From 7f6d539ac53ee90e33a445cc220261bf0a8e1581d0366a3cae7d826cc5c9460a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Tue, 16 Jun 2026 12:18:00 -0600 Subject: [PATCH] feat(makefile): add targets to install and remove CA cert on local PC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add install-ca and remove-ca targets to GNUmakefile. - Allows local installation/removal of certs/koji_ca_cert.crt into the system CA trust anchors. Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- GNUmakefile | 11 +++++++++++ roles/koji_hub/files/koji-sign-spooler | 2 ++ 2 files changed, 13 insertions(+) diff --git a/GNUmakefile b/GNUmakefile index f9b4d1d..f92a5e9 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -32,3 +32,14 @@ bootstrap: .PHONY: reset reset: ansible-playbook --vault-pass-file=.pass reset.yaml + +.PHONY: install-ca +install-ca: + cp certs/koji_ca_cert.crt /etc/pki/ca-trust/source/anchors/koji_ca_cert.crt + update-ca-trust + +.PHONY: remove-ca +remove-ca: + rm -f /etc/pki/ca-trust/source/anchors/koji_ca_cert.crt + update-ca-trust + diff --git a/roles/koji_hub/files/koji-sign-spooler b/roles/koji_hub/files/koji-sign-spooler index f78f9f2..e33e809 100644 --- a/roles/koji_hub/files/koji-sign-spooler +++ b/roles/koji_hub/files/koji-sign-spooler @@ -27,6 +27,7 @@ def get_siguldry_key_info(): """ env = os.environ.copy() env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket' + env['CREDENTIALS_DIRECTORY'] = '/etc/credstore' # Get key info res = subprocess.run( @@ -199,6 +200,7 @@ def process_queue(): env = os.environ.copy() env['PKCS11_MODULE_PATH'] = '/usr/lib64/pkcs11/libsiguldry_pkcs11.so' env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket' + env['CREDENTIALS_DIRECTORY'] = '/etc/credstore' # Sign using rpmsign command with Sequoia backend macro definitions cmd = [