releng

#9087 coreos koji tagger bot kerberos account is not able to tag secureboot packages
Closed: Fixed by dustymabe. Opened by dustymabe.

Closed: Fixed
Reopen Issue
  • Describe the issue

The coreos-koji-tagger/coreos-koji-tagger.fedoraproject.org kerberos user (used by the coreos-koji-tagger) should be able to tag/untag secureboot packages into coreos tags. It's currently broken. Here are some logs from the tagger from earlier today:

2019-12-05 15:27:26,245 INFO coreos_koji_tagger - Tagging the following (tag, nvr): 
    ('f31-coreos-signing-pending', 'grub2-2.02-103.fc31')
    ('f31-coreos-signing-pending', 'kernel-5.3.13-300.fc31')
Traceback (most recent call last):
  File "/usr/bin/fedora-messaging", line 11, in <module>
    load_entry_point('fedora-messaging==1.7.1', 'console_scripts', 'fedora-messaging')()
  File "/usr/lib/python3.7/site-packages/click/core.py", line 763, in __call__
    return self.main(*args, **kwargs)
  File "/usr/lib/python3.7/site-packages/click/core.py", line 716, in main
    rv = self.invoke(ctx)
  File "/usr/lib/python3.7/site-packages/click/core.py", line 1136, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/usr/lib/python3.7/site-packages/click/core.py", line 955, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/lib/python3.7/site-packages/click/core.py", line 554, in invoke
    return callback(*args, **kwargs)
  File "/usr/lib/python3.7/site-packages/fedora_messaging/cli.py", line 144, in consume
    callback, bindings=bindings, queues=queues
  File "/usr/lib/python3.7/site-packages/fedora_messaging/api.py", line 108, in twisted_consume
    callback = _check_callback(callback)
  File "/usr/lib/python3.7/site-packages/fedora_messaging/api.py", line 51, in _check_callback
    callback_object = callback()
  File "/usr/lib/python3.7/site-packages/coreos_koji_tagger.py", line 247, in __init__
    self.process_lockfiles()
  File "/usr/lib/python3.7/site-packages/coreos_koji_tagger.py", line 378, in process_lockfiles
    for (tag, nvr) in tuples]
  File "/usr/lib/python3.7/site-packages/koji/__init__.py", line 3077, in __exit__
    self.call_all()
  File "/usr/lib/python3.7/site-packages/koji/__init__.py", line 3059, in call_all
    raise err
koji.ActionNotAllowed: policy violation (tag)

And here is me executing a privileged operation by hand just now using the same user:

sh-5.0$ kinit -t /etc/coreos-koji-tagger-keytab/koji-keytab coreos-koji-tagger/coreos-koji-tagger.fedoraproject.org@FEDORAPROJECT.ORG 
keytab specified, forcing -k
sh-5.0$ klist
Ticket cache: FILE:/tmp/krb5cc_1000320000
Default principal: coreos-koji-tagger/coreos-koji-tagger.fedoraproject.org@FEDORAPROJECT.ORG
Valid starting     Expires            Service principal
12/05/19 21:33:56  12/06/19 21:33:56  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
        renew until 12/12/19 21:33:56
sh-5.0$ 
sh-5.0$ koji untag-build coreos-pool grub2-2.02-100.fc31
2019-12-05 21:36:35,841 [ERROR] koji: ActionNotAllowed: policy violation (tag)
sh-5.0$ 
sh-5.0$ koji hello
g'day, coreos-koji-tagger/coreos-koji-tagger.fedoraproject.org!
You are using the hub at https://koji.fedoraproject.org/kojihub
Authenticated via GSSAPI
  • When do you need this? (YYYY/MM/DD)

This week. This breaks any automation in our Fedora CoreOS build pipelines.

  • When is this no longer needed or useful? (YYYY/MM/DD)

NA

  • If we cannot complete your request, what is the impact?

Our automation breaks when secureboot packages pop up.

cc @mizdebsk @mohanboddu - We discussed this in IRC earlier today.

I think I've fixed this.
@dustymabe Can you confirm?

I think I've fixed this.
@dustymabe Can you confirm?

Yep. It seems to be fixed. If you don't mind, can you share what you did to fix it? I don't see any changes in ansible.

Yep. It seems to be fixed. If you don't mind, can you share what you did to fix it? I don't see any changes in ansible.

I've updated Koji database:
update user_krb_principals set user_id=4471 where user_id=4537;

Metadata Update from @dustymabe:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.