Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1857367

Summary: buildah push/pull --encryption-key: tests failing on RHEL8
Product: Red Hat Enterprise Linux 8 Reporter: Ed Santiago <santiago>
Component: buildahAssignee: Tom Sweeney <tsweeney>
Status: CLOSED DUPLICATE QA Contact: atomic-bugs <atomic-bugs>
Severity: high Docs Contact:
Priority: unspecified    
Version: 8.0CC: dwalsh, jnovy, tsweeney
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-01-28 12:51:17 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Ed Santiago 2020-07-15 17:51:05 UTC 
Basically: `buildah push --encryption-key X` succeeds, the `buildah pull WITHOUT-KEY` also succeeds (it should fail). This probably points to a problem with `push`.

Sample error:

   # $ /usr/bin/buildah push --signature-policy /usr/share/buildah/test/system/./policy.json --tls-verify=false --creds testuser:testpassword --encryption-key jwe:/tmp/tmpf02d37d5c0e4e26645cd0f5e/tmp/mykey.pub busybox docker://localhost:5000/buildah/busybox_encrypted:latest
   # Getting image source signatures
   # Copying blob sha256:50761fe126b6e4d90fa0b7a6e195f6030fe250c016c2fc860ac40f2e8d2f2615
   # Copying config sha256:e9b279bfd5ab325aea1e8c9cfb16247380afaea6a0c29fa1b9934b77b4685e4d
   # Writing manifest to image destination
   # Copying config sha256:e9b279bfd5ab325aea1e8c9cfb16247380afaea6a0c29fa1b9934b77b4685e4d
   # Writing manifest to image destination
   # Storing signatures
   # $ /usr/bin/buildah pull --signature-policy /usr/share/buildah/test/system/./policy.json --tls-verify=false --creds testuser:testpassword docker://localhost:5000/buildah/busybox_encrypted:latest
   # Getting image source signatures
   # Copying blob sha256:5aee0a4068d86dbafc2fe06984af1950882aa2ea93f900808320dd2d3286c63b
   # Copying config sha256:e9b279bfd5ab325aea1e8c9cfb16247380afaea6a0c29fa1b9934b77b4685e4d
   # Writing manifest to image destination
   # Storing signatures
   # e9b279bfd5ab325aea1e8c9cfb16247380afaea6a0c29fa1b9934b77b4685e4d
   # #/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
   # #| FAIL: exit code is 0; expected 125
   # #\^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

buildah-1.15.0-1.module+el8.3.0+7368+e8f3498f.x86_64
Comment 2 Ed Santiago 2020-07-15 17:54:32 UTC 
Forgot to add: reproduces easily on rhel8 virt, but requires setting up a local registry. I'll supply instructions on request.
Comment 4 Ed Santiago 2020-07-16 16:56:10 UTC 
I really have no idea when it first failed: I only look at gating-test results when absolutely necessary. I first noticed it yesterday in 7377 (buildah 1.15.0-1) and then just now in 7385 (buildah 1.11.6-8). The very-different versions of buildah lead me to suspect that the problem may be elsewhere.
Comment 5 Ed Santiago 2020-07-16 17:28:36 UTC 
My mistake: this does not affect buildah 1.11, only 1.15.0-1. I got confused between too many browser tabs. I am sorry for muddying things.
Comment 6 Ed Santiago 2020-07-16 19:56:09 UTC 
Another update: it looks like the tests pass when the registry is docker.io/library/registry:2 (no dot six). Perhaps this encrypt functionality requires a newer registry image. I will continue looking into this as my first priority Monday, and will update gating test helpers (Fedora, RHEL) as necessary.
Comment 8 Daniel Walsh 2021-01-28 12:11:43 UTC 
Ed is this till an bug?