Hello CI folks!
Several times somebody asked me "Why there are two CI jobs in Fedora dist-git
PRs, when the Zuul's rpm-test and the *Fedora CI - dist-git test* run the exact
My answers so far was: "I don't know why it happened, but now it works as a
nice backup plan. It is very common that one of them breaks . When you see
an unreadable infrastructure failure  at one of them, you have a pretty good
chance tat the other one would still work."
With the idea to switch Zuul to the Testing Farm (rpm-tmt-test), this benefit
would be lost. We would just have two CI tests runs where both of them have
infrastructure failures at the same times (see for example ), both of them
run on the same system, and both of them run the same tests.
Could you please consider not doing that, at least until the overall stability
of the CI improves?
my Fedora 37 update
runs a gating test
In the test we check if the tool (rpm2swidtag) generates the correct
SWID tags, and one of the things that it checks is the match between
the distribution and the signatures used on the packages.
However, the output of the gating test shows that the
rpm -qi bash | grep '^Signature'
+ rpm -qi bash
+ grep '^Signature'
Signature : RSA/SHA256, Wed 19 Jan 2022 10:50:42 PM UTC, Key ID 999f7cbf38ab71f4
which is exactly the same that the Fedora 36 job shows in
but it's not the key with which for example the package in the Fedora
rawhide container is signed:
$ podman run --rm registry.fedoraproject.org/fedora:rawhide rpm -qi bash | grep '^Signature'
Signature : RSA/SHA256, Wed Feb 9 02:13:15 2022, Key ID f55ad3fb5323552a
Note that the container still has the .fc36 build
$ podman run --rm registry.fedoraproject.org/fedora:rawhide rpm -q bash
but its signature matches the rawhide (and future Fedora 37) key.
It seems the environment used to run the tests for Fedora 37 has
/etc/os-release which says Fedora 37 but at the same time the packages
are not signed with the respective key, even if those signatures are
already available as shown by the rawhide compose image.
Is this expected or a bug?
Product Owner, Platform Security Readiness, Red Hat