#12575 ELN re-signing is incomplete
Closed: Fixed 11 months ago by yselkowitz. Opened 11 months ago by yselkowitz.

  • Describe the issue
    ELN builds were supposed to be re-signed with the F43 key during F42 branching activities. However, attempting to make a compose with only F43-signed packages failed:
2025-02-09 04:19:54 [DEBUG   ] Waiting for signed package to appear for libreoffice-25.2.0.3-1.eln145
2025-02-09 04:19:55 [DEBUG   ] Waiting for signed package to appear for pcp-6.3.2-5.eln145
2025-02-09 04:19:56 [DEBUG   ] Waiting for signed package to appear for ktls-utils-0.11-4.eln145
2025-02-09 04:19:56 [DEBUG   ] Waiting for signed package to appear for python-twisted-24.10.0-1.eln146
2025-02-09 04:19:56 [DEBUG   ] Waiting for signed package to appear for qt6-qtquick3dphysics-6.8.2-1.eln146
2025-02-09 04:19:56 [DEBUG   ] Waiting for signed package to appear for rust-snpguest-0.8.2-1.eln146
2025-02-09 04:19:56 [DEBUG   ] Waiting for signed package to appear for rust-packaging-26.3-4.eln146
2025-02-09 04:20:42 [DEBUG   ] Waiting for signed package to appear for texlive-20240311-6.eln144
2025-02-09 04:20:42 [DEBUG   ] Waiting for signed package to appear for openvpn-2.6.13-1.eln145
  • When do you need this? (YYYY/MM/DD)
    ASAP

  • When is this no longer needed or useful? (YYYY/MM/DD)
    F43 branching, when everything should be re-signed with the F44 key.

  • If we cannot complete your request, what is the impact?
    ELN composes will continue to include both F42- and F43-signed content.


In the meantime, I re-enabled the F42 key in ELN composes: https://pagure.io/pungi-fedora/pull-request/1446

Metadata Update from @jnsamyak:
- Issue tagged with: high-gain, medium-trouble, ops

11 months ago

Do you happen to know if just these are the left overs, or there might be more packages?

I see:

➜  scripts git:(main) ✗ time ./sigulsign_unsigned.py --just-list --tag eln fedora-43 | grep src.
rpm | sed -e 's|.src.rpm||' > unsigned-packages-eln
./sigulsign_unsigned.py --just-list --tag eln fedora-43  11.80s user 1.04s system 10% cpu 2:05.79 total
grep --color=auto --exclude-dir={.bzr,CVS,.git,.hg,.svn,.idea,.tox,.venv,venv  0.00s user 0.00s system 0% cpu 2:05.79 total
sed -e 's|.src.rpm||' > unsigned-packages-eln  0.00s user 0.00s system 0% cpu 2:05.79 total
➜  scripts git:(main) ✗ cat unsigned-packages-eln 
ktls-utils-0.11-4.eln145
python-twisted-24.10.0-1.eln146
qt6-qtquick3dphysics-6.8.2-1.eln146
rust-packaging-26.3-4.eln146
rust-snpguest-0.8.2-1.eln146

Which doesn't seem to match up. ;(

@yselkowitz note that you can force resigning by retagging into eln tag... robosignatory should then sign them.

I tried retagging those; could you retry your script?

Sure. You can run it too if you like, it's in the releng repo...

But it shows 0 unsigned packages with the f43 key.

Thanks, we'll try again with only the F43 key in Fedora-eln-20250217.n.2 later today. (.n.1 is currently in process.)

Fedora-eln-20250217.n.2 was successful with only the F43 key, so we should be set now.

Metadata Update from @yselkowitz:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

11 months ago

Log in to comment on this ticket.

Metadata
Boards 1
Ops Status: Backlog