This prevents the script from filing waivers, which means the updates never actually manage to go stable.

18:35:41 - Waiving test results for bodhi update
Command `bodhi updates waive FEDORA-2024-b7350efa98 'This is fine, we are testing the workflow' --debug` return code: `1`
stdout:
-------
b'Waiving unsatisfied requirements: \nKerberos authentication failed (There was an issue while performing Kerberos authentication: 401 Client Error: Unauthorized for url: https://id.fedoraproject.org/login/gssapi/negotiate?ipsilon_transaction_id=9af92adc-295f-409b-ac8d-cebd38dfd8c1). Proceeding with browser-based authentication.\nAuthenticating... Please open your browser to:\nhttps://id.fedoraproject.org/openidc/Authorization?response_type=code&client_id=bodhi-client&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&scope=openid+email+profile+https%3A%2F%2Fid.fedoraproject.org%2Fscope%2Fgroups+https%3A%2F%2Fid.fedoraproject.org%2Fscope%2Fagreements&state=tQTqi71EdacCBSDIZaobLihg04OUP8\nPaste here the code that you got after logging in:\n'

Hey @adamwill! I spent some time looking at the bohdi client looking for instructions or examples of how the client expects to use kerberos authentication but couldn't find it in the manpage or on bodhi documentation. I likely just missed it but are there any examples of how bohdi expects to utilize the auth? IE: is it forwarding a service account at the host level (IE: -f)? Handling the negotiation itself via an internal library and specific set of info? etc.. Thanks!

Ah ha! This may be the difference! https://github.com/fedora-infra/bodhi/blob/develop/bodhi-client/bodhi/client/bindings.py#L192

I believe the error seen above is raised in this location https://github.com/fedora-infra/bodhi/blob/develop/bodhi-client/bodhi/client/oidcclient.py#L198-L202

edit: sorry, that was wrong

This is now tracked in another issue: https://pagure.io/releng/issue/12156