#10543 Request to add packager rights to a service account
Closed: Fixed by spetros. Opened by spetros.

  • Describe the issue
    The team that manages linux-system-roles that I represent has a service (bot) account linuxsystemrolles.
    https://accounts.fedoraproject.org/user/linuxsystemroles/
    This account needs a packager permission, without this permissions I cannot give the account admin permissions on the linux-system-roles repository. That is required to enable this account to open pull request on our repo.
    https://src.fedoraproject.org/rpms

  • When do you need this?
    This is required to automate update our manual processes :) I'll set the date to the end of this week for now.

  • When is this no longer needed or useful? (YYYY/MM/DD)
    Is always useful

  • If we cannot complete your request, what is the impact?
    We will have to do a bunch of manual tasks each week, heh


packager permission/admin permission is not required to open a pull request.

@churchyard could you please help me do this?
I cannot do fedpkg clone, SSH link is not showing in the UI. I am able to do fedpkg clone -a linux-system-roles though. I can then add remote to my fork over HTTPS too. I can do and commit changes, But I cannot do git push to my fork. It fails with the following error:

# git push linuxsystemroles update-vendored-collections
Please visit https://id.fedoraproject.org/openidc/Authorization?scope=openid+https%3A%2F%2Fid.fedoraproject.org%2Fscope%2Fgroups+https%3A%2F%2Fmbs.fedoraproject.org%2Foidc%2Fsubmit-build+https%3A%2F%2Fsrc.fedoraproject.org%2Fpush&response_type=code&client_id=fedpkg&redirect_uri=http%3A%2F%2Flocalhost%3A12345%2F&response_mode=query to grant authorization

I am running this from a container.

I also cannot clone my fork via SSH:

Source Code
Only members of the packager group(s) can clone via ssh
GIT
https://src.fedoraproject.org/forks/linuxsystemroles/rpms/linux-system-roles.git
Pull Requests
Only members of the packager group(s) can clone via ssh

You can't use ssh unless you are in packager, but you can use https and a token if you arent'.

See: https://fedoraproject.org/wiki/Infrastructure/HTTPS-commits

can you make that work, or do you need ssh?

Hi @kevin, if I understand correctly, adding an API token to /etc/rpkg/fedpkg.conf is not enough for fedpkg push. fedpkg push requires also opening a link in the browser. I cannot do this because I am running fedpkg push from a container.
Per the link that you shared:

Q: Can I do a push on a headless machine?
A: Not yet. Currently you need a graphical session with a browser (firefox, chrome, etc). This will get fixed down the road. `

Seems like I need to push via SSH

linuxsystemroles commented

As per the discussion in #10374, I've created a wiki page for the bot here:
https://fedoraproject.org/wiki/Linuxsystemroles

That has bees solved, thank you @kevin

Metadata Update from @spetros:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Metadata