Re-enable gpgchecks for dnf packages (where public keys are available) #873
Conversation
bertiethorpe
commented
Dec 16, 2025
bertiethorpe
commented
- dnf_repo_timestamps.yml now makes it possible to toggle repo gpgchecks.
- EESSI CVMFS config now pulled from Ark
bertiethorpe
force-pushed
the
feat/ark-eessi-cvmfs-config
branch
from
cc46ea3 to
89fdeac
Compare
environments/common/inventory/group_vars/all/dnf_repo_timestamps.yml
Outdated
Show resolved
Hide resolved
| password: "{{ dnf_repos_password }}" | ||
| gpgcheck: false | ||
| gpgcheck: "{{ repo_values.gpgcheck | default(true) }}" | ||
| gpgkey: "{{ repo_values.gpgkey | default('') }}" |
There was a problem hiding this comment.
If gpgkey isn't provided and gpgcheck is true, that should be an error I think to avoid hard-to-diagnose errors later?
| dest: ./cvmfs-key.gpg | ||
| checksum: "{{ cvmfs_gpg_checksum }}" | ||
| mode: "0644" | ||
| - name: Install CVMFS GPG key |
There was a problem hiding this comment.
So what's different here vs e.g. openhpc where we install/import the key as part as of the dnf_repos role?
There was a problem hiding this comment.
The dnf_repos role can only really install/import keys and write repo files with keys. There are places which call ansible.builtin.dnf which actually determine if gpg keys are used.
So there's two things we need to do:
- Write repo file with keys
- Ensure ansible.builtin.dnf is not run with
disable_gpg_checkon that repo file
Its not really clear to me why we don't need to e.g. import the openhpc key (pre this PR) but we do seem to need to import the rocky ones.
| pulp_timestamp: 20250828T161842 | ||
| repo_file: rocky-extras | ||
| gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9 | ||
| grafana: |
There was a problem hiding this comment.
Need to check grafana. Might e.g. be disabled in the role which enables it.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
