fesco

#2887 move IMA RPM file-signature change to F38?
Closed: Accepted by zbyszek. Opened by fche.

Closed: Accepted
Reopen Issue

There is question whether the F37 accepted change [1] is ready. Months ago, questions were raised whether F37 RPMs were indeed released with rpmsign --signfiles [2], with no responses. The associated fedora-releng issue was closed without addressing this point [3]. There appear to be no release notes and no operational instructions to let users see the signatures, let alone verify them, on the packages koji is brewing up for us. I'm not sure what's going on - it's probably just a glitch somewhere. But without evidence that this data is even going out, it seems premature to announce it as a F37 feature. Perhaps this should be pushed back to F38?

[1] https://fedoraproject.org/wiki/Changes/Signed_RPM_Contents
[2] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/4TU5F7YTPPU7SDU6MZBLU6YEHIPGV4AQ/
[3] https://pagure.io/releng/issue/10731
[4] https://pagure.io/fedora-docs/release-notes/issue/819

This doesn't seem to have happened.

/cc @puiterwijk, @pbrobinson

@kevin: you wrote in https://pagure.io/releng/issue/10731#comment-808158 that the signatures are there… Is that (still?) true?

It has happened, there's a few bits needed to be cleaned up.

What bits?

I don't have time to write out everything, but one is the publishing of the pub key in a cert. We had some team changes and a few things fell through the gaps, i became aware of that two weeks ago but have had PTO and other things so haven't had time to fully follow up yet.

Hmm, but can you comment on the fact that:
- getfattr -d -m security.ima yields nothing with rpm-plugin-ima installed
- rpm -q --qf='%{FILESIGNATURES}\n' also yields (none)

This doesn't seem to have happened.

/cc @puiterwijk, @pbrobinson

@kevin: you wrote in https://pagure.io/releng/issue/10731#comment-808158 that the signatures are there… Is that (still?) true?

I'm afraid I don't have any special insight here. The signing server claims to be signing IMA, but perhaps there is something going wrong somewhere. :( Hopefully we can sort it out..

Metadata Update from @zbyszek:
- Issue tagged with: meeting

This will be discussed during today's meeting at 17:00 UTC.

This was discussed during today's meeting:
AGREED: Change doesn't seem to have been implemented. It can be resubmitted for F38 with more details (+6, 0, 0)

Metadata Update from @zbyszek:
- Issue close_status updated to: Rejected
- Issue status updated to: Closed (was: Open)

Metadata Update from @zbyszek:
- Issue untagged with: meeting
- Issue status updated to: Open (was: Closed)

Metadata Update from @zbyszek:
- Issue close_status updated to: Accepted
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.