Skip to content

Commit a58ec60

Browse files
LalufuLalufu
authored
Rework RPM signing key handling (#75)
This is an attempt to address openzfs/zfs#14344. It reworks the zfs-release RPM to * Always include all signing keys that are in active use on any release * Provide versioned symlinks for the supported releases, pointing to the appropriate key * Modifies the .repo files to point to a versioned symlink by utilizing the $releasever variable provided by yum/dnf This will allow smooth key transitions between different major releases. The same mechanism is used by other major repos, including Fedora itself. Signed-off-by: Ralf Ertzinger <ralf@skytale.net> Reviewed-by: Tony Hutter <hutter2@llnl.gov>
1 parent b65c273 commit a58ec60

4 files changed

Lines changed: 46 additions & 27 deletions

File tree

‎zfs-release/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ The released zfs-release RPMs should be checked into the top level
1313
the Fedora RPMs on Fedora, and the EPEL RPMs on a RHEL derivative, as
1414
the SPEC file does different things depending on the OS it's built upon.
1515

16+
### Updating ###
17+
Whenever a new Fedora (or EL) release is near, the `zfs-release` package
18+
should be rebuilt to include the proper symlink for the new release,
19+
pointing to the proper key.
20+
1621
### Keys ###
1722
`RPM-GPG-KEY-openzfs-key1` - Older key used to sign packages for Fedora 36
1823
(and older) and EL 6-8. It's header is encoded with SHA1, and thus is not

‎zfs-release/zfs-el.repo‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,42 +4,42 @@ baseurl=http://download.zfsonlinux.org/epel/$releasever/$basearch/
44
enabled=1
55
metadata_expire=7d
66
gpgcheck=1
7-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
7+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-$releasever
88

99
[zfs-kmod]
1010
name=ZFS on Linux for EL$releasever - kmod
1111
baseurl=http://download.zfsonlinux.org/epel/$releasever/kmod/$basearch/
1212
enabled=0
1313
metadata_expire=7d
1414
gpgcheck=1
15-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
15+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-$releasever
1616

1717
[zfs-source]
1818
name=ZFS on Linux for EL$releasever - Source
1919
baseurl=http://download.zfsonlinux.org/epel/$releasever/SRPMS/
2020
enabled=0
2121
gpgcheck=1
22-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
22+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-$releasever
2323

2424
[zfs-testing]
2525
name=ZFS on Linux for EL$releasever - dkms - Testing
2626
baseurl=http://download.zfsonlinux.org/epel-testing/$releasever/$basearch/
2727
enabled=0
2828
metadata_expire=7d
2929
gpgcheck=1
30-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
30+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-$releasever
3131

3232
[zfs-testing-kmod]
3333
name=ZFS on Linux for EL$releasever - kmod - Testing
3434
baseurl=http://download.zfsonlinux.org/epel-testing/$releasever/kmod/$basearch/
3535
enabled=0
3636
metadata_expire=7d
3737
gpgcheck=1
38-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
38+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-$releasever
3939

4040
[zfs-testing-source]
4141
name=ZFS on Linux for EL$releasever - Testing Source
4242
baseurl=http://download.zfsonlinux.org/epel-testing/$releasever/SRPMS/
4343
enabled=0
4444
gpgcheck=1
45-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
45+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-$releasever

‎zfs-release/zfs-fedora.repo‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,26 @@ baseurl=http://download.zfsonlinux.org/fedora/$releasever/$basearch/
44
enabled=1
55
metadata_expire=7d
66
gpgcheck=1
7-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
7+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-$releasever
88

99
[zfs-source]
1010
name=ZFS on Linux for Fedora $releasever - Source
1111
baseurl=http://download.zfsonlinux.org/fedora/$releasever/SRPMS/
1212
enabled=0
1313
gpgcheck=1
14-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
14+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-$releasever
1515

1616
[zfs-testing]
1717
name=ZFS on Linux for Fedora $releasever - Testing
1818
baseurl=http://download.zfsonlinux.org/fedora-testing/$releasever/$basearch/
1919
enabled=0
2020
metadata_expire=7d
2121
gpgcheck=1
22-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
22+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-$releasever
2323

2424
[zfs-testing-source]
2525
name=ZFS on Linux for Fedora $releasever - Testing Source
2626
baseurl=http://download.zfsonlinux.org/fedora-testing/$releasever/SRPMS/
2727
enabled=0
2828
gpgcheck=1
29-
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs
29+
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-$releasever

‎zfs-release/zfs-release.spec‎

Lines changed: 31 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
Name: zfs-release
1010
Version: 2
11-
Release: 2%{dist}
11+
Release: 3%{dist}
1212
Summary: OpenZFS Repository Configuration
1313

1414
Group: System Environment/Base
@@ -20,8 +20,7 @@ Source10: RPM-GPG-KEY-openzfs-key1
2020
Source11: RPM-GPG-KEY-openzfs-key2
2121
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
2222
BuildArch: noarch
23-
Obsoletes: zfs-release <= %{version}-%{release}
24-
Obsoletes: zfs-release-%{osname} <= %{version}-%{release}
23+
Obsoletes: zfs-release-%{osname} <= 2-1
2524
Provides: zfs-release = %{version}-%{release}
2625

2726
# We have two GPG keys -
@@ -32,18 +31,6 @@ Provides: zfs-release = %{version}-%{release}
3231
# RPM-GPG-KEY-openzfs-key2:
3332
# Newer, SHA512-encoded key used on RHEL 9+ and Fedora 37+. RHEL 9
3433
# no longer allows SHA1 RPM keys by default.
35-
#
36-
# We install the correct one depending on the distro version.
37-
#
38-
%if 0%{?rhel} && 0%{?rhel} < 9
39-
%global rpmkey %{SOURCE10}
40-
%else
41-
%if 0%{?fedora} && 0%{?fedora} < 37
42-
%global rpmkey %{SOURCE10}
43-
%else
44-
%global rpmkey %{SOURCE11}
45-
%endif
46-
%endif
4734

4835
# RHEL 9 defaults to using zstd for RPM compression. Unfortunately, CentOS 7
4936
# does not support zstd, so force gzip compression for compatibility.
@@ -69,8 +56,32 @@ install -d -m755 \
6956
$RPM_BUILD_ROOT%{_sysconfdir}/yum.repos.d
7057

7158
# GPG Key
72-
%{__install} -Dp -m644 %{rpmkey} \
73-
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs
59+
%{__install} -Dp -m644 %{SOURCE10} \
60+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-2013
61+
%{__install} -Dp -m644 %{SOURCE11} \
62+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-2022
63+
64+
# Create symlinks to the appropriate keys
65+
%if 0%{?rhel}
66+
ln -s RPM-GPG-KEY-openzfs-2013 \
67+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-6
68+
ln -s RPM-GPG-KEY-openzfs-2013 \
69+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-7
70+
ln -s RPM-GPG-KEY-openzfs-2013 \
71+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-8
72+
ln -s RPM-GPG-KEY-openzfs-2022 \
73+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-el-9
74+
%endif
75+
%if 0%{?fedora}
76+
ln -s RPM-GPG-KEY-openzfs-2013 \
77+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-35
78+
ln -s RPM-GPG-KEY-openzfs-2013 \
79+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-36
80+
ln -s RPM-GPG-KEY-openzfs-2022 \
81+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-37
82+
ln -s RPM-GPG-KEY-openzfs-2022 \
83+
$RPM_BUILD_ROOT%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-openzfs-fedora-38
84+
%endif
7485

7586
# Yum .repo files
7687
%{__install} -p -m644 zfs-%{osname}.repo \
@@ -87,6 +98,9 @@ rm -rf $RPM_BUILD_ROOT
8798
%post
8899

89100
%changelog
101+
* Tue Jan 03 2023 Ralf Ertzinger <ralf@skytale.net> - 2-3
102+
- Rework key and repo files to allow dynamic (by $releasever variable)
103+
selection of correct signing keys. This allows major version upgrades
90104
* Mon Jul 25 2022 Tony Hutter <hutter2@llnl.gov> - 2-2
91105
- Add newer, SHA512-encoded, RPM-GPG-KEY-openzfs-key2 key.
92106
- Add "Obsoletes" and "Provides" sections.

0 commit comments

Comments
 (0)