Bug 2120653

Summary:	Add beta keys to default-policy.json [rhel-9.1]
Product:	Red Hat Enterprise Linux 9	Reporter:	Jindrich Novy <jnovy>
Component:	containers-common	Assignee:	Jindrich Novy <jnovy>
Status:	CLOSED ERRATA	QA Contact:	Yuhui Jiang <yujiang>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	ddarrah, ypu
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	containers-common-1-43.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2120651	Environment:
Last Closed:	2022-11-15 09:56:33 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2120651
Bug Blocks:

Description Jindrich Novy 2022-08-23 13:23:18 UTC

+++ This bug was initially created as a clone of Bug #2120651 +++

Description of problem:
The released container images are signed with the release/production key.  Images categorized as "Beta" are signed with the beta GPG Key.  Extend policy.json to support a list of files containing trusted keys. This could be via a new keyPaths (plural) field which accepts an array of strings, or by allowing keyPath to accept either a string or array of strings. 

Proposed fix:
diff --git a/default-policy.json b/default-policy.json
index 7ed16d6..eb5934e 100644
--- a/default-policy.json
+++ b/default-policy.json
@@ -10,14 +10,14 @@
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
-                   "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                   "keyPaths": ["/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release", "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta"]
                }
            ],
            "registry.redhat.io": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
-                   "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                   "keyPaths": ["/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release", "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta"]
                }
            ]
        },

--- Additional comment from Jindrich Novy on 2022-08-23 13:20:53 UTC ---

Related JIRA reference: https://issues.redhat.com/browse/RHELPLAN-118470

Comment 7 errata-xmlrpc 2022-11-15 09:56:33 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (containers-common bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7972