fedora-infrastructure

Clone
Source Code
GIT

#12319 fedpkg upload says Could not execute upload: Dist-git request is unauthorized.
Closed: Fixed 2 months ago by zlopez. Opened 2 months ago by stevenfalco.

Closed: Fixed
Reopen Issue

NOTE

If your issue is for security or deals with sensitive info please
mark it as private using the checkbox below.

Describe what you would like us to do:

I'm the main packager for KiCad. Today I tried uploading new sources but got the following:

$ fedpkg upload *.gz
Uploading: kicad-8.0.7.tar.gz to https://src.fedoraproject.org/repo/pkgs/upload.cgi
Could not execute upload: Dist-git request is unauthorized.

I'm not sure what is wrong. I was able to get a kerberos ticket:

Ticket cache: KCM:1026
Default principal: stevenfalco@FEDORAPROJECT.ORG

Valid starting       Expires              Service principal
10/14/2024 11:37:23  10/15/2024 11:13:45  HTTP/koji.fedoraproject.org@
    renew until 10/21/2024 11:13:45
    Ticket server: HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG
10/14/2024 11:13:45  10/15/2024 11:13:45  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
    renew until 10/21/2024 11:13:45
10/14/2024 11:15:49  10/15/2024 11:13:45  HTTP/src.fedoraproject.org@
    renew until 10/21/2024 11:13:45
    Ticket server: HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG
10/14/2024 15:11:07  10/15/2024 11:13:45  HTTP/id.fedoraproject.org@
    renew until 10/21/2024 11:13:45
    Ticket server: HTTP/id.fedoraproject.org@FEDORAPROJECT.ORG

When do you need this to be done by? (YYYY/MM/DD)

As soon as possible please, because I need to package the latest release of KiCad.

Here is a trace in case that helps...

$ KRB5_TRACE=/dev/stdout fedpkg -v new-sources *.gz
Creating repo object from /home/sfalco/fedora-scm/kicad
Could not determine the remote name: Cmd('git') failed due to: exit code(1)
  cmdline: git config --get branch.update_8.0.7.remote
Falling back to default remote name 'origin'
Uploading: kicad-8.0.7.tar.gz to https://src.fedoraproject.org/repo/pkgs/upload.cgi
[532779] 1733179863.717932: ccselect module realm chose cache KCM:1026 with client principal stevenfalco@FEDORAPROJECT.ORG for server principal HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG
[532779] 1733179863.717933: Storing config in KCM:1026 for : refresh_time: 1733179893
[532779] 1733179863.717934: Storing stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in KCM:1026
[532779] 1733179863.717935: Getting initial credentials for stevenfalco@FEDORAPROJECT.ORG
[532779] 1733179863.717936: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/1026/client.keytab' not found
[532779] 1733179863.717938: Sending unauthenticated request
[532779] 1733179863.717939: Sending request (214 bytes) to FEDORAPROJECT.ORG
[532779] 1733179863.717940: Resolving hostname id.fedoraproject.org
[532779] 1733179863.717941: TLS certificate name matched "id.fedoraproject.org"
[532779] 1733179863.717942: Sending HTTPS request to https 38.145.60.21:443
[532779] 1733179863.717943: Received answer (262 bytes) from https 38.145.60.21:443
[532779] 1733179863.717944: Terminating TCP connection to https 38.145.60.21:443
[532779] 1733179863.717945: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[532779] 1733179863.717946: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[532779] 1733179863.717947: Response was from primary KDC
[532779] 1733179863.717948: Received error from KDC: -1765328359/Additional pre-authentication required
[532779] 1733179863.717951: Preauthenticating using KDC method data
[532779] 1733179863.717952: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-PKINIT-KX (147), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[532779] 1733179863.717953: Received cookie: MIT
[532779] 1733179863.717954: PKINIT client has no configured identity; giving up
[532779] 1733179863.717955: Preauth module pkinit (147) (info) returned: 0/Success
[532779] 1733179863.717956: PKINIT client received freshness token from KDC
[532779] 1733179863.717957: Preauth module pkinit (150) (info) returned: 0/Success
[532779] 1733179863.717958: PKINIT client has no configured identity; giving up
[532779] 1733179863.717959: Preauth module pkinit (16) (real) returned: 22/Invalid argument
[532779] 1733179863.717960: Getting credentials stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ using ccache KCM:1026
[532779] 1733179863.717961: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1026 with result: -1765328243/Matching credential not found
[532779] 1733179863.717962: Retrieving stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ from KCM:1026 with result: -1765328243/Matching credential not found
[532779] 1733179863.717963: Retrying stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG with result: -1765328243/Matching credential not found
[532779] 1733179863.717964: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1026 with result: 0/Success
[532779] 1733179863.717965: ccselect module realm chose cache KCM:1026 with client principal stevenfalco@FEDORAPROJECT.ORG for server principal HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG
[532779] 1733179863.717966: Storing config in KCM:1026 for : refresh_time: 1733179893
[532779] 1733179863.717967: Storing stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in KCM:1026
[532779] 1733179863.717968: Getting initial credentials for stevenfalco@FEDORAPROJECT.ORG
[532779] 1733179863.717969: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/1026/client.keytab' not found
[532779] 1733179863.717971: Sending unauthenticated request
[532779] 1733179863.717972: Sending request (214 bytes) to FEDORAPROJECT.ORG
[532779] 1733179863.717973: Resolving hostname id.fedoraproject.org
[532779] 1733179864.045296: TLS certificate name matched "id.fedoraproject.org"
[532779] 1733179864.045297: Sending HTTPS request to https 38.145.60.20:443
[532779] 1733179864.045298: Received answer (262 bytes) from https 38.145.60.20:443
[532779] 1733179864.045299: Terminating TCP connection to https 38.145.60.20:443
[532779] 1733179864.045300: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[532779] 1733179864.045301: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[532779] 1733179864.045302: Response was from primary KDC
[532779] 1733179864.045303: Received error from KDC: -1765328359/Additional pre-authentication required
[532779] 1733179864.045306: Preauthenticating using KDC method data
[532779] 1733179864.045307: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-PKINIT-KX (147), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[532779] 1733179864.045308: Received cookie: MIT
[532779] 1733179864.045309: PKINIT client has no configured identity; giving up
[532779] 1733179864.045310: Preauth module pkinit (147) (info) returned: 0/Success
[532779] 1733179864.045311: PKINIT client received freshness token from KDC
[532779] 1733179864.045312: Preauth module pkinit (150) (info) returned: 0/Success
[532779] 1733179864.045313: PKINIT client has no configured identity; giving up
[532779] 1733179864.045314: Preauth module pkinit (16) (real) returned: 22/Invalid argument
[532779] 1733179864.045315: Getting credentials stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ using ccache KCM:1026
[532779] 1733179864.045316: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1026 with result: -1765328243/Matching credential not found
[532779] 1733179864.045317: Retrieving stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ from KCM:1026 with result: -1765328243/Matching credential not found
[532779] 1733179864.045318: Retrying stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG with result: -1765328243/Matching credential not found
[532779] 1733179864.045319: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1026 with result: 0/Success
Could not execute new_sources: Dist-git request is unauthorized.
Traceback (most recent call last):
  File "/usr/bin/fedpkg", line 33, in <module>
    sys.exit(load_entry_point('fedpkg==1.45', 'console_scripts', 'fedpkg')())
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/fedpkg/__main__.py", line 84, in main
    sys.exit(client.args.command())
             ~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/cli.py", line 2855, in new_sources
    self.cmd.upload(
    ~~~~~~~~~~~~~~~^
        self.args.files,
        ^^^^^^^^^^^^^^^^
        replace=self.args.replace,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^
        offline=self.args.offline,)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/__init__.py", line 3248, in upload
    self.lookasidecache.upload(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self.ns_repo_name if self.lookaside_namespaced else self.repo_name,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        f, file_hash, offline=offline)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 323, in upload
    if self.remote_file_exists(name, filename, hash):
       ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 280, in remote_file_exists
    self.raise_upload_error(status)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 136, in raise_upload_error
    raise UploadError(message, http_status=http_status)
pyrpkg.errors.UploadError: Dist-git request is unauthorized.

Here is another trace while on the rawhide branch - the previous trace that I attached was on a new branch.

$ KRB5_TRACE=/dev/stdout fedpkg -v new-sources *.gz
Creating repo object from /home/sfalco/fedora-scm/kicad
Uploading: kicad-8.0.7.tar.gz to https://src.fedoraproject.org/repo/pkgs/upload.cgi
[533045] 1733179988.026997: ccselect module realm chose cache KCM:1026 with client principal stevenfalco@FEDORAPROJECT.ORG for server principal HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG
[533045] 1733179988.026998: Storing config in KCM:1026 for : refresh_time: 1733180018
[533045] 1733179988.026999: Storing stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in KCM:1026
[533045] 1733179988.027000: Getting initial credentials for stevenfalco@FEDORAPROJECT.ORG
[533045] 1733179988.027001: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/1026/client.keytab' not found
[533045] 1733179988.027003: Sending unauthenticated request
[533045] 1733179988.027004: Sending request (214 bytes) to FEDORAPROJECT.ORG
[533045] 1733179988.027005: Resolving hostname id.fedoraproject.org
[533045] 1733179988.027006: TLS certificate name matched "id.fedoraproject.org"
[533045] 1733179988.027007: Sending HTTPS request to https 38.145.60.21:443
[533045] 1733179988.027008: Received answer (262 bytes) from https 38.145.60.21:443
[533045] 1733179988.027009: Terminating TCP connection to https 38.145.60.21:443
[533045] 1733179988.027010: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[533045] 1733179988.027011: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[533045] 1733179988.027012: Response was from primary KDC
[533045] 1733179988.027013: Received error from KDC: -1765328359/Additional pre-authentication required
[533045] 1733179988.027016: Preauthenticating using KDC method data
[533045] 1733179988.027017: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-PKINIT-KX (147), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[533045] 1733179988.027018: Received cookie: MIT
[533045] 1733179988.027019: PKINIT client has no configured identity; giving up
[533045] 1733179988.027020: Preauth module pkinit (147) (info) returned: 0/Success
[533045] 1733179988.027021: PKINIT client received freshness token from KDC
[533045] 1733179988.027022: Preauth module pkinit (150) (info) returned: 0/Success
[533045] 1733179988.027023: PKINIT client has no configured identity; giving up
[533045] 1733179988.027024: Preauth module pkinit (16) (real) returned: 22/Invalid argument
[533045] 1733179988.027025: Getting credentials stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ using ccache KCM:1026
[533045] 1733179988.027026: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1026 with result: -1765328243/Matching credential not found
[533045] 1733179988.027027: Retrieving stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ from KCM:1026 with result: -1765328243/Matching credential not found
[533045] 1733179988.027028: Retrying stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG with result: -1765328243/Matching credential not found
[533045] 1733179988.027029: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1026 with result: 0/Success
[533045] 1733179988.027030: ccselect module realm chose cache KCM:1026 with client principal stevenfalco@FEDORAPROJECT.ORG for server principal HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG
[533045] 1733179988.027031: Storing config in KCM:1026 for : refresh_time: 1733180018
[533045] 1733179988.027032: Storing stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in KCM:1026
[533045] 1733179988.027033: Getting initial credentials for stevenfalco@FEDORAPROJECT.ORG
[533045] 1733179988.027034: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/1026/client.keytab' not found
[533045] 1733179988.027036: Sending unauthenticated request
[533045] 1733179988.027037: Sending request (214 bytes) to FEDORAPROJECT.ORG
[533045] 1733179988.027038: Resolving hostname id.fedoraproject.org
[533045] 1733179988.027039: TLS certificate name matched "id.fedoraproject.org"
[533045] 1733179988.027040: Sending HTTPS request to https 38.145.60.20:443
[533045] 1733179988.027041: Received answer (262 bytes) from https 38.145.60.20:443
[533045] 1733179988.027042: Terminating TCP connection to https 38.145.60.20:443
[533045] 1733179988.027043: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[533045] 1733179988.027044: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[533045] 1733179988.027045: Response was from primary KDC
[533045] 1733179988.027046: Received error from KDC: -1765328359/Additional pre-authentication required
[533045] 1733179988.027049: Preauthenticating using KDC method data
[533045] 1733179988.027050: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-PKINIT-KX (147), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[533045] 1733179988.027051: Received cookie: MIT
[533045] 1733179988.027052: PKINIT client has no configured identity; giving up
[533045] 1733179988.027053: Preauth module pkinit (147) (info) returned: 0/Success
[533045] 1733179988.027054: PKINIT client received freshness token from KDC
[533045] 1733179988.027055: Preauth module pkinit (150) (info) returned: 0/Success
[533045] 1733179988.027056: PKINIT client has no configured identity; giving up
[533045] 1733179988.027057: Preauth module pkinit (16) (real) returned: 22/Invalid argument
[533045] 1733179988.027058: Getting credentials stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ using ccache KCM:1026
[533045] 1733179988.027059: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1026 with result: -1765328243/Matching credential not found
[533045] 1733179988.027060: Retrieving stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ from KCM:1026 with result: -1765328243/Matching credential not found
[533045] 1733179988.027061: Retrying stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG with result: -1765328243/Matching credential not found
[533045] 1733179988.027062: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1026 with result: 0/Success
Could not execute new_sources: Dist-git request is unauthorized.
Traceback (most recent call last):
  File "/usr/bin/fedpkg", line 33, in <module>
    sys.exit(load_entry_point('fedpkg==1.45', 'console_scripts', 'fedpkg')())
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/fedpkg/__main__.py", line 84, in main
    sys.exit(client.args.command())
             ~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/cli.py", line 2855, in new_sources
    self.cmd.upload(
    ~~~~~~~~~~~~~~~^
        self.args.files,
        ^^^^^^^^^^^^^^^^
        replace=self.args.replace,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^
        offline=self.args.offline,)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/__init__.py", line 3248, in upload
    self.lookasidecache.upload(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self.ns_repo_name if self.lookaside_namespaced else self.repo_name,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        f, file_hash, offline=offline)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 323, in upload
    if self.remote_file_exists(name, filename, hash):
       ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 280, in remote_file_exists
    self.raise_upload_error(status)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 136, in raise_upload_error
    raise UploadError(message, http_status=http_status)
pyrpkg.errors.UploadError: Dist-git request is unauthorized.

I do have rdns = false in /etc/krb5.conf, by the way.

Can you please try again now?

I just tried it but I'm getting the same error:

$  KRB5_TRACE=/dev/stdout fedpkg -v new-sources *.gz
Creating repo object from /home/sfalco/fedora-scm/kicad
Uploading: kicad-8.0.7.tar.gz to https://src.fedoraproject.org/repo/pkgs/upload.cgi
[5878] 1733187731.510810: ccselect module realm chose cache KCM:1026 with client principal stevenfalco@FEDORAPROJECT.ORG for server principal HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG
[5878] 1733187731.510811: Storing config in KCM:1026 for : refresh_time: 1733187761
[5878] 1733187731.510812: Storing stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in KCM:1026
[5878] 1733187731.510813: Getting initial credentials for stevenfalco@FEDORAPROJECT.ORG
[5878] 1733187731.510814: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/1026/client.keytab' not found
[5878] 1733187731.510816: Sending unauthenticated request
[5878] 1733187731.510817: Sending request (214 bytes) to FEDORAPROJECT.ORG
[5878] 1733187731.510818: Resolving hostname id.fedoraproject.org
[5878] 1733187731.510819: TLS certificate name matched "id.fedoraproject.org"
[5878] 1733187731.510820: Sending HTTPS request to https 38.145.60.20:443
[5878] 1733187731.510821: Received answer (262 bytes) from https 38.145.60.20:443
[5878] 1733187731.510822: Terminating TCP connection to https 38.145.60.20:443
[5878] 1733187731.510823: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[5878] 1733187731.510824: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[5878] 1733187731.510825: Response was from primary KDC
[5878] 1733187731.510826: Received error from KDC: -1765328359/Additional pre-authentication required
[5878] 1733187731.510829: Preauthenticating using KDC method data
[5878] 1733187731.510830: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-PKINIT-KX (147), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[5878] 1733187731.510831: Received cookie: MIT
[5878] 1733187731.510832: PKINIT client has no configured identity; giving up
[5878] 1733187731.510833: Preauth module pkinit (147) (info) returned: 0/Success
[5878] 1733187731.510834: PKINIT client received freshness token from KDC
[5878] 1733187731.510835: Preauth module pkinit (150) (info) returned: 0/Success
[5878] 1733187731.510836: PKINIT client has no configured identity; giving up
[5878] 1733187731.510837: Preauth module pkinit (16) (real) returned: 22/Invalid argument
[5878] 1733187731.510838: Getting credentials stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ using ccache KCM:1026
[5878] 1733187731.510839: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1026 with result: -1765328243/Matching credential not found
[5878] 1733187731.510840: Retrieving stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ from KCM:1026 with result: -1765328243/Matching credential not found
[5878] 1733187731.510841: Retrying stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG with result: -1765328243/Matching credential not found
[5878] 1733187731.510842: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1026 with result: 0/Success
[5878] 1733187731.510843: ccselect module realm chose cache KCM:1026 with client principal stevenfalco@FEDORAPROJECT.ORG for server principal HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG
[5878] 1733187731.510844: Storing config in KCM:1026 for : refresh_time: 1733187761
[5878] 1733187731.510845: Storing stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in KCM:1026
[5878] 1733187731.510846: Getting initial credentials for stevenfalco@FEDORAPROJECT.ORG
[5878] 1733187731.510847: Couldn't lookup etypes in keytab: 2/Key table file '/var/kerberos/krb5/user/1026/client.keytab' not found
[5878] 1733187731.510849: Sending unauthenticated request
[5878] 1733187731.510850: Sending request (214 bytes) to FEDORAPROJECT.ORG
[5878] 1733187731.510851: Resolving hostname id.fedoraproject.org
[5878] 1733187731.510852: TLS certificate name matched "id.fedoraproject.org"
[5878] 1733187731.510853: Sending HTTPS request to https 38.145.60.21:443
[5878] 1733187731.510854: Received answer (262 bytes) from https 38.145.60.21:443
[5878] 1733187731.510855: Terminating TCP connection to https 38.145.60.21:443
[5878] 1733187731.510856: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
[5878] 1733187731.510857: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
[5878] 1733187731.510858: Response was from primary KDC
[5878] 1733187731.510859: Received error from KDC: -1765328359/Additional pre-authentication required
[5878] 1733187731.510862: Preauthenticating using KDC method data
[5878] 1733187731.510863: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-PKINIT-KX (147), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
[5878] 1733187731.510864: Received cookie: MIT
[5878] 1733187731.510865: PKINIT client has no configured identity; giving up
[5878] 1733187731.510866: Preauth module pkinit (147) (info) returned: 0/Success
[5878] 1733187731.510867: PKINIT client received freshness token from KDC
[5878] 1733187731.510868: Preauth module pkinit (150) (info) returned: 0/Success
[5878] 1733187731.510869: PKINIT client has no configured identity; giving up
[5878] 1733187731.510870: Preauth module pkinit (16) (real) returned: 22/Invalid argument
[5878] 1733187731.510871: Getting credentials stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ using ccache KCM:1026
[5878] 1733187731.510872: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1026 with result: -1765328243/Matching credential not found
[5878] 1733187731.510873: Retrieving stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@ from KCM:1026 with result: -1765328243/Matching credential not found
[5878] 1733187731.510874: Retrying stevenfalco@FEDORAPROJECT.ORG -> HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG with result: -1765328243/Matching credential not found
[5878] 1733187731.510875: Retrieving stevenfalco@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1026 with result: 0/Success
Could not execute new_sources: Dist-git request is unauthorized.
Traceback (most recent call last):
  File "/usr/bin/fedpkg", line 33, in <module>
    sys.exit(load_entry_point('fedpkg==1.45', 'console_scripts', 'fedpkg')())
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/fedpkg/__main__.py", line 84, in main
    sys.exit(client.args.command())
             ~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/cli.py", line 2855, in new_sources
    self.cmd.upload(
    ~~~~~~~~~~~~~~~^
        self.args.files,
        ^^^^^^^^^^^^^^^^
        replace=self.args.replace,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^
        offline=self.args.offline,)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/__init__.py", line 3248, in upload
    self.lookasidecache.upload(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^
        self.ns_repo_name if self.lookaside_namespaced else self.repo_name,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        f, file_hash, offline=offline)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 323, in upload
    if self.remote_file_exists(name, filename, hash):
       ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 280, in remote_file_exists
    self.raise_upload_error(status)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
  File "/usr/lib/python3.13/site-packages/pyrpkg/lookaside.py", line 136, in raise_upload_error
    raise UploadError(message, http_status=http_status)
pyrpkg.errors.UploadError: Dist-git request is unauthorized.

I think I've got it working. I did a kdestroy followed by a fresh fkinit, and it seems to be working.

Does that make any sense? I don't know much about kerberos. :-)

The output from klist now looks much more sane - that time and date on the ticket looks correct whereas before it was from October:

$ klist
Ticket cache: KCM:1026
Default principal: stevenfalco@FEDORAPROJECT.ORG

Valid starting       Expires              Service principal
12/02/2024 20:08:39  12/03/2024 20:08:39  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
    renew until 12/09/2024 20:08:39
12/02/2024 20:08:55  12/03/2024 20:08:39  HTTP/src.fedoraproject.org@
    renew until 12/09/2024 20:08:39
    Ticket server: HTTP/src.fedoraproject.org@FEDORAPROJECT.ORG

If you agree, then I think we can close this.

Oh yeah, that was definitely expired... odd that it didn't say that though. ;(

Glad it's working!

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
2 months ago

Issue status updated to: Open (was: Closed)
2 months ago

Metadata Update from @zlopez:
- Issue assigned to kevin
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: low-gain, low-trouble, ops
2 months ago

Metadata Update from @zlopez:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
2 months ago

Log in to comment on this ticket.

Metadata

ops low-gain low-trouble

None
None
Waiting on Assignee
Boards 1
ops Status: Backlog
Powered by Pagure 5.14.1
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.