releng/tickets

Fork 2

Create detached signatures for the butane 0.29.0 release #13409

New issue

Closed

opened 2026-07-01 18:00:07 +00:00 by ydesouza · 6 comments

ydesouza commented

2026-07-01 18:00:07 +00:00

Please create detached signatures for the binaries we will upload to GitHub for the butane 0.29.0 release. This is a manual process for now, pending the automation discussed in https://pagure.io/robosignatory/issue/53 and https://github.com/coreos/fedora-coreos-tracker/issues/335.

The binaries themselves have been built in koji. Here is a small script to grab all of the rpms and the files out of the rpms and name them appropriately:

#!/bin/bash
set -eux -o pipefail

# Use the Fedora 44 key for the detached signatures
KEYTOSIGNWITH='fedora-44'

VR='0.29.0-1.fc44'
RPMKEY='6d9f90a6' # Fedora 44 key

do_sign() {
    # Sign with sigul unless FAKESIGN=1
    if [ ${FAKESIGN:-0} != 1 ]; then
        sigul sign-data -a $KEYTOSIGNWITH "$1" -o "$1.asc"
    else
        echo INVALID > "$1.asc"
    fi
}

# Grab the binaries out of the redistributable rpm
rpm="butane-redistributable-${VR}.noarch.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -Kv "$rpm" 2>&1 | grep -qi "${RPMKEY}" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv './usr/share/butane/butane-*'

# Rename the binaries
mv usr/share/butane/butane-aarch64-apple-darwin \
    butane-aarch64-apple-darwin
mv usr/share/butane/butane-aarch64-unknown-linux-gnu-static \
    butane-aarch64-unknown-linux-gnu
mv usr/share/butane/butane-ppc64le-unknown-linux-gnu-static \
    butane-ppc64le-unknown-linux-gnu
mv usr/share/butane/butane-s390x-unknown-linux-gnu-static \
    butane-s390x-unknown-linux-gnu
mv usr/share/butane/butane-x86_64-apple-darwin \
    butane-x86_64-apple-darwin
mv usr/share/butane/butane-x86_64-pc-windows-gnu.exe \
    butane-x86_64-pc-windows-gnu.exe
mv usr/share/butane/butane-x86_64-unknown-linux-gnu-static \
    butane-x86_64-unknown-linux-gnu

# Sign them
do_sign butane-aarch64-apple-darwin
do_sign butane-aarch64-unknown-linux-gnu
do_sign butane-ppc64le-unknown-linux-gnu
do_sign butane-s390x-unknown-linux-gnu
do_sign butane-x86_64-apple-darwin
do_sign butane-x86_64-pc-windows-gnu.exe
do_sign butane-x86_64-unknown-linux-gnu

# Fix permissions and clean up
chmod go+r *.asc
rm $rpm; rmdir ./usr/share/butane; rmdir ./usr/share; rmdir ./usr

After running this you should end up with a directory with files in it like:

$ ls -1
butane-aarch64-apple-darwin
butane-aarch64-apple-darwin.asc
butane-aarch64-unknown-linux-gnu
butane-aarch64-unknown-linux-gnu.asc
butane-ppc64le-unknown-linux-gnu
butane-ppc64le-unknown-linux-gnu.asc
butane-s390x-unknown-linux-gnu
butane-s390x-unknown-linux-gnu.asc
butane-x86_64-apple-darwin
butane-x86_64-apple-darwin.asc
butane-x86_64-pc-windows-gnu.exe
butane-x86_64-pc-windows-gnu.exe.asc
butane-x86_64-unknown-linux-gnu
butane-x86_64-unknown-linux-gnu.asc

Please create detached signatures for the binaries we will upload to GitHub for the `butane` 0.29.0 release. This is a manual process for now, pending the automation discussed in https://pagure.io/robosignatory/issue/53 and https://github.com/coreos/fedora-coreos-tracker/issues/335. The binaries themselves have been built in koji. Here is a small script to grab all of the rpms and the files out of the rpms and name them appropriately: ``` #!/bin/bash set -eux -o pipefail # Use the Fedora 44 key for the detached signatures KEYTOSIGNWITH='fedora-44' VR='0.29.0-1.fc44' RPMKEY='6d9f90a6' # Fedora 44 key do_sign() { # Sign with sigul unless FAKESIGN=1 if [ ${FAKESIGN:-0} != 1 ]; then sigul sign-data -a $KEYTOSIGNWITH "$1" -o "$1.asc" else echo INVALID > "$1.asc" fi } # Grab the binaries out of the redistributable rpm rpm="butane-redistributable-${VR}.noarch.rpm" koji download-build --key $RPMKEY --rpm $rpm rpm -Kv "$rpm" 2>&1 | grep -qi "${RPMKEY}" # Verify the output has the key in it rpm2cpio $rpm | cpio -idv './usr/share/butane/butane-*' # Rename the binaries mv usr/share/butane/butane-aarch64-apple-darwin \ butane-aarch64-apple-darwin mv usr/share/butane/butane-aarch64-unknown-linux-gnu-static \ butane-aarch64-unknown-linux-gnu mv usr/share/butane/butane-ppc64le-unknown-linux-gnu-static \ butane-ppc64le-unknown-linux-gnu mv usr/share/butane/butane-s390x-unknown-linux-gnu-static \ butane-s390x-unknown-linux-gnu mv usr/share/butane/butane-x86_64-apple-darwin \ butane-x86_64-apple-darwin mv usr/share/butane/butane-x86_64-pc-windows-gnu.exe \ butane-x86_64-pc-windows-gnu.exe mv usr/share/butane/butane-x86_64-unknown-linux-gnu-static \ butane-x86_64-unknown-linux-gnu # Sign them do_sign butane-aarch64-apple-darwin do_sign butane-aarch64-unknown-linux-gnu do_sign butane-ppc64le-unknown-linux-gnu do_sign butane-s390x-unknown-linux-gnu do_sign butane-x86_64-apple-darwin do_sign butane-x86_64-pc-windows-gnu.exe do_sign butane-x86_64-unknown-linux-gnu # Fix permissions and clean up chmod go+r *.asc rm $rpm; rmdir ./usr/share/butane; rmdir ./usr/share; rmdir ./usr ``` After running this you should end up with a directory with files in it like: ``` $ ls -1 butane-aarch64-apple-darwin butane-aarch64-apple-darwin.asc butane-aarch64-unknown-linux-gnu butane-aarch64-unknown-linux-gnu.asc butane-ppc64le-unknown-linux-gnu butane-ppc64le-unknown-linux-gnu.asc butane-s390x-unknown-linux-gnu butane-s390x-unknown-linux-gnu.asc butane-x86_64-apple-darwin butane-x86_64-apple-darwin.asc butane-x86_64-pc-windows-gnu.exe butane-x86_64-pc-windows-gnu.exe.asc butane-x86_64-unknown-linux-gnu butane-x86_64-unknown-linux-gnu.asc ```

jnsamyak self-assigned this

2026-07-02 04:15:27 +00:00

jnsamyak added this to the Current Sprint ( 2026-06-29 to 2026-07-12 ) project

2026-07-02 04:15:33 +00:00

jnsamyak added the

labels

2026-07-02 04:15:45 +00:00

jnsamyak commented

2026-07-02 06:41:46 +00:00

Owner

@ydesouza I think we really need to fix this script, becuase I happen to see it didnt work out last time and it seems to be the case again.

./sign.sh 
+ KEYTOSIGNWITH=fedora-44
+ VR=0.29.0-1.fc44
+ RPMKEY=6d9f90a6
+ rpm=butane-redistributable-0.29.0-1.fc44.noarch.rpm
+ koji download-build --key 6d9f90a6 --rpm butane-redistributable-0.29.0-1.fc44.noarch.rpm
Downloading [1/1]: butane-redistributable-0.29.0-1.fc44.noarch.rpm
[====================================] 100% 38.45 MiB / 38.45 MiB
+ rpm -Kv butane-redistributable-0.29.0-1.fc44.noarch.rpm
+ grep -qi 6d9f90a6

Current script output.

@ydesouza I think we really need to fix this script, becuase I happen to see it didnt work out last time and it seems to be the case again. ``` ./sign.sh + KEYTOSIGNWITH=fedora-44 + VR=0.29.0-1.fc44 + RPMKEY=6d9f90a6 + rpm=butane-redistributable-0.29.0-1.fc44.noarch.rpm + koji download-build --key 6d9f90a6 --rpm butane-redistributable-0.29.0-1.fc44.noarch.rpm Downloading [1/1]: butane-redistributable-0.29.0-1.fc44.noarch.rpm [====================================] 100% 38.45 MiB / 38.45 MiB + rpm -Kv butane-redistributable-0.29.0-1.fc44.noarch.rpm + grep -qi 6d9f90a6 ``` Current script output.

jnsamyak added

points

and removed

points

labels

2026-07-02 06:41:59 +00:00

spresti commented

2026-07-02 14:07:11 +00:00

@jnsamyak I am confused, it was working last time and nothing has changed right ?

#13359

@jnsamyak I am confused, it was working last time and nothing has changed right ? https://forge.fedoraproject.org/releng/tickets/issues/13359

jnsamyak commented

2026-07-02 15:58:42 +00:00

Owner

I need to see, we did signed out the butane copies seprately need to see why it is only trying to find one arch tho.

ydesouza commented

2026-07-03 14:20:15 +00:00

Author

Hey @jnsamyak, is there anything that I can do to help fix this situation?

jnsamyak commented

2026-07-07 06:12:31 +00:00

Owner

I investigated the signing script failure and found that the issue was not with the RPM or the signing key, but with how the script was verifying the signature.

After upgrading to RPM 6.0.1, rpm -Kv returns a non-zero exit status when the public signing key is not present in the local RPM database (NOKEY), even though the RPM is correctly signed and the expected key ID is present in the output. Because the script uses set -e -o pipefail, it exited immediately on the non-zero status before continuing.

I updated the verification logic to capture the output of rpm -Kv while ignoring its exit status, and then explicitly verified that the expected key ID is present in the output. This preserves the intended signature check while avoiding failures caused solely by the local key not being imported. After making this change, the script completed successfully.

#!/bin/bash
set -eux -o pipefail

# Use the Fedora 44 key for the detached signatures
KEYTOSIGNWITH='fedora-44'

VR='0.29.0-1.fc44'
RPMKEY='6d9f90a6' # Fedora 44 key

do_sign() {
    # Sign with sigul unless FAKESIGN=1
    if [ "${FAKESIGN:-0}" != 1 ]; then
        sigul sign-data -a "$KEYTOSIGNWITH" "$1" -o "$1.asc"
    else
        echo INVALID > "$1.asc"
    fi
}

# Grab the binaries out of the redistributable RPM
rpm="butane-redistributable-${VR}.noarch.rpm"

koji download-build --key "$RPMKEY" --rpm "$rpm"

# Verify the RPM contains the expected signing key.
# rpm -Kv may exit non-zero (e.g. NOKEY) if the public key is not
# installed locally, so inspect its output instead of its exit code.
verify_output=$(rpm -Kv "$rpm" 2>&1 || true)

if ! grep -qi "key ID .*${RPMKEY}" <<< "$verify_output"; then
    echo "ERROR: $rpm is not signed with expected key ${RPMKEY}"
    echo "$verify_output"
    exit 1
fi

rpm2cpio "$rpm" | cpio -idv './usr/share/butane/butane-*'

# Rename the binaries
mv usr/share/butane/butane-aarch64-apple-darwin \
    butane-aarch64-apple-darwin
mv usr/share/butane/butane-aarch64-unknown-linux-gnu-static \
    butane-aarch64-unknown-linux-gnu
mv usr/share/butane/butane-ppc64le-unknown-linux-gnu-static \
    butane-ppc64le-unknown-linux-gnu
mv usr/share/butane/butane-s390x-unknown-linux-gnu-static \
    butane-s390x-unknown-linux-gnu
mv usr/share/butane/butane-x86_64-apple-darwin \
    butane-x86_64-apple-darwin
mv usr/share/butane/butane-x86_64-pc-windows-gnu.exe \
    butane-x86_64-pc-windows-gnu.exe
mv usr/share/butane/butane-x86_64-unknown-linux-gnu-static \
    butane-x86_64-unknown-linux-gnu

# Sign them
do_sign butane-aarch64-apple-darwin
do_sign butane-aarch64-unknown-linux-gnu
do_sign butane-ppc64le-unknown-linux-gnu
do_sign butane-s390x-unknown-linux-gnu
do_sign butane-x86_64-apple-darwin
do_sign butane-x86_64-pc-windows-gnu.exe
do_sign butane-x86_64-unknown-linux-gnu

# Fix permissions and clean up
chmod go+r *.asc
rm "$rpm"
rmdir ./usr/share/butane
rmdir ./usr/share
rmdir ./usr

I investigated the signing script failure and found that the issue was not with the RPM or the signing key, but with how the script was verifying the signature. After upgrading to RPM 6.0.1, `rpm -Kv` returns a non-zero exit status when the public signing key is not present in the local RPM database (`NOKEY`), even though the RPM is correctly signed and the expected key ID is present in the output. Because the script uses `set -e -o pipefail`, it exited immediately on the non-zero status before continuing. I updated the verification logic to capture the output of `rpm -Kv` while ignoring its exit status, and then explicitly verified that the expected key ID is present in the output. This preserves the intended signature check while avoiding failures caused solely by the local key not being imported. After making this change, the script completed successfully. ``` #!/bin/bash set -eux -o pipefail # Use the Fedora 44 key for the detached signatures KEYTOSIGNWITH='fedora-44' VR='0.29.0-1.fc44' RPMKEY='6d9f90a6' # Fedora 44 key do_sign() { # Sign with sigul unless FAKESIGN=1 if [ "${FAKESIGN:-0}" != 1 ]; then sigul sign-data -a "$KEYTOSIGNWITH" "$1" -o "$1.asc" else echo INVALID > "$1.asc" fi } # Grab the binaries out of the redistributable RPM rpm="butane-redistributable-${VR}.noarch.rpm" koji download-build --key "$RPMKEY" --rpm "$rpm" # Verify the RPM contains the expected signing key. # rpm -Kv may exit non-zero (e.g. NOKEY) if the public key is not # installed locally, so inspect its output instead of its exit code. verify_output=$(rpm -Kv "$rpm" 2>&1 || true) if ! grep -qi "key ID .*${RPMKEY}" <<< "$verify_output"; then echo "ERROR: $rpm is not signed with expected key ${RPMKEY}" echo "$verify_output" exit 1 fi rpm2cpio "$rpm" | cpio -idv './usr/share/butane/butane-*' # Rename the binaries mv usr/share/butane/butane-aarch64-apple-darwin \ butane-aarch64-apple-darwin mv usr/share/butane/butane-aarch64-unknown-linux-gnu-static \ butane-aarch64-unknown-linux-gnu mv usr/share/butane/butane-ppc64le-unknown-linux-gnu-static \ butane-ppc64le-unknown-linux-gnu mv usr/share/butane/butane-s390x-unknown-linux-gnu-static \ butane-s390x-unknown-linux-gnu mv usr/share/butane/butane-x86_64-apple-darwin \ butane-x86_64-apple-darwin mv usr/share/butane/butane-x86_64-pc-windows-gnu.exe \ butane-x86_64-pc-windows-gnu.exe mv usr/share/butane/butane-x86_64-unknown-linux-gnu-static \ butane-x86_64-unknown-linux-gnu # Sign them do_sign butane-aarch64-apple-darwin do_sign butane-aarch64-unknown-linux-gnu do_sign butane-ppc64le-unknown-linux-gnu do_sign butane-s390x-unknown-linux-gnu do_sign butane-x86_64-apple-darwin do_sign butane-x86_64-pc-windows-gnu.exe do_sign butane-x86_64-unknown-linux-gnu # Fix permissions and clean up chmod go+r *.asc rm "$rpm" rmdir ./usr/share/butane rmdir ./usr/share rmdir ./usr ```

jnsamyak commented

2026-07-07 06:23:39 +00:00

Owner

You can get these here: https://jnsamyak.fedorapeople.org/butane/0.29.0/

jnsamyak closed this issue

2026-07-07 06:23:39 +00:00