search

rsyslog / rsyslog-pkg-rhel-centos

Package build sources for building RHEL/CentOS packages
17 stars 27 forks source link

2001 release RPM missing signatures #66

Closed dreamlibrarian closed 4 years ago

dreamlibrarian commented 4 years ago

Heyo! New release appears to not have the PGP signature.

$ curl -LO http://rpms.adiscon.com/v8-stable/epel-7/x86_64/RPMS/rsyslog-8.2001.0-1.el7.x86_64.rpm    
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  729k  100  729k    0     0  1316k      0 --:--:-- --:--:-- --:--:-- 1315k
$ rpm -K rsyslog-8.2001.0-1.el7.x86_64.rpm 
rsyslog-8.2001.0-1.el7.x86_64.rpm: sha1 md5 OK

Would expect to see pgp on that return line for a signed result. (also yum installs fail because it's not signed)

regner commented 4 years ago

Seeing this as well with the newest .2 release.

LTIOfficial commented 4 years ago

Same here with 8.2001.0-2.el7

Package rsyslog-8.2001.0-2.el7.x86_64.rpm is not signed

dreamlibrarian commented 4 years ago

Would be appreciated if the unsigned RPM was not published, as it prevents yum install of rsyslog or update of any sort on any system leveraging this repository that doesn't disable signatures.

I too am seeing the issue with 2001.0-2.

LTIOfficial commented 4 years ago

@dreamlibrarian , Until they fix it, one workaround would be to run: yum update --disablerepo=rsyslog

dreamlibrarian commented 4 years ago

Yup. I'm doing AMI builds against this, so I had to specify an explicit version to install (because latest is unsigned) and disable the repo afterwards so the update wouldn't trip.

friedl commented 4 years ago

We have just uploaded the new package version 8.2001.0-3 for EL builds. These are now signed again.

Please try again with the new package.

rgerhards commented 4 years ago

pls let me add that I am looking in why things went wrong twice in a row. I am implementing safeguard to prevent this in the future.

alorbach commented 4 years ago

The rpmbuilder script has been updated to abort package processing if the sign process fails. This will avoid uploading unsigned packages in future.

regner commented 4 years ago

Thanks for taking care of that. Appreciate all the work you guys do.

dreamlibrarian commented 4 years ago

many thanks, glad this is caught now!

LTIOfficial commented 4 years ago

Thank you, gentlemen! The yum update has since proceeded without any issues.