Project

Profile

Help

Issue #9206

Repodata signing is broken if sqlite is enabled

Added by rmcgover about 2 months ago. Updated about 9 hours ago.

Status:
NEW
Priority:
Normal
Assignee:
-
Sprint/Milestone:
-
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version:
2.21.1
Platform Release:
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Sprint 106
Quarter:

Description

In Pulp2, if a repo has repodata signing enabled via gpg_sign_metadata: true, and also has sqlite enabled via generate_sqlite: true, then the published signatures are invalid.

Steps to reproduce

Actual behavior

Signature verification fails.

Expected behavior

Signature verification succeeds.

Additional info

It's broken because the signing occurs on an intermediate version of repomd.xml rather than the final form.

It can be easily observed by inspection of the publish steps in BaseYumRepoPublisher: https://github.com/pulp/pulp_rpm/blob/5c5a7dcc058b29d89b3a913d29cfcab41db96686/plugins/pulp_rpm/plugins/distributors/yum/publish.py#L46

Here's the last few steps of that publisher, with added comments:

        self.add_child(PublishModulesStep())
        self.add_child(PublishCompsStep())
        self.add_child(PublishMetadataStep())
        self.add_child(CloseRepoMetadataStep())  # finalizes repomd.xml and creates repomd.xml.asc
        self.add_child(GenerateSqliteForRepoStep(self.get_working_dir()))  # rewrites repomd.xml to add sqlite, invalidating signature
        self.add_child(RemoveOldRepodataStep())

Though CloseRepoMetadataStep treats repomd.xml as "final" and ready for signing, if generate_sqlite is enabled then the very next step will overwrite repomd.xml with different content (generated by sqliterepo_c command) and will not redo the signing, meaning the signature will never be correct.

History

#1 Updated by dalley about 2 months ago

  • Triaged changed from No to Yes
  • Sprint set to Sprint 102

#2 Updated by rchan about 1 month ago

  • Sprint changed from Sprint 102 to Sprint 103

#3 Updated by rchan 28 days ago

  • Sprint changed from Sprint 103 to Sprint 104

#4 Updated by rchan 14 days ago

  • Sprint changed from Sprint 104 to Sprint 105

#5 Updated by rchan about 9 hours ago

  • Sprint changed from Sprint 105 to Sprint 106

Please register to edit this issue

Also available in: Atom PDF