Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/container/cil:1246
Failed to resolve AST
/usr/sbin/semodule:  Failed!

There seems to be a related ticket on bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2069325

Hello,
in the https://pagure.io/rpkg/pull-request/646 I was talking about moving the functionality here.
Additionally, some points came to my mind:

• I didn't see any restrictions. The retire command could pass even without having a distgit token set in the config. So far, the token was used just for forking distgit repos. Which ACL is needed? https://src.fedoraproject.org/settings/token/new It would be fine to mention it somewhere in the command's help.
• It is OK for me to have the distgit token just optional. I can imagine, most users don't use them (and you have to even renew it sometimes)
• I prefer separate disable-monitoring command. Then you can execute it on other (already retired) packages. Or when you retire your package without distgit token and message about monitoring will surprise you. Of course, this command could be executed together with retire.

Again, I can implement such code.

Hello @onosek, thanks for the points!

Regarding the ACLs, fork_project is not enough to pass a change in monitoring. The ACL has to be modify_project.

It was written with the intention of having the token optional, in that case the disable_monitoring will not run, but the user will be notified that the monitoring has not been disabled, and it should be done manually.

Regarding the function as a separate CLI command, that is a pretty good idea.

Thanks for taking over and let me know if I can help in any way.

Closed in favour of: https://pagure.io/fedpkg/pull-request/499