Debian Support

the original REST request I do for creating the publication is:

curl
--location
--request
POST
http://cppfw.hopto.org/pulp/api/v3/publications/deb/apt/
--user
*****
--header
Content-Type: application/json
--data
{"repository":"http://cppfw.hopto.org/pulp/api/v3/repositories/deb/apt/f0f0d008-b093-4a84-bf41-48c2df0e99ca/","simple":true,"signing_service":"http://cppfw.hopto.org/pulp/api/v3/signing-services/f204bdc9-2c5c-4963-b5a9-75dae6f4960d/"}

When running the pulpcore manager command, did you use the --class "pulp_deb:AptReleaseSigningService" option, because I think it will default to "core:AsciiArmoredDetachedSigningService", which is not what you need for pulp_deb.

Note: I have never used pulpcore manager to create my signing services, so I am not sure if I am interpreting the --class options syntax correctly... See here for more info: https://github.com/pulp/pulpcore/blob/master/pulpcore/app/management/commands/add-signing-service.py

I'm also seeing the behavior @igagis describes.

openapi_client.exceptions.ApiException: (400)
Reason: Bad Request
HTTP response headers: HTTPHeaderDict({'Date': 'Wed, 14 Jul 2021 08:15:55 GMT', 'Content-Type': 'application/json', 'Content-Length': '66', 'Connection': 'keep-alive', 'Vary': 'Accept', 'Allow': 'GET, POST, HEAD, OPTIONS', 'X-Frame-Options': 'SAMEORIGIN', 'Correlation-ID': '897ba59380c24f74baf219541438a333', 'Access-Control-Expose-Headers': 'Correlation-ID', 'Strict-Transport-Security': 'max-age=15724800; includeSubDomains'})
HTTP response body: {"signing_service":["Invalid hyperlink - Object does not exist."]}

Is there a way to figure out which SigningService was used?

I cannot reproduce this issue, so I will post my entire procedure in the hope that this will help you either fix your issue or further describe what is different in your case.

To create my signing service using the Pulp QE GPG key (the secret key is publicly available), I am using the following:

curl -L https://github.com/pulp/pulp-fixtures/raw/master/common/GPG-PRIVATE-KEY-pulp-qe | gpg --import
echo "6EDF301256480B9B801EBA3D05A5E6DA269D9D98:6:" | gpg --import-ownertrust
pulpcore-manager add-signing-service --class 'deb:AptReleaseSigningService' 'Pulp QE' pulp_deb/pulp_deb/tests/functional/sign_deb_release.sh 6EDF301256480B9B801EBA3D05A5E6DA269D9D98
SIGNING_SERVICE_HREF=$(http get "${BASE_ADDR}/pulp/api/v3/signing-services/ name="Pulp QE" | jq '.results[0].pulp_href' | tr -d '"')

The signing service script is the one from the pulp_deb Git repo. You will need to set BASE_ADDR="<your_pulp_instance_url>" (e.g.: for my test system it is http://pulp3-source-fedora33.qatix71.example.com) for the above to work, and you need httpie and jq installed.

When I am ready to create my publication I use:

PUBLICATION_TASK_HREF=$(http post "${BASE_ADDR}"/pulp/api/v3/publications/deb/apt/ repository="${REPO_HREF}" simple=true structured=true signing_service="${BASE_ADDR}${SIGNING_SERVICE_HREF}" | jq -r '.task')

This requires REPO_HREF to contain the repo href of the Pulp deb repo I want to publish.

I can check on the task using:

http get "${BASE_ADDR}${PUBLICATION_TASK_HREF}" | jq '.state'

Using these steps, everything works for me.

Thanks for the update quba42. I'll follow your instructions and see if I can get it to work.

quba42 Unfortuantely the same issue prevails.

 http ${BASE_ADDR}pulp/api/v3/publications/deb/apt/ repository=/pulp/api/v3/repositories/deb/apt/84ef2ab7-d8ad-4695-895e-614abc3aa25a/  simple=true signing_service=${BASE_ADDR}pulp/api/v3/signing-services/9aa302f7-0b7e-444d-a66f-281ba509afc3/  --auth <removed>


{
    "signing_service": [
        "Invalid hyperlink - Object does not exist."
    ]
}

but I can see my signing_service

http ${BASE_ADDR}pulp/api/v3/signing-services/9aa302f7-0b7e-444d-a66f-281ba509afc3/

{
    "name": "sign-metadata-v1-XXXXXXXXX",
    "pubkey_fingerprint": "C9CDB2D2F029FAE51568B2E12CAC36C51D5F3726",
...
}

@jxsxs Do you remember the command that was used to create your signing service?

One thing you can try on a hunch of mine: Try having the URL you supply for the signing service (signing_service=${BASE_ADDR}pulp/api/v3/signing-services/9aa302f7-0b7e-444d-a66f-281ba509afc3/) start with https:// (even if your pulp instance has HTTPS disabled). I think I did that on my test system and it worked. I have no idea why this should make a difference, but it can't hurt to try. Instead of ${BASE_ADDR}, just hard code the entire URL, starting with https://.

My instance is configured for https and that's what I use as BASE_ADDR. I tried to force http by changing the URL but that just redirects me (as anticipated).

Do you remember the command that was used to create your signing service?

I can dig that up

quba42 turns out we're using the AsciiArmoredDetachedSigningService. I can report if chaning that to AptReleaseSigningService fixes the issue.

An nicer error message would avoid confusion I guess :)

Using the wrong signing service class can't work, though I agree that the symptoms are not very informative of what went wrong. I will keep this issue open as a reminder to find a way to provide an informative error message in such cases.

I should also improve the documentation on creating APT repo signing services. With the pulpcore-manager command it is now somewhat easier than it used to be...

If I get the following PR merged: https://github.com/pulp/pulpcore/pull/1696

It will also be possible to provide a completely generic APT repo signing service example script. (The current one from the pulp_deb tests is hard coded for a specific GPG key...)