koji

#4147 [1.34.0] rpm signing feature broken
Opened by frank-mdc. Modified

Open
Close Issue

It looks like the function for signing RPM packages is defective. If you change the settings as described under:
https://docs.pagure.org/koji/using_the_koji_build_system/
in the "mock signing plugin" section, the packages are created and signed, but the build process is marked as failed.
The error then appears in the log:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/koji/daemon.py", line 1494, in runTask
    response = (handler.run(),)
  File "/usr/lib/python3.6/site-packages/koji/tasks.py", line 335, in run
    return koji.util.call_with_argcheck(self.handler, self.params, self.opts)
  File "/usr/lib/python3.6/site-packages/koji/util.py", line 271, in call_with_argcheck
    return func(*args, **kwargs)
  File "/usr/sbin/kojid", line 1587, in handler
    d = koji.rpmdiff.Rpmdiff(fpath, fpath, ignore='S5TN')
  File "/usr/lib/python3.6/site-packages/koji/rpmdiff.py", line 96, in __init__
    old = self.__load_pkg(old)
  File "/usr/lib/python3.6/site-packages/koji/rpmdiff.py", line 171, in __load_pkg
    hdr = ts.hdrFromFdno(f)
  File "/usr/lib64/python3.6/site-packages/rpm/transaction.py", line 186, in hdrFromFdno
    raise rpm.error("public key not available")
_rpm.error: public key not available

The cause of the problem is that koji tries to read the used public key from the RPM database of the host system. Because if you use :

rpm --import <Path to the public key>

once on the host, it works.

Metadata Update from @tkopecek:
- Custom field Size adjusted to None
- Issue set to the milestone: 1.36

Metadata Update from @tkopecek:
- Issue tagged with: bug

Is this a Koji problem or a deficiency of the mock plugin?

Breadcrumbs: issue #84 PR #1932

This is less of a Koji feature and more of a mock feature that Koji provides limited enablement for. Koji itself does not provide an rpm signing feature, just the ability to import rpm signatures.

The referenced doc does warn, "Note, that these tools are run outside of the jailed env," which seems the be the crux of the problem you have.

Signing rpms in this way is very kludgy and limited. It might work for some users in some circustances, but it is a hassle to configure and I would not recommend it in general.

As far as I understand the code, in line 169 of the file koji/rpmdiff.py a compatibility function is called instead of TransactionSet. There is an option in the TransactionSet, rpm.RPMVSF_MASK_NOSIGNATURES (according to the C source code). This should solve the problem.
But I can't say what the side effects are. Since __load_pkg from the file koji/rpmdiff.py is probably used by other places.

Metadata Update from @mikem:
- Issue set to the milestone: None (was: 1.36)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/4147

Please continue any further discussion there.
Metadata
None

bug

None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.