Bug 2183038

Summary:	Rebuild to pull in cryptographic fixes for RPM (bug 2170878)
Product:	[Fedora] Fedora Container Images	Reporter:	Boyd <bkelly>
Component:	fedora-toolbox	Assignee:	Debarshi Ray <debarshir>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	38	CC:	amessina, debarshir, fedoraproject, gmarr, harrymichal, kparal, ogutierr, petersen, sumukher, travier
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:	AcceptedFreezeException
Fixed In Version:	fedora-toolbox-38-15	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-07-04 10:45:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2083913, 2170878

Description Boyd 2023-03-30 09:44:05 UTC

Description of problem:  Seems to have issue related to https://bugzilla.redhat.com/show_bug.cgi?id=2170878


Version-Release number of selected component (if applicable):


How reproducible:
Install certain 3rd party packages fails.  Not possible to --nogpgcheck or --force rpm install


Steps to Reproduce:

1. toolbox create toolbox --release 38
2. toolbox enter fedora-toolbox-38
3. su -
4. dnf update -y
5. enable copr agriffis/neovim-nightly
6. dnf install python3-neovim

Actual results:
Problem opening package python3-neovim-0.4.3.0.git.601.71102c0-1.fc38.noarch.rpm
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED
⬢[root@toolbox ~]#


Expected results:
Install package successfully.


Additional info:
https://discussion.fedoraproject.org/t/talk-popular-third-party-rpms-fail-to-install-update-remove-due-to-security-policies-verification/70379/23

Comment 1 Debarshi Ray 2023-03-30 18:10:34 UTC

Thanks for testing out the fedora-toolbox:38 image.

(In reply to Boyd from comment #0)
> Additional info:
> https://discussion.fedoraproject.org/t/talk-popular-third-party-rpms-fail-to-
> install-update-remove-due-to-security-policies-verification/70379/23

Yeah, it's been a month since the fedora-toolbox images were last rebuilt, and the images for Fedora 38 are missing the fixes for bug 2170878 which was marked as a Fedora 38 blocker.

Even under normal circumstances, it's time to rebuild them again, especially the one for Fedora 38 because of the Beta freeze, but this makes it really critical.  Unfortunately, the 'fedpkg container-build' is currently broken: https://pagure.io/releng/issue/11367

Comment 2 Debarshi Ray 2023-04-03 14:19:05 UTC

I don't know why Bodhi didn't notify this bug, but a new image build was done three days ago:
https://bodhi.fedoraproject.org/updates/FEDORA-CONTAINER-2023-5046242970

Testing and karma welcome.

Comment 3 Geoffrey Marr 2023-04-03 20:33:49 UTC

Discussed during the 2023-04-03 blocker review meeting: [0]

The decision to classify this bug as an "AcceptedFreezeException (Final)" was made as it'd be good to have the known cryptographic issues fixed in the toolbox image.

[0] https://meetbot.fedoraproject.org/fedora-blocker-review/2023-04-03/f38-blocker-review.2023-04-03-16.01.txt

Comment 4 Jens Petersen 2023-04-12 03:48:25 UTC

This is actually fixed in the new fedora-toolbox-38-15 build (pushed yesterday - note it is actually already stable).

The previous fedora-toolbox-38-14 build probably didn't include the crypto fix yet.