Feature #26278: GPG sign Foreman client RPM repository - Packaging - Foreman

Feature #26278

GPG sign Foreman client RPM repository

Added by Peter Oliver over 2 years ago. Updated about 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Ewoud Kohl van Wijngaarden

Category:

RPMs

Target version:

Foreman - 1.23.0

Difficulty:

Triaged:

Bugzilla link:

Pull request:

https://github.com/theforeman/foreman-packaging/pull/3863, https://github.com/theforeman/foreman-packaging/pull/3862, https://github.com/theforeman/foreman-packaging/pull/3875, https://github.com/theforeman/foreman-packaging/pull/3874

Fixed in Releases:

Foreman - 1.21.1, Foreman - 1.22.1, Foreman - 1.23.0

Found in Releases:

Foreman - 1.20.0

Description

Package https://yum.theforeman.org/client/1.20/el7/x86_64/foreman-client-release-1.20.2-1.el7.noarch.rpm sets up a GPG public key, but it is not the key used to sign the packages found in that repository. After some trial and error, I found the correct key, D0B17F13, at https://github.com/theforeman/foreman-packaging/blob/rpm/1.20/packages/katello-3.9/katello-repos-3.9/RPM-GPG-KEY-katello-2015.

Related issues

Associated revisions

Revision 0c9164e8 (diff)
Added by Ewoud Kohl van Wijngaarden about 2 years ago

Fixes #26278 - GPG sign client repositories

This enforces that the client repo is GPG signed with the same key as
the main foreman repository.

History

#1 Updated by Ewoud Kohl van Wijngaarden over 2 years ago

At this point we're not signing the client packages repository. The packages in that repository are signed by some key, which for those packages happens to be that key. There is however no guarantee and we could include updates packages which might not be signed or signed with a different key.

#2 Updated by Ewoud Kohl van Wijngaarden over 2 years ago

Related to Bug #26401: Remove Foreman GPG key from foreman-release-client added

#3 Updated by Ewoud Kohl van Wijngaarden about 2 years ago

Target version set to 1.23.0
Subject changed from Incorrect GPG key for Foreman client RPM repository to GPG sign Foreman client RPM repository
Tracker changed from Bug to Feature

#4 Updated by The Foreman Bot about 2 years ago

Assignee set to Ewoud Kohl van Wijngaarden
Status changed from New to Ready For Testing
Pull request https://github.com/theforeman/foreman-packaging/pull/3862 added