Pulp

Ticket moved to GitHub: "pulp/pulpcore/2036":https://github.com/pulp/pulpcore/issues/2036

On Pulp2, if GPG signing of repo metadata is enabled per https://docs.pulpproject.org/en/2.21/plugins/pulp_rpm/tech-reference/yum-plugins.html#gpg-signing-of-repository-metadata , but signing fails for any reason, yum publish incorrectly succeeds.

This is wrong - if signing is enabled, it's a mandatory part of the publish process and failures should cause the entire publish to fail.

Steps to reproduce¶

• Enable repodata signing by setting "gpg_sign_metadata": true for a repo
• Ensure configuration is such that signing will fail (e.g. don't set up any secret key)
• Publish repo

Actual behavior¶

Signing fails, but publish task for repo is marked successful, as in example:

Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344) Finalizing failed
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344) Traceback (most recent call last):
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)   File "/usr/lib/python2.7/site-packages/pulp/plugins/util/publish_step.py", line 265, in process
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)     self.finalize()
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)   File "/usr/lib/python2.7/site-packages/pulp_rpm/plugins/distributors/yum/publish.py", line 416, in finalize
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)     self.parent.repomd_file_context.finalize()
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)   File "/usr/lib/python2.7/site-packages/pulp_rpm/plugins/distributors/yum/metadata/repomd.py", line 49, in finalize
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)     signer.sign(self.metadata_file_path)
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)   File "/usr/lib/python2.7/site-packages/pulp_rpm/yum_plugin/util.py", line 327, in sign
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344)     stdout=stdout, stderr=stderr)
Aug  3 23:32:40 rhsm-pulp04 pulp: pulp.plugins.util.publish_step:ERROR: [4a67d40b] (4703-09344) SignerError: Return code: 2
Aug  3 23:32:41 rhsm-pulp04 pulp: celery.app.trace:INFO: [4a67d40b] Task pulp.server.managers.repo.publish.publish[4a67d40b-9a78-4e05-970b-f8851d623d0b] succeeded in 0.957519632997s: {'exception': None, 'repo_id': 'satellite-tools-6_DOT_8-for-rhel-8-x86_64-eus-rpms__8_DOT_1', 'traceback': None, 'started': datetime.datetime(2021, 8, 3, 23, 32, 40, 226116, tzinfo=<isodate.tzinfo.Utc object at 0x7f1edc27a710>), '_ns': 'repo_publish_results', 'completed': datetime.datetime(2021, 8, 3, 23, 32, 41, 155973, tzinfo=<isodate.tzinfo.Utc object at 0x7f1edc27a710>), 'error_message': None, 'distributor_type_id': 'yum_distributor', 'distributor_id': 'yum_distributor', 'summary': {'generate sqlite': 'FINISHED', 'initialize_repo_metadata': 'FINISHED', 'remove_old_repodata': 'FINISHED', 'rpms': 'FINISHED', 'modules': 'SKIPPED', 'close_repo_metadata': 'FINISHED', 'drpms': 'SKIPPED', 'comps': 'FINISHED', 'distribution': 'FINISHED', 'repoview': 'SKIPPED', 'publish_directory': 'FINISHED', 'errata': 'FINISHED', 'metadata': 'FINISHED'}, 'result': 'success', 'id': '6109d219d822f2125ffc3bcf', 'details': [{'num_processed': 1, 'items_total': 1, 'state': 'FINISHED', 'num_success': 1, 'error_details': [...], 'descript...', ...}]}

Expected behavior¶

Signing fails, and publish task for repo fails.

Additional info¶

There's code here which catches all exceptions from finalize and doesn't re-raise them or mark the task as failed: https://github.com/pulp/pulp/blob/f84198bb4cb9aaf233e8c4d9208ec7ee9df9790c/server/pulp/plugins/util/publish_step.py#L262

I've filed this as relating to signing since that's where the issue is relevant to me, but the above code seems like it could cause tasks to be incorrectly marked as successful in many other error cases as well, e.g. an I/O error when trying to close the repomd.xml file normally.