From 481ba383c82c914e7ea2db813af8c9d2786b0f75 Mon Sep 17 00:00:00 2001 From: KJ Tsanaktsidis Date: Jul 08 2024 01:06:03 +0000 Subject: Remove mbs.fedoraproject.org scopes from git cred helper The fedpkg git credential helper defaults to asking for the https://mbs.fedoraproject.org/oidc/submit-build scope in the default config file. It seems that the mbs infrastructure has been torn down and this scope is no longer valid: https://pagure.io/fedora-infrastructure/issue/11990 And attempting to ask for it means that the credential helper fails with: ``` Please visit https://id.fedoraproject.org/openidc/Authorization?scope=openid+https%3A%2F%2Fid.fedoraproject.org%2Fscope%2Fgroups+https%3A%2F%2Fmbs.fedoraproject.org%2Foidc%2Fsubmit-build+https%3A%2F%2Fsrc.fedoraproject.org%2Fpush&response_type=code&client_id=fedpkg&redirect_uri=http%3A%2F%2Flocalhost%3A12345%2F&response_mode=query to grant authorization 127.0.0.1 - - [14/Jun/2024 21:23:41] "GET /?error=invalid_scope&error_description=unknown+scope+https%3A%2F%2Fmbs.fedoraproject.org%2Foidc%2Fsubmit-build+requested HTTP/1.1" 200 47 No token received. fatal: credential helper '/usr/bin/fedpkg gitcred' told us to quit Could not execute push: Failed to execute command. ``` I'm not sure if the actual code for interfacing with the MBS should be deleted out of rpkg or not, but certainly I think the default fedpkg config file should work, so let's do this first? Signed-off-by: KJ Tsanaktsidis --- diff --git a/conf/etc/rpkg/fedpkg-stage.conf b/conf/etc/rpkg/fedpkg-stage.conf index 44ee4f5..144ce76 100644 --- a/conf/etc/rpkg/fedpkg-stage.conf +++ b/conf/etc/rpkg/fedpkg-stage.conf @@ -32,7 +32,7 @@ kerberos_realms = STG.FEDORAPROJECT.ORG oidc_id_provider = https://id.stg.fedoraproject.org/openidc/ oidc_client_id = fedpkg oidc_client_secret = notsecret -oidc_scopes = openid,https://id.fedoraproject.org/scope/groups,https://mbs.fedoraproject.org/oidc/submit-build,https://src.fedoraproject.org/push +oidc_scopes = openid,https://id.fedoraproject.org/scope/groups,https://src.fedoraproject.org/push git_excludes = i386/ i686/ diff --git a/conf/etc/rpkg/fedpkg.conf b/conf/etc/rpkg/fedpkg.conf index e73f6ed..c4ab51a 100644 --- a/conf/etc/rpkg/fedpkg.conf +++ b/conf/etc/rpkg/fedpkg.conf @@ -32,7 +32,7 @@ kerberos_realms = FEDORAPROJECT.ORG oidc_id_provider = https://id.fedoraproject.org/openidc/ oidc_client_id = fedpkg oidc_client_secret = notsecret -oidc_scopes = openid,https://id.fedoraproject.org/scope/groups,https://mbs.fedoraproject.org/oidc/submit-build,https://src.fedoraproject.org/push +oidc_scopes = openid,https://id.fedoraproject.org/scope/groups,https://src.fedoraproject.org/push git_excludes = i386/ i686/