fedora-infrastructure

#7448 Cannot build due to kerberos error
Closed: Insufficient data Opened by bowlofeggs.

Closed: Insufficient data
Reopen Issue
  • Describe what you need us to do:
    I and Richard Jones have been having trouble making builds in Koji due to what seems like Kerberos errors:
$ fedpkg scratch-build --srpm
Wrote: /home/bowlofeggs/fedora-scm/bodhi/bodhi-3.12.0-100.fc30.src.rpm
Kerberos authentication fails: unable to obtain a session
Could not execute scratch_build: Could not login to https://koji.fedoraproject.org/kojihub

  • When do you need this? (YYYY/MM/DD)
    2018/12/18 - I need to build a Bodhi to fix a Bugzilla error.

  • When is this no longer needed or useful? (YYYY/MM/DD)
    N/A

  • If we cannot complete your request, what is the impact?
    It seems that I and at least one other packager cannot use Koji.

Can you please do:

KRB5_TRACE=/dev/stdout fedpkg scratch-build --srpm

and attach the full output?

Strange… I tried a few minutes later, perhaps 5 or so, and now it works…

It still doesn't work here, and the output is:

[14125] 1545086347.555568: ccselect module realm chose cache KCM:1000 with client principal rjones@FEDORAPROJECT.ORG for server principal HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG
[14125] 1545086347.555569: Getting credentials rjones@FEDORAPROJECT.ORG -> HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG using ccache KCM:1000
[14125] 1545086347.555570: Retrieving rjones@FEDORAPROJECT.ORG -> HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG from KCM:1000 with result: -1765328243/Matching credential not found
[14125] 1545086347.555571: Retrieving rjones@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1000 with result: 0/Success
[14125] 1545086347.555577: ccselect module realm chose cache KCM:1000 with client principal rjones@FEDORAPROJECT.ORG for server principal HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG
[14125] 1545086347.555578: Getting credentials rjones@FEDORAPROJECT.ORG -> HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG using ccache KCM:1000
[14125] 1545086347.555579: Retrieving rjones@FEDORAPROJECT.ORG -> HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG from KCM:1000 with result: -1765328243/Matching credential not found
[14125] 1545086347.555580: Retrieving rjones@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KCM:1000 with result: 0/Success
Kerberos authentication fails: unable to obtain a session
Could not execute scratch_build: Could not login to https://koji.fedoraproject.org/kojihub

.. and it turns out to be because the krb key had just expired. Can't we have keys that last longer than 8 hours?

@bowlofeggs do you have 'rdns=true' in any of your /etc/krb5/ files? That would match that symptom.

@rjones keys should be valid for 24 hours and renewable for 7 days. Gnome online accounts is supposed to renew these but I think there's some bug there currently.

In my case I had just acquired my key immediately prior to calling fedpkg build. I have not been able to reproduce the problem since (I started 3 more builds after filing this).

@kevin no, just rdns = false.

Anything else on this ticket or can it be closed since it seems to have solved itself?

It seems neither of us can reproduce it now, so I'll close.

Metadata Update from @bowlofeggs:
- Issue close_status updated to: Insufficient data
- Issue status updated to: Closed (was: Open)
Metadata
None

authentication koji

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.