#650 ostree image artifacts: wait on ostree commit gpg signing
Closed: Fixed 7 years ago Opened 7 years ago by dustymabe.

We plan to start building ostrees and images together in the same compose (just like we do right now for fedora 26 before fedora 26 release) as part of the bodhi runs by calling pungi to create ostrees and images at the same time.

This poses one problem for ostree commit signing. We'd like to include the signed commits in the media we are building, but there is a race condition because the signing hasn't happened yet (it's automated, but can take some time to happen). We need to account for this in pungi if we are going to properly handle this case. Some sort of wait until the commits are verified to be signed??


I assume the waiting will actually be waiting for a fedmsg, right? If so, that seems really specific for Fedora deployment and the solution should be something more generic.

yeah - i'm not sure of the best solution, just trying to describe the need as discussed earlier with @puiterwijk.

@lsedlar no, there's no fedmsg for this (at the moment).
I would say you could just do a

while not os.path.exists(rootdir + '/objects/' + commithash[:2] + '/' + commithash[2:] + '.commitmeta'):
    time.sleep(5).

(and yes, that is a very ugly way, but you probably get the idea)

One way to achieve this would be to abuse the progress notification system. Currently it's only used for announcing compose progress on the message bus, but it's basically a callback system.

There is a message about having created an ostree commit, which contains the hash.
https://docs.pagure.org/pungi/messaging.html

Something like this might do it (it's a little ugly due to having to parse path to ostree repo from the config as that information is not in the message data).

parser = argparse.ArgumentParser()
parser.add_argument('cmd')
opts = parser.parse_args()

if opts.cmd != 'ostree':
    sys.exit()

data = json.load(sys.stdin)
with open(glob('logs/global/config-dump*')[0]) as f:
    config = json.load(f)

for conf_variant, conf_data in config['ostree'].iteritems():
    if not re.match(conf_variant, data['variant']):
        continue
    for conf_arch in conf_data:
        if conf_arch != data['arch']:
            continue
        rootdir = conf_data['ostree_repo']

commithash = data['commitid']
while not os.path.exists(rootdir + '/objects/' + commithash[:2] + '/' + commithash[2:] + '.commitmeta'):
    time.sleep(5)

If this sounds like a reasonable approach, I think there would be at least two changes needed:

  • allow running multiple callback scripts (currently there can be only one)
  • add path to the ostree repo to the data so that parsing config is not needed

Metadata Update from @lsedlar:
- Issue assigned to lsedlar

7 years ago

Metadata Update from @lsedlar:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
- Issue tagged with: 4.1.17

7 years ago

Log in to comment on this ticket.

Metadata