MxOS/ansible-koji
SHA256
Watch
6
0
Fork
You've already forked ansible-koji
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

feat: Integración de Siguldry PKCS#11 y spooler de firmas

Browse source 
* Implementación del rol de Ansible 'siguldry' para CentOS Stream 10
* Migración del plugin de firmas de Koji Hub a un spooler asíncrono
* Modificación de roles para utilizar empaquetamiento RPM nativo de siguldry-pkcs11
* Documentación de decisiones (ADRs) y roadmap en docs/technical/
* Limpieza de binarios locales pesados de PKCS#11 en Ansible

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
This commit is contained in:
Rénich Bon Ćirić 2026-06-16 10:06:44 -06:00
commit 89d6f66be8
Signed by: renich
GPG key ID: AB2A9F49384FE324
32 changed files with 1453 additions and 321 deletions
Download patch file Download diff file Expand all files Collapse all files

241
roles/koji_hub/files/koji-sign-spooler Normal file
View file

@ -0,0 +1,241 @@
#!/usr/bin/python3
import os
import sys
import time
import glob
import logging
import configparser
import subprocess
import tempfile
# Setup logging
logging.basicConfig(
level=logging.INFO,
format='%(asctime)s [%(levelname)s] %(name)s: %(message)s',
handlers=[
logging.StreamHandler(sys.stdout)
]
)
logger = logging.getLogger('koji-sign-spooler')
SPOOL_DIR = '/var/spool/koji-sign/queue'
FAILED_DIR = '/var/spool/koji-sign/failed'
def get_siguldry_key_info():
"""
Retrieves the public key and key ID/fingerprint from Siguldry.
"""
env = os.environ.copy()
env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
# Get key info
res = subprocess.run(
['siguldry-client', '--credentials-directory', '/etc/credstore', '-c', '/etc/siguldry/client.toml', 'key', 'get', 'mxos-signing-key', '--certificates'],
env=env,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True
)
if res.returncode != 0:
logger.error(f"Failed to get key info from Siguldry: {res.stderr}")
return None, None
output = res.stdout
start_marker = "-----BEGIN PGP PUBLIC KEY BLOCK-----"
end_marker = "-----END PGP PUBLIC KEY BLOCK-----"
start_idx = output.find(start_marker)
end_idx = output.find(end_marker)
if start_idx == -1 or end_idx == -1:
logger.error("Could not find PGP public key block in Siguldry client output.")
return None, None
pubkey = output[start_idx:end_idx + len(end_marker)]
with tempfile.NamedTemporaryFile(mode='w', suffix='.pub', delete=False) as f:
f.write(pubkey)
tmp_name = f.name
try:
gpg_res = subprocess.run(
['gpg', '--show-keys', '--with-colons', tmp_name],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True
)
if gpg_res.returncode != 0:
logger.error(f"Failed to read GPG key ID: {gpg_res.stderr}")
return None, None
key_id = None
fingerprint = None
for line in gpg_res.stdout.splitlines():
parts = line.split(':')
if parts[0] == 'pub':
key_id = parts[4][-8:]
elif parts[0] == 'fpr':
fingerprint = parts[9]
break
sig_key_id = fingerprint if fingerprint else key_id
return pubkey, sig_key_id
finally:
try:
os.remove(tmp_name)
except Exception:
pass
def process_queue():
if not os.path.exists(SPOOL_DIR):
return
# Import kojihub dynamically so that it loads after service starts
import kojihub
import koji
# Read configuration file to get KojiDir
config = configparser.ConfigParser()
config_files = ['/etc/koji-hub/hub.conf'] + sorted(glob.glob('/etc/koji-hub/hub.conf.d/*.conf'))
config.read(config_files)
koji_dir = config.get('hub', 'KojiDir', fallback='/mnt/koji')
# Get list of files in spool directory
files = sorted(os.listdir(SPOOL_DIR))
if not files:
return
# Connect to database
try:
kojihub.db.connect()
except Exception as e:
logger.error(f"Failed to connect to Koji Hub DB: {e}")
return
for filename in files:
file_path = os.path.join(SPOOL_DIR, filename)
if not os.path.isfile(file_path):
continue
try:
build_id = int(filename)
except ValueError:
logger.error(f"Invalid build ID in spool file name: {filename}")
os.rename(file_path, os.path.join(FAILED_DIR, filename))
continue
with open(file_path, 'r') as f:
build_nvr = f.read().strip()
logger.info(f"Processing build {build_id} ({build_nvr}) for signing")
# Retry loop to wait for the completeBuild transaction to commit
rpms = []
for attempt in range(5):
try:
rpms = kojihub.list_rpms(buildID=build_id)
if rpms:
break
except Exception as e:
logger.warning(f"Error querying RPMs (attempt {attempt+1}): {e}")
logger.info(f"RPMs not found yet for build {build_id}, waiting 1 second... (attempt {attempt+1}/5)")
time.sleep(1)
if not rpms:
logger.error(f"No RPMs found for build {build_id} after retries. Moving spool file to failed.")
os.makedirs(FAILED_DIR, exist_ok=True)
os.rename(file_path, os.path.join(FAILED_DIR, filename))
continue
# Get Siguldry key information
pubkey, sig_key_id = get_siguldry_key_info()
if not sig_key_id:
logger.error("Failed to retrieve Siguldry key ID. Skipping build signing.")
os.makedirs(FAILED_DIR, exist_ok=True)
os.rename(file_path, os.path.join(FAILED_DIR, filename))
continue
# Write public key to koji topdir so it can be served
pubkey_path = os.path.join(koji_dir, 'gpg_key.pub')
try:
with open(pubkey_path, 'w') as f:
f.write(pubkey)
logger.info(f"Wrote public GPG key to {pubkey_path}")
except Exception as e:
logger.warning(f"Failed to write public key to {pubkey_path}: {e}")
success = True
for rpm in rpms:
rpm_id = rpm['id']
rpm_nvr = rpm['nvr']
rpm_path = rpm['path']
full_rpm_path = os.path.join(koji_dir, rpm_path)
try:
logger.info(f"Signing RPM {rpm_nvr} via rpmsign and Siguldry PKCS#11")
env = os.environ.copy()
env['PKCS11_MODULE_PATH'] = '/usr/lib64/libsiguldry_pkcs11.so'
env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
# Sign using rpmsign command with Sequoia backend macro definitions
cmd = [
'rpmsign',
'--define', '_openpgp_sign sq',
'--define', f'_openpgp_sign_id {sig_key_id}',
'--addsign', full_rpm_path
]
result = subprocess.run(
cmd,
env=env,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True
)
if result.returncode != 0:
logger.error(f"rpmsign failed for {rpm_nvr}: stdout: {result.stdout}, stderr: {result.stderr}")
success = False
else:
logger.info(f"Successfully signed RPM {rpm_nvr} on disk. Extracting signature header.")
sig_data = koji.rip_rpm_sighdr(full_rpm_path)
kojihub.add_rpm_sig(rpm_id, sig_data, sigkey=sig_key_id)
logger.info(f"Successfully imported signature for {rpm_nvr} with key {sig_key_id}")
except Exception as e:
logger.error(f"Error signing RPM {rpm_nvr}: {e}")
success = False
if success:
try:
kojihub.context.cnx.commit()
logger.info(f"All signatures committed for build {build_id} ({build_nvr}).")
os.remove(file_path)
except Exception as e:
logger.error(f"Failed to commit signatures to database: {e}")
try:
kojihub.context.cnx.rollback()
except Exception:
pass
else:
logger.error(f"Failed to sign some/all RPMs for build {build_id}. Keeping spool file for retry.")
break
try:
kojihub.context.cnx.close()
except Exception:
pass
def main():
logger.info("Koji Sign Spooler Daemon started")
os.makedirs(SPOOL_DIR, exist_ok=True)
os.makedirs(FAILED_DIR, exist_ok=True)
while True:
try:
process_queue()
except Exception as e:
logger.error(f"Unhandled exception in spooler loop: {e}")
time.sleep(5)
if __name__ == '__main__':
main()

14
roles/koji_hub/files/koji-sign-spooler.service Normal file
View file

@ -0,0 +1,14 @@
[Unit]
Description=Koji Sign Spooler Daemon
After=httpd.service postgresql.service
[Service]
Type=simple
ExecStart=/usr/libexec/koji-sign-spooler
User=root
Group=apache
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target

93
roles/koji_hub/files/sigul_sign.py
View file

@ -1,66 +1,43 @@
import koji
import kojihub
import xmlrpc.client
from koji.plugin import callback
import logging
import os
logger = logging.getLogger(__name__)
logger = logging.getLogger('koji.plugin.sigul_sign')
class SigulSignPlugin(kojihub.Plugin):
def __init__(self, hub):
super(SigulSignPlugin, self).__init__(hub)
self.sigul_server = self.hub.config.get('SigulServer')
if not self.sigul_server:
logger.error("SigulServer not configured in Koji Hub. Automated signing will not work.")
return
SPOOL_DIR = '/var/spool/koji-sign/queue'
self.sigul_proxy = xmlrpc.client.ServerProxy(self.sigul_server)
logger.info(f"SigulSignPlugin initialized with server: {self.sigul_server}")
@callback('postBuildStateChange')
def sigul_sign(cbtype, *args, **kws):
"""
Called after a build state changes.
We will queue the build for signing if the state changed to COMPLETE.
"""
if kws.get('attribute') != 'state':
return
if kws.get('new') != koji.BUILD_STATES['COMPLETE']:
return
def postBuild(self, build_id, build, request, **kwargs):
"""
Called after a build is completed.
We will attempt to sign the RPMs in this build.
"""
if build.get('state') != koji.BUILD_STATES['COMPLETE']:
logger.info(f"Build {build_id} not complete, skipping signing.")
return
build = kws.get('info')
if not build:
logger.error("No build info found in callback.")
return
logger.info(f"Attempting to sign RPMs for build {build_id} ({build.get('nvr')})")
build_id = build['id']
build_nvr = build.get('nvr', str(build_id))
# Ensure spool directory exists
try:
if not os.path.exists(SPOOL_DIR):
os.makedirs(SPOOL_DIR, mode=0o770)
except Exception as e:
logger.error(f"Failed to create spool directory {SPOOL_DIR}: {e}")
return
# Get RPMs associated with the build
rpms = self.hub.getBuildRPMs(build_id)
if not rpms:
logger.info(f"No RPMs found for build {build_id}, skipping signing.")
return
for rpm in rpms:
rpm_id = rpm['id']
rpm_nvr = rpm['nvr']
rpm_path = rpm['path'] # This path is relative to KojiDir
# Construct full path to RPM on the Koji filesystem
# In a real scenario, you might need to fetch the RPM from Koji's storage
# For simplicity, we assume Sigul can access Koji's storage directly or via URL
full_rpm_path = f"{self.hub.config.get('KojiDir')}/{rpm_path}"
try:
# Call Sigul to sign the RPM
# This is a mock call. A real Sigul API call would be more complex.
logger.info(f"Calling Sigul to sign {full_rpm_path}")
# result = self.sigul_proxy.sign_rpm(full_rpm_path) # Example Sigul API call
result = {'success': True, 'signature': 'mock_signature_data'} # Mock result
if result.get('success'):
logger.info(f"Successfully signed RPM {rpm_nvr}. Importing signature to Koji.")
# Import signature back into Koji
# This is a simplified example. Koji's import-sig expects specific data.
# For a real plugin, you'd get the actual signature from Sigul and format it.
self.hub.importSig(rpm_id, 'mock_sig_id', 'mock_sig_type', result['signature'])
logger.info(f"Signature imported for {rpm_nvr}.")
else:
logger.error(f"Sigul failed to sign {rpm_nvr}: {result.get('error', 'Unknown error')}")
except Exception as e:
logger.error(f"Error signing RPM {rpm_nvr}: {e}")
# Register the plugin
kojihub.add_plugin(SigulSignPlugin)
spool_file = os.path.join(SPOOL_DIR, str(build_id))
try:
with open(spool_file, 'w') as f:
f.write(f"{build_nvr}\n")
logger.info(f"Queued build {build_id} ({build_nvr}) for signing in {spool_file}")
except Exception as e:
logger.error(f"Failed to queue build {build_id} for signing: {e}")