Bug 1559028

Summary:	Signing issues with modular-updates and modular-updates-testing
Product:	[Fedora] Fedora	Reporter:	Stephen Gallagher <sgallagh>
Component:	distribution	Assignee:	Patrick Uiterwijk <puiterwijk>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	28	CC:	awilliam, dennis, kevin, mboddu, robatino, sgallagh
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	AcceptedBlocker
Fixed In Version:	bodhi-3.5.1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-03-22 14:35:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1469204

Description Stephen Gallagher 2018-03-21 14:33:25 UTC

Description of problem:
Installing packages from the modular-updates-testing repository fails because keysigning is improperly set up. This issue does not appear to exist on the "modular" (stable) repo.

Version-Release number of selected component (if applicable):
Fedora 28 development repositories

How reproducible:
Every time

Steps to Reproduce:
1. Install the latest Fedora 28 Server Edition nightly compose
2. `dnf module install` a module that contains content currently in -testing

Actual results:


[root@f28bclient ~]# dnf module list
Last metadata expiration check: 1:50:38 ago on Wed 21 Mar 2018 08:37:53 AM EDT.
Fedora Modular 28 - x86_64
Name                      Stream           Version                  Profiles                             
nodejs                    8                20180308143646           default, development, ...            
nodejs                    9                20180308142225           default, development, ...            
reviewboard               2.5              20180206144254           default, server                      

Fedora Modular 28 - x86_64 - Test Updates
Name                      Stream           Version                  Profiles                             
django                    1.6              20180307130104           default, python2_development         
flatpak-runtime           f28              20180307202408           buildroot, runtime, ...              
nodejs                    6                20180308155546           default, development, ...            

Hint: [d]efault, [e]nabled, [i]nstalled, [l]ocked
[root@f28bclient ~]# dnf module install nodejs:6/default
Last metadata expiration check: 1:50:52 ago on Wed 21 Mar 2018 08:37:53 AM EDT.
Dependencies resolved.
=========================================================================================================
 Package            Arch     Version                                     Repository                 Size
=========================================================================================================
Installing module packages:
 nodejs             x86_64   1:6.13.1-1.module_1575+55808bea             updates-testing-modular   4.9 M
 npm                x86_64   1:3.10.10-1.6.13.1.1.module_1575+55808bea   updates-testing-modular   2.5 M
Installing dependencies:
 compat-openssl10   x86_64   1:1.0.2n-3.fc28                             fedora                    1.1 M
 libicu             x86_64   60.2-2.fc28                                 fedora                    8.8 M
 libuv              x86_64   1:1.19.2-1.fc28                             fedora                    127 k
 make               x86_64   1:4.2.1-6.fc28                              fedora                    497 k

Transaction Summary
=========================================================================================================
Install  4 Packages

Total download size: 18 M
Installed size: 62 M
Is this ok [y/N]: y
Downloading Packages:
(1/6): compat-openssl10-1.0.2n-3.fc28.x86_64.rpm                         1.3 MB/s | 1.1 MB     00:00    
(2/6): npm-3.10.10-1.6.13.1.1.module_1575+55808bea.x86_64.rpm            1.0 MB/s | 2.5 MB     00:02    
(3/6): libuv-1.19.2-1.fc28.x86_64.rpm                                    355 kB/s | 127 kB     00:00    
(4/6): make-4.2.1-6.fc28.x86_64.rpm                                      1.2 MB/s | 497 kB     00:00    
(5/6): nodejs-6.13.1-1.module_1575+55808bea.x86_64.rpm                   1.4 MB/s | 4.9 MB     00:03    
(6/6): libicu-60.2-2.fc28.x86_64.rpm                                     2.7 MB/s | 8.8 MB     00:03    
---------------------------------------------------------------------------------------------------------
Total                                                                    3.5 MB/s |  18 MB     00:05     
Package nodejs-6.13.1-1.module_1575+55808bea.x86_64.rpm is not signed
Package npm-3.10.10-1.6.13.1.1.module_1575+55808bea.x86_64.rpm is not signed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED


Expected results:
The packages should be installed as expected.


Additional info:

This is pretty serious for Beta, as we have the -testing repositories enabled by default there.

Comment 1 Fedora Blocker Bugs Application 2018-03-21 14:39:05 UTC

Proposed as a Blocker for 28-beta by Fedora user sgallagh using the blocker tracking app because:

 This is a conditional violation of "The installed system must be able to download and install updates with the default console package manager." from the basic criteria. The condition being "only modules and only updates[-testing]".

Comment 2 Kevin Fenzi 2018-03-21 16:53:47 UTC

+1 blocker

Comment 3 Mohan Boddu 2018-03-21 16:56:08 UTC

+1 Blocker

Comment 4 Patrick Uiterwijk 2018-03-21 16:58:57 UTC

+1 blocker.
Note that the Bodhi fix for this is currently in staging.

Comment 5 Adam Williamson 2018-03-21 17:17:18 UTC

That's +3, setting accepted.

Comment 6 Patrick Uiterwijk 2018-03-21 22:02:09 UTC

The version of Bodhi that should fix this is live in production, and the first mash with the fix has finished.
This should be fixed with the next repo sync.

Comment 7 Stephen Gallagher 2018-03-22 00:26:54 UTC

I updated my repo file to point at the master repo and retried this. Everything appears to be working properly now. I'll check again in the morning to make sure it filtered out to the other mirrors, then we can call this VERIFIED.

Thanks for the quick turnaround, Patrick!

Comment 8 Stephen Gallagher 2018-03-22 13:35:02 UTC

(In reply to Stephen Gallagher from comment #7)
> I updated my repo file to point at the master repo and retried this.
> Everything appears to be working properly now. I'll check again in the
> morning to make sure it filtered out to the other mirrors, then we can call
> this VERIFIED.

This worked this morning from arbitrary mirrors, so I'm prepared to call this VERIFIED.

Comment 9 Patrick Uiterwijk 2018-03-22 14:35:49 UTC

Thanks for confirming, then I'd say that this bug is fixed.