releng

#11003 Question: Is it possible for Pungi to pull from GitLab.com/fedora for Silverblue/Kinoite composes
Closed: It's all good by siosm. Opened by siosm.

Closed: It's all good
Reopen Issue
  • Describe the issue

This is not an issue but more a question that will help us guide our implementation.

We're looking at migrating the workstation-ostree-config repo o GitLab (somewhere under the Fedora namespace) to be able to more easily setup CI.

This is tracked in https://github.com/fedora-silverblue/issue-tracker/issues/334.

Once we've done that, we will have two options:
- Change Fedora's Pungi configuration to pull from the new location: https://pagure.io/pungi-fedora/blob/main/f/fedora.conf#_797
- If the above is not possible, setup the internal Pagure repo as a mirror of the one in GitLab.

Thus the questions is: Is it possible for Fedora's Pungi to pull from GitLab.com/fedora for Silverblue/Kinoite composes or do we have to setup mirroring?

  • When do you need this? (YYYY/MM/DD)

No timeline.

  • When is this no longer needed or useful? (YYYY/MM/DD)

N/A

  • If we cannot complete your request, what is the impact?

N/A

CC @tpopela

Currently... it is not possible.

But we could add it.

It would need changes to allowed scms in the kojid config: https://pagure.io/fedora-infra/ansible/blob/main/f/roles/koji_builder/templates/kojid.conf#_81

And also changes to the builder's firewalls to allow them to reach it over the net.

I think this is doable, but we want to make sure we don't open all of gitlab, only specific repos.

Should we keep this open to track that work? or close it since the question was answered?
:)

Interesting. Would adding https://gitlab.com/fedora/* or something more precise would work there?

We can close this one. Thanks!

Metadata Update from @siosm:
- Issue close_status updated to: It's all good
- Issue status updated to: Closed (was: Open)

I would think we would want to be more precise than that... only subprojects that specifically needed to used.

We're investigating doing more Fedora CoreOS like things in Fedora pungi directly, and honestly I really do not want to have pagure be a load-bearing part of my day to day life. Needing to understand both gitlab and github is already a high burden (but one I'm willing to pay). Expanding from 2 to 3 is even more.

That said, at a practical level what may work right now is to have a repo in gitlab.com/fedora be canonical, and set up automation to mirror it into pagure.

The workstation-ostree-config repo is cloned by Pungi running on the compose host. Does that also have such restrictive network policy?

The parts that run on the Koji builder in the runroot task do not need any network access to the repository, because it has already been prepared on the filesystem.

Example task: https://koji.fedoraproject.org/koji/taskinfo?taskID=105893268

Yeah, the compose hosts should be able to pull from whatever is needed.

I understand wanting to put more things in one place.

We can setup the mirroring if desired. I have no problems with that...

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.