Bug #32145
closed
syncing deb repo with invalid/incorrect gpg key produces "No valid Release file found" error
Description
Error doesn't make it clear that the issue with Release integrity check failing, or that key is invalid.
There is nothing in the dynflow console either.
Files
| pulp_deb_invalid_gpgkey.png | View pulp_deb_invalid_gpgkey.png | 46.6 KB | invalid gpg happy accepted, and sync fails |
Updated by Ian Ballou about 3 years ago
- Status changed from New to Need more information
Hi Rossen P,
What url are you pointing your repository to for syncing?
Like with the other issue you filed, we'd like to know if your debian content is using Pulp 2 or Pulp 3. Please let us know using the instructions there, and let us know if you have any questions.
Updated by Ian Ballou about 3 years ago
I just noticed on another bug of yours that you are on Pulp 3, so don't worry about that bit. We'd still like to know what URL you used so we can try it out.
Updated by Rossen G about 3 years ago
- File pulp_deb_invalid_gpgkey.png pulp_deb_invalid_gpgkey.png added
- Found in Releases Katello 3.18.2 added
I believe I'm on pulp3, as its was fresh install on 3.18.1, which I updated today to 3.18.2.
I've tested with a Saltstack repo. See screenshot for sync attempt with invalid key.
There doesn't seem to by any validation on GPG content credentials, and it happily accepts anything.
Repo URL: https://repo.saltproject.io/py3/ubuntu/20.04/amd64/latest/
Saltstack GPG key:
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.22 (GNU/Linux) mQENBFOpvpgBCADkP656H41i8fpplEEB8IeLhugyC2rTEwwSclb8tQNYtUiGdna9 m38kb0OS2DDrEdtdQb2hWCnswxaAkUunb2qq18vd3dBvlnI+C4/xu5ksZZkRj+fW tArNR18V+2jkwcG26m8AxIrT+m4M6/bgnSfHTBtT5adNfVcTHqiT1JtCbQcXmwVw WbqS6v/LhcsBE//SHne4uBCK/GHxZHhQ5jz5h+3vWeV4gvxS3Xu6v1IlIpLDwUts kT1DumfynYnnZmWTGc6SYyIFXTPJLtnoWDb9OBdWgZxXfHEcBsKGha+bXO+m2tHA gNneN9i5f8oNxo5njrL8jkCckOpNpng18BKXABEBAAG0MlNhbHRTdGFjayBQYWNr YWdpbmcgVGVhbSA8cGFja2FnaW5nQHNhbHRzdGFjay5jb20+iQE4BBMBAgAiBQJT qb6YAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAOCKFJ3le/vhkqB/0Q WzELZf4d87WApzolLG+zpsJKtt/ueXL1W1KA7JILhXB1uyvVORt8uA9FjmE083o1 yE66wCya7V8hjNn2lkLXboOUd1UTErlRg1GYbIt++VPscTxHxwpjDGxDB1/fiX2o nK5SEpuj4IeIPJVE/uLNAwZyfX8DArLVJ5h8lknwiHlQLGlnOu9ulEAejwAKt9CU 4oYTszYM4xrbtjB/fR+mPnYh2fBoQO4d/NQiejIEyd9IEEMd/03AJQBuMux62tjA /NwvQ9eqNgLw9NisFNHRWtP4jhAOsshv1WW+zPzu3ozoO+lLHixUIz7fqRk38q8Q 9oNR31KvrkSNrFbA3D89uQENBFOpvpgBCADJ79iH10AfAfpTBEQwa6vzUI3Eltqb 9aZ0xbZV8V/8pnuU7rqM7Z+nJgldibFk4gFG2bHCG1C5aEH/FmcOMvTKDhJSFQUx uhgxttMArXm2c22OSy1hpsnVG68G32Nag/QFEJ++3hNnbyGZpHnPiYgej3FrerQJ zv456wIsxRDMvJ1NZQB3twoCqwapC6FJE2hukSdWB5yCYpWlZJXBKzlYz/gwD/Fr GL578WrLhKw3UvnJmlpqQaDKwmV2s7MsoZogC6wkHE92kGPG2GmoRD3ALjmCvN1E PsIsQGnwpcXsRpYVCoW7e2nW4wUf7IkFZ94yOCmUq6WreWI4NggRcFC5ABEBAAGJ AR8EGAECAAkFAlOpvpgCGwwACgkQDgihSd5Xv74/NggA08kEdBkiWWwJZUZEy7cK WWcgjnRuOHd4rPeT+vQbOWGu6x4bxuVf9aTiYkf7ZjVF2lPn97EXOEGFWPZeZbH4 vdRFH9jMtP+rrLt6+3c9j0M8SIJYwBL1+CNpEC/BuHj/Ra/cmnG5ZNhYebm76h5f T9iPW9fFww36FzFka4VPlvA4oB7ebBtquFg3sdQNU/MmTVV4jPFWXxh4oRDDR+8N 1bcPnbB11b5ary99F/mqr7RgQ+YFF0uKRE3SKa7a+6cIuHEZ7Za+zhPaQlzAOZlx fuBmScum8uQTrEF5+Um5zkwC7EXTdH1co/+/V/fpOtxIg4XO4kcugZefVm5ERfVS MA== =dtMN -----END PGP PUBLIC KEY BLOCK-----
Updated by Rossen G about 3 years ago
- Status changed from Need more information to New
Updated by Justin Sherrill about 3 years ago
- Status changed from New to Rejected
- Target version set to Katello Recycle Bin
I've opened a pulp issue for this: https://pulp.plan.io/issues/8511
i'm not sure there's anything that katello can do.
I'm gonna close this issue, but we can reopen if that turns out not to be the case