Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check GPG key on Candlepin repository #10880

Open
wants to merge 3 commits into
base: rpm/develop
Choose a base branch
from
+8 −5
Open

Check GPG key on Candlepin repository #10880

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0a9765e
Check GPG key on Candlepin repository
ehelms Jun 3, 2024
0dd0d09
Update packages/katello/katello-repos/katello.repo
ehelms Aug 5, 2024
46036dc
Update packages/katello/katello-repos/katello.repo
ehelms Aug 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion packages/katello/katello-repos/katello-repos.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

%global prereleasesource nightly
%global prerelease %{?prereleasesource:.}%{?prereleasesource}
%global release 2
%global release 3

Name: katello-repos
Version: 4.14
Expand Down Expand Up @@ -73,6 +73,9 @@ rm -rf %{buildroot}
%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-candlepin

%changelog
* Mon Jun 03 2024 Eric D. Helms <[email protected]> - 4.14-0.3.nightly
- Set Candlepin repo gpgcheck to true

* Mon Jun 03 2024 Evgeni Golov - 4.14-0.2.nightly
- Update Candlepin 4.4 key

Expand Down
8 changes: 4 additions & 4 deletions packages/katello/katello-repos/katello.repo
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ name=Candlepin: an open source entitlement management system.
baseurl=https://yum.theforeman.org/candlepin/@CANDLEPIN_VERSION@/@DIST@/$basearch/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-candlepin
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-candlepin
gpgkey=https://yum.theforeman.org/candlepin/@CANDLEPIN_VERSION@/RPM-GPG-KEY-candlepin

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd still prefer to include the GPG keys in the file so it can validate offline. That's the whole point of this package. I now see we don't do it for Pulp either.

One problem with networked URLs is that yum/dnf never checks expiration. So if the keys expire, you must manually replace them. Now this probably isn't a big deal for us if users stay on supported releases, given how often we use new keys but still something to keep in mind.

It does mean more work in the release process.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Validate what offline? The RPMs that you need to be online to fetch?
(If you're mirroring the repo, that package is useless anyway and you can to mirror the key too)

To make that more viable, we'd need to ship separate packages for these things, like CentOS does:

# rpm -qa centos*
centos-gpg-keys-9.0-23.el9.noarch
centos-stream-repos-9.0-23.el9.noarch
centos-stream-release-9.0-23.el9.noarch

(This is not me volunteering to implement this)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant to include the GPG key in this file. And I too thought about separate release files for each repo, but wasn't keen on implementing it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implemented my preference in #11128.

enabled=1
gpgcheck=@REPO_GPGCHECK@
gpgcheck=1

[pulpcore]
name=pulpcore: Fetch, Upload, Organize, and Distribute Software Packages.
Expand All @@ -35,10 +35,10 @@ gpgcheck=@REPO_GPGCHECK@

[candlepin-source]
name=Katello Candlepin source
baseurl=https://yum.theforeman.org/candlepin/@REPO_VERSION@/@DIST@/source/
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-candlepin
baseurl=https://yum.theforeman.org/candlepin/@CANDLEPIN_VERSION@/@DIST@/source/
gpgkey=https://yum.theforeman.org/candlepin/@CANDLEPIN_VERSION@/RPM-GPG-KEY-candlepin
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here you updated to the web url, but not above. seems inconsistent.

enabled=0
gpgcheck=@REPO_GPGCHECK@
gpgcheck=1

[pulpcore-source]
name=pulpcore source
Expand Down