search

adoptium / installer

Installer scripts for Eclipse Temurin binaries
Apache License 2.0
145 stars 71 forks source link

GPG Signing Fails For RHEL Installer Packages #905

Closed steelhead31 closed 1 month ago

steelhead31 commented 1 month ago

All, following the bump to Fedora 40 in the dockerfiles for the RHEL JDK & JRE RPM package builds, the process now fails with the following error when GPG signing is enabled ( the error doesnt present when signing is not enabled ):gpg: enabled compatibility flags:
gpg: using pgp trust model
gpg: no running keyboxd - starting '/usr/libexec/keyboxd'
gpg: waiting for the keyboxd to come up ... (5s)
gpg: connection to the keyboxd established
gpg: Note: database_open 134217901 waiting for lock (held by 9) ...Having done some testing and investigation around this, the process works fine until Fedora 39, ( Fedora 38 doesn't exhibit this problem ) Known Issue in Fedora 39:
https://discussion.fedoraproject.org/t/gpg-hang-on-fedora-silverblue-39/103262 , which still appears to be present in Fedora 40.

Two potential fixes.. to keep using Fedora 40

1) Comment Out: use-keyboxd in .gnupg/common.conf.
2) Remove any .lock files prior to running the sign

Fix 1, doesnt work inside the docker container, Fix 2 does, and allows the rpms to be signed correctly

Alternatively reverting the docker containers to use a Fedora 38 base image would also work.

steelhead31 commented 1 month ago

Following discussions at PMC, decision was made to revert RHEL build dockerfiles to Fedora 38, to prevent this bug, and then do additional test using non-fedora images, such as ubi-8 and ubi-9 to determine a path forward.