
      <!-- OCI related jobs -->
      <securedutility
          component="lp.oci.model.ocirecipebuildjob.OCIRegistryUploadJob"
 diff --git a/lib/lp/oci/interfaces/ocirecipe.py b/lib/lp/oci/interfaces/ocirecipe.py
 index 51cf370..a27c5fd 100644
 --- a/lib/lp/oci/interfaces/ocirecipe.py
 +++ b/lib/lp/oci/interfaces/ocirecipe.py
@@ -280,10 +280,10 @@ class IOCIRecipeView(Interface):
              "Whether everything is set up to allow uploading builds of "
              "this OCI recipe to a registry."))
--    use_distribution_credentials = Bool(
--        title=_("Use Distribution credentials"), required=True, readonly=True,
--        description=_("Use the credentials on a Distribution for "
--                      "registry upload"))
++    is_valid_branch_format = Bool(
++        title=_("Is valid branch format"), required=True, readonly=True,
++        description=_("Whether the git branch name is the correct "
++                      "format for using as a tag name."))
      def requestBuild(requester, architecture):
          """Request that the OCI recipe is built.
@@ -439,13 +439,6 @@ class IOCIRecipeEditableAttributes(IHasOwner):
          description=_("If True, this recipe should be built daily."),
          readonly=False))
--    image_name = exported(TextLine(
--        title=_("Image name"),
--        description=_("Image name to use on upload to registry. "
--                      "Defaults to recipe name if not set."),
--        required=False,
--        readonly=False))
--
  class IOCIRecipeAdminAttributes(Interface):
      """`IOCIRecipe` attributes that can be edited by admins.
 diff --git a/lib/lp/oci/model/ocipushrule.py b/lib/lp/oci/model/ocipushrule.py
 index f7736e6..24d5e27 100644
 --- a/lib/lp/oci/model/ocipushrule.py
 +++ b/lib/lp/oci/model/ocipushrule.py
@@ -7,7 +7,6 @@ from __future__ import absolute_import, print_function, unicode_literals
  __metaclass__ = type
  __all__ = [
--    'OCIDistributionPushRule',
      'OCIPushRule',
      'OCIPushRuleSet',
+     ]
@@ -73,27 +72,6 @@ class OCIPushRule(Storm):
          IStore(OCIPushRule).remove(self)
--@implementer(IOCIPushRule)
--class OCIDistributionPushRule:
--    """A none-database instance that is synthesised from data elsewhere."""
--
--    registry_credentials = None
--
--    def __init__(self, recipe, registry_credentials, image_name):
--        self.id = -1
--        self.recipe = recipe
--        self.registry_credentials = registry_credentials
--        self.image_name = image_name
--
--    @property
--    def registry_url(self):
--        return self.registry_credentials.url
--
--    @property
--    def username(self):
--        return self.registry_credentials.username
--
--
  @implementer(IOCIPushRuleSet)
  class OCIPushRuleSet:
 diff --git a/lib/lp/oci/model/ocirecipe.py b/lib/lp/oci/model/ocirecipe.py
 index 34fd348..8e5d6f5 100644
 --- a/lib/lp/oci/model/ocirecipe.py
 +++ b/lib/lp/oci/model/ocirecipe.py
@@ -12,6 +12,8 @@ __all__ = [
      'OCIRecipeSet',
+     ]
++import re
++
  from lazr.lifecycle.event import ObjectCreatedEvent
  import pytz
  import six
@@ -74,10 +76,7 @@ from lp.oci.interfaces.ocirecipejob import IOCIRecipeRequestBuildsJobSource
  from lp.oci.interfaces.ociregistrycredentials import (
      IOCIRegistryCredentialsSet,
+     )
--from lp.oci.model.ocipushrule import (
--    OCIDistributionPushRule,
--    OCIPushRule,
--    )
++from lp.oci.model.ocipushrule import OCIPushRule
  from lp.oci.model.ocirecipebuild import OCIRecipeBuild
  from lp.oci.model.ocirecipejob import OCIRecipeJob
  from lp.registry.interfaces.distribution import IDistributionSet
@@ -163,13 +162,10 @@ class OCIRecipe(Storm, WebhookTargetMixin):
      build_daily = Bool(name="build_daily", default=False)
--    _image_name = Unicode(name="image_name", allow_none=True)
--
      def __init__(self, name, registrant, owner, oci_project, git_ref,
                   description=None, official=False, require_virtualized=True,
                   build_file=None, build_daily=False, date_created=DEFAULT,
--                 allow_internet=True, build_args=None, build_path=None,
--                 image_name=None):
++                 allow_internet=True, build_args=None, build_path=None):
          if not getFeatureFlag(OCI_RECIPE_ALLOW_CREATE):
              raise OCIRecipeFeatureDisabled()
          super(OCIRecipe, self).__init__()
@@ -188,7 +184,6 @@ class OCIRecipe(Storm, WebhookTargetMixin):
          self.allow_internet = allow_internet
          self.build_args = build_args or {}
          self.build_path = build_path
--        self.image_name = image_name
      def __repr__(self):
          return "<OCIRecipe ~%s/%s/+oci/%s/+recipe/%s>" % (
@@ -205,6 +200,11 @@ class OCIRecipe(Storm, WebhookTargetMixin):
          return self._official
      @property
++    def is_valid_branch_format(self):
++        format_regex = "^(?!(stable|candidate|beta|edge)).*-(\d{2}\.\d{2})$"
++        return bool(re.match(format_regex, self.git_ref.name))
++
++    @property
      def build_args(self):
          return self._build_args or {}
@@ -470,18 +470,10 @@ class OCIRecipe(Storm, WebhookTargetMixin):
      @property
      def push_rules(self):
--        # if we're in a distribution that has credentials set at that level
--        # create a push rule using those credentials
--        if self.use_distribution_credentials:
--            push_rule = OCIDistributionPushRule(
--                self,
--                self.oci_project.distribution.oci_registry_credentials,
--                self.image_name)
--            return [push_rule]
          rules = IStore(self).find(
              OCIPushRule,
              OCIPushRule.recipe == self.id)
--        return list(rules)
++        return rules
      @property
      def _pending_states(self):
@@ -542,20 +534,7 @@ class OCIRecipe(Storm, WebhookTargetMixin):
      @property
      def can_upload_to_registry(self):
--        return bool(self.push_rules)
--
--    @property
--    def use_distribution_credentials(self):
--        distribution = self.oci_project.distribution
--        return distribution and distribution.oci_registry_credentials
--
--    @property
--    def image_name(self):
--        return self._image_name or self.name
--
--    @image_name.setter
--    def image_name(self, value):
--        self._image_name = value
++        return not self.push_rules.is_empty()
      def newPushRule(self, registrant, registry_url, image_name, credentials,
                      credentials_owner=None):
@@ -597,8 +576,7 @@ class OCIRecipeSet:
      def new(self, name, registrant, owner, oci_project, git_ref, build_file,
              description=None, official=False, require_virtualized=True,
              build_daily=False, processors=None, date_created=DEFAULT,
--            allow_internet=True, build_args=None, build_path=None,
--            image_name=None):
++            allow_internet=True, build_args=None, build_path=None):
          """See `IOCIRecipeSet`."""
          if not registrant.inTeam(owner):
              if owner.is_team:
@@ -623,7 +601,7 @@ class OCIRecipeSet:
          oci_recipe = OCIRecipe(
              name, registrant, owner, oci_project, git_ref, description,
              official, require_virtualized, build_file, build_daily,
--            date_created, allow_internet, build_args, build_path, image_name)
++            date_created, allow_internet, build_args, build_path)
          store.add(oci_recipe)
          if processors is None:
 diff --git a/lib/lp/oci/model/ociregistryclient.py b/lib/lp/oci/model/ociregistryclient.py
 index e528281..5470b6a 100644
 --- a/lib/lp/oci/model/ociregistryclient.py
 +++ b/lib/lp/oci/model/ociregistryclient.py
@@ -15,6 +15,8 @@ from functools import partial
  import hashlib
  from io import BytesIO
  import json
++
++
  try:
      from json.decoder import JSONDecodeError
  except ImportError:
@@ -243,22 +245,22 @@ class OCIRegistryClient:
          return data
      @classmethod
--    def _calculateTag(cls, build, push_rule):
++    def _calculateTags(cls, recipe):
          """Work out the base tag for the image should be.
--        :param build: `OCIRecipeBuild` representing this build.
          :param push_rule: `OCIPushRule` that we are using.
          """
--        # XXX twom 2020-04-17 This needs to include OCIProjectSeries and
--        # base image name
--        return "{}".format("edge")
++        tags = []
++        if recipe.is_valid_branch_format:
++            tags.append("{}_{}".format(recipe.git_ref.name, "edge"))
++        tags.append("edge")
++        return tags
      @classmethod
--    def _getCurrentRegistryManifest(cls, http_client, push_rule):
++    def _getCurrentRegistryManifest(cls, http_client, tag):
          """Get the current manifest for the given push rule. If manifest
          doesn't exist, raises HTTPError.
          """
--        tag = cls._calculateTag(None, push_rule)
          url = "/manifests/{}".format(tag)
          accept = "application/vnd.docker.distribution.manifest.list.v2+json"
          response = http_client.requestPath(
@@ -267,7 +269,7 @@ class OCIRegistryClient:
      @classmethod
      def _uploadRegistryManifest(cls, http_client, registry_manifest,
--                                push_rule, build=None):
++                                push_rule, tag, build=None):
          """Uploads the build manifest, returning its content information.
          The returned information can be used to create a Manifest list
@@ -276,18 +278,15 @@ class OCIRegistryClient:
          :return: A dict with {"digest": "sha256:xxx", "size": total_bytes}
          """
++        # This is
++        # https://docs.docker.com/registry/spec/manifest-v2-2/#manifest-list
++        # Specifically the Schema 2 manifest.
          digest = None
          data = json.dumps(registry_manifest)
          size = len(data)
          content_type = registry_manifest.get(
              "mediaType",
              "application/vnd.docker.distribution.manifest.v2+json")
--        if build is None:
--            # When uploading a manifest list, use the tag.
--            tag = cls._calculateTag(build, push_rule)
--        else:
--            # When uploading individual build manifests, use their digest.
--            tag = "sha256:%s" % hashlib.sha256(data).hexdigest()
          try:
              manifest_response = http_client.requestPath(
                  "/manifests/{}".format(tag),
@@ -311,7 +310,7 @@ class OCIRegistryClient:
      @classmethod
      def _upload_to_push_rule(
--            cls, push_rule, build, manifest, digests, preloaded_data):
++            cls, push_rule, build, manifest, digests, preloaded_data, tag):
          http_client = RegistryHTTPClient.getInstance(push_rule)
          for section in manifest:
@@ -346,7 +345,7 @@ class OCIRegistryClient:
              # Upload the registry manifest
              manifest = cls._uploadRegistryManifest(
--                http_client, registry_manifest, push_rule, build)
++                http_client, registry_manifest, push_rule, tag, build)
              # Save the uploaded manifest location, so we can use it in case
              # this is a multi-arch image upload.
@@ -376,11 +375,13 @@ class OCIRegistryClient:
          exceptions = []
          for push_rule in build.recipe.push_rules:
--            try:
--                cls._upload_to_push_rule(
--                    push_rule, build, manifest, digests, preloaded_data)
--            except Exception as e:
--                exceptions.append(e)
++            for tag in cls._calculateTags(build.recipe):
++                try:
++                    cls._upload_to_push_rule(
++                        push_rule, build, manifest, digests, preloaded_data,
++                        tag)
++                except Exception as e:
++                    exceptions.append(e)
          if len(exceptions) == 1:
              raise exceptions[0]
          elif len(exceptions) > 1:
@@ -388,7 +389,7 @@ class OCIRegistryClient:
      @classmethod
      def makeMultiArchManifest(cls, http_client, push_rule, build_request,
--                              uploaded_builds):
++                              uploaded_builds, tag):
          """Returns the multi-arch manifest content including all uploaded
          builds of the given build_request.
          """
@@ -402,7 +403,7 @@ class OCIRegistryClient:
          try:
              current_manifest = cls._getCurrentRegistryManifest(
--                http_client, push_rule)
++                http_client, tag)
              # Check if the current manifest is not an incompatible version.
              version = current_manifest.get("schemaVersion", 1)
              if version < 2 or "manifests" not in current_manifest:
@@ -481,11 +482,14 @@ class OCIRegistryClient:
          if not uploaded_builds:
              return
          for push_rule in build_request.recipe.push_rules:
--            http_client = RegistryHTTPClient.getInstance(push_rule)
--            multi_manifest_content = cls.makeMultiArchManifest(
--                http_client, push_rule, build_request, uploaded_builds)
--            cls._uploadRegistryManifest(
--                http_client, multi_manifest_content, push_rule, build=None)
++            for tag in cls._calculateTags(build_request.recipe):
++                http_client = RegistryHTTPClient.getInstance(push_rule)
++                multi_manifest_content = cls.makeMultiArchManifest(
++                    http_client, push_rule, build_request, uploaded_builds,
++                    tag)
++                cls._uploadRegistryManifest(
++                    http_client, multi_manifest_content, push_rule, tag,
++                    build=None)
  class OCIRegistryAuthenticationError(Exception):
 diff --git a/lib/lp/oci/templates/ocirecipe-index.pt b/lib/lp/oci/templates/ocirecipe-index.pt
 index 662c742..9a9aefc 100644
 --- a/lib/lp/oci/templates/ocirecipe-index.pt
 +++ b/lib/lp/oci/templates/ocirecipe-index.pt
@@ -81,12 +81,6 @@
            <pre tal:content="build_args" />
          </dd>
        </dl>
--      <dl id="image-name" tal:condition="context/use_distribution_credentials">
--        <dt>Registry image name</dt>
--        <dd>
--          <span tal:content="context/image_name" />
--        </dd>
--      </dl>
      </div>
      <h2>Latest builds</h2>
@@ -150,42 +144,35 @@
      </div>
--    <div tal:condition=context/use_distribution_credentials>
--      <h3>Registry upload</h3>
--      <p>This recipe will use the registry credentials set by the parent distribution</p>
--    </div>
--
--    <div tal:condition="not: context/use_distribution_credentials">
--      <h2>Recipe push rules</h2>
--      <table id="push-rules-listing" tal:condition="view/has_push_rules" class="listing"
--            style="margin-bottom: 1em; ">
--        <thead>
--          <tr>
--            <th>Registry URL</th>
--            <th>Username</th>
--            <th>Image Name</th>
++    <h2>Recipe push rules</h2>
++    <table id="push-rules-listing" tal:condition="view/has_push_rules" class="listing"
++           style="margin-bottom: 1em; ">
++      <thead>
++        <tr>
++          <th>Registry URL</th>
++          <th>Username</th>
++          <th>Image Name</th>
++        </tr>
++      </thead>
++      <tbody>
++        <tal:recipe-push-rules repeat="item view/push_rules">
++          <tr tal:define="rule item;
++                          show_credentials rule/registry_credentials/required:launchpad.View"
++              tal:attributes="id string:rule-${rule/id}">
++            <td tal:content="python: rule.registry_credentials.url if show_credentials else ''"/>
++            <td tal:content="python: rule.registry_credentials.username if show_credentials else ''"/>
++            <td tal:content="rule/image_name"/>
            </tr>
--        </thead>
--        <tbody>
--          <tal:recipe-push-rules repeat="item view/push_rules">
--            <tr tal:define="rule item;
--                            show_credentials rule/registry_credentials/required:launchpad.View"
--                tal:attributes="id string:rule-${rule/id}">
--              <td tal:content="python: rule.registry_credentials.url if show_credentials else ''"/>
--              <td tal:content="python: rule.registry_credentials.username if show_credentials else ''"/>
--              <td tal:content="rule/image_name"/>
--            </tr>
--          </tal:recipe-push-rules>
--        </tbody>
--      </table>
--      <p tal:condition="not: view/has_push_rules">
--        This OCI recipe has no push rules defined yet.
--      </p>
++        </tal:recipe-push-rules>
++      </tbody>
++    </table>
++    <p tal:condition="not: view/has_push_rules">
++      This OCI recipe has no push rules defined yet.
++    </p>
--      <div tal:define="link context/menu:context/edit_push_rules"
--          tal:condition="link/enabled">
--        <tal:edit-push-rules replace="structure link/fmt:link"/>
--      </div>
++    <div tal:define="link context/menu:context/edit_push_rules"
++         tal:condition="link/enabled">
++      <tal:edit-push-rules replace="structure link/fmt:link"/>
      </div>
    </div>
 diff --git a/lib/lp/oci/templates/ocirecipe-new.pt b/lib/lp/oci/templates/ocirecipe-new.pt
 index 00d9b08..1cae71e 100644
 --- a/lib/lp/oci/templates/ocirecipe-new.pt
 +++ b/lib/lp/oci/templates/ocirecipe-new.pt
@@ -41,11 +41,6 @@
          <tal:widget define="widget nocall:view/widgets/processors">
            <metal:block use-macro="context/@@launchpad_form/widget_row" />
          </tal:widget>
--        <span tal:condition="view/use_distribution_credentials">
--          <tal:widget define="widget nocall:view/widgets/image_name" >
--            <metal:block use-macro="context/@@launchpad_form/widget_row" />
--          </tal:widget>
--        </span>
        </table>
      </metal:formbody>
    </div>
 diff --git a/lib/lp/oci/tests/test_ocirecipe.py b/lib/lp/oci/tests/test_ocirecipe.py
 index 699954a..69f7cbf 100644
 --- a/lib/lp/oci/tests/test_ocirecipe.py
 +++ b/lib/lp/oci/tests/test_ocirecipe.py
@@ -749,36 +749,6 @@ class TestOCIRecipe(OCIConfigHelperMixin, TestCaseWithFactory):
              "VAR3": "A string",
          }, recipe.build_args)
--    def test_use_distribution_credentials_set(self):
--        distribution = self.factory.makeDistribution()
--        credentials = self.factory.makeOCIRegistryCredentials()
--        with person_logged_in(distribution.owner):
--            distribution.oci_registry_credentials = credentials
--        project = self.factory.makeOCIProject(pillar=distribution)
--        recipe = self.factory.makeOCIRecipe(oci_project=project)
--        self.assertTrue(recipe.use_distribution_credentials)
--
--    def test_use_distribution_credentials_not_set(self):
--        distribution = self.factory.makeDistribution()
--        project = self.factory.makeOCIProject(pillar=distribution)
--        recipe = self.factory.makeOCIRecipe(oci_project=project)
--        self.assertFalse(recipe.use_distribution_credentials)
--
--    def test_image_name_set(self):
--        distribution = self.factory.makeDistribution()
--        project = self.factory.makeOCIProject(pillar=distribution)
--        recipe = self.factory.makeOCIRecipe(oci_project=project)
--        image_name = self.factory.getUniqueUnicode()
--        with person_logged_in(recipe.owner):
--            recipe.image_name = image_name
--        self.assertEqual(image_name, removeSecurityProxy(recipe)._image_name)
--
--    def test_image_name_not_set(self):
--        distribution = self.factory.makeDistribution()
--        project = self.factory.makeOCIProject(pillar=distribution)
--        recipe = self.factory.makeOCIRecipe(oci_project=project)
--        self.assertEqual(recipe.name, recipe.image_name)
--
  class TestOCIRecipeProcessors(TestCaseWithFactory):
@@ -900,6 +870,23 @@ class TestOCIRecipeProcessors(TestCaseWithFactory):
              self.assertContentEqual(
                  [self.default_procs[0], self.arm, hppa], recipe.processors)
++    def test_valid_branch_format(self):
++        [git_ref] = self.factory.makeGitRefs(paths=["refs/heads/v1.0-20.04"])
++        recipe = self.factory.makeOCIRecipe(git_ref=git_ref)
++        self.assertTrue(recipe.is_valid_branch_format)
++
++    def test_valid_branch_format_invalid(self):
++        [git_ref] = self.factory.makeGitRefs(paths=["refs/heads/v1.0-foo"])
++        recipe = self.factory.makeOCIRecipe(git_ref=git_ref)
++        self.assertFalse(recipe.is_valid_branch_format)
++
++    def test_valid_branch_format_invalid_uses_risk(self):
++        for risk in ["stable", "candidate", "beta", "edge"]:
++            path = "refs/heads/{}-20.04".format(risk)
++            [git_ref] = self.factory.makeGitRefs(paths=[path])
++            recipe = self.factory.makeOCIRecipe(git_ref=git_ref)
++            self.assertFalse(recipe.is_valid_branch_format)
++
  class TestOCIRecipeSet(TestCaseWithFactory):
@@ -1314,29 +1301,6 @@ class TestOCIRecipeWebservice(OCIConfigHelperMixin, TestCaseWithFactory):
          self.assertEqual(
              image_name, push_rules["entries"][0]["image_name"])
--    def test_api_set_image_name(self):
--        """Can you set and retrieve the image name via the API?"""
--        self.setConfig()
--
--        image_name = self.factory.getUniqueUnicode()
--
--        with person_logged_in(self.person):
--            oci_project = self.factory.makeOCIProject(
--                registrant=self.person)
--            recipe = self.factory.makeOCIRecipe(
--                oci_project=oci_project, owner=self.person,
--                registrant=self.person)
--            url = api_url(recipe)
--
--        resp = self.webservice.patch(
--            url, 'application/json',
--            json.dumps({'image_name': image_name}))
--
--        self.assertEqual(209, resp.status, resp.body)
--
--        ws_project = self.load_from_api(url)
--        self.assertEqual(image_name, ws_project['image_name'])
--
  class TestOCIRecipeAsyncWebservice(TestCaseWithFactory):
      layer = LaunchpadFunctionalLayer
 diff --git a/lib/lp/oci/tests/test_ociregistryclient.py b/lib/lp/oci/tests/test_ociregistryclient.py
 index 403662d..3cfc920 100644
 --- a/lib/lp/oci/tests/test_ociregistryclient.py
 +++ b/lib/lp/oci/tests/test_ociregistryclient.py
@@ -69,7 +69,6 @@ from lp.services.compat import mock
  from lp.services.features.testing import FeatureFixture
  from lp.testing import (
      admin_logged_in,
--    person_logged_in,
      TestCaseWithFactory,
+     )
  from lp.testing.fixture import ZopeUtilityFixture
@@ -182,6 +181,14 @@ class TestOCIRegistryClient(OCIConfigHelperMixin, SpyProxyCallsMixin,
+         )
          responses.add("PUT", manifests_url, status=status_code, json=json)
++        # format for distribution credential upload
++        manifests_url = "{}/v2/{}/manifests/{}_edge".format(
++            push_rule.registry_credentials.url,
++            push_rule.image_name,
++            push_rule.recipe.git_ref.name
++        )
++        responses.add("PUT", manifests_url, status=status_code, json=json)
++
      @responses.activate
      def test_upload(self):
          self._makeFiles()
@@ -227,7 +234,6 @@ class TestOCIRegistryClient(OCIConfigHelperMixin, SpyProxyCallsMixin,
          }))
      @responses.activate
--<<<<<<< lib/lp/oci/tests/test_ociregistryclient.py
      def test_upload_ignores_superseded_builds(self):
          self.build.updateStatus(BuildStatus.FULLYBUILT)
          recipe = self.build.recipe
@@ -251,56 +257,6 @@ class TestOCIRegistryClient(OCIConfigHelperMixin, SpyProxyCallsMixin,
              OCIRecipeBuildRegistryUploadStatus.SUPERSEDED,
              self.build.registry_upload_status)
          self.assertEqual(0, len(responses.calls))
--=======
--    def test_upload_with_distribution_credentials(self):
--        self._makeFiles()
--        self.useFixture(MockPatch(
--            "lp.oci.model.ociregistryclient.OCIRegistryClient._upload"))
--        self.useFixture(MockPatch(
--            "lp.oci.model.ociregistryclient.OCIRegistryClient._upload_layer",
--            return_value=999))
--        credentials = self.factory.makeOCIRegistryCredentials()
--        image_name = self.factory.getUniqueUnicode()
--        self.build.recipe.image_name = image_name
--        distro = self.build.recipe.oci_project.distribution
--        with person_logged_in(distro.owner):
--            distro.oci_registry_credentials = credentials
--        # we have distribution credentials, we should have a 'push rule'
--        push_rule = self.build.recipe.push_rules[0]
--        responses.add("GET", "%s/v2/" % push_rule.registry_url, status=200)
--        self.addManifestResponses(push_rule)
--
--        self.client.upload(self.build)
--
--        request = json.loads(responses.calls[1].request.body)
--
--        self.assertThat(request, MatchesDict({
--            "layers": MatchesListwise([
--                MatchesDict({
--                    "mediaType": Equals(
--                        "application/vnd.docker.image.rootfs.diff.tar.gzip"),
--                    "digest": Equals("diff_id_1"),
--                    "size": Equals(999)}),
--                MatchesDict({
--                    "mediaType": Equals(
--                        "application/vnd.docker.image.rootfs.diff.tar.gzip"),
--                    "digest": Equals("diff_id_2"),
--                    "size": Equals(999)})
--            ]),
--            "schemaVersion": Equals(2),
--            "config": MatchesDict({
--                "mediaType": Equals(
--                    "application/vnd.docker.container.image.v1+json"),
--                "digest": Equals(
--                    "sha256:33b69b4b6e106f9fc7a8b93409"
--                    "36c85cf7f84b2d017e7b55bee6ab214761f6ab"),
--                "size": Equals(52)
--            }),
--            "mediaType": Equals(
--                "application/vnd.docker.distribution.manifest.v2+json")
--        }))
--
-->>>>>>> lib/lp/oci/tests/test_ociregistryclient.py
      @responses.activate
      def test_upload_formats_credentials(self):
@@ -390,10 +346,18 @@ class TestOCIRegistryClient(OCIConfigHelperMixin, SpyProxyCallsMixin,
                  'diff_id_1': Equals(self.layer_files[0].library_file),
                  'diff_id_2': Equals(self.layer_files[1].library_file)})}))
--    def test_calculateTag(self):
--        result = self.client._calculateTag(
--            self.build, self.build.recipe.push_rules[0])
--        self.assertEqual("edge", result)
++    def test_calculateTags_invalid_format(self):
++        [git_ref] = self.factory.makeGitRefs(paths=["refs/heads/invalid"])
++        self.build.recipe.git_ref = git_ref
++        result = self.client._calculateTags(self.build.recipe)
++        self.assertThat(result, MatchesListwise([Equals("edge")]))
++
++    def test_calculateTags_valid_format(self):
++        [git_ref] = self.factory.makeGitRefs(paths=["refs/heads/v1.0-20.04"])
++        self.build.recipe.git_ref = git_ref
++        result = self.client._calculateTags(self.build.recipe)
++        self.assertThat(result, MatchesListwise(
++            [Equals("v1.0-20.04_edge"), Equals("edge")]))
      def test_build_registry_manifest(self):
          self._makeFiles()
 diff --git a/lib/lp/registry/browser/configure.zcml b/lib/lp/registry/browser/configure.zcml
 index 6954e2c..cdaa3da 100644
 --- a/lib/lp/registry/browser/configure.zcml
 +++ b/lib/lp/registry/browser/configure.zcml
@@ -2275,7 +2275,7 @@
          for="lp.registry.interfaces.distribution.IDistribution"
          class="lp.registry.browser.distribution.DistributionEditView"
          permission="launchpad.Edit"
--        template="../templates/distribution-edit.pt"
++        template="../../app/templates/generic-edit.pt"
          />
      <browser:page
          name="+admin"
 diff --git a/lib/lp/registry/browser/distribution.py b/lib/lp/registry/browser/distribution.py
 index 25950ae..c499689 100644
 --- a/lib/lp/registry/browser/distribution.py
 +++ b/lib/lp/registry/browser/distribution.py
@@ -49,15 +49,10 @@ from zope.formlib.boolwidgets import CheckBoxWidget
  from zope.formlib.widget import CustomWidgetFactory
  from zope.interface import implementer
  from zope.lifecycleevent import ObjectCreatedEvent
--from zope.schema import (
--    Bool,
--    Password,
--    TextLine,
--    )
++from zope.schema import Bool
  from zope.security.checker import canWrite
  from zope.security.interfaces import Unauthorized
--from lp import _
  from lp.answers.browser.faqtarget import FAQTargetNavigationMixin
  from lp.answers.browser.questiontarget import QuestionTargetTraversalMixin
  from lp.app.browser.launchpadform import (
@@ -85,9 +80,6 @@ from lp.bugs.browser.structuralsubscription import (
+     )
  from lp.buildmaster.interfaces.processor import IProcessorSet
  from lp.code.browser.vcslisting import TargetDefaultVCSNavigationMixin
--from lp.oci.interfaces.ociregistrycredentials import (
--    IOCIRegistryCredentialsSet,
--    )
  from lp.registry.browser import (
      add_subscribe_link,
      RegistryEditFormView,
@@ -1027,101 +1019,6 @@ class DistributionEditView(RegistryEditFormView,
          """See `LaunchpadFormView`."""
          return 'Change %s details' % self.context.displayname
--    def createOCICredentials(self):
--        return form.Fields(
--            TextLine(
--                __name__='oci_credentials_url',
--                title=u"Registry URL",
--                description=(
--                    u"URL for the OCI registry to upload images to."
--                ),
--                required=False),
--            TextLine(
--                __name__='oci_credentials_region',
--                title=u"OCI registry region",
--                description=u"Region for the OCI Registry.",
--                required=False),
--            TextLine(
--                __name__='oci_credentials_username',
--                title=u"OCI registry username",
--                description=u"Username for the OCI Registry.",
--                required=False),
--            Password(
--                __name__='oci_credentials_password',
--                title=u"OCI registry password",
--                description=u"Password for the OCI Registry.",
--                required=False),
--            Password(
--                __name__='oci_credentials_confirm_password',
--                title=u"Confirm password",
--                required=False),
--            Bool(
--                __name__='oci_credentials_delete',
--                title=u"Delete",
--                description=u"Delete these credentials.",
--                required=False,)
--            )
--
--    def changeOCICredentials(self, data):
--        delete = data.pop("oci_credentials_delete", None)
--        if delete and self.context.oci_registry_credentials:
--            credentials = self.context.oci_registry_credentials
--            self.context.oci_registry_credentials = None
--            credentials.destroySelf()
--            return
--
--        url = data.pop("oci_credentials_url", None)
--        username = data.pop("oci_credentials_username", None)
--        region = data.pop("oci_credentials_region", None)
--        # validated against confirm password in validateOCICredentials
--        password = data.pop("oci_credentials_password", None)
--        if "oci_credentials_confirm_password" in data:
--            del(data["oci_credentials_confirm_password"])
--
--        # If we're not deleting, but don't have a url, then don't do anything
--        if not url:
--            return
--
--        current_credentials = self.context.oci_registry_credentials
--        if current_credentials:
--            current_credentials.url = url
--            current_credentials.setCredentials({
--                "username": username,
--                "password": password,
--                "region": region})
--            return
--        credentials = getUtility(IOCIRegistryCredentialsSet).new(
--            self.context.owner,
--            self.context.owner,
--            url,
--            {"username": username,
--             "password": password,
--             "region": region})
--        self.context.oci_registry_credentials = credentials
--
--    def validateOCICredentials(self, data):
--        # if we're deleting credentials, we don't need to validate
--        if data.get("oci_credentials_delete"):
--            return
--        url = data.get("oci_credentials_url")
--        username = data.get("oci_credentials_username")
--        if username and not url:
--            self.setFieldError(
--                'oci_credentials_url',
--                _("A URL is required if a username is present."))
--        password = data.get("oci_credentials_password")
--        confirm_password = data.get("oci_credentials_confirm_password")
--        if password != confirm_password:
--            self.setFieldError(
--                "oci_credentials_password",
--                _("Passwords must match."))
--        existing_credentials = self.context.oci_registry_credentials
--        if existing_credentials and not url:
--            self.setFieldError(
--                "oci_credentials_url",
--                _("URL must be specified. "
--                  "Delete credentials to unset URL."))
--
      def setUpFields(self):
          """See `LaunchpadFormView`."""
          RegistryEditFormView.setUpFields(self)
@@ -1130,22 +1027,14 @@ class DistributionEditView(RegistryEditFormView,
              getUtility(IProcessorSet).getAll(),
              u"The architectures on which the distribution's main archive can "
              u"build.")
--        self.form_fields += self.createOCICredentials()
      @property
      def initial_values(self):
--        data = {
++        return {
              'require_virtualized':
                  self.context.main_archive.require_virtualized,
              'processors': self.context.main_archive.processors,
+             }
--        # Do OCI initial values
--        oci_credentials = self.context.oci_registry_credentials
--        if oci_credentials:
--            data["oci_credentials_url"] = oci_credentials.url
--            data["oci_credentials_username"] = oci_credentials.username
--            data["oci_credentials_region"] = oci_credentials.region
--        return data
      def validate(self, data):
          """Constrain bug expiration to Launchpad Bugs tracker."""
@@ -1155,7 +1044,6 @@ class DistributionEditView(RegistryEditFormView,
          official_malone = data.get('official_malone', False)
          if not official_malone:
              data['enable_bug_expiration'] = False
--        self.validateOCICredentials(data)
      def change_archive_fields(self, data):
          # Update context.main_archive.
@@ -1175,7 +1063,6 @@ class DistributionEditView(RegistryEditFormView,
      @action("Change", name='change')
      def change_action(self, action, data):
          self.change_archive_fields(data)
--        self.changeOCICredentials(data)
          self.updateContextFromData(data)
 diff --git a/lib/lp/registry/browser/tests/test_distribution_views.py b/lib/lp/registry/browser/tests/test_distribution_views.py
 index 195560d..fde5a8a 100644
 --- a/lib/lp/registry/browser/tests/test_distribution_views.py
 +++ b/lib/lp/registry/browser/tests/test_distribution_views.py
@@ -9,7 +9,6 @@ from zope.component import getUtility
  from lp.archivepublisher.interfaces.publisherconfig import IPublisherConfigSet
  from lp.buildmaster.interfaces.processor import IProcessorSet
--from lp.oci.tests.helpers import OCIConfigHelperMixin
  from lp.registry.browser.distribution import DistributionPublisherConfigView
  from lp.registry.enums import DistributionDefaultTraversalPolicy
  from lp.registry.interfaces.distribution import IDistributionSet
@@ -184,7 +183,7 @@ class TestDistroAddView(TestCaseWithFactory):
          self.assertContentEqual([], distribution.main_archive.processors)
--class TestDistroEditView(OCIConfigHelperMixin, TestCaseWithFactory):
++class TestDistroEditView(TestCaseWithFactory):
      """Test the +edit page for a distribution."""
      layer = DatabaseFunctionalLayer
@@ -194,7 +193,6 @@ class TestDistroEditView(OCIConfigHelperMixin, TestCaseWithFactory):
          self.admin = login_celebrity('admin')
          self.distribution = self.factory.makeDistribution()
          self.all_processors = getUtility(IProcessorSet).getAll()
--        self.setConfig()
      def test_edit_distro_init_value_require_virtualized(self):
          view = create_initialized_view(
@@ -262,125 +260,6 @@ class TestDistroEditView(OCIConfigHelperMixin, TestCaseWithFactory):
              method="POST", form=edit_form)
          self.assertEqual(self.distribution.package_derivatives_email, email)
--    def test_oci_validation_username_no_url(self):
--        edit_form = self.getDefaultEditDict()
--        edit_form["field.oci_credentials_username"] = "username"
--
--        view = create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        self.assertEqual(
--            "A URL is required if a username is present.",
--            view.getFieldError("oci_credentials_url"))
--
--    def test_oci_validation_different_passwords(self):
--        edit_form = self.getDefaultEditDict()
--        edit_form["field.oci_credentials_password"] = "password1"
--        edit_form["field.oci_credentials_confirm_password"] = "password2"
--        view = create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        self.assertEqual(
--            "Passwords must match.",
--            view.getFieldError("oci_credentials_password"))
--
--    def test_oci_validation_url_unset(self):
--        edit_form = self.getDefaultEditDict()
--        edit_form["field.oci_credentials_url"] = ""
--
--        credentials = self.factory.makeOCIRegistryCredentials(
--            registrant=self.distribution.owner,
--            owner=self.distribution.owner)
--        self.distribution.oci_registry_credentials = credentials
--
--        view = create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        self.assertEqual(
--            "URL must be specified. Delete credentials to unset URL.",
--            view.getFieldError("oci_credentials_url"))
--
--    def test_oci_create_credentials_url_only(self):
--        edit_form = self.getDefaultEditDict()
--        registry_url = self.factory.getUniqueURL()
--        edit_form["field.oci_credentials_url"] = registry_url
--
--        create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        self.assertEqual(
--            registry_url, self.distribution.oci_registry_credentials.url)
--
--    def test_oci_create_credentials(self):
--        edit_form = self.getDefaultEditDict()
--        registry_url = self.factory.getUniqueURL()
--        username = self.factory.getUniqueUnicode()
--        password = self.factory.getUniqueUnicode()
--        edit_form["field.oci_credentials_url"] = registry_url
--        edit_form["field.oci_credentials_username"] = username
--        edit_form["field.oci_credentials_password"] = password
--        edit_form["field.oci_credentials_confirm_password"] = password
--
--        create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        self.assertEqual(
--            username, self.distribution.oci_registry_credentials.username)
--
--    def test_oci_create_credentials_change_url(self):
--        edit_form = self.getDefaultEditDict()
--        credentials = self.factory.makeOCIRegistryCredentials(
--            registrant=self.distribution.owner,
--            owner=self.distribution.owner)
--        self.distribution.oci_registry_credentials = credentials
--        registry_url = self.factory.getUniqueURL()
--        edit_form["field.oci_credentials_url"] = registry_url
--
--        create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        self.assertEqual(
--            registry_url, self.distribution.oci_registry_credentials.url)
--        # This should have mutated, not created new credentials records
--        self.assertEqual(
--            credentials.id, self.distribution.oci_registry_credentials.id)
--
--    def test_oci_create_credentials_change_password(self):
--        edit_form = self.getDefaultEditDict()
--        credentials = self.factory.makeOCIRegistryCredentials(
--            registrant=self.distribution.owner,
--            owner=self.distribution.owner)
--        self.distribution.oci_registry_credentials = credentials
--        password = self.factory.getUniqueUnicode()
--        edit_form["field.oci_credentials_url"] = credentials.url
--        edit_form["field.oci_credentials_username"] = credentials.username
--        edit_form["field.oci_credentials_password"] = password
--        edit_form["field.oci_credentials_confirm_password"] = password
--
--        create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        distro_credentials = self.distribution.oci_registry_credentials
--        unencrypted_credentials = distro_credentials.getCredentials()
--        self.assertEqual(
--            password, unencrypted_credentials["password"])
--        # This should not have changed
--        self.assertEqual(
--            distro_credentials.url, credentials.url)
--
--    def test_oci_delete_credentials(self):
--        edit_form = self.getDefaultEditDict()
--        credentials = self.factory.makeOCIRegistryCredentials(
--            registrant=self.distribution.owner,
--            owner=self.distribution.owner)
--        self.distribution.oci_registry_credentials = credentials
--        edit_form['field.oci_credentials_delete'] = 'on'
--
--        create_initialized_view(
--            self.distribution, '+edit', principal=self.admin,
--            method='POST', form=edit_form)
--        self.assertIsNone(self.distribution.oci_registry_credentials)
--
  class TestDistributionAdminView(TestCaseWithFactory):
      """Test the +admin page for a distribution."""
 diff --git a/lib/lp/registry/configure.zcml b/lib/lp/registry/configure.zcml
 index 7a7a396..7c2dad8 100644
 --- a/lib/lp/registry/configure.zcml
 +++ b/lib/lp/registry/configure.zcml
@@ -1833,7 +1833,6 @@
                  mirror_admin
                  mugshot
                  oci_project_admin
--                oci_registry_credentials
                  official_answers
                  official_blueprints
                  official_malone
 diff --git a/lib/lp/registry/interfaces/distribution.py b/lib/lp/registry/interfaces/distribution.py
 index 6d13dc5..8c23b90 100644
 --- a/lib/lp/registry/interfaces/distribution.py
 +++ b/lib/lp/registry/interfaces/distribution.py
@@ -73,7 +73,6 @@ from lp.bugs.interfaces.bugtarget import (
  from lp.bugs.interfaces.structuralsubscription import (
      IStructuralSubscriptionTarget,
+     )
--from lp.oci.interfaces.ociregistrycredentials import IOCIRegistryCredentials
  from lp.registry.enums import (
      DistributionDefaultTraversalPolicy,
      VCSType,
@@ -720,13 +719,6 @@ class IDistributionPublic(
      def newOCIProject(registrant, name, description=None):
          """Create an `IOCIProject` for this distro."""
--    oci_registry_credentials = Reference(
--        IOCIRegistryCredentials,
--        title=_("OCI registry credentials"),
--        description=_("Credentials and URL to use for uploading all OCI "
--                      "Images in this distribution to a registry."),
--        required=False, readonly=True)
--
  @exported_as_webservice_entry(as_of="beta")
  class IDistribution(
 diff --git a/lib/lp/registry/model/distribution.py b/lib/lp/registry/model/distribution.py
 index bc4690d..0db17cb 100644
 --- a/lib/lp/registry/model/distribution.py
 +++ b/lib/lp/registry/model/distribution.py
@@ -33,10 +33,6 @@ from storm.expr import (
      SQL,
+     )
  from storm.info import ClassAlias
--from storm.locals import (
--    Int,
--    Reference,
--    )
  from storm.store import Store
  from zope.component import getUtility
  from zope.interface import implementer
@@ -271,9 +267,6 @@ class Distribution(SQLBase, BugTargetBase, MakesAnnouncements,
          enum=DistributionDefaultTraversalPolicy, notNull=False,
          default=DistributionDefaultTraversalPolicy.SERIES)
      redirect_default_traversal = BoolCol(notNull=False, default=False)
--    oci_registry_credentialsID = Int(name='oci_credentials', allow_none=True)
--    oci_registry_credentials = Reference(
--        oci_registry_credentialsID, "OCIRegistryCredentials.id")
      def __repr__(self):
          display_name = six.ensure_str(
 diff --git a/lib/lp/registry/templates/distribution-edit.pt b/lib/lp/registry/templates/distribution-edit.pt
 deleted file mode 100644
 index a8562b9..0000000
 --- a/lib/lp/registry/templates/distribution-edit.pt
 +++ /dev/null
@@ -1,98 +0,0 @@
--<html
--  xmlns="http://www.w3.org/1999/xhtml"
--  xmlns:tal="http://xml.zope.org/namespaces/tal"
--  xmlns:metal="http://xml.zope.org/namespaces/metal"
--  xmlns:i18n="http://xml.zope.org/namespaces/i18n"
--  metal:use-macro="view/macro:page/main_side"
--  i18n:domain="launchpad"
-->
--<body>
--
--<tal:main metal:fill-slot="main">
--
--  <div metal:use-macro="context/@@launchpad_form/form">
--    <metal:formbody fill-slot="widgets">
--      <table class="form">
--        <tal:widget define="widget nocall:view/widgets/display_name">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/summary">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/description">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/bug_reporting_guidelines">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/bug_reported_acknowledgement">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/package_derivatives_email">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/icon">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/logo">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/mugshot">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/official_malone">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/enable_bug_expiration">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/blueprints_usage">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/translations_usage">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/answers_usage">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/translation_focus">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/default_traversal_policy">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--        <tal:widget define="widget nocall:view/widgets/redirect_default_traversal">
--          <metal:block use-macro="context/@@launchpad_form/widget_row" />
--        </tal:widget>
--
--        <tr>
--            <td><label>OCI registry credentials</label></td>
--        <tr>
--        <tr>
--            <td tal:define="widget nocall:view/widgets/oci_credentials_url">
--                <metal:widget use-macro="context/@@launchpad_form/widget_div" />
--            </td>
--            <td tal:define="widget nocall:view/widgets/oci_credentials_region">
--                <metal:widget use-macro="context/@@launchpad_form/widget_div" />
--            </td>
--            <td tal:define="widget nocall:view/widgets/oci_credentials_username">
--                <metal:widget use-macro="context/@@launchpad_form/widget_div" />
--            </td>
--            <td tal:define="widget nocall:view/widgets/oci_credentials_password">
--                <metal:widget use-macro="context/@@launchpad_form/widget_div" />
--            </td>
--            <td tal:define="widget nocall:view/widgets/oci_credentials_confirm_password">
--                <metal:widget use-macro="context/@@launchpad_form/widget_div" />
--            </td>
--            <td tal:define="widget nocall:view/widgets/oci_credentials_delete">
--                <metal:widget use-macro="context/@@launchpad_form/widget_div" />
--            </td>
--        </tr>
--      </table>
--    </metal:formbody>
--  </div>
--
--</tal:main>
--
--</body>
--</html>