releng

#9126 create detached signatures for the ignition 2.1.1 and 0.34.0 releases
Closed: Fixed by dustymabe. Opened by dustymabe.

Closed: Fixed
Reopen Issue

As part of https://pagure.io/releng/issue/9057 we are going to be creating detached signatures for binaries that we upload to github for ignition releases. We have figured out how to build everything we need in koji. Now we need to get the detached signatures. Here is a small script to grab all of the rpms and the files out of the rpms and name them appropriately:

#!/bin/bash
set -eux -o pipefail
# Use the Fedora 31 key for the detached signatures
KEYTOSIGNWITH='fedora-31'
VR='2.1.1-3.git40c0b57.fc31'
RPMKEY='3c3359c4' # Fedora 31 key
ARCHES='x86_64 aarch64 ppc64le s390x'
#VR='0.34.0-1.git92f874c.el7'
#RPMKEY='352c64e5' # EPEL 7 key (for legacy branch releases)
#ARCHES='x86_64 ppc64le'
# Grab the windows/mac binaries out of the nonlinux rpm
arch="x86_64"
rpm="ignition-validate-nonlinux-${VR}.${arch}.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -qip $rpm | grep -P "^Signature.*${RPMKEY}$" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv ./usr/bin/ignition-validate-darwin ./usr/bin/ignition-validate-windows
mv ./usr/bin/ignition-validate-darwin ./ignition-validate-${arch}-apple-darwin
mv ./usr/bin/ignition-validate-windows ./ignition-validate-${arch}-windows
sigul sign-data -a $KEYTOSIGNWITH ./ignition-validate-${arch}-apple-darwin -o ./ignition-validate-${arch}-apple-darwin.asc
sigul sign-data -a $KEYTOSIGNWITH ./ignition-validate-${arch}-windows -o ./ignition-validate-${arch}-windows.asc 
rm $rpm; rmdir ./usr/bin; rmdir ./usr
# Grab the linux binary for a few arches we care about
for arch in $ARCHES; do
    mkdir $arch; pushd $arch
    rpm="ignition-validate-${VR}.${arch}.rpm"
    outfile="ignition-validate-${arch}-linux"
    koji download-build --key $RPMKEY --rpm $rpm
    rpm -qip $rpm | grep $RPMKEY # Verify the output has the key in it
    rpm2cpio "${rpm}" | cpio -idv ./usr/bin/ignition-validate
    mv ./usr/bin/ignition-validate "../${outfile}"
    # Add detached signature step here using $KEYTOSIGNWITH
    rm "${rpm}"; rmdir ./usr/bin; rmdir ./usr
    popd; rmdir $arch
    sigul sign-data -a $KEYTOSIGNWITH "./${outfile}" -o "./${outfile}.asc"
done

After running this you should end up with a directory with files in it like:

$ ls -1
ignition-validate-aarch64-linux
ignition-validate-ppc64le-linux
ignition-validate-s390x-linux
ignition-validate-x86_64-apple-darwin
ignition-validate-x86_64-linux
ignition-validate-x86_64-windows

Please run this once with the VR=2.1.1-3.git40c0b57.fc31 variables uncommented and once in a separate directory with the VR=0.34.0-1.git92f874c.el7 variables uncommented..

note that we plan to automate this process in the future. See the discussion in https://pagure.io/releng/issue/9057 and https://github.com/coreos/fedora-coreos-tracker/issues/335 for more details.

Thanks @mohanboddu for helping us out with this. This has been done and the signatures can be found at https://github.com/coreos/ignition/releases/tag/v2.1.1 and https://github.com/coreos/ignition/releases/tag/v0.34.0

Metadata Update from @dustymabe:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.