Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be unavailable on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1416266 - [Upstream ONLY] Not all packages are signed
Summary: [Upstream ONLY] Not all packages are signed
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: ovirt-node
Classification: oVirt
Component: Packaging.rpm
Version: 4.1
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ovirt-4.1.1
: 4.1
Assignee: Sandro Bonazzola
QA Contact: cshao
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-25 05:27 UTC by cshao
Modified: 2017-04-21 09:44 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-04-21 09:44:30 UTC
oVirt Team: Integration
rule-engine: ovirt-4.1+
rule-engine: planning_ack+
sbonazzo: devel_ack+
cshao: testing_ack+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 72184 0 master MERGED build: exporting a list of unsigned rpms 2017-02-15 16:36:09 UTC
oVirt gerrit 72420 0 ovirt-4.1-snapshot MERGED build: exporting a list of unsigned rpms 2017-02-16 10:53:32 UTC
oVirt gerrit 72421 0 ovirt-4.1-pre MERGED build: exporting a list of unsigned rpms 2017-02-16 10:53:55 UTC
oVirt gerrit 72422 0 ovirt-4.1 MERGED build: exporting a list of unsigned rpms 2017-02-16 10:54:16 UTC

Description cshao 2017-01-25 05:27:44 UTC
Description of problem:
Not all packages are signed 

# imgbase w
[INFO] You are on ovirt-node-ng-4.1.0-0.20170122.0+1

# rpm -qa --qf '%{name}-%{version}-%{release}.%{arch} (%{SIGPGP:pgpsig})\n' | grep -v "Key ID" 
collectd-write_http-5.7.0-2.el7.x86_64 ((none))
fluentd-0.12.26-1.el7.noarch ((none))
rubygem-yajl-ruby-1.2.1-1.el7.x86_64 ((none))
python-pthreading-0.1.3-3.el7.noarch ((none))
collectd-5.7.0-2.el7.x86_64 ((none))
collectd-netlink-5.7.0-2.el7.x86_64 ((none))
rubygem-resolve-hostname-0.0.4-1.el7.noarch ((none))
rubygem-sigdump-0.2.2-1.el7.noarch ((none))
python-daemon-1.6-4.el7.noarch ((none))
python-cpopen-1.5-3.el7.x86_64 ((none))
rubygem-tzinfo-data-1.2014.10-2.el7.noarch ((none))
collectd-virt-5.7.0-2.el7.x86_64 ((none))
mom-0.5.8-1.el7.noarch ((none))
rubygem-thread_safe-0.3.4-1.el7.noarch ((none))
rubygem-msgpack-0.5.11-1.el7.x86_64 ((none))
rubygem-cool.io-1.2.4-2.el7.x86_64 ((none))
rubygem-http_parser.rb-0.6.0-1.el7.x86_64 ((none))
collectd-disk-5.7.0-2.el7.x86_64 ((none))
rubygem-fluent-plugin-secure-forward-0.4.3-1.el7.noarch ((none))
rubygem-tzinfo-1.2.2-2.el7.noarch ((none))
rubygem-proxifier-1.0.3-1.el7.noarch ((none))
rubygem-string-scrub-0.0.5-1.el7.x86_64 ((none))
# 


Version-Release number of selected component (if applicable):
ovirt-node-ng-installer-ovirt-4.1-pre-2017012204.iso
imgbased-0.9.5-0.201701181504git35ef6dc.el7.centos.noarch 

How reproducible:
100%

Steps to Reproduce:
1. Boot from iso and install upstream build ovirt-node-ng-installer-ovirt-4.1-pre-2017012204.iso 
2. Verify that all packages are signed
3.

Actual results:
Not all packages are signed.

Expected results:
After executed above command,it should return nothing and all packages are signed

Additional info:

Comment 1 Sandro Bonazzola 2017-01-25 08:29:49 UTC
Matthias, when do you expect to release collectd and fluentd to mirror.centos.org?
If not soon, we'll have to tag into Virt SIG for getting them signed and released on mirrors.

Comment 3 Matthias Runge 2017-01-25 09:18:14 UTC
I've sent a mail to centos-devel to get more info on the process to get the content signed and distributed to mirror.c.o.

Comment 4 Matthias Runge 2017-01-25 09:20:24 UTC
https://lists.centos.org/pipermail/centos-devel/2017-January/015623.html

What are you using for repository configuration? The included centos-release-opstools rpm?

http://buildlogs.centos.org/centos/7/opstools/x86_64/common/centos-release-opstools-1-4.el7.noarch.rpm

Comment 5 Sandro Bonazzola 2017-01-25 12:07:53 UTC
Matthias, node is built using as repo source: http://resources.ovirt.org/pub/yum-repo/ovirt-release41-pre.rpm for el7 case.

with regards to OpsTools, the enabled repo is:
[centos-opstools-testing]
name=CentOS-7 - OpsTools - testing repo
baseurl=http://buildlogs.centos.org/centos/7/opstools/$basearch/
gpgcheck=0
enabled=1

Comment 6 Matthias Runge 2017-01-26 10:26:05 UTC
Slowly moving:

http://cbs.centos.org/koji/buildinfo?buildID=15341

Comment 7 Sandro Bonazzola 2017-02-01 14:59:28 UTC
Yuval, can you please add a check in node-ng build sequence executing:

# rpm -qa --qf '%{name}-%{version}-%{release}.%{arch} (%{SIGPGP:pgpsig})\n' | grep -v "Key ID" 

and saving the output in a file like we do with manifest?
This will allow us to get the info on missing signature for each jenkins build.

Comment 8 Yuval Turgeman 2017-02-13 13:52:08 UTC
Posted a patch for node-ng that creates a file with unsigned-rpms in the image

Comment 9 Sandro Bonazzola 2017-02-20 17:16:55 UTC
(In reply to Matthias Runge from comment #6)
> Slowly moving:
> 
> http://cbs.centos.org/koji/buildinfo?buildID=15341

REady on oVirt side: https://cbs.centos.org/koji/buildinfo?buildID=15792

Comment 11 Sandro Bonazzola 2017-03-06 08:37:11 UTC
http://jenkins.ovirt.org/job/ovirt-node-ng_ovirt-4.1-pre_build-artifacts-el7-x86_64/124/ can be used for testing

Comment 12 cshao 2017-03-10 11:49:17 UTC
Test version
redhat-virtualization-host-4.1-20170309.0
imgbased-0.9.17-0.1.el7ev.noarch

Test result:
All packages are signed, so the bug is fixed, change bug status to VERIFIED.

Comment 13 Ying Cui 2017-03-10 13:14:41 UTC
Moving back to ON_QA, because it is upstream only bug, it should be tested on upstream build instead of downstream build.

Comment 14 cshao 2017-03-14 03:00:41 UTC
Test version:
ovirt-node-ng-installer-ovirt-4.1-pre-2017030911.iso
imgbased-0.9.17-0.201703081456gitaf8e18b.el7.centos.noarch

# imgbase w
[INFO] You are on ovirt-node-ng-4.1.1-0.20170309.0+1
[root@dhcp-8-136 ~]# 
[root@dhcp-8-136 ~]# rpm -qa --qf '%{name}-%{version}-%{release}.%{arch} (%{SIGPGP:pgpsig})\n' | grep -v "Key ID" 
[root@dhcp-8-136 ~]# 

Test result:
All packages are signed

So the bug is fixed, change bug status to VERIFIED.

Comment 15 cshao 2017-03-16 07:43:35 UTC
Re-open this bug as this issue still can be reproduced on the latest upstream build.

Test version:
ovirt-node-ng-installer-ovirt-4.1-2017031404.iso
imgbased-0.9.6-1.el7.noarch


# imgbase w
[INFO] You are on ovirt-node-ng-4.1.0-0.20170314.0+1
# 
# rpm -qa --qf '%{name}-%{version}-%{release}.%{arch} (%{SIGPGP:pgpsig})\n' | grep -v "Key ID"
rubygem-resolve-hostname-0.0.4-1.el7.noarch ((none))
collectd-netlink-5.7.0-2.el7.x86_64 ((none))
rubygem-proxifier-1.0.3-1.el7.noarch ((none))
rubygem-string-scrub-0.0.5-1.el7.x86_64 ((none))
rubygem-fluent-plugin-secure-forward-0.4.3-1.el7.noarch ((none))
collectd-disk-5.7.0-2.el7.x86_64 ((none))
collectd-write_http-5.7.0-2.el7.x86_64 ((none))
rubygem-sigdump-0.2.2-1.el7.noarch ((none))
python-daemon-1.6-4.el7.noarch ((none))
fluentd-0.12.26-1.el7.noarch ((none))
collectd-virt-5.7.0-2.el7.x86_64 ((none))
safelease-1.0-7.el7.x86_64 ((none))
rhvm-appliance-4.1.20170126.0-1.el7ev.noarch ((none))
rubygem-thread_safe-0.3.4-1.el7.noarch ((none))
rubygem-yajl-ruby-1.2.1-1.el7.x86_64 ((none))
rubygem-cool.io-1.2.4-2.el7.x86_64 ((none))
rubygem-http_parser.rb-0.6.0-1.el7.x86_64 ((none))
ovirt-imageio-common-1.0.0-1.el7.noarch ((none))
collectd-5.7.0-2.el7.x86_64 ((none))
rubygem-tzinfo-1.2.2-2.el7.noarch ((none))
python-cpopen-1.5-3.el7.x86_64 ((none))
rubygem-tzinfo-data-1.2014.10-2.el7.noarch ((none))
imgbased-0.9.6-1.el7.noarch ((none))
ovirt-imageio-daemon-1.0.0-1.el7.noarch ((none))
rubygem-msgpack-0.5.11-1.el7.x86_64 ((none))
python-pthreading-0.1.3-3.el7.noarch ((none))

Comment 16 Red Hat Bugzilla Rules Engine 2017-03-16 07:43:42 UTC
Target release should be placed once a package build is known to fix a issue. Since this bug is not modified, the target version has been reset. Please use target milestone to plan a fix for a oVirt release.

Comment 17 Sandro Bonazzola 2017-03-16 07:47:57 UTC
Restoring verified status.
In comment #15 test has been done on: 
# imgbase w
[INFO] You are on ovirt-node-ng-4.1.0-0.20170314.0+1

While the bug has been fixed in 4.1.1 and verified as per comment #14 on
# imgbase w
[INFO] You are on ovirt-node-ng-4.1.1-0.20170309.0+1


Note You need to log in before you can comment on or make changes to this bug.