epel10-infra: add new signing key

The old key we were using for old releases had some sha1 in it
somewhere, so rhel10 rejects it (great!). So, lets use a newly generated
key that is acceptable to rhel10 and much nicer.

This adds the public key file, the repos that use that file, the rhel10
post kickstart that sets up the repo, robosignatory to sign epel10-infra
stuff with this new key and finally on rhel10 hosts put the new repo in
place.

Note that this only changes the rhel10 setup, all rhel8/9 machines are
still using the old key. We may want to move them over, or just not care
as we retire all of them.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

files/common/RPM-GPG-KEY-INFRASTRUCTURE-SIGUL-20260709

@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGpQExgBEADP5+9qybH7gg2aapWmy7dBLL64j45ALFyYtZCFprsFALW4OdIH
+5jQwnt/k3ErygvVA2HTsN85f2vTnBUeRyCcZhgx6wLbfxSMqI1eCvWfTgTQ+Xyd/
+TB8eDUW5hVPtW3M/9lCNm3gW8FFsY8eo62gbKQFMEHqv4jzvycJHC+dLSJwqDhRo
+8QXcw8Xa3yyD1i4x/CJsxgnkbAuNN3FvJ0ALdc4QkeCslTV0R/APZYojOsdOxxj9
+6OM8KsHTofoM90x7uDH5SBYfszA/dV38s7IIRMdhQVff7Vyru1Wg19xWAV1DB/XD
+fIarhFV+UuzjdGBdYHCh8dJ7f+l3IvzeYtNDdgf1uho6TPU79OaGF5BQdyq3h3Ep
+n7MvP7kDmf3zp/169ED1KafBzKlCxCB1f6C5icaddl4GXHhsSnLVU6GNWVDYzs49
+PT1iJquGqQIVrdvZPVRxF9EajtOy2ihZrGuyu0CfEhmlxbxodRhl4QWxHtqI9VQf
+qr8hNt3PJjQ9ZXF+39u65aV8VmsZm0ifwLjXf028KHYEn/ZxIADJpf6cs3tST/FC
+NUdWydaRy15wHZGAW4DjITJYyOaxS/O88c0AYiPpyIzjcdM5X6yPd/Ks7jNp4jix
+xq5+in4kT6Ob6i/vLGPiMOg2lgoDyk9Se4Xnfj0mji8BA+0Kd8822UQZtQARAQAB
+tEBGZWRvcmEgSW5mcmFzdHJ1Y3R1cmUgKGluZnJhc3RydWN0dXJlKSA8YWRtaW5A
+ZmVkb3JhcHJvamVjdC5vcmc+iQJSBBMBCAA8FiEEZsXzm0iCia3GFtyfH6GpJwHY
+P8QFAmpQExgCGw8FCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEB+hqScB
+2D/ET3wP/RvrubZbpK5TGSnLnxbOx74RfjSW7B01cKuLEnZV4VMMlqZONTpvMPBT
+t69aifiuVYsD1Pynj+WA0HduZdLnoczrlIYAqeAPwGOPz/ogmsEeTtnlCLzAT8Gr
+VIT0MR/jhP/IUVuZQ0t7wY2Ezl7yYRnYiB4y8ZuofF8hmby363bceMsX0T/aDQNy
+brbWKF38Ag8FQfzhTnYHnlBVUdo0Sdu94uINoW0jh6Y+ml+zusx4rP+BBqEvSQIG
+xYEbWaDxxGyrCIIADz6yz6/0w6HYBh8LgqPOfRKqo/0KTe4ZuzX3Ao8r03ZIiQj4
+7N+dA8bC9lPgHsoa6hMXamR6Mh1m/561RIzPSN8bkygg3d+Og4sglGI0FojFmdF7
+C/WHZwXpMnLkaDIQgju0JCVO9Blut85u7u0WM5AcoEC7ODsv+kxAIFiTAZVf2zh2
+1fV+lDyMVOtbykdn7YjbRvFGj3++2CJq+jP3S0Pnsc34eKsY+bw0pmCV2Wu1VPeA
+V8hnpeGqz2vyhG8TqSXZnSgWaVR5T52GCNiohqPBMaOrNFa5xoV+FYPAZbPEJf/A
+m85HsYgzmE9DbExX9JxrPpPiCmBe/DDmweP7slq+016OUHafR0shOBXVH5OFLU+w
+esbMjQFiccYct/oGbfUZVIyDBxAL3Wq8yGzzI4sskR5HqoYIeNYb
+=2YPV
+-----END PGP PUBLIC KEY BLOCK-----

files/common/rhel-infra-tags-20260709.repo

@@ -0,0 +1,6 @@
+[infrastructure-tags]
+name=Fedora Infrastructure tag $releasever - $basearch
+baseurl=https://kojipkgs.fedoraproject.org/repos-dist/epel$releasever-infra/latest/$basearch/
+enabled=1
+gpgcheck=1
+gpgkey=https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS-20260709

files/common/rhel-infra-tags-stg-20260709.repo

@@ -0,0 +1,6 @@
+[infrastructure-tags-stg]
+name=Fedora Infrastructure tag $releasever - $basearch
+baseurl=https://kojipkgs.fedoraproject.org/repos-dist/epel$releasever-infra-stg/latest/$basearch/
+enabled=1
+gpgcheck=1
+gpgkey=https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS-20260709

roles/kickstarts/files/rhel10-post.sh

@@ -19,7 +19,7 @@ restorecon -Rv /etc/ssh
 pushd /etc/yum.repos.d
 curl -O $infraurl/rhel/rhel10.repo
 curl -O $infraurl/rhel/epel10.repo
-curl -O $infraurl/infra/ansible/files/common/rhel-infra-tags.repo
+curl -o /etc/yum.repos.d/rhel-infra-tags.repo $infraurl/infra/ansible/files/common/rhel-infra-tags-20260709.repo
 popd
 
 #

roles/robosignatory/templates/robosignatory.toml.j2

@@ -109,8 +109,8 @@ handlers = ["console"]
             [[consumer_config.koji_instances.primary.tags]]
             from = "epel10-infra-candidate"
             to = "epel10-infra-stg"
-            key = "{{ (env == 'production')|ternary('fedora-infra', 'testkey') }}"
-            keyid = "{{ (env == 'production')|ternary('47dd8ef9', 'd300e724') }}"
+            key = "{{ (env == 'production')|ternary('fedora-infra-20260709', 'testkey') }}"
+            keyid = "{{ (env == 'production')|ternary('01d83fc4', 'd300e724') }}"
 
             [[consumer_config.koji_instances.primary.tags]]
             from = "f43-infra-candidate"

tasks/yumrepos.yml

@@ -100,9 +100,17 @@
   - packages
   - yumrepos
 
-- name: Add infrastructure tags repo - RHEL
+- name: Add infrastructure tags repo - RHEL (8,9)
   ansible.builtin.copy: src="{{ files }}/common/rhel-infra-tags.repo" dest="/etc/yum.repos.d/infra-tags.repo"
-  when: ansible_distribution == 'RedHat' or ansible_distribution == 'CentOS'
+  when: ansible_distribution == 'RedHat' and ansible_distribution_major_version|int != 10
+  tags:
+  - config
+  - packages
+  - yumrepos
+
+- name: Add infrastructure tags repo - RHEL (10+)
+  ansible.builtin.copy: src="{{ files }}/common/rhel-infra-tags-20260709.repo" dest="/etc/yum.repos.d/infra-tags.repo"
+  when: ansible_distribution == 'RedHat' and ansible_distribution_major_version|int >= 10
   tags:
   - config
   - packages