Description of problem: If Satellite 7.0 is running on a FIPS enabled RHEL 8.5, when I am trying to install the foreman-discovery-package it fails to get installed as dnf\yum verify its digest. Version-Release number of selected component (if applicable): Satellite 7.0 (7.0.0-0.5.beta.el8sat) RHEL 8.5 + FIPS How reproducible: Always Steps to Reproduce: 1. Install RHEL 8.5 and enable FIPS 2. Setup repositories as per ohsnap\rh-engineering instructions 3. Install "satellite" and "foreman-discovery-image" packages Actual results: The foreman-discovery-image package installation fails. The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'yum clean packages'. Error: Transaction test error: package foreman-discovery-image-1:3.8.1-2.el7sat.noarch does not verify: no digest If we look carefully, we ship an el7 package via RHEL 8 repo for Sat 7.0 ~~ foreman-discovery-image.noarch 1:3.8.1-2.el7sat Sat6-CI_Red_Hat_Satellite_7_0_Composes_Satellite_7_0_RHEL8 ~~ Expected results: To have foreman-discovery-package installed properly on a FIPS enabled RHEL 8 based Satellite 7.0 without needing to use any workaround Additional info: NA
RELEASE NOTES (please verify Sayan thank you): Known issue doc: When installing foreman-discovery-package on FIPS mode in RHEL8, RPM package installation will fail with "does not verify: no digest". Solution: Extract the ISO manually: rpm2cpio foreman-discovery-image-XYZ.rpm | cpio -idmv Convert the ISO to the PXE files: ln -snf foreman-discovery-image-XYZ.iso fdi.iso discovery-iso-to-pxe fdi.iso cp ./tftpboot/vmlinuz0 /var/lib/tftpboot/fdi-image/vmlinuz cp ./tftpboot/initrd0.img /var/lib/tftpboot/fdi-image/initrd0.img
Verified Release Notes: Issue: Installing foreman-discovery-image package on FIPS mode in RHEL8, RPM package installation fails with "does not verify: no digest". Solution: 1. If you do not have the foreman-discovery-image iso, try downloading from package manager at https://access.redhat.com/downloads/content/foreman-discovery-image/3.8.0-1.el7sat/noarch/fd431d51/package 2. Else, continue with steps as follows: A. rpm2cpio foreman-discovery-image-XYZ.rpm | cpio -idmv B. ln -snf usr/share/foreman-discovery-image/foreman-discovery-image-3.8.0-1.iso fdi.iso C. ./usr/bin/discovery-iso-to-pxe fdi.iso D. mkdir /var/lib/tftpboot/fdi-image E. cp ./tftpboot/vmlinuz0 /var/lib/tftpboot/fdi-image/vmlinuz F. cp ./tftpboot/initrd0.img /var/lib/tftpboot/fdi-image/initrd0.img
(In reply to Griffin Sullivan from comment #9) > Verified Release Notes: > > Issue: > > Installing foreman-discovery-image package on FIPS mode in RHEL8, RPM > package installation fails with "does not verify: no digest". > > Solution: > > 1. If you do not have the foreman-discovery-image iso, try downloading from > package manager at > https://access.redhat.com/downloads/content/foreman-discovery-image/3.8.0-1. > el7sat/noarch/fd431d51/package > > 2. Else, continue with steps as follows: > > A. rpm2cpio foreman-discovery-image-XYZ.rpm | cpio -idmv > > B. ln -snf > usr/share/foreman-discovery-image/foreman-discovery-image-3.8.0-1.iso fdi.iso > > C. ./usr/bin/discovery-iso-to-pxe fdi.iso > > D. mkdir /var/lib/tftpboot/fdi-image > > E. cp ./tftpboot/vmlinuz0 /var/lib/tftpboot/fdi-image/vmlinuz > > F. cp ./tftpboot/initrd0.img /var/lib/tftpboot/fdi-image/initrd0.img Hello, For some reason, I never had a notification in my mailbox about Comment 8 and hence I missed the notes from lzap completely. Theoretically, the steps are looking good except for these i.e. D. mkdir /var/lib/tftpboot/fdi-image E. cp ./tftpboot/vmlinuz0 /var/lib/tftpboot/fdi-image/vmlinuz F. cp ./tftpboot/initrd0.img /var/lib/tftpboot/fdi-image/initrd0.img The /var/lib/tftpboot/fdi-image/ should be /var/lib/tftpboot/boot/fdi-image/ if i am correct. And also "/var/lib/tftpboot/boot" and anything inside the same should have the ownership of foreman-proxy user Now, Practically, To verify whether the manual approach works and allows me to discover a host via PXE or not, I will need to install the latest snap of 6.11 on a FIPS-enabled system which will take some time. -- Sayan
RN draft: *Installation of foreman-discovery-package fails on RHEL 8 with FIPS enabled* When installing the foreman-discovery-package on RHEL 8 with FIPS mode enabled, RPM package installation fails with the following error message: `does not verify: no digest`. To work around this issue, extract the ISO manually by running `rpm2cpio foreman-discovery-image-XYZ.rpm | cpio -idmv` in your Terminal, then convert the ISO to the PXE files by running `ln -snf foreman-discovery-image-XYZ.iso fdi.iso discovery-iso-to-pxe fdi.iso mkdir -p /var/lib/tftpboot/boot/fdi-image cp ./tftpboot/vmlinuz0 /var/lib/tftpboot/boot/fdi-image/vmlinuz cp ./tftpboot/initrd0.img /var/lib/tftpboot/boot/fdi-image/initrd0.img chown -R foreman-proxy:root /var/lib/tftpboot/boot/fdi-image restorecon -RFv /var/lib/tftpboot/boot/fdi-image` in your Terminal. Doc: https://docs.google.com/document/d/1xMkjPbkwF9ZJ95tEcWYmRRqVdusIZENHZsL3-B3YvJw/edit Tagging @lzap for sanity check here and in doc.
Yeah correct. These are all separate commands, 7 in total, just to be clear: ln -snf foreman-discovery-image-XYZ.iso fdi.iso discovery-iso-to-pxe fdi.iso mkdir -p /var/lib/tftpboot/boot/fdi-image cp ./tftpboot/vmlinuz0 /var/lib/tftpboot/boot/fdi-image/vmlinuz cp ./tftpboot/initrd0.img /var/lib/tftpboot/boot/fdi-image/initrd0.img chown -R foreman-proxy:root /var/lib/tftpboot/boot/fdi-image restorecon -RFv /var/lib/tftpboot/boot/fdi-image
Final RN: *RHEL 8 FIPS mode installation failure* When installing the `foreman-discovery-package` on RHEL 8 with FIPS mode enabled, the package installation fails with an error message stating `does not verify: no digest`. As a workaround, extract the ISO manually using `rpm2cpio foreman-discovery-image-XYZ.rpm | cpio -idmv`, then convert the ISO to PXE files using the following commands: [start=1] . `ln -snf foreman-discovery-image-XYZ.iso fdi.iso` . `discovery-iso-to-pxe fdi.iso` . `mkdir -p /var/lib/tftpboot/boot/fdi-image` . `cp ./tftpboot/vmlinuz0 /var/lib/tftpboot/boot/fdi-image/vmlinuz` . `cp ./tftpboot/initrd0.img /var/lib/tftpboot/boot/fdi-image/initrd0.img` . `chown -R foreman-proxy:root /var/lib/tftpboot/boot/fdi-image` . `restorecon -RFv /var/lib/tftpboot/boot/fdi-image`
Link to doc: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/release_notes/assembly_introducing-red-hat-satellite_sat6-release-notes#ref_known-issues_assembly_introducing-red-hat-satellite