The old key we were using for old releases had some sha1 in it
somewhere, so rhel10 rejects it (great!). So, lets use a newly generated
key that is acceptable to rhel10 and much nicer.
This adds the public key file, the repos that use that file, the rhel10
post kickstart that sets up the repo, robosignatory to sign epel10-infra
stuff with this new key and finally on rhel10 hosts put the new repo in
place.
Note that this only changes the rhel10 setup, all rhel8/9 machines are
still using the old key. We may want to move them over, or just not care
as we retire all of them.
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
We used to do this only on builders, but right now it's causing
problems on all hosts during the infra move:
2025-06-30T23:35:32+0000 INFO Serious error - Curl code (28): Timeout was reached for https://kojipkgs.fedoraproject.org/repos-dist/f42-infra/latest/x86_64/repodata/repomd.xml [Connection timed out after 30001 milliseconds]
and we don't actually need this repo for any infra systems, I
don't think. Let's just disable it for every Fedora host.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
fix 1900 failures of the following case issue:
`name[casing]: All names should start with an uppercase letter.`
Signed-off-by: Ryan Lerch <rlerch@redhat.com>
dnf5 requires neither python3-rpm nor python3-dnf, so we cannot
assume they are installed (as they always were before). ansible's
package_facts needs python3-rpm (even in the latest upstream
version), so we at least need that. The ansible in rhel9 (which
is what's on batcave01 currently) does not support dnf5 at all,
so we need python3-dnf installed so it can use its dnf3/4
support. python3-dnf relies on python3-rpm, so we can just
check for and install python3-dnf. Once batcave01 is updated to
an ansible that supports dnf5 we won't need python3-dnf, but we
*will* still need python3-rpm.
Stuffing this in yumrepos.yml as it runs on everything, early,
and is packaging-related. We could make it a separate task but
then we'd need to make every playbook include it...
Signed-off-by: Adam Williamson <awilliam@redhat.com>
The old way of setting Fedora repos was not idempotent for
vmhost-p09-copr01.rdu-cc.fedoraproject.org (was considered both primary
and secondary). And it appears this would be the same for all Fedora
s390x/ppc64le boxes.
We have some hosts that run on archived/EOL Fedora releases, their
repository URLs need to reflect that.
Signed-off-by: Nils Philippsen <nils@redhat.com>
In ansible 2.8 the - character isn't supposed to be valid in group names.
While we could override this, might has well just bite the bullet and change it.
So, just switch all group names to use _ instead of -
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
