Re-sign flatpak-1.19.0^really1.18.2-2.fc45 (signed copies missing, blocking F45 branched composes) #13534

New issue

Closed

opened 2026-09-19 09:04:32 +00:00 by cverna · 1 comment

cverna commented

2026-09-19 09:04:32 +00:00

Member

flatpak-1.19.0^really1.18.2-2.fc45 is recorded as signed with the f45 key (F577861E), but its signed RPM copies are missing from the Koji storage tree, so Pungi rejects the whole pkgset and the Fedora 45 branched compose DOOMs at the WEAVER/PKGSET phase.

Evidence:

Compose: Fedora-45-20260919.n.0 DOOMED — UnsignedPackagesError: RPM(s) not found for sigs: ('F577861E',)
Log: pungi.global.log
Build: buildID 3092238 — koji buildinfo reports Signatures: f577861e
data/signed/ is empty: https://kojipkgs.fedoraproject.org/packages/flatpak/1.19.0%5Ereally1.18.2/2.fc45/data/signed/
But detached signatures exist in sigcache/ (dated 2026-09-03 12:49): https://kojipkgs.fedoraproject.org/packages/flatpak/1.19.0%5Ereally1.18.2/2.fc45/data/sigcache/f577861e/
The canonical RPM on disk is unsigned (rpm --checksig: "digests OK", no signature).
The previous build is fine — ...-1.fc45 has data/signed/f577861e/: https://kojipkgs.fedoraproject.org/packages/flatpak/1.19.0%5Ereally1.18.2/1.fc45/data/signed/
Other f45 builds (bash, coreutils, cachelib) all have data/signed/f577861e/.
This looks identical in nature to tickets#13454 (signing messages lost → signed copies not produced, fixed by re-signing).
Request: re-sign flatpak-1.19.0^really1.18.2-2.fc45 so the signed RPMs land in data/signed/f577861e/ (e.g. tag into a rebuild/signing tag and untag), then re-run the F45 branched compose.

When do you need this? (YYYY/MM/DD)

ASAP, blocks the daily F45 branched compose.

When is this no longer needed or useful? (YYYY/MM/DD)

If we cannot complete this, what is the impact? [Dependencies/Blocker]

Blocker: the Fedora 45 branched nightly compose fails at the start and produces no images. Affects beta/GA validation.

Assisted-by: OpenCode

`flatpak-1.19.0^really1.18.2-2.fc45` is recorded as signed with the f45 key (`F577861E`), but its signed RPM copies are missing from the Koji storage tree, so Pungi rejects the whole pkgset and the Fedora 45 branched compose DOOMs at the WEAVER/PKGSET phase. Evidence: - Compose: [Fedora-45-20260919.n.0 DOOMED](https://forge.fedoraproject.org/releng/compose-tracker-issues/issues/9629) — `UnsignedPackagesError: RPM(s) not found for sigs: ('F577861E',)` - Log: [pungi.global.log](https://kojipkgs.fedoraproject.org/compose/branched/Fedora-45-20260919.n.0/logs/global/pungi.global.log) - Build: [buildID 3092238](https://koji.fedoraproject.org/koji/buildinfo?buildID=3092238) — `koji buildinfo` reports `Signatures: f577861e` - `data/signed/` is **empty**: https://kojipkgs.fedoraproject.org/packages/flatpak/1.19.0%5Ereally1.18.2/2.fc45/data/signed/ - But detached signatures exist in `sigcache/` (dated 2026-09-03 12:49): https://kojipkgs.fedoraproject.org/packages/flatpak/1.19.0%5Ereally1.18.2/2.fc45/data/sigcache/f577861e/ - The canonical RPM on disk is unsigned (`rpm --checksig`: "digests OK", no signature). - The previous build **is** fine — `...-1.fc45` has `data/signed/f577861e/`: https://kojipkgs.fedoraproject.org/packages/flatpak/1.19.0%5Ereally1.18.2/1.fc45/data/signed/ - Other f45 builds (bash, coreutils, cachelib) all have `data/signed/f577861e/`. This looks identical in nature to [tickets#13454](https://forge.fedoraproject.org/releng/tickets/issues/13454) (signing messages lost → signed copies not produced, fixed by re-signing). **Request:** re-sign `flatpak-1.19.0^really1.18.2-2.fc45` so the signed RPMs land in `data/signed/f577861e/` (e.g. tag into a rebuild/signing tag and untag), then re-run the F45 branched compose. ## When do you need this? (YYYY/MM/DD) ASAP, blocks the daily F45 branched compose. ## When is this no longer needed or useful? (YYYY/MM/DD) ## If we cannot complete this, what is the impact? [Dependencies/Blocker] Blocker: the Fedora 45 branched nightly compose fails at the start and produces no images. Affects beta/GA validation. Assisted-by: OpenCode

cverna referenced this issue from releng/compose-tracker-issues

2026-09-19 09:04:44 +00:00

Fedora-45-20260919.n.0 DOOMED #9629

kevin added the

labels

2026-09-19 15:55:14 +00:00

kevin added this to the Sprint ( 2026-09-07 to 2026-09-20 ) project

2026-09-19 15:55:20 +00:00

kevin self-assigned this

2026-09-19 15:55:25 +00:00

kevin commented

2026-09-19 15:55:29 +00:00

Owner

So, this was due to fedora-45 not having been added to koji-gc at branching.
So, without that the written out signed copies of this package were cleaned up.

I wrote them out again with:

koji write-signed-rpm f577861e flatpak-1.19.0^really1.18.2-2.fc45

and added fedora-45 to koji-gc in ansible commit 8906a2eaacebc0cb0bed5a3e877d61e8ea583a3c

@patrikp we will need to make sure this is mentioned in branching SOP.

So, it was signed all along, just needed it's written out signed copies not to be deleted.

So, this was due to fedora-45 not having been added to koji-gc at branching. So, without that the written out signed copies of this package were cleaned up. I wrote them out again with: koji write-signed-rpm f577861e flatpak-1.19.0^really1.18.2-2.fc45 and added fedora-45 to koji-gc in ansible commit 8906a2eaacebc0cb0bed5a3e877d61e8ea583a3c @patrikp we will need to make sure this is mentioned in branching SOP. So, it was signed all along, just needed it's written out signed copies not to be deleted.

kevin closed this issue

2026-09-19 15:55:29 +00:00