PR#1235: keygen: cron-job to automate prolonging gpg-keys - copr/copr

copr / copr

#1235 keygen: cron-job to automate prolonging gpg-keys

Merged 4 years ago by msuchy. Opened 4 years ago by praiskup.

Unknown source keygen-cron-prolong-expiry into master

keygen: cron-job to automate prolonging gpg-keys

Pavel Raiskup • 4 years ago

a87a1f9

keygen/configs/cron.daily

file modified

		`@@ -3,3 +3,6 @@`
		`# Do a periodic trustdb maintenance. Use --batch, so the maintenance is done`
		`# only when needed.`
		`runuser -u copr-signer -- /usr/bin/gpg-copr --check-trustdb --batch`
		`+`
		`+ # prolong keys which would otherwise expire in the following 30 days`
		`+ runuser -u copr-signer -- /usr/bin/gpg-copr-prolong`

keygen/copr-keygen.spec

file modified

		`@@ -105,6 +105,7 @@`

		`%{__install} -p -m 0755 run/gpg_copr.sh %{buildroot}/%{_bindir}/gpg_copr.sh`
		`%{__install} -p -m 0755 run/gpg-copr %{buildroot}/%{_bindir}/`
		`+ %{__install} -p -m 0755 run/gpg-copr-prolong %{buildroot}/%{_bindir}/`

		`%{__install} -p -m 0755 run/application.py %{buildroot}%{_datadir}/copr-keygen/`
		`%{__install} -p -m 0644 configs/httpd/copr-keygen.conf.example %{buildroot}%{_pkgdocdir}/httpd/`
		`@@ -148,6 +149,7 @@`

		`%{_bindir}/gpg_copr.sh`
		`%{_bindir}/gpg-copr`
		`+ %{_bindir}/gpg-copr-prolong`
		`%config(noreplace) %{_sysconfdir}/sudoers.d/copr_signer`

		`%defattr(600, copr-signer, copr-signer, 700)`

keygen/run/gpg-copr-prolong

file added

+41

		`@@ -0,0 +1,41 @@`
		`+ #! /bin/sh`
		`+`
		`+ # list all soon-to-expire keys, which are still valid, and prolong them`
		`+`
		`+ if test "$(id -u -n)" != copr-signer; then`
		`+ echo >&2 "execute as 'copr-signer' user"`
		`+ exit 1`
		`+ fi`
		`+`
		`+ # get the unix timestamp`
		`+ date=$(date +"%s")`
		`+`
		`+ set -e`
		`+`
		`+ gpg-copr --list-keys --with-colons \| grep ^pub: \`
		`+ \| while read -r line`
		`+ do`
		`+ # split $line fore each colon into $1, $2, $3, ...`
		`+ old_IFS=$IFS ; IFS=:`
		`+ set -- $line`
		`+ IFS=$old_IFS`
		`+`
		`+ state=$2`
		`+ expires=$7`
		`+ key_id=$5`
		`+`
		`+ case $state in`
		`+ # see /usr/share/doc/gnupg2/DETAILS, the keys not yet checked`
		`+ # by '--check-trustdb' have '-'`
		`+ -\|u) ;;`
		`+ *) continue ;;`
		`+ esac`
		`+`
		`+ prolong_years=5`
		`+ days=365`
		`+ if test "$date" -gt "$(( expires - 246060 * days ))"; then`
		`+ echo "$key_id expires in $days days, prolonging ..."`
		`+ printf "expire\n%sy\nsave\n" "${prolong_years}" \| \`
		`+ gpg-copr --batch --command-fd 0 --edit-key "$key_id"`
		`+ fi`
		`+ done`

praiskup commented 4 years ago

Relates: rhbz#1794462

rebased onto 4b27ead7b45c7cf9f27589506c0d8bfbdfaeb6af

4 years ago

praiskup commented 4 years ago

I am trying to prolong all keys which are already expired, or are to be expired before

$ date --date @1580828812
Tue 04 Feb 2020 03:06:52 PM UTC

The /tmp/prolong-now contains KEY_ID TIMESTAMP_EXPIRES pairs of those keys.

Backing up by:

cat /tmp/prolong-now | while read key_id when; do gpg-copr -a --export-secret-keys "$key_id" > /var/tmp/backup-keys/"${key_id}.key"; done

cat /tmp/prolong-now | while read key_id when; do gpg-copr -a --export "$key_id" > /var/tmp/backup-keys/"${key_id}.pub"; done

praiskup commented 4 years ago

Prolong by:

$ cat /tmp/prolong-now | while read key_id when; do printf "expire\n%sy\nsave\n" 1 | gpg-copr --batch --command-fd 0 --edit-key "$key_id"; done |& tee /var/tmp/manual-expiry-prolong.log

praiskup commented 4 years ago

command gpg --check-trustdb failed for 44 keys, log dumped into /var/tmp/check-trustdb-errors

praiskup commented 4 years ago

And these (from the 44 affected projects) still exist.

https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/rpm-gitoverlay-1538472543.925221/
https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/rpm-gitoverlay-1538470712.989815/
https://copr.fedorainfracloud.org/coprs/vbatts/shadow-utils-newxidmap/
https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/rpm-gitoverlay-1538468009.898779/
https://copr.fedorainfracloud.org/coprs/tmm/VDO/
https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/rpm-gitoverlay-1538414506.031539/
https://copr.fedorainfracloud.org/coprs/pmunkes/Linux-Firmware/
https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/rpm-gitoverlay-1538395789.796077/
https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/rpm-gitoverlay-1538390080.056829/
https://copr.fedorainfracloud.org/coprs/smaudet/nvhda/
https://copr.fedorainfracloud.org/coprs/dvdmuckle/minikube-rpm/
https://copr.fedorainfracloud.org/coprs/further/apache-commons-jcs/
https://copr.fedorainfracloud.org/coprs/further/Josm/
https://copr.fedorainfracloud.org/coprs/mrdoge/unity8-rpm/
https://copr.fedorainfracloud.org/coprs/dvdmuckle/racket/
https://copr.fedorainfracloud.org/coprs/jonaslb/spotifyd/
https://copr.fedorainfracloud.org/coprs/likan999/static-lto/
https://copr.fedorainfracloud.org/coprs/oranenj/sway/
https://copr.fedorainfracloud.org/coprs/jlanda/fedora-toolbox/
https://copr.fedorainfracloud.org/coprs/duh/Testing/
https://copr.fedorainfracloud.org/coprs/sasiddiq/jmc/

The question is how they relate ...

Metadata Update from @praiskup:
- Request assigned

4 years ago

msuchy commented on line 11 of keygen/run/gpg-copr-prolong 4 years ago

can you comment on what it actually does.

rebased onto a87a1f9

4 years ago

rebased onto a87a1f9

4 years ago

msuchy commented 4 years ago

Pull-Request has been merged by msuchy

4 years ago

praiskup commented 4 years ago

I have run the script manually, and dumped the output to /var/lib/copr-keygen/prolong-manual.log FTR. Many of the keys were prolonged, so hopefully everything is just fine now.

praiskup commented 4 years ago

runuser -u copr-signer -- /usr/bin/gpg-copr-prolong &>> /var/lib/copr-keygen/prolong-manual.log