9to10: Handle multisig/PQC RPM GPG keys during the upgrade#1531
Draft
matejmatuska wants to merge 7 commits into
Draft
9to10: Handle multisig/PQC RPM GPG keys during the upgrade#1531matejmatuska wants to merge 7 commits into
matejmatuska wants to merge 7 commits into
Conversation
Thank you for contributing to the Leapp project!Please note that every PR needs to comply with the leapp-repository contribution and development guidelines and must pass all tests in order to be mergeable.
Packit will automatically schedule regression tests for this PR's build and latest upstream leapp build.
Note that first time contributors cannot run tests automatically - they need to be started by a reviewer. It is possible to schedule specific on-demand tests as well. Currently 2 test sets are supported,
See other labels for particular jobs defined in the Please open ticket in case you experience technical problem with the CI. (RH internal only) Note: In case there are problems with tests not being triggered automatically on new PR/commit or pending for a long time, please contact leapp-infra. |
matejmatuska
force-pushed
the
rhel-10-pqc-cont
branch
from
295f3bc to
3339f7f
Compare
… 10 packages Signed-off-by: Jakub Jelen <jjelen@redhat.com>
This way it can be independently when it's sure it can - only using the target RPM stack (on RHEL 10). Jira: RHEL-155375
Create a new subdirectory within the gpg key directories. Opted for a subdirectory instead of sibling dir as there could be pqc keys for betas in the future and betas are already a sibling dir. TODO: Other distros Jira: RHEL-155375
Jira: RHEL-155375
matejmatuska
force-pushed
the
rhel-10-pqc-cont
branch
from
3339f7f to
9c42275
Compare
On RHEL 9 the system rpm stack doesn't work with PQC RPM GPG keys. There is a separate PQC RPM stack at /usr/lib/pqrpm which does and the dnf multisig plugin delegates package signature verification to it before falling back to the system stack. Therefore the PQC keys need to be imported into the separate pqrpmdb in /usr/lib/pqrpm/lib/sysimage/rpm/ using /usr/lib/pqrpm/bin/rpmkeys. This is currently attempted unconditionally on 9to10 - even if the pqrpm package isn't installed, if the import fails with ENOENT then it's logged and does not attempt to import any more pqc keys. Jira: RHEL-155375
On RHEL 9 there is no way to import PQC RPM GPG keys (gpg v6 keys) to the system rpmdb. The current solution only imports keys before the installation of the target dnf/rpm using the host rpm binary. This patch implements import of RPM GPG keys using the target system rpm stack which is capable of importing to the system rpmdb. Currently, both "traditional" (v4) keys and PQC (v6) keys are imported. The keys are copied to the target userspace to /leapp-trusted-gpg-keys which should not clash with anything. Jira: RHEL-155375
…ions Currently keys are imported before the dnfplugin transactions via executing the importrpmgpgkeys script passed in via DNFWorkaround message. This script runs in the overlay therefore it's using the source system rpm binary to do the importing. However, the RHEL 9 system rpm stack doesn't work with PQC RPM GPG keys and need to be imported using the RHEL 10 rpm stack. To import PQC keys a new importrpmgpgkeysintarget script is registered using DNFWorkaround alongside the original one. The script starts another container using nspawn with the target userspace as the root, meaning it uses the target system rpm binary. The keys are copied to the target userspace during it's creation already. Jira: RHEL-155375
matejmatuska
force-pushed
the
rhel-10-pqc-cont
branch
from
5d9963e to
a3cba48
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Includes #1508.
I think the commit messages are details enough for now
TODO