releng

#9185 Create detached signatures for the Ignition 0.35.0 release
Closed: Fixed by mohanboddu. Opened by bgilbert.

Closed: Fixed
Reopen Issue

Please create detached signatures for the binaries we will upload to GitHub for the Ignition 0.35.0 release. This is a manual process for now, pending the automation discussed in https://pagure.io/releng/issue/9057 and https://github.com/coreos/fedora-coreos-tracker/issues/335.

The binaries themselves have been built in koji. Here is a small script to grab all of the rpms and the files out of the rpms and name them appropriately:

#!/bin/bash
set -eux -o pipefail
# Use the Fedora 31 key for the detached signatures
KEYTOSIGNWITH='fedora-31'
VR='0.35.0-1.git7afbeba.el7'
RPMKEY='352c64e5' # EPEL 7 key (for legacy branch releases)
ARCHES='x86_64 ppc64le'
# Grab the windows/mac binaries out of the nonlinux rpm
arch="x86_64"
rpm="ignition-validate-nonlinux-${VR}.${arch}.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -qip $rpm | grep -P "^Signature.*${RPMKEY}$" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv ./usr/bin/ignition-validate-darwin ./usr/bin/ignition-validate-windows
mv ./usr/bin/ignition-validate-darwin ./ignition-validate-${arch}-apple-darwin
mv ./usr/bin/ignition-validate-windows ./ignition-validate-${arch}-windows
sigul sign-data -a $KEYTOSIGNWITH ./ignition-validate-${arch}-apple-darwin -o ./ignition-validate-${arch}-apple-darwin.asc
sigul sign-data -a $KEYTOSIGNWITH ./ignition-validate-${arch}-windows -o ./ignition-validate-${arch}-windows.asc 
rm $rpm; rmdir ./usr/bin; rmdir ./usr
# Grab the linux binary for a few arches we care about
for arch in $ARCHES; do
    mkdir $arch; pushd $arch
    rpm="ignition-validate-${VR}.${arch}.rpm"
    outfile="ignition-validate-${arch}-linux"
    koji download-build --key $RPMKEY --rpm $rpm
    rpm -qip $rpm | grep $RPMKEY # Verify the output has the key in it
    rpm2cpio "${rpm}" | cpio -idv ./usr/bin/ignition-validate
    mv ./usr/bin/ignition-validate "../${outfile}"
    # Add detached signature step here using $KEYTOSIGNWITH
    rm "${rpm}"; rmdir ./usr/bin; rmdir ./usr
    popd; rmdir $arch
    sigul sign-data -a $KEYTOSIGNWITH "./${outfile}" -o "./${outfile}.asc"
done

After running this you should end up with a directory with files in it like:

$ ls -1
ignition-validate-aarch64-linux
ignition-validate-ppc64le-linux
ignition-validate-s390x-linux
ignition-validate-x86_64-apple-darwin
ignition-validate-x86_64-linux
ignition-validate-x86_64-windows

I am a bit confused here, you are trying to sign an epel-7 build with fedora-31 key?
Edited by mohanboddu

I am a bit confused here, you are trying to sign an epel-7 build with fedora-31 key?

@mohanboddu - it looks like this script is an evolution of the one in #9126 . In that ticket we were signing two separate releases (one legacy, one current). In this ticket we are only signing one release. We did use the fedora 31 key to sign the epel7 build in #9126 too. I don't think it really matters to the end users as we've just instructed them to verify with the latest fedora releases signing key.

@mohanboddu Yeah, it's a bit confusing. Legacy releases (0.x) are built in EPEL and current releases (2.x) are built in Fedora, but all releases are signed with Fedora keys.

Sorry for the delay, but its done now.

Here's the link

Metadata Update from @mohanboddu:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

The signature files are returning 403 for me. Could you check the file permissions?
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.