zlopez/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

koji / pesign: add systemd-boot to hub policy and pesign

Browse source 
Set the systemd-boot package to build on secure-boot channel and set all
the normal permissions for that that other secure-boot builds have.

Add the systemd-boot cert to pesign config so it can be signed by the
right cert.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2026-06-02 14:20:37 -07:00 • committed by Kevin Fenzi
commit 8f8a5a0a23
2 changed files with 21 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
roles/koji_hub/templates/hub.conf.j2
View file

@ -125,10 +125,10 @@ tag =
# We don't want to allow any draft builds to be tagged yet
is_draft :: deny
{% if koji_instance == "primary" %}
user bodhi && tag *-override && package kernel shim grub2 pesign fwupd fwupd-efi :: allow
has_perm autosign && fromtag *-pending && package kernel shim grub2 pesign fwupd fwupd-efi :: allow
has_perm autosign && fromtag *-candidate && package kernel shim grub2 pesign fwupd fwupd-efi :: allow
has_perm secure-boot && package kernel shim grub2 pesign fwupd fwupd-efi :: allow
user bodhi && tag *-override && package systemd-boot kernel shim grub2 pesign fwupd fwupd-efi :: allow
has_perm autosign && fromtag *-pending && package systemd-boot kernel shim grub2 pesign fwupd fwupd-efi :: allow
has_perm autosign && fromtag *-candidate && package systemd-boot kernel shim grub2 pesign fwupd fwupd-efi :: allow
has_perm secure-boot && package systemd-boot kernel shim grub2 pesign fwupd fwupd-efi :: allow
# CoreOS continuous builds, https://pagure.io/releng/issue/8165
operation tag && tag f*-coreos-continuous && has_perm coreos-continuous :: allow
operation untag && fromtag f*-coreos-continuous && has_perm coreos-continuous :: allow
@ -140,7 +140,7 @@ tag =
operation tag && tag eln* && has_perm eln :: allow
operation untag && fromtag eln* && has_perm eln :: allow
# deny tagging secureboot packages that are not related to coreos-continuous and eln
package kernel shim grub2 pesign fwupd fwupd-efi :: deny
package systemd-boot kernel shim grub2 pesign fwupd fwupd-efi :: deny
# Allow people to tag stuff into infra-candidate if they're infra
tag *-infra-candidate && has_perm infra :: allow
tag *-infra-candidate :: deny
@ -184,6 +184,7 @@ channel =
{% if koji_instance == "primary" %}
#policys to deal with secure boot allowing only people in the secure-boot group to build the packages
source */systemd-boot* && has_perm secure-boot :: use secure-boot
source */kernel* && has_perm secure-boot :: use secure-boot
source */shim* && has_perm secure-boot :: use secure-boot
source */grub2* && has_perm secure-boot :: use secure-boot

15
roles/siguldry/pesign_bridge/templates/config.toml.j2
View file

@ -56,3 +56,18 @@ certificate_name = "Certificate 4"
passphrase_path = "sigul.signing-key-passphrase"
# Need to get the right cert here to verify pesigned things.
certificate_file = "/etc/sigul-pesign-bridge/fedora-ca-20200709.crt"
[[keys]]
# This key is the systemd-boot one
# This is the smart card token name
pesign_token_name = "OpenSC Card"
# This is the cert name on the smart card
pesign_certificate_name = "fedora-systemd-signer-20250530"
# This is the name of the key in sigul
key_name = "fedora-signer"
# This is also the cert name on the smart card
certificate_name = "Certificate 7"
# This is the passphrase for the bridge user and key name above
passphrase_path = "sigul.signing-key-passphrase"
# Need to get the right cert here to verify pesigned things.
certificate_file = "/etc/sigul-pesign-bridge/fedora-ca-20250530.crt"