fix(sign): corregir rpmsign con GnuPG PKCS11 y firma en spooler

- Configurar GnuPG con gnupg-pkcs11-scd y libsiguldry_pkcs11.so para el usuario root.
- Importar clave pública de firma de Siguldry al llavero GPG de root automáticamente.
- Modificar el spooler para usar rpmsign con la macro _gpg_name en lugar de Sequoia (_openpgp_sign).
- Remover el argumento keyword no soportado 'sigkey' de add_rpm_sig().
- Definir variables de entorno SIGULDRY_SOCKET y CREDENTIALS_DIRECTORY en el servicio systemd del spooler.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

roles/koji_hub/files/koji-sign-spooler

@@ -213,11 +213,10 @@ def process_queue():
                 env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
                 env['CREDENTIALS_DIRECTORY'] = '/etc/credstore'
 
-                # Sign using rpmsign command with Sequoia backend macro definitions
+                # Sign using rpmsign command with GnuPG backend using PKCS#11 module
                 cmd = [
                     'rpmsign',
-                    '--define', '_openpgp_sign sq',
-                    '--define', f'_openpgp_sign_id {sig_key_id}',
+                    '--define', f'_gpg_name {sig_key_id}',
                     '--addsign', full_rpm_path
                 ]
                 
@@ -235,7 +234,7 @@ def process_queue():
                 else:
                     logger.info(f"Successfully signed RPM {rpm_nvr} on disk. Extracting signature header.")
                     sig_data = koji.rip_rpm_sighdr(full_rpm_path)
-                    kojihub.add_rpm_sig(rpm_id, sig_data, sigkey=sig_key_id)
+                    kojihub.add_rpm_sig(rpm_id, sig_data)
                     logger.info(f"Successfully imported signature for {rpm_nvr} with key {sig_key_id}")
             except Exception as e:
                 logger.error(f"Error signing RPM {rpm_nvr}: {e}")

roles/koji_hub/files/koji-sign-spooler.service

@@ -7,6 +7,8 @@ Type=simple
 ExecStart=/usr/libexec/koji-sign-spooler
 User=root
 Group=apache
+Environment="SIGULDRY_SOCKET=/run/siguldry-client-proxy/siguldry-client-proxy.socket"
+Environment="CREDENTIALS_DIRECTORY=/etc/credstore"
 Restart=always
 RestartSec=5