releng

#6671 Figure out how to block real builds in koji coming from forks in pagure
Closed: Fixed Opened by pingou.

Closed: Fixed
Reopen Issue

As far as I understood from Patrick the current mechanism for koji to allow/deny building from a source is fairly simple.

With pagure on the top of dist-git, we may need something a little more flexible as we would like to support the following use-cases:

  • Builds from main repo proceed as now
  • Builds from forks can only be either (or both) of:
    • scratch-build
    • in a certain tag used for the CI integration (redefining the dist tag to allow building the same package, once for testing and once for real)

This may be a koji issue, happy to bring it there if needed :)

I think until this is supported in koji there is nothing releng can do

Well there is support for this in koji now:
https://pagure.io/koji/pull-request/421

It doesn't do the second bullet points that was listed above but it allows denying non-scratch builds to forks, which is the most important point.

I actually wanted to ask rel-eng if they would consider backporting this patch into the RPM as it is rather important for the pagure over dist-git move.

/cc @ralph

Friendly ping, we would need this patch backported and deployed for pagure on dist-git which means for July 10th.

Does that sound doable? Can I help with something?
Edited by pingou

I actually wanted to ask rel-eng if they would consider backporting this patch into the RPM as it is rather important for the pagure over dist-git move.

Features for rpm are nothing to do with rel-eng, they need to go to the rpm team

Isn't the koji rpm handled by rel-eng?

Note: since koji just release a new version, I guess upgrading koji will solve this question :)

@pingou Except we're not going to upgrade to an entirely new upstream Koji release within one working day from now on production if that release is not even in staging most likely.

I did ask about a month ago if we could backport the patch into the RPM of koji, then asked again about 2 weeks ago.

I guess pagure can't be deployed on dist-git as long as this ticket isn't fixed.

We would like to target July 24th to push pagure on the top of dist-git and we would need this ticket to be resolved by then.

Could someone give us some sort of timeline for this ticket?

Would a reasonable target be for the updated koji in staging around July 14th (with the 17th as a fallback if needed), so we have time to test and get to production?

Just noting that courtesy of @puiterwijk we have koji-1.13 in staging now. :thumbsup:

Awesome! Thanks @puiterwijk

Do we know if the configuration been adjusted as well?

@puiterwijk would you know?

there has been no adjustment at all and only stg has had koji updated. @ralph has said he will get stg changed so it can be tested and validated

Will start looking at this around 19:00 UTC today.

See discussion on the mailing list thread about how this went in staging. It went well. It works and seems to correctly allow and deny building from non-forks and forks.

Applied https://infrastructure.fedoraproject.org/cgit/ansible.git/commit/?id=7a62af798d789c26b0e4195eff9145770a5a0744

Metadata Update from @ralph:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.