Message-ID: <1463474464.21363.83.camel@gunduz.org>
Subject: Re: Unsigned libevent RPM for 9.6 beta / F23
From: Devrim =?ISO-8859-1?Q?G=FCnd=FCz?= <devrim@gunduz.org>
To: Oskari Saarenmaa <os@aiven.io>, pgsql-pkg-yum@postgresql.org
Date: Tue, 17 May 2016 11:41:04 +0300
In-Reply-To: <aaaa77fc-979c-22e5-5ad0-0cf1b64d4d37@aiven.io>
References: <aaaa77fc-979c-22e5-5ad0-0cf1b64d4d37@aiven.io>
Content-Type: multipart/signed; micalg="pgp-sha256";
	protocol="application/pgp-signature"; boundary="=-TT5i1Dh6lHvpitMHLybC"
Mime-Version: 1.0
Precedence: bulk
Sender: pgsql-pkg-yum-owner@postgresql.org


--=-TT5i1Dh6lHvpitMHLybC
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable


Hi,

On Tue, 2016-05-17 at 09:05 +0300, Oskari Saarenmaa wrote:
> http://yum.postgresql.org/9.6/fedora/fedora-23-x86_64/ currently=C2=A0
> contains an unsigned libevent-2.0.22-1.f23.x86_64.rpm package breaking=C2=
=A0
> installations when gpg check is requested.

*sigh*.

> I'm wondering if the package is needed at all on Fedora which provides=C2=
=A0
> libevent 2.0.21?

Just a newer version, that is all. I agree that it is not a must.

> Unsigned packages have appeared a couple of times in the repos, would it=
=C2=A0
> be possible to add a step checking signatures to the publishing process,=
=C2=A0
> eg something that just runs rpm -K on the rpms.

Actually the packages cannot be built without signing them first -- at leas=
t it
used to be case until Fedora 22.

As of Fedora 22, we enter the passhprase once, and virtually all packages c=
an
be built. The problem is, there is a (IIRC) 30 min timeout for a single
package. If the build takes longer than that, rpmbuild again asks for the
passphrase. If we are late at entering the password, the packages are built=
 w/o
the keys.

For this particular 9.6/F-23 issue you reported, I intentionally built all
packages w/o gpg keys, to skip the issue above, then I'd sign everything
manually. I probably pushed the packages w/o signing them, before leaving h=
ome
at 05:30 on Sunday for my flight. Sorry about that.

I pushed signed packages to repo. They will sync to master repo in next hou=
r.

Regards,
--=20
Devrim G=C3=9CND=C3=9CZ
Principal Systems Engineer @ EnterpriseDB: http://www.enterprisedb.com
PostgreSQL Dan=C4=B1=C5=9Fman=C4=B1/Consultant, Red Hat Certified Engineer
Twitter: @DevrimGunduz , @DevrimGunduzTR


--=-TT5i1Dh6lHvpitMHLybC
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAABCAAGBQJXOtkgAAoJENjDPf6Sz261ua0P/ifAPq6Fi/aJ4fS856dMuxu2
XmLtZ0jY0HWqBX9W7SS/DDyagZlxl3vf6fEjkKdb8h8dEAbxbAMgXGbE6hxL0gh3
1zDuWSs1je1ENF6nPamrT5ZI3yH4r5z60zfvguvE1OFvm2bBFNyHSgJg16dw6NsM
cmpQGwudJ/dsw79cQvL8QygJCkQymFs2cKt/LQywEZ8DE1aaMmOtgk8jGZLndZES
IMCM1IMXz8YsHbRP54gtUIbq+fSnW/KPCzJGL/rehSE6B6mjDbPC7PFoYgv1xt7e
/HdCU/PbNYAr467LyDmJQok0sZ+9iQ6WX7iBq+8mGhqd4rLaaVFlPa5bMcS58nGC
l6a94rh7jrQVp5DxZVjkE4w6eMh1meNVlIzL8+LacCPLqpMtLGblR3Fhdi/Wgume
uGfThxtsgHu6tNRTk0xJgb3hSlpRQRYlNG0gYs/1kplgOsuXavaGOaeKQZR/QMJa
lTRRGMvOkEWIQSWYeeT5I7+Ly2mGniSZilRVlrX3pnklc5MmVsfPlpTGdQkBwRGH
nSNWG3CudFYj2IkKiody2FKabiGcmScDXKaG3v8qxUHO/rv7GMphGgrLshB0bgc6
ATODcXS5Ck2Vfzz77oA3D2RJAubPuxEnCrfY/gNtN2qzwM7KyC32kdTQ3WW+WDQl
qrOE6bz46bM5Fxk7JnMJ
=7MBF
-----END PGP SIGNATURE-----

--=-TT5i1Dh6lHvpitMHLybC--