infra/ansible
22
7
Fork 56
Code Pull requests 7 Activity Actions

epel10-infra: add new signing key
All checks were successful
Differential yamllint / yamllint-job (push) Successful in 8s
Details

Browse source 
The old key we were using for old releases had some sha1 in it
somewhere, so rhel10 rejects it (great!). So, lets use a newly generated
key that is acceptable to rhel10 and much nicer.

This adds the public key file, the repos that use that file, the rhel10
post kickstart that sets up the repo, robosignatory to sign epel10-infra
stuff with this new key and finally on rhel10 hosts put the new repo in
place.

Note that this only changes the rhel10 setup, all rhel8/9 machines are
still using the old key. We may want to move them over, or just not care
as we retire all of them.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2026-07-09 14:50:07 -07:00
commit a326adbb30
6 changed files with 54 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/robosignatory/templates/robosignatory.toml.j2
View file

@ -109,8 +109,8 @@ handlers = ["console"]
[[consumer_config.koji_instances.primary.tags]]
from = "epel10-infra-candidate"
to = "epel10-infra-stg"
key = "{{ (env == 'production')|ternary('fedora-infra', 'testkey') }}"
keyid = "{{ (env == 'production')|ternary('47dd8ef9', 'd300e724') }}"
key = "{{ (env == 'production')|ternary('fedora-infra-20260709', 'testkey') }}"
keyid = "{{ (env == 'production')|ternary('01d83fc4', 'd300e724') }}"
[[consumer_config.koji_instances.primary.tags]]
from = "f43-infra-candidate"