robosignatory

#15 Sign all modules (koji tags with 'module-' prefix) with module_key/module_keyid.
Merged by ralph. Opened by jkaluza.
jkaluza/robosignatory sign-modules  into  master

Download 15.patch

While releasing modular F26, we started signing all modules using the single key no matter from which stream they came from. This has never resulted in a code change, so while signing, robosignatory still inspects the module inheritance tree to find out what is the base module for given module and from what stream it has been built. This is useless and makes robosignatory slower and more complex.

It has also started to be a problem for F27, because the list of base modules changed - we no longer have base-runtime module, but we have platform module instead. This platform module cannot be signed currently, because it is new base module and robosignatory does not have it listed in the base_modules config option.

This PR removes the inheritance tree checks and also the stream checks and just signs any module with the single configured key. This should fix modular builds signing forever :).

rebased

Hmm, I wonder - can we also sign the module build itself? Does that even make sense? Maybe we sign the resulting modulemd in the build? i.e. https://koji.fedoraproject.org/koji/buildinfo?buildID=953079

Not sure, I have no idea if it's possible to sign modulemd like that. But anyway, this should be part of anothe RFE/PR. This one is here really to remove blocker that we currently cannot sign "platform" module in prod, which is blocking others from building their own modules.

Right, no problem with that

We'll need to remember to patch our ansible config here too.

This looks good to me.

... I wish we had a test suite to exercise it, though.

FYI, here are the relevant modules I see that might need manual signing.

scripts/mbs❯ python find-unsigned-modules.py platform-master shim-master bootstrap-master
Using cache file /var/tmp/find-unsigned-modules-cache.dbm
- platform-master-20170807115511 with tag module-e507a2873dda189a is not signed.
+ shim-master-20170502110601 with tag module-5d197e359fd3ea1d is signed with a3cc4e62
- bootstrap-master-1 with tag module-bootstrap-rawhide is not signed.

@psabata are there any others we should check for while @puiterwijk is on the system later doing an upgrade?

Pull-Request has been merged by ralph

@ralph I'm building atomic:master right now. It will take some time but I'm not sure when the signing happens -- whether immediately on RPM build or on module build. We may want to wait.
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.