Bug 2232439 - jq-1.6-15.el9.aarch64.rpm became unsigned in C9S development compose
Summary: jq-1.6-15.el9.aarch64.rpm became unsigned in C9S development compose
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: jq
Version: CentOS Stream
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Tomas Halman
QA Contact: sssd-qe
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-16 21:52 UTC by Michael Ho
Modified: 2023-08-17 08:34 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-08-17 08:34:01 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Michael Ho 2023-08-16 21:52:57 UTC
Description of problem:

In the production C9S compose [1], the jq-1.6-15.el9.aarch64.rpm is signed correctly. In the development C9S compose [2], the jq-1.6-15.el9.aarch64.rpm is now unsigned. It is also unsigned in CentOS Koji [3] now. This is problematic because it now cannot be used in gpg enabled repos (i.e. AutoSD compose).

The rpm signatures being stripped in post seems to be a bug or unwanted modification to the rpm.

[1]: https://mirror.stream.centos.org/9-stream/AppStream/aarch64/os/Packages/jq-1.6-15.el9.aarch64.rpm
[2]: https://composes.stream.centos.org/development/latest-CentOS-Stream/compose/AppStream/aarch64/os/Packages/jq-1.6-15.el9.aarch64.rpm
[3]: https://kojihub.stream.centos.org/kojifiles/packages/jq/1.6/15.el9/aarch64/jq-1.6-15.el9.aarch64.rpm

Version-Release number of selected component (if applicable):

jq-1.6-15.el9

How reproducible:

Easy to reproduce.

Steps to Reproduce:
1. Download rpm from development compose or koji directly (See [2] or [3]
   in the description above)
2. Verify the signature with `rpm -qpi`
   rpm -qpi jq-1.6-15.el9.aarch64.rpm
3. Confirm that Signature field is empty
   eg. Signature   : (none)

Actual results:

  Signature   : (none)

Expected results:

  Signature   : RSA/SHA256, Tue 11 Apr 2023 08:25:58 PM CEST, Key ID 05b555b38483c65d

Additional info:

Comment 1 Michael Ho 2023-08-17 08:34:01 UTC
Disregard this, the other rpms in general are unsigned in these source locations (didn't verify a report deeply enough before creating this bug).


Note You need to log in before you can comment on or make changes to this bug.