Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Red Hat RPM GPG keys. #734

Merged
merged 4 commits into from
Jun 10, 2024
Merged

Conversation

thozza
Copy link
Member

@thozza thozza commented Jun 6, 2024

Update the Red Hat GPG keys (release key and auxiliary key), which used SHA-1. SHA-1 is no longer valid in signatures on c10s / el10. Use the keys from RH customer portal, which use SHA-256 in their signature: https://access.redhat.com/security/team/key

Note that the auxiliary key is specific to each RHEL major version and the el8 key uses SHA-1 in its signature and can't be replaced with the aux key from el9.

Edit:

  • I added RHEL-9.5 repo definitions.
  • I deleted c8s repo definitions, since it is EOL.

@thozza thozza force-pushed the fix-rh-release-key branch 4 times, most recently from c7cbd34 to 149e7a6 Compare June 6, 2024 15:49
achilleas-k
achilleas-k previously approved these changes Jun 6, 2024
@achilleas-k achilleas-k enabled auto-merge June 6, 2024 17:08
@achilleas-k
Copy link
Member

error: /tmp/gpgkey.x20kag8z: key 1 not an armored public key.

:/

@thozza thozza marked this pull request as draft June 6, 2024 20:14
auto-merge was automatically disabled June 6, 2024 20:14

Pull request was converted to draft

@thozza thozza force-pushed the fix-rh-release-key branch from 149e7a6 to 569bd36 Compare June 7, 2024 09:20
@achilleas-k
Copy link
Member

Seems to be running smoothly now. Ready?

@achilleas-k
Copy link
Member

Seems to be running smoothly now. Ready?

I somehow missed that RHEL 8.6 aarch64 failed.

@thozza thozza force-pushed the fix-rh-release-key branch 2 times, most recently from 309fd08 to 6db69f1 Compare June 7, 2024 13:06
@thozza thozza marked this pull request as ready for review June 7, 2024 13:07
@thozza thozza force-pushed the fix-rh-release-key branch from 6db69f1 to 3b5c898 Compare June 7, 2024 13:27
achilleas-k
achilleas-k previously approved these changes Jun 7, 2024
Copy link
Member

@achilleas-k achilleas-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SPLENDID. Thanks for the cleanups too!!

@achilleas-k achilleas-k enabled auto-merge June 7, 2024 13:54
@thozza
Copy link
Member Author

thozza commented Jun 7, 2024

SPLENDID. Thanks for the cleanups too!!

Now 9.5 builds failed 😭

@achilleas-k
Copy link
Member

oh, stupid ec2-sap exception for RHEL 8.4 (which requires listing every other distro in the empty one).

@achilleas-k
Copy link
Member

achilleas-k commented Jun 7, 2024

diff --git a/test/config-map.json b/test/config-map.json
index e78c8e538..3f7ed3a79 100644
--- a/test/config-map.json
+++ b/test/config-map.json
@@ -33,21 +33,13 @@
   },
   "./configs/ec2-sap-empty.json": {
     "distros": [
-      "centos-8",
-      "centos-9",
-      "fedora-39",
-      "fedora-40",
       "rhel-8.10",
       "rhel-8.5",
       "rhel-8.6",
       "rhel-8.7",
       "rhel-8.8",
       "rhel-8.9",
-      "rhel-9.0",
-      "rhel-9.1",
-      "rhel-9.2",
-      "rhel-9.3",
-      "rhel-9.4"
+      "rhel-9.*"
     ],
     "image-types": [
       "ec2-sap"

that'll probably fix it (and make the config map more accurate)

@achilleas-k
Copy link
Member

Pushed the config map patch. Hope you don't mind.

@achilleas-k achilleas-k force-pushed the fix-rh-release-key branch from 09b1132 to 559b741 Compare June 7, 2024 14:30
@achilleas-k
Copy link
Member

error: /tmp/gpgkey.fpnmi_os: key 1 not an armored public key.
Traceback (most recent call last):
  File "/run/osbuild/bin/org.osbuild.rpm", line 251, in <module>
    r = main(args["tree"], args["inputs"], args["options"])
  File "/run/osbuild/bin/org.osbuild.rpm", line 155, in main
    ], check=True)
  File "/usr/lib64/python3.6/subprocess.py", line 438, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['rpmkeys', '--root', '/run/osbuild/tree', '--import', '/tmp/gpgkey.fpnmi_os']' returned non-zero exit status 1.

on RHEL 8.6 aarch64 ec2 and azure rhui :/

@thozza thozza force-pushed the fix-rh-release-key branch from 26c488f to b21d200 Compare June 7, 2024 17:03
thozza added 3 commits June 7, 2024 19:33
Update the Red Hat GPG keys (release key and auxiliary key), which used
SHA-1. SHA-1 is no longer valid in signatures on c10s / el10. Use the
keys from RH customer portal, which use SHA-256 in their signature:
https://access.redhat.com/security/team/key

Also update auxiliary keys based on the distro version as specified on
the customer portal page mentioned above.

Signed-off-by: Tomáš Hozza <[email protected]>
CentOS and Fedora don't support the ec2-sap image type.
All RHEL 9.x should use the config by default.
Only RHEL 8.4 gets a special config for ec2-sap to disable the
lm_sensors service, which fails to start on boot.

See RHEL-14096
@thozza thozza force-pushed the fix-rh-release-key branch from b21d200 to 323fc3e Compare June 7, 2024 17:33
@thozza thozza requested review from achilleas-k and supakeen June 10, 2024 10:35
Copy link
Member

@achilleas-k achilleas-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎉

@achilleas-k achilleas-k added this pull request to the merge queue Jun 10, 2024
Merged via the queue into osbuild:main with commit 530d150 Jun 10, 2024
16 of 17 checks passed
@thozza thozza deleted the fix-rh-release-key branch June 10, 2024 11:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants