« Koji/SigulUsing » : différence entre les versions

De TartareFR
Aller à la navigation Aller à la recherche
Aucun résumé des modifications
Ligne 1 : Ligne 1 :
= Description =
== Sigul ==
At the beginning of each release under development a new package signing key is created for it.  This key is used to prove the authenticity of packages built by Fedora and distributed by Fedora.  This key will be used to sign all packages for the public test and final releases. This article follows [[Koji/SigulInstall|Install a Sigul Signing server]]
 
après une [[Koji/SigulInstall|installation de Sigul]], on peut l'utiliser.
{{Admon/note|Commandes disponible|<pre>$ sigul --help-commands
delete-key          Delete a key
modify-key-user    Modify user's key access
list-users          List users
grant-key-access    Grant key access to a user
sign-text          Output a cleartext signature of a text
import-key          Import a key
new-user            Add a user
sign-rpm            Sign a RPM
list-keys          List keys
sign-data          Create a detached signature
revoke-key-access  Revoke key acess from a user
user-info          Show information about a user
change-passphrase  Change key passphrase
list-key-users      List users that can access a key
new-key             Add a key
modify-user        Modify a user
sign-rpms          Sign one or more RPMs
modify-key          Modify a key
delete-user        Delete a user
key-user-info      Show information about user's key access
get-public-key      Output public part of the key
</pre>
}}


= Action =
=== Créer une nouvelle clé ===
== Sigul ==
 
Sigul is the signing server which holds our keys.  In order to make use of a new key, the key will have to be created and access to the key will have to be granted.  The <code>new-key</code>, <code>grant-key-access</code>, and <code>change-passphrase</code> commands are used.
Une fois le client Sigul capable d'envoyer des commandes à <class>Sigul</class>, on peut créer une nouvelle clé nommée '''centos-5-key'''.
  sigul new-key --name-real='CentOS-5-B2PWeb' --name-comment='CentOS 5 B2PWeb Signing Key' --name-email='srs@b2pweb.com' --key-admin root centos-5-key
{{Admon/note|Générer beaucoup d'entropie durant le génération de la clé|La génération de la clé nécessite beaucoup d'entropie sur le serveur Sigul. On peut donc occuper le serveur et paradoxalement accélerer la génération de la clé.


<pre>
La commande suivant génère assez d'entropie pour 2 minutes:
<pre>find / > /dev/null 2>&1</pre>}}<pre>
$ sigul new-key --help
$ sigul new-key --help
usage: client.py new-key [options] key
usage: client.py new-key [options] key
Ligne 23 : Ligne 51 :
   --expire-date=YYYY-MM-DD
   --expire-date=YYYY-MM-DD
                         Key expiration date
                         Key expiration date
</pre>


$ sigul grant-key-access --help
=== Import d'une clé existante ===
sigul import-key 'CentOS-5-B2PWeb' ~/.gnupg/secring.gpg
 
=== Changer le nom de la clé ===
Changer le nom de la clé '''centos5''' en '''centos-5-key'''<pre>sigul modify-key --new-name centos-5-key centos5</pre>
 
=== Ajout d'un utilisateur ===
 
* Ajout d'un utilisateur administrateur<pre>sigul new-user --admin --with-password didier</pre>
 
=== Autoriser l'utilisation d'une clé existante à un utilisateur ===
<pre>sigul grant-key-access centos-5-key didier</pre>
<pre>
sigul grant-key-access --help
usage: client.py grant-key-access key user
usage: client.py grant-key-access key user


Ligne 31 : Ligne 73 :
options:
options:
   -h, --help  show this help message and exit
   -h, --help  show this help message and exit
</pre>


$ sigul change-passphrase --help
=== Modifier la phrase de passe ===
sigul change-passphrase centos-5-key
<pre>
sigul change-passphrase --help
usage: client.py change-passphrase key
usage: client.py change-passphrase key


Ligne 41 : Ligne 87 :
</pre>
</pre>


For example if we wanted to create the Fedora 13 signing key, we would do the following:
=== FAQ ===
<ol>
<li>Log into a system configured to run sigul client.</li>
<li>Create the key using a strong passphrase when prompted
<pre>
$ sigul new-key --key-admin jkeating --name-real Fedora \
        --name-comment 13 \
        --name-email fedora@fedoraproject.org fedora-13
</pre></li>
<li>Wait a while for entropy.  This can take several minutes.</li>
<li>Grant key access to Fedora Account holders who will be signing packages and protect it with a temporary a passphrase.  For example, "CHANGEME."
<pre>
$ sigul grant-key-access fedora-13 jwboyer
</pre></li>
<li>Provide the key name and temporary passphrase to signers. If they don't respond, revoke access until they are ready to change their passphrase.  Signers can change their passphrase using the <code>change-passphrase</code> command:
<pre>
$ sigul change-passphrase fedora-13
</pre></li>
<pre><li>
When your sigul cert expires, you will need to run: 'certutil -d ~/.sigul -D -n sigul-client-cert' to remove the old cert, then 'sigul-client-setup' to add a new one.
</pre></li>
</ol>
 
== fedora-release ==
The fedora-release package houses a copy of the public key information.  This is used by rpm to verify the signature on files encountered.  Currently the fedora-release package has a single key file named after the version of the key and the arch the key is for.  To continue our example, the file would be named <code>RPM-GPG-KEY-fedora-13-primary</code> which is the primary arch key for Fedora 13.  To create this file, use the <code>get-public-key</code> command from sigul:


<pre>
{{Admon/faq|ERROR: I/O error: Unexpected EOF in NSPR|
$ sigul get-public-key fedora-13 > RPM-GPG-KEY-fedora-13-primary
* Ensure the key directory exists and have good permissions ( owner and group: '''sigul''' )<br>This path is declared on <path>/etc/sigul/server.conf</path><pre>gnupg-home: /var/lib/sigul/server/gnupg</pre>
</pre>
* Ensure sigul_bridge and sigul_server daemons are running<pre>systemctl status sigul_server.service && systemctl status sigul_bridge.service</pre>
* Ensure sigul_bridge can connect to sigul_server ( [[Koji/SigulInstall#Firewall| Configure firewall]] )}}


Add this file to the repo, and remove the previous release's file.
{{Admon/faq|Unknown error on creating key process|
* Install <package>gnupg1</package> from [ http://people.redhat.com/mitr/rpmsigner/rhel6 ] or [ http://infrastructure.stg.fedoraproject.org/repo/builder-rpms/6Server/SRPMS/ ]
* Make sure you're using a patched version of sigul<pre>sed -i -e '/gnupg_bin/s,^.*$,gnupg_bin = "/usr/bin/gpg1",' /usr/share/sigul/settings.py</pre>
* Ensure <package>python-sqlalchemy</package> is installed}}


<pre>
When your sigul cert expires, you will need to run: 'certutil -d ~/.sigul -D -n sigul-client-cert' to remove the old cert, then 'sigul-client-setup' to add a new one.
$ cvs rm RPM-GPG-KEY-fedora-12-primary
$ cvs add RPM-GPG-KEY-fedora-13-primary
</pre>


Then make a new fedora-release build for rawhide ('''FIXME''': this should be its own SOP)
== Scripts ==


== fedoraproject.org ==
=== sigulsign_unsigned.py ===
fedoraproject.org/keys lists information about all of our keys.  We need to let the webteam know we have created a new key so that they can add it to the list.


We do this by sending an email to webmaster@fedoraproject.org pointing to the viewvc
Le script est à récupérer depuis un depôt releng de Fedora via git (git://git.fedorahosted.org/git/releng) ou directement depuis https://git.fedorahosted.org/cgit/releng/tree/scripts/sigulsign_unsigned.py
http://cvs.fedoraproject.org/viewvc/fedora-release/RPM-GPG-KEY-fedora-13-primary?revision=1.1&root=fedora&view=co as well as including a URL to this page so that the process is not forgotten (see section below)


This url will have to be refreshed for the right release and CVS version
Avant de pouvoir utiliser ce script magique qui va signer tous les RPM non-signés construit dans le Koji, il est nécessaire de modifier quelques variables:
 
* Changer l'URL du HUB Koji (2 fois): KOJIHUB
=== Web team SOP ===
* Spécifier nos propres fichiers de certificats: SERVERCA, CLIENTCA, CLIENTCERT
* Ajout de nos clés de signature: KEYS


Pour obtenir l'ID de nos clés:
* exporter de la clé<pre>sigul get-public-key centos-5-key > centos-5-key.asc</pre>
* importer dans GPG<pre>gpg --import centos-5-key.asc</pre>
* Lister nos clé GPG<pre>gpg --list-keys</pre>
<pre>
<pre>
# from git repo root
/root/.gnupg/pubring.gpg
cd fedoraproject.org/
------------------------
curl $KEYURL > /tmp/newkey
pub   1024D/773DF357 2013-08-20
$EDITOR update-gpg-keys # Add key ID of recently EOL'd version to obsolete_keys
uid                  CentOS-5-B2PWeb (CentOS 5 B2PWeb Signing Key) <srs@b2pweb.com>
./update-gpg-key /tmp/newkey
sub   2048g/EBC96FF2 2013-08-20
gpg static/fedora.gpg # used to verify the new keyring
# it should look something like this:
# pub  4096R/57BBCCBA 2009-07-29 Fedora (12) <fedora@fedoraproject.org>
# pub 4096R/E8E40FDE 2010-01-19 Fedora (13) <fedora@fedoraproject.org>
# pub  4096R/97A1071F 2010-07-23 Fedora (14) <fedora@fedoraproject.org>
# pub  1024D/217521F6 2007-03-02 Fedora EPEL <epel@fedoraproject.org>
# sub 2048g/B6610DAF 2007-03-02 [expires: 2017-02-27]
# it must only have the two supported versions of fedora, rawhide and EPEL
# also verify that static/$NEWKEY.txt exists
$EDITOR data/content/{keys,verify}.html # see git diff 1840f96~ 1840f96
</pre>
</pre>
 
L'ID de notre clé '''centos-5-key''' est 773DF357
== sigulsign_unsigned ==
<syntaxhighlight lang="diff">
sigulsign_unsigned is the script Release Engineers use to sign content in koji.  This script has a hardcoded list of keys and aliases to the keys that needs to be updated when we create new keys.
Change koji hostname, certificate files and add B2PWeb signing keys
 
diff -u a/sigulsign_unsigned.py b/sigulsign_unsigned.py
Add the key details to the <code>KEYS</code> dictionary near the top of the <code>sigulsign_unsigned.py</code> script. It lives in Release Engineering's git repo at <code>git://git.fedorahosted.org/git/releng</code> in the <code>scripts</code> directory. You will need to know the key ID to insert the correct information:
--- a/sigulsign_unsigned.py 2013-08-21 10:05:57.418032284 +0200
<pre>
+++ b/sigulsign_unsigned.py 2013-08-21 10:13:11.683976970 +0200
$ gpg <key block from sigul get-public-key>
@@ -38,11 +38,11 @@ rpmdict = {}
</pre>
unsigned = []
 
loglevel = ''
== Public Keyservers ==
  passphrase = ''
We upload the key to the public key servers when we create the keys. To do this, we need to get the ascii key block from sigul, determine the key ID, import they key into our local keyring, and then upload it to the key servers.
-KOJIHUB = 'https://koji.fedoraproject.org/kojihub'
 
+KOJIHUB = 'http://koji.b2pweb.com/kojihub'
<pre>
# Should probably set these from a koji config file
$ sigul get-public-key fedora-13 > fedora-13
-SERVERCA = os.path.expanduser('~/.fedora-server-ca.cert')
$ gpg fedora-13 (The ID is the "E8E40FDE" part of 4096R/E8E40FDE)
-CLIENTCA = os.path.expanduser('~/.fedora-upload-ca.cert')
$ gpg --import fedora-13
-CLIENTCERT = os.path.expanduser('~/.fedora.cert')
$ gpg --send-keys E8E40FDE
+SERVERCA = os.path.expanduser('~/.koji/serverca.crt')
</pre>
+CLIENTCA = os.path.expanduser('~/.koji/clientca.crt')
 
+CLIENTCERT = os.path.expanduser('~/.koji/client.pem')
== Mash ==
# Setup a dict of our key names as sigul knows them to the actual key ID
Mash is the tool that composes our nightly trees, and as such it needs to know about the new key. This currently is done by checking mash out from git, editing the rawhide.mash file and sending the patch to the mash upstream.
# that koji would use. We should get this from sigul somehow.
 
KEYS = {'fedora-12-sparc': {'id': 'b3eb779b', 'v3': True},
<pre>
@@ -67,7 +67,9 @@ KEYS = {'fedora-12-sparc': {'id': 'b3eb7
$ git clone git://git.fedorahosted.org/git/mash
        'fedora-10': {'id': '4ebfc273', 'v3': False},
$ cd mash
        'fedora-10-testing': {'id': '0b86274e', 'v3': False},
$ vim configs/rawhide.mash
        'epel-6': {'id': '0608b895', 'v3': True},
<add key to front of keys = line>
-        'epel-5': {'id': '217521f6', 'v3': False}}
$ git commit -m 'Add new key'
+        'epel-5': {'id': '217521f6', 'v3': False},
$ git send-email --to notting@redhat.com HEAD^
+        'centos-5-key' : {'id': '773df357', 'v3': True},
</pre>
+       'centos-6-key' : {'id': 'd3f3c56a', 'v3': True}}
 
Coordinate with Bill Nottingham to get a new build of mash done with the change.
 
== Koji ==
Koji has a garbage collection utility that will find builds that meet criteria to be removed to save space. Part of that criteria has to do with whether or not the build has been signed with a key. If the collection utility doesn't know about a key it will ignore the build. Thus as we create new keys we need to inform the utility of these keys or else builds can pile up. The configuration for the garbage collection lives within puppet.
 
On the puppet server in a clone edit the configs/build/koji-gc.conf file:
<pre>
diff --git a/configs/build/koji-gc.conf b/configs/build/koji-gc.conf
index 8b14704..042ec35 100644
--- a/configs/build/koji-gc.conf
+++ b/configs/build/koji-gc.conf
@@ -11,6 +11,7 @@ key_aliases =
    4EBFC273    fedora-10
    D22E77F2    fedora-11
    57BBCCBA    fedora-12
+   217521F6    fedora-epel
   
   
  unprotected_keys =
  def exit(status):
     fedora-test
     """End the program using status, report any errors"""
@@ -21,6 +22,7 @@ unprotected_keys =
@@ -213,7 +215,7 @@ if not (opts.just_list or opts.just_writ
    fedora-12
    fedora-extras
    redhat-beta
+    fedora-epel
   
   
  server = https://koji.fedoraproject.org/kojihub
  # Reset the KOJIHUB if the target is a secondary arch
weburl = http://koji.fedoraproject.org/koji
  if opts.arch:
@@ -38,6 +40,7 @@ policy =
-   KOJIHUB = 'http://%s.koji.fedoraproject.org/kojihub' % opts.arch
    sig fedora-10 && age < 12 weeks :: keep
+    KOJIHUB = 'http://%s.koji.b2pweb.com/kojihub' % opts.arch
    sig fedora-11 && age < 12 weeks :: keep
# setup the koji session
    sig fedora-12 && age < 12 weeks :: keep
  logging.info('Setting up koji session')
+    sig fedora-epel && age < 12 weeks :: keep
kojisession = koji.ClientSession(KOJIHUB)
</syntaxhighlight>
    #stuff to chuck semi-rapidly
    tag *-testing *-candidate *-override && order >= 2 :: untag
</pre>
In this case the fedora-epel key was added to the list of key aliases, then referenced in the list of unprotected_keys, and finally a policy was created for how long to keep builds signed with this key.
 
Once you've made your change commit and push. The buildsystem will pick up this change the next time puppet refreshes.
 
= Verification =
We can verify that the key was created in sigul, the correct users have access to the key, the key was added to the fedora-release package, that the website was updated with the right key, that sigulsign_unsigned was properly updated, and that the key was successfully updated to the public key servers.
 
== sigul ==
Use the <code>list-keys</code> command to verify that the key was indeed added to sigul:
<pre>
$ sigul list-keys
Administrator's password:  
fedora-10
fedora-10-testing
fedora-11
fedora-12
fedora-13
</pre>
Our new key should be on the list.  This command expects <b>your</b> administrative password.
 
Use the <code>list-key-users</code> command to verify all the signers have access:
<pre>
$ sigul list-key-users fedora-13
Key passphrase:
jkeating
jwboyer
</pre>
This command expects <b>your</b> key passphrase for the key in question.
 
== fedora-release ==
To verify that the key was added to this package correctly, download the latest build from koji and run rpm2cpio on it, then run gpg on the key file:
 
<pre>
$ koji download-build --arch noarch --latest dist-f13 fedora-release
fedora-release.noarch                                  |  39 kB    00:00 ...
 
$ rpm2cpio fedora-release-13-0.3.noarch.rpm |cpio -ivd
./etc/fedora-release
./etc/issue
./etc/issue.net
./etc/pki/rpm-gpg
./etc/pki/rpm-gpg/RPM-GPG-KEY-fedora
./etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-13-primary
./etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-i386
./etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-ppc
./etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-ppc64
./etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-x86_64
./etc/redhat-release
./etc/rpm/macros.dist
./etc/system-release
./etc/system-release-cpe
./etc/yum.repos.d
./etc/yum.repos.d/fedora-rawhide.repo
./etc/yum.repos.d/fedora-updates-testing.repo
./etc/yum.repos.d/fedora-updates.repo
./etc/yum.repos.d/fedora.repo
./usr/share/doc/fedora-release-13
./usr/share/doc/fedora-release-13/GPL
57 blocks
 
$ gpg etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-13-primary
pub  4096R/E8E40FDE 2010-01-19 Fedora (13) <fedora@fedoraproject.org>
</pre>
You may wish to do this in a tempoary directory to make cleaning it up easy.
 
== fedoraproject.org ==
One can simply browse to http://fedoraproject.org/keys to verify that the key has been uploaded.
 
== sigulsign_unsigned ==
The best way to test whether or not the key has been added correctly is to sign a package using the key, like our newly built fedora-release package.
 
<pre>
$ ./sigulsign_unsigned.py fedora-13 fedora-release-13-0.3
Passphrase for fedora-13:
</pre>
The command should exit cleanly.
 
== Public key servers ==
One can use the <code>search-keys</code> command from gpg to locate the key on the public server:
<pre>
$ gpg --search-keys "Fedora (13)"
gpg: searching for "Fedora (13)" from hkp server subkeys.pgp.net
(1) Fedora (13) <fedora@fedoraproject.org>
      4096 bit RSA key E8E40FDE, created: 2010-01-19
...
</pre>
 
== Koji ==
Log into koji01 by way of gateway.fedoraproject.org.
 
Verify that /etc/koji-gc/koji-gc.conf has the new key in it.
 
[[Category:Release Engineering SOPs]]
 
== CDOT Sigul Signing SOP ==
 
The following documents the process to be taken in order to correctly sign packages for Fedora-ARM. Please be sure to follow these steps to the letter, if you have any complications direct your questions to aeboccia on IRC.
 
== Creating A Key ==
If a new key is to be created for the signing process the following step must be taken to do so in compliance with primary arch key generation SOP.
 
From ireland issue the following commands:
 
For example if we wanted to create the Fedora 13 signing key, we would do the following:
<ol>
<li>Create the key using a strong passphrase when prompted
<pre>
$ sigul new-key --key-admin aeboccia --name-real Fedora-ARM \
        --name-comment 14 \
        --name-email fedora@fedoraproject.org fedora-14-arm
</pre></li>
<li>Wait a while for entropy. This can take several minutes.</li>
<li>Grant key access to any users who will be using it to sign packages
<pre>
$ sigul grant-key-access fedora-14-arm aeboccia
</pre>
 
One the key has been created you can continue on to prep for signing.
 
== Signing prep ==
 
For signing, the script sigulsign_unsigned is used. In order to use the new key with the script it's ID must be added.
 
To obtain the ID issue the following on Ireland
<pre>
$ sigul get-public-key > keyblock
$ gpg keyblock
</pre>
From that output on the PUB line copy the Code after the / usually this code starts with a letter for example B207AABC <br />
 
The next step is to add it to the sigulsign_unsigned script.
 
<pre>
$ vi sigulsign_unsigned
 
Under the KEYS section add your new key and name to the line following the previous entries.
 
KEYS = { 'fedora-14-arm': {'id': 'b207aabc', 'v3': True}, <-- Your Entry
        'fedora-13-sparc': {'id': '5bf71b5e', 'v3': True},
        'fedora-12': {'id': '57bbccba', 'v3': True},
        'fedora-13': {'id': 'e8e40fde', 'v3': True},
        'fedora-11': {'id': 'd22e77f2', 'v3': True},
        'fedora-10': {'id': '4ebfc273', 'v3': False},
        'fedora-10-testing': {'id': '0b86274e', 'v3': False},
        'epel-6': {'id': '0608b895', 'v3': True}}
</pre>
 
Close and Save the Script
 
== Signing ==
 
Signing is rather straight forward, be sure to do so in a screen so you can freely leave and come back to check on the progress as it can take much time.
 
<pre>
 
$ screen -t SigulSigning
$ ./sigulsign_unsigned.py -v -v --write-all --inherit --arch=arm --tag=dist-f14 --password=<keypassphrase> fedora-14-arm
 
* The tag option is set to the tag within koji under which all the packages to be signed currently reside.
 
</pre>

Version du 21 août 2013 à 12:44

Sigul

après une installation de Sigul, on peut l'utiliser.

Note.png
Commandes disponible
$ sigul --help-commands
delete-key          Delete a key
modify-key-user     Modify user's key access
list-users          List users
grant-key-access    Grant key access to a user
sign-text           Output a cleartext signature of a text
import-key          Import a key
new-user            Add a user
sign-rpm            Sign a RPM
list-keys           List keys
sign-data           Create a detached signature
revoke-key-access   Revoke key acess from a user
user-info           Show information about a user
change-passphrase   Change key passphrase
list-key-users      List users that can access a key
new-key             Add a key
modify-user         Modify a user
sign-rpms           Sign one or more RPMs
modify-key          Modify a key
delete-user         Delete a user
key-user-info       Show information about user's key access
get-public-key      Output public part of the key

Créer une nouvelle clé

Une fois le client Sigul capable d'envoyer des commandes à <class>Sigul</class>, on peut créer une nouvelle clé nommée centos-5-key. 

sigul new-key --name-real='CentOS-5-B2PWeb' --name-comment='CentOS 5 B2PWeb Signing Key' --name-email='srs@b2pweb.com' --key-admin root centos-5-key
Note.png
Générer beaucoup d'entropie durant le génération de la clé
La génération de la clé nécessite beaucoup d'entropie sur le serveur Sigul. On peut donc occuper le serveur et paradoxalement accélerer la génération de la clé.

La commande suivant génère assez d'entropie pour 2 minutes: 

find / > /dev/null 2>&1
$ sigul new-key --help
usage: client.py new-key [options] key

Add a key

options:
  -h, --help            show this help message and exit
  --key-admin=USER      Initial key administrator
  --name-real=NAME_REAL
                        Real name of key subject
  --name-comment=NAME_COMMENT
                        A comment about of key subject
  --name-email=NAME_EMAIL
                        E-mail of key subject
  --expire-date=YYYY-MM-DD
                        Key expiration date

Import d'une clé existante

sigul import-key 'CentOS-5-B2PWeb' ~/.gnupg/secring.gpg

Changer le nom de la clé

Changer le nom de la clé centos5 en centos-5-key

sigul modify-key --new-name centos-5-key centos5

Ajout d'un utilisateur

  • Ajout d'un utilisateur administrateur
    sigul new-user --admin --with-password didier

Autoriser l'utilisation d'une clé existante à un utilisateur

sigul grant-key-access centos-5-key didier
sigul grant-key-access --help
usage: client.py grant-key-access key user

Grant key access to a user

options:
  -h, --help  show this help message and exit

Modifier la phrase de passe

sigul change-passphrase centos-5-key

sigul change-passphrase --help
usage: client.py change-passphrase key

Change key passphrase

options:
  -h, --help  show this help message and exit

FAQ

FaqQuestion.png
ERROR: I/O error: Unexpected EOF in NSPR
  • Ensure the key directory exists and have good permissions ( owner and group: sigul )
    This path is declared on <path>/etc/sigul/server.conf</path>
    gnupg-home: /var/lib/sigul/server/gnupg
  • Ensure sigul_bridge and sigul_server daemons are running
    systemctl status sigul_server.service && systemctl status sigul_bridge.service
  • Ensure sigul_bridge can connect to sigul_server ( Configure firewall )


FaqQuestion.png
Unknown error on creating key process

When your sigul cert expires, you will need to run: 'certutil -d ~/.sigul -D -n sigul-client-cert' to remove the old cert, then 'sigul-client-setup' to add a new one.

Scripts

sigulsign_unsigned.py

Le script est à récupérer depuis un depôt releng de Fedora via git (git://git.fedorahosted.org/git/releng) ou directement depuis https://git.fedorahosted.org/cgit/releng/tree/scripts/sigulsign_unsigned.py

Avant de pouvoir utiliser ce script magique qui va signer tous les RPM non-signés construit dans le Koji, il est nécessaire de modifier quelques variables:

  • Changer l'URL du HUB Koji (2 fois): KOJIHUB
  • Spécifier nos propres fichiers de certificats: SERVERCA, CLIENTCA, CLIENTCERT
  • Ajout de nos clés de signature: KEYS

Pour obtenir l'ID de nos clés:

  • exporter de la clé
    sigul get-public-key centos-5-key > centos-5-key.asc
  • importer dans GPG
    gpg --import centos-5-key.asc
  • Lister nos clé GPG
    gpg --list-keys
/root/.gnupg/pubring.gpg
------------------------
pub   1024D/773DF357 2013-08-20
uid                  CentOS-5-B2PWeb (CentOS 5 B2PWeb Signing Key) <srs@b2pweb.com>
sub   2048g/EBC96FF2 2013-08-20

L'ID de notre clé centos-5-key est 773DF357 

Change koji hostname, certificate files and add B2PWeb signing keys
diff -u a/sigulsign_unsigned.py b/sigulsign_unsigned.py
--- a/sigulsign_unsigned.py	2013-08-21 10:05:57.418032284 +0200
+++ b/sigulsign_unsigned.py	2013-08-21 10:13:11.683976970 +0200
@@ -38,11 +38,11 @@ rpmdict = {}
 unsigned = []
 loglevel = ''
 passphrase = ''
-KOJIHUB = 'https://koji.fedoraproject.org/kojihub'
+KOJIHUB = 'http://koji.b2pweb.com/kojihub'
 # Should probably set these from a koji config file
-SERVERCA = os.path.expanduser('~/.fedora-server-ca.cert')
-CLIENTCA = os.path.expanduser('~/.fedora-upload-ca.cert')
-CLIENTCERT = os.path.expanduser('~/.fedora.cert')
+SERVERCA = os.path.expanduser('~/.koji/serverca.crt')
+CLIENTCA = os.path.expanduser('~/.koji/clientca.crt')
+CLIENTCERT = os.path.expanduser('~/.koji/client.pem')
 # Setup a dict of our key names as sigul knows them to the actual key ID
 # that koji would use.  We should get this from sigul somehow.
 KEYS = {'fedora-12-sparc': {'id': 'b3eb779b', 'v3': True},
@@ -67,7 +67,9 @@ KEYS = {'fedora-12-sparc': {'id': 'b3eb7
         'fedora-10': {'id': '4ebfc273', 'v3': False},
         'fedora-10-testing': {'id': '0b86274e', 'v3': False},
         'epel-6': {'id': '0608b895', 'v3': True},
-        'epel-5': {'id': '217521f6', 'v3': False}}
+        'epel-5': {'id': '217521f6', 'v3': False},
+        'centos-5-key' : {'id': '773df357', 'v3': True},
+        'centos-6-key' : {'id': 'd3f3c56a', 'v3': True}}
 
 def exit(status):
     """End the program using status, report any errors"""
@@ -213,7 +215,7 @@ if not (opts.just_list or opts.just_writ
 
 # Reset the KOJIHUB if the target is a secondary arch
 if opts.arch:
-    KOJIHUB = 'http://%s.koji.fedoraproject.org/kojihub' % opts.arch
+    KOJIHUB = 'http://%s.koji.b2pweb.com/kojihub' % opts.arch
 # setup the koji session
 logging.info('Setting up koji session')
 kojisession = koji.ClientSession(KOJIHUB)
Récupérée de « https://wikiold.home.tartarefr.eu/index.php?title=Koji/SigulUsing&oldid=1934 »