Fedora 37 gating tests use environment with Fedora 36-signed packages
by Jan Pazdziora
Hello,
my Fedora 37 update
https://bodhi.fedoraproject.org/updates/FEDORA-2022-ea61708c2d
runs a gating test
https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/dist-git-pi...
In the test we check if the tool (rpm2swidtag) generates the correct
SWID tags, and one of the things that it checks is the match between
the distribution and the signatures used on the packages.
However, the output of the gating test shows that the
rpm -qi bash | grep '^Signature'
command produces
+ rpm -qi bash
+ grep '^Signature'
Signature : RSA/SHA256, Wed 19 Jan 2022 10:50:42 PM UTC, Key ID 999f7cbf38ab71f4
which is exactly the same that the Fedora 36 job shows in
https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/dist-git-pi...
but it's not the key with which for example the package in the Fedora
rawhide container is signed:
$ podman run --rm registry.fedoraproject.org/fedora:rawhide rpm -qi bash | grep '^Signature'
Signature : RSA/SHA256, Wed Feb 9 02:13:15 2022, Key ID f55ad3fb5323552a
Note that the container still has the .fc36 build
$ podman run --rm registry.fedoraproject.org/fedora:rawhide rpm -q bash
bash-5.1.16-2.fc36.x86_64
but its signature matches the rawhide (and future Fedora 37) key.
It seems the environment used to run the tests for Fedora 37 has
/etc/os-release which says Fedora 37 but at the same time the packages
are not signed with the respective key, even if those signatures are
already available as shown by the rawhide compose image.
Is this expected or a bug?
--
Jan Pazdziora
Product Owner, Platform Security Readiness, Red Hat
1 year, 8 months