PR#1842: [DO NOT MERGE] Add EPEL9 to robosignatory config - fedora-infra/ansible

fedora-infra / ansible

#1842 [DO NOT MERGE] Add EPEL9 to robosignatory config

Merged 4 months ago by kevin. Opened 4 months ago by patrikp.

fedora-infra/ patrikp/ansible robosignatory_openh264 into main

Patrik Polakovič • 4 months ago

0d507b0

roles/robosignatory/templates/robosignatory.toml.j2

file modified

		`@@ -397,6 +397,13 @@`
		`keyid = "{{ (env == 'production')\|ternary('eb10b464', 'd300e724') }}"`
		`file_signing_key = "fedora-38-ima"`

		`+ [[consumer_config.koji_instances.primary.tags]]`
		`+ from = "epel9-openh264"`
		`+ to = "epel9-openh264"`
		`+ key = "{{ (env == 'production')\|ternary('epel-9', 'testkey') }}"`
		`+ keyid = "{{ (env == 'production')\|ternary('3228467c', 'd300e724') }}"`
		`+ file_signing_key = "epel-9-ima"`
		`+`
		`# f38 resigning`
		`[[consumer_config.koji_instances.primary.tags]]`
		`from = "f38"`

patrikp commented 4 months ago

Signed-off-by: Patrik Polakovič ppolakov@redhat.com

zuul commented 4 months ago

Build succeeded.
https://fedora.softwarefactory-project.io/zuul/buildset/8831e11e384045aa9e70f03be8de1c5c

fi-ansible-lint-diff : SUCCESS in 5m 54s
fi-yamllint-diff : SUCCESS in 3m 37s

kevin commented 4 months ago

Looks fine to me. Can this be post freeze? Or does it need a freeze break?

patrikp commented 4 months ago

Hmm, good question, I'm not actually sure. I need to sign the build openh264-2.4.1-1.el9 (and other EPEL9 OpenH264 builds in the future) but I suppose this PR could wait for after the freeze is over and the build could be signed manually through koji write-signed-rpm 3228467c openh264-2.4.1-1.el9?

kevin commented 4 months ago

no, that won't work. koji write-signed-rpm only writes out the signed rpms from the unsigned ones + a detached signature. ie, they have to be signed first at least once before it can do that, otherwise it has no detached signature to write out. ;(

So, sounds like we should try for a freeze break then? I can +1 it, you will need to get one more +1... usually I mail the mailing list and/or ask on matrix from sysadmin-main/releng folks.

humaton commented 4 months ago

It's nice to have now since we are missing epel9 builds to send to Cisco. But it is not blocking we can send Fedora now and epel9 later after the freeze.

OFC I wrote this comment but didnt hit enter 2 days ago and just discovered this tab.

Edited 4 months ago by humaton

patrikp commented 4 months ago

OK, I changed the title and we can wait for after the freeze is over. :thumbsup:

zuul commented 4 months ago

Build succeeded.
https://fedora.softwarefactory-project.io/zuul/buildset/d56e32b92a794d4ca03f84af12ab37c4