#6234 Requesting koji service account for Cockpit
Closed: Can't Fix 7 years ago Opened 8 years ago by sgallagh.

The Cockpit Project has a CI/CD infrastructure that regularly tests Cockpit very heavily. At each upstream release tagging, we would like to be able to submit the new updates to Koji (assuming that the CI run completes successfully).

To do this today, we would need to put someone's real Koji credentials into the CI infrastructure (where it could potentially be stolen and used to interact with other packages that the user has privilege on). We would like to request a set of dedicated credentials (likely in the form of a new FAS account) that we can use for submitting these builds.

Such a FAS account should be shared by the team and thus using the cockpit-team@redhat.com mailing list as its identity.

I spoke to Kevin Fenzi about this briefly on IRC and he asked me to file this ticket (and add the meeting keyword) to track this request.


Likely workflow.

All steps here taken by Cockpit continuous delivery (CD) scripts. The scripts do much more than this, but we just focus on the Fedora (and non COPR) specific steps here.

  1. CD notices a new signed git tag in upstream git.
  2. CD checks with Cockpit CI to see whether it's tested.
  3. CD does (fedpkg clone), updates spec file, performs a scratch build (and many other non-Fedora release tasks in parallel)
  4. CD checks if other release tasks are green
  5. CD commits to koji git and pushes (ie: fedpkg push)
  6. CD performs real build (ie: fedpkg build)

Steps 3, 5 and 6 done for Fedora branched + rawhide.

Currently the CD scripts are run with a packager's credentials.

removing the meeting keyword. we have no way to do this today and will need to sit down and figure something out.

We have implemented this here: https://github.com/cockpit-project/cockpituous/tree/master/release

We have team credentials that we are currently using to accomplish this.

Metadata Update from @ausil:
- Issue close_status updated to: Can't Fix
- Issue status updated to: Closed (was: Open)

7 years ago

Login to comment on this ticket.

Metadata