releng

#11283 Signing issue on ELN
Closed: Fixed by kevin. Opened by sgallagh.

Closed: Fixed
Reopen Issue
  • Describe the issue

Composes are failing with:

2023-02-13 14:53:06 [DEBUG   ] Waiting for signed package to appear for rubygem-sassc-rails-2.1.2-4.eln114
2023-02-13 14:53:06 [DEBUG   ] Waiting for signed package to appear for rust-ethtool-0.2.3-2.eln121
2023-02-13 14:53:08 [DEBUG   ] Waiting for signed package to appear for edk2-20221117gitfff6d81270b5-13.eln126
2023-02-13 14:53:08 [DEBUG   ] Waiting for signed package to appear for python-boto3-1.26.69-1.eln126
2023-02-13 14:53:08 [DEBUG   ] Waiting for signed package to appear for mingw-python3-3.11.2-1.eln126
2023-02-13 14:53:08 [DEBUG   ] Waiting for signed package to appear for python-portalocker-2.7.0-1.eln126
2023-02-13 14:53:08 [DEBUG   ] Waiting for signed package to appear for rubygem-rouge-4.0.1-3.eln126
2023-02-13 14:53:08 [DEBUG   ] Waiting for signed package to appear for jaxb-dtd-parser-1.5.0-6.eln126
2023-02-13 14:53:08 [DEBUG   ] Waiting for signed package to appear for python-attrs-22.2.0-2.eln126

I've tried manually tagging these packages to eln-signing-pending and they get moved along by autopen, but the compose still cannot find the signed packages.

  • When do you need this? (YYYY/MM/DD)
    Immediately

  • When is this no longer needed or useful? (YYYY/MM/DD)
    When auto-signing is working properly.

  • If we cannot complete your request, what is the impact?
    ELN Composes are unable to complete successfully.

Can you link to the entire compose log?

Also, what keys are you looking for them signed with...

https://odcs.fedoraproject.org/composes/odcs-27203/pungi-stderr.log

They should all be signed with the Rawhide key. At branching, they should be re-signed with the new Rawhide key.

Yes, eln was resigned with the f39 key.

The f39 key that rawhide is signed with (and eln) is 18B8e74c, but the config is saying: 

2023-02-13 16:51:12 [ERROR   ] RPM {'arch': 'src', 'build_id': 2148959, 'buildroot_id': 40955055, 'buildtime': 1676015649, 'epoch': None, 'extra': None, 'id': 33528135, 'metadata_only': False, 'name': 'kinfocenter', 'payloadhash': 'f03a2b3427e53cbd9b425fbe37f812c0', 'release': '1.eln126', 'size': 1052774, 'version': '5.27.0'} not found for sigs: ('eb10b464', '5323552a', '809a8d7c'). Paths checked: ['/mnt/koji/packages/kinfocenter/5.27.0/1.eln126/data/signed/eb10b464/src/kinfocenter-5.27.0-1.eln126.src.rpm', '/mnt/koji/packages/kinfocenter/5.27.0/1.eln126/data/signed/5323552a/src/kinfocenter-5.27.0-1.eln126.src.rpm', '/mnt/koji/packages/kinfocenter/5.27.0/1.eln126/data/signed/809a8d7c/src/kinfocenter-5.27.0-1.eln126.src.rpm']

ie, "not found for sigs: ('eb10b464', '5323552a', '809a8d7c')."

I don't see 18B8e74c there? Everything should be signed with 18B8e74c, so there shouldn't normally be a need to have the others listed.

Argh, I see the problem. We missed a spot in the SOP. We need to update the pungi.conf with the new key. (I'm not sure why the other ones are there; probably legacy.)

I'm pushing a fix now. Thanks for catching that.

https://pagure.io/pungi-fedora/pull-request/1146

Cool. Hopefully that's the fix. ;)

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

OK, a different set of packages are now complaining about missing signatures:

2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-powerpc64-linux-gnu-debuginfo-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for cross-gcc-debugsource-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-hppa-linux-gnu-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-hppa-linux-gnu-debuginfo-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-powerpc64-linux-gnu-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-c6x-linux-gnu-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-avr32-linux-gnu-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-aarch64-linux-gnu-debuginfo-12.2.1-4.eln125
2023-02-13 18:40:11 [DEBUG   ] Waiting for signed package to appear for gcc-x86_64-linux-gnu-debuginfo-12.2.1-4.eln125

Did the debuginfo packages somehow not get signed?

They do.

Might be there were no written out signed copies.

I forced koji to write those out... and...there's somehow one subpackage not signed. ;(

So, I retagged it into eln and it's being signed now.

See if that gets it going?

It was still telling me that webkitgtk was unsigned, but I tagged that into eln-signing-pending and it was able to proceed after that.

Thanks!
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.