centos-sig-hyperscale / mock-centos-sig-configs

#4 Add CentOS Stream 9 Hyperscale configs
Merged by ngompa. Opened by ngompa.
c9s-hs9-configs  into  main

Download 4.patch
no initial comment

This isn't ready yet as we don't have the extras repo in upstream c9s mock in place, nor do we have the release packages.

Mock config PR: https://github.com/rpm-software-management/mock/pull/854

the PR was merged and a new release was cut:

$ rpm -q mock-core-configs
mock-core-configs-37.1-1.fc35.noarch
$ grep extras /etc/mock/templates/centos-stream-9.tpl 
[extras-common]
#baseurl=http://mirror.stream.centos.org/SIGs/$releasever-stream/extras/$basearch/extras-common/
metalink=https://mirrors.centos.org/metalink?repo=centos-extras-sig-extras-common-$releasever-stream&arch=$basearch

Is it all that was needed to get this PR unblocked?

There was a couple of other things, which I dealt with at the beginning of the week.

I will test them in the morning and then merge them if they're in good shape.

I just tried to build against centos-stream-hyperscale-experimental-9-x86_64.cfg:

Total                                                                                                                                                          11 MB/s |  66 MB     00:05     
CentOS Stream 9 - BaseOS                                                                                                                                      1.6 MB/s | 1.6 kB     00:00    
Importing GPG key 0x8483C65D:
 Userid     : "CentOS (CentOS Official Signing Key) <security@centos.org>"
 Fingerprint: 99DB 70FA E1D7 CE22 7FB6 4882 05B5 55B3 8483 C65D
 From       : /usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
Key imported successfully
CentOS Stream 9 - Extras packages                                                                                                                             2.1 MB/s | 2.1 kB     00:00    
Importing GPG key 0x1D997668:
 Userid     : "CentOS Extras SIG (https://wiki.centos.org/SpecialInterestGroup) <security@centos.org>"
 Fingerprint: 363F C097 2F64 B699 AED3 968E 1FF6 A217 1D99 7668
 From       : /usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Extras
Extra Packages for Enterprise Linux 9 - x86_64                                                                                                                1.6 MB/s | 1.6 kB     00:00    
Importing GPG key 0x3228467C:
 Userid     : "Fedora (epel9) <epel@fedoraproject.org>"
 Fingerprint: FF8A D134 4597 106E CE81 3B91 8A38 72BF 3228 467C
 From       : /usr/share/distribution-gpg-keys/epel/RPM-GPG-KEY-EPEL-9
Key imported successfully
Key import failed (code 2). Failing package is: centos-release-hyperscale-9-2.el9s.noarch
 GPG Keys are configured as: file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Extras
Public key for centos-release-hyperscale-experimental-9-2.el9s.noarch.rpm is not installed. Failing package is: centos-release-hyperscale-experimental-9-2.el9s.noarch
 GPG Keys are configured as: file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Extras
Public key for epel-next-release-9-2.el9.noarch.rpm is not installed. Failing package is: epel-next-release-9-2.el9.noarch
 GPG Keys are configured as: file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Extras
Public key for epel-release-9-2.el9.noarch.rpm is not installed. Failing package is: epel-release-9-2.el9.noarch
 GPG Keys are configured as: file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Extras
Error: GPG check FAILED

when using centos-stream-hyperscale-experimental-9-x86_64.cfg, the only thing that seems to prevent this from working is package centos-release-hyperscale-9-2.el9s.noarch which fails validation.

e.g if I comment out

config_opts['chroot_setup_cmd'] += " centos-release-hyperscale-experimental"

then

mock -r ~/.mock/centos-stream-hyperscale-experimental-9-x86_64.cfg --shell

works. I am surprised it is not failing. this is probably because epel-release is only installed as a dep of centos-release-hyperscale-*.

Yeah, that's why I haven't merged it yet. Something is still not quite right.

Do we need to go through something similar to https://pagure.io/centos-infra/issue/193 ?

In centos-stream-hyperscale-8-x86_64

<mock-chroot> sh-4.4# rpm -qa | grep gpg
gpg-pubkey-2f86d6a1-5cf7cefb
centos-gpg-keys-8-4.el8.noarch
gpg-pubkey-8483c65d-5ccc5b19
gpg-pubkey-eb3dac40-60053dd1
libgpg-error-1.31-1.el8.x86_64
<mock-chroot> sh-4.4# rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
gpg-pubkey-8483c65d-5ccc5b19    gpg(CentOS (CentOS Official Signing Key) <security@centos.org>)
gpg-pubkey-2f86d6a1-5cf7cefb    gpg(Fedora EPEL (8) <epel@fedoraproject.org>)
gpg-pubkey-eb3dac40-60053dd1    gpg(CentOS HyperScale SIG (https://wiki.centos.org/SpecialInterestGroup/Hyperscale) <security@centos.org>)
<mock-chroot> sh-4.4# 
<mock-chroot> sh-4.4# rpm -ql gpg-pubkey-eb3dac40-60053dd1
(contains no files)

I am expecting those gpg keys to be installed by some rpm scripts or something.

From looking a bit more into it, it seems the epel package is not signed with the right key:

Package is expected to be signed with key id 1d997668, but we have 3228467c instead. 

<mock-chroot> sh-5.1# rpm -i /var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/centos-release-hyperscale-experimental-9-2.el9s.noarch.rpm 
warning: /var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/centos-release-hyperscale-experimental-9-2.el9s.noarch.rpm: Header V4 RSA/SHA256 Signature, key ID 1d997668: NOKEY
error: Failed dependencies:
    centos-release-hyperscale = 9-2.el9s is needed by centos-release-hyperscale-experimental-9-2.el9s.noarch
<mock-chroot> sh-5.1# rpm -i /var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/centos-release-hyperscale-9-2.el9s.noarch.rpm
warning: /var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/centos-release-hyperscale-9-2.el9s.noarch.rpm: Header V4 RSA/SHA256 Signature, key ID 1d997668: NOKEY
error: Failed dependencies:
    epel-next-release = 9 is needed by centos-release-hyperscale-9-2.el9s.noarch
    epel-release = 9 is needed by centos-release-hyperscale-9-2.el9s.noarch
<mock-chroot> sh-5.1# rpm -i /var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/epel-release-9-2.el9.noarch.rpm
warning: /var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/epel-release-9-2.el9.noarch.rpm: Header V4 RSA/SHA256 Signature, key ID 1d997668: NOKEY
<mock-chroot> sh-5.1# rpm -Kv /var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/epel-release-9-2.el9.noarch.rpm
/var/cache/dnf/extras-common-d5863a8fa978ac9d/packages/epel-release-9-2.el9.noarch.rpm:
    Header V4 RSA/SHA256 Signature, key ID 1d997668: NOKEY
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V4 RSA/SHA256 Signature, key ID 1d997668: NOKEY
    MD5 digest: OK

<mock-chroot> sh-5.1# rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
gpg-pubkey-8483c65d-5ccc5b19    CentOS (CentOS Official Signing Key) <security@centos.org> public key
gpg-pubkey-3228467c-613798eb    Fedora (epel9) <epel@fedoraproject.org> public key

which is /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-9

 gpg -v --dry-run --import  /var/lib/mock/centos-stream-hyperscale-experimental-9-x86_64/root/etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-9 
gpg: Note: RFC4880bis features are enabled.
gpg: pub  rsa4096/8A3872BF3228467C 2021-09-07  Fedora (epel9) <epel@fedoraproject.org>
gpg: Total number processed: 1

For comparaison, on c8s:

<mock-chroot> sh-4.4# rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
gpg-pubkey-8483c65d-5ccc5b19    gpg(CentOS (CentOS Official Signing Key) <security@centos.org>)
gpg-pubkey-2f86d6a1-5cf7cefb    gpg(Fedora EPEL (8) <epel@fedoraproject.org>)
gpg-pubkey-eb3dac40-60053dd1    gpg(CentOS HyperScale SIG (https://wiki.centos.org/SpecialInterestGroup/Hyperscale) <security@centos.org>)
<mock-chroot> sh-4.4# rpm -Kv /var/cache/dnf/epel-59dc218ad097ee72/packages/epel-rpm-macros-8-26.noarch.rpm
/var/cache/dnf/epel-59dc218ad097ee72/packages/epel-rpm-macros-8-26.noarch.rpm:
    Header V4 RSA/SHA256 Signature, key ID 2f86d6a1: OK
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V4 RSA/SHA256 Signature, key ID 2f86d6a1: OK
    MD5 digest: OK

My mistake, on c8s, epel-release is signed by CentOs key:

<mock-chroot> sh-4.4# curl http://mirror.centos.org/centos/8-stream/extras/x86_64/os/Packages/epel-release-8-11.el8.noarch.rpm -o epel-release-8-11.el8.noarch.rpm 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 24488  100 24488    0     0  38322      0 --:--:-- --:--:-- --:--:-- 38262
<mock-chroot> sh-4.4# rpm -Kv epel-release-8-11.el8.noarch.rpm 
epel-release-8-11.el8.noarch.rpm:
    Header V3 RSA/SHA256 Signature, key ID 8483c65d: OK
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V3 RSA/SHA256 Signature, key ID 8483c65d: OK
    MD5 digest: OK
<mock-chroot> sh-4.4# rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
gpg-pubkey-8483c65d-5ccc5b19    gpg(CentOS (CentOS Official Signing Key) <security@centos.org>)
gpg-pubkey-2f86d6a1-5cf7cefb    gpg(Fedora EPEL (8) <epel@fedoraproject.org>)
gpg-pubkey-eb3dac40-60053dd1    gpg(CentOS HyperScale SIG (https://wiki.centos.org/SpecialInterestGroup/Hyperscale) <security@centos.org>)

But on c9s, it is signed by /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras

$ gpg -v --dry-run --import  /var/lib/mock/centos-stream-hyperscale-experimental-9-x86_64/root/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras 
gpg: Note: RFC4880bis features are enabled.
gpg: armor header: Version: GnuPG v2.0.22 (GNU/Linux)
gpg: pub  rsa2048/1FF6A2171D997668 2021-12-16  CentOS Extras SIG (https://wiki.centos.org/SpecialInterestGroup) <security@centos.org>
gpg: Total number processed: 1

which does not seem imported.

Based on https://lists.centos.org/pipermail/centos-devel/2022-March/120262.html, this key needs to be re-signed. If like the Extras key, it gets -512 appended... we will need to update this PR to reflect the new name.

Well, it seems like the keys are supposed to work to verify old stuff, so... https://github.com/xsuchy/distribution-gpg-keys/pull/60

Keys made it in release 66 (I believe). I could test the c9s hsx mock by copying it to my ~/.mock/ directory. I believe this is good to go.
Once landed, we should be able to build in koji when picked up by the builders?

These configs are not used by Koji, they're pretty much only for local builds.

These configs are not used by Koji, they're pretty much only for local builds.

Ha! Thanks. Well, still lgtm :)

Pull-Request has been merged by ngompa
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.