On středa 14. června 2023 12:37:24 CEST Pavel Raiskup wrote:
On čtvrtek 8. června 2023 17:42:13 CEST Pavel Raiskup wrote:
> Hello maintainers!
>
> Copr builders have been updated to Fedora 38 today (some old builders
> might still be running F37 ATM, but when they finish the task(s) they
> work on, they will be deleted). Our testsuite is passing just fine, so
> you _should_ be fine too :-). Please let us know if you have some
> troubles.
>
> There was one important change in Fedora 38 - RPM switched to the
> Sequoia crypto backend. It refuses SHA-1 in crypto; which basically
> disallows Mock to properly check EL6 GPG signatures. To allow further
> builds, we switched to gpgcheck=0 for all epel-6 chroots. If you know a
> better work-around, let me know.
As it turns out, epel-6 config was based on CentOS 6 and EPEL 6, and the
problem was with the CentOS 6 certificate (not EPEL 6). With the 1-line
change [1], epel-6 chroots were changed to RHEL+EPEL instead of
CentOS+EPEL, so we can again use `gpgcheck=1` (even on F38).
[1]
https://pagure.io/fedora-infra/ansible/c/b9c69f5cac314c18a539c42d1ca3bf28...
FTR, with DNF5 things just work for some reason. Which was especially
confusing to me (dnf5 is the default package manager on my workstation):
https://github.com/rpm-software-management/dnf5/issues/617
Seems like the policy is entirely ignored with dnf5? I'm not sure, but
if anything - worth debugging.
BTW. without the original problem in hand, this would be spotted much
later.
Pavel
Pavel
> Pavel
>
>
>
>