releng

#9538 Permissions needed to tag restricted packages into the `eln` tag
Closed: Fixed by mohanboddu. Opened by sgallagh.

Closed: Fixed
Reopen Issue

  • Describe the issue
    ELN is a rebuild of a subset of Fedora Rawhide with the %{rhel} value set (among other build-time tweaks). We are attempting to generate a compose from ELN which requires us to have the secure boot packages in the tag (shim, grub2, pesign, kernel, maybe others). We need to have a user granted permission to do this tagging.

  • When do you need this? (YYYY/MM/DD)

As soon as possible, no later than 2020-07-17.

  • When is this no longer needed or useful? (YYYY/MM/DD)
    This will last as long as ELN exists.

  • If we cannot complete your request, what is the impact?
    ELN will require manual intervention by someone with these restricted permissions every time one of the affected packages is updated.

So, the work that is needed here is

  1. Add a new permission to handle this:
$ koji grant-permission --new eln mohanboddu
$ koji grant-permission eln sgallagh

I can add more people if needed.

  1. Change the koji hub policy to allow tagging
diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2
index 98ebad1c2..e64e76281 100644
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@@ -100,7 +100,10 @@ tag =
     # as the coreos-release tag. https://pagure.io/releng/issue/8294
     operation tag && tag coreos-pool f*-coreos-signing-pending coreos-release && has_perm coreos-continuous :: allow
     operation untag && fromtag coreos-pool f*-coreos-signing-pending coreos-release && has_perm coreos-continuous :: allow
-    # deny tagging secureboot packages that are not related to coreos-continuous
+    # eln and eln-rebuild builds, https://pagure.io/releng/issue/9538
+    operation tag && tag eln eln-rebuild && has_perm eln :: allow
+    operation untag && fromtag eln eln-rebuild && has_perm eln :: allow
+    # deny tagging secureboot packages that are not related to coreos-continuous and eln
     package kernel shim grub2 pesign :: deny
 # Allow people to tag stuff into infra-candidate if they're infra
     tag *-infra-candidate && has_perm infra :: allow

That should do it.

Yep. That looks about right to me. :) +1

@sgallagh I have made the changes mentioned in https://pagure.io/releng/issue/9538#comment-659064

Can you give it a try and let us know?

Thanks.

Metadata Update from @mohanboddu:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.