2.8 KiB
Koji Plugins used by Koozali in our setup
To install these plugins:
Copy the tag2distrepo.py and sign.py programs into /usr/lib/koji-hub-plugins
Set the configurations as per the directions for each plugin below
Edit the following settings in /etc/koji-hub/hub.conf to enable the plugins:
PluginPath = /usr/lib/koji-hub-plugins
Plugins = tag2distrepo sign
Reload Apache
systemctl reload httpd
koji-plugin-sign
Automagically sign rpms with our key after successful build
This is a slightly modified version of the OSG Software Teams koji-hub plugin which can be found at https://github.com/osg-htc/koji-plugin-sign
This plugin requires the pexpect python module to be installed
Make sure that the koji-sign selinux policy is installed and enabled
semodule --list-modules=full | grep koji-sign
If it's not listed, copy down the koji-sign.te file, compile and install it
checkmodule -M -m -o koji-sign.mod koji-sign.te
semodule_package -o koji-sign.pp -m koji-sign.mod
semodule -X 300 -i koji-sign.pp
Copy your gpg keys etc. into /etc/koji-hub/plugins/gnupg/
Change the ownership of the gnupg directory and all contents to the apache user
sudo chown -R apache:apache /etc/koji-hub/plugins/gnupg
Copy sign.conf into /etc/koji-hub/plugins/.
Change the ownership of the sign.conf file to the apache user
sudo chown apache:apache /etc/koji-hub/plugins/sign.conf
Edit /etc/koji-hub/plugins/sign.conf to have the correct gpg key names for each tag and set enabled, when ready
tag2distrepo
This is a koji-hub plugin available in the default koji installation, but we have modified it slightly to allow the missing signature options
It will create an external repository for any tag when a new build is completed in, or a build is attached to (tag-build) a tag
Set the extra options on the tag so the plugin will generate the repository: (missing signature options ar optional)
koji edit-tag -x tag2distrepo.enabled=True -x tag2distrepo.keys='44922a28' smecontribs11
koji edit-tag -x tag2distrepo.skip_missing_signatures=True -x tag2distrepo.allow_missing_signatures=True smecontribs11
Where ONLY those rpms signed with that key will be included in the generated external repository
You can check by doing:
koji taginfo smecontribs11
and you should see
Tag: smecontribs11 [38]
Arches: x86_64
Groups:
Tag options:
mock.bootstrap_image : 'rockylinux:8'
mock.package_manager : 'dnf'
rpm.macro.dist : '.el8.sme'
rpm.macro.distribution : 'SME Server v11'
rpm.macro.packager : 'Koozali.org <http://www.koozali.org>'
rpm.macro.vendor : 'Koozali.org <http://www.koozali.org>'
tag2distrepo : '44922a28'
tag2distrepo.enabled : True
Inheritance: