From 96c7d426e5348e5512138a106a710cfb534fd2bb24d8c6dda3443b0e1f877058 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Tue, 16 Jun 2026 10:53:43 -0600 Subject: [PATCH] fix(branding,siguldry): deploy Forgejo DNF repo and fix local tool check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Configure mxos-packages DNF repository to allow siguldry-pkcs11 package resolution. - Verify if rsvg-convert exists on localhost to bypass become/dnf installation check when passwordless sudo is unavailable. - Align PKCS#11 module path to /usr/lib64/pkcs11/libsiguldry_pkcs11.so in spooler and docs. Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- docs/technical/reference/siguldry_pkcs11.rst | 4 ++-- roles/common/tasks/main.yaml | 10 ++++++++++ roles/koji_hub/files/koji-sign-spooler | 2 +- roles/koji_hub/tasks/main.yaml | 7 +++++++ 4 files changed, 20 insertions(+), 3 deletions(-) diff --git a/docs/technical/reference/siguldry_pkcs11.rst b/docs/technical/reference/siguldry_pkcs11.rst index f8626b7..eb82e14 100644 --- a/docs/technical/reference/siguldry_pkcs11.rst +++ b/docs/technical/reference/siguldry_pkcs11.rst @@ -42,7 +42,7 @@ Client-side signing setups require configuration of the connection settings and .. code-block:: text providers siguldry - provider-siguldry-library /usr/lib64/libsiguldry_pkcs11.so + provider-siguldry-library /usr/lib64/pkcs11/libsiguldry_pkcs11.so Environment Variables and Credentials ------------------------------------- @@ -68,7 +68,7 @@ Siguldry leverages the modern systemd credentials mechanism to securely pass sen .. code-block:: bash - export PKCS11_MODULE_PATH=/usr/lib64/libsiguldry_pkcs11.so + export PKCS11_MODULE_PATH=/usr/lib64/pkcs11/libsiguldry_pkcs11.so RPM Macro Configuration for rpmsign ----------------------------------- diff --git a/roles/common/tasks/main.yaml b/roles/common/tasks/main.yaml index d6c4e8c..b865ad9 100644 --- a/roles/common/tasks/main.yaml +++ b/roles/common/tasks/main.yaml @@ -170,6 +170,16 @@ timeout=10 when: inventory_hostname != 'localhost' +- name: Deploy MxOS Forgejo Packages repository + ansible.builtin.yum_repository: + name: mxos-packages + description: MxOS Forgejo Packages + baseurl: https://git.mx-os.mx/api/packages/RPMs/rpm + enabled: true + gpgcheck: false + metadata_expire: "0" + when: inventory_hostname != 'localhost' + - name: Install EPEL release repository ansible.builtin.dnf: name: epel-release diff --git a/roles/koji_hub/files/koji-sign-spooler b/roles/koji_hub/files/koji-sign-spooler index e797715..e88e7e0 100644 --- a/roles/koji_hub/files/koji-sign-spooler +++ b/roles/koji_hub/files/koji-sign-spooler @@ -174,7 +174,7 @@ def process_queue(): try: logger.info(f"Signing RPM {rpm_nvr} via rpmsign and Siguldry PKCS#11") env = os.environ.copy() - env['PKCS11_MODULE_PATH'] = '/usr/lib64/libsiguldry_pkcs11.so' + env['PKCS11_MODULE_PATH'] = '/usr/lib64/pkcs11/libsiguldry_pkcs11.so' env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket' # Sign using rpmsign command with Sequoia backend macro definitions diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml index 4f50c37..d3593f5 100644 --- a/roles/koji_hub/tasks/main.yaml +++ b/roles/koji_hub/tasks/main.yaml @@ -398,11 +398,18 @@ delegate_to: localhost run_once: true block: + - name: Check if rsvg-convert is installed on localhost + ansible.builtin.command: which rsvg-convert + register: rsvg_check + ignore_errors: true + changed_when: false + - name: Ensure librsvg2-tools is installed on localhost (Fedora) ansible.builtin.dnf: name: librsvg2-tools state: present become: true + when: rsvg_check.rc != 0 - name: Convert main logo SVG to PNG ansible.builtin.command: