fix(sign): corregir rpmsign con GnuPG PKCS11 y firma en spooler

- Configurar GnuPG con gnupg-pkcs11-scd y libsiguldry_pkcs11.so para el usuario root.
- Importar clave pública de firma de Siguldry al llavero GPG de root automáticamente.
- Modificar el spooler para usar rpmsign con la macro _gpg_name en lugar de Sequoia (_openpgp_sign).
- Remover el argumento keyword no soportado 'sigkey' de add_rpm_sig().
- Definir variables de entorno SIGULDRY_SOCKET y CREDENTIALS_DIRECTORY en el servicio systemd del spooler.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

roles/koji_hub/files/koji-sign-spooler

@@ -213,11 +213,10 @@ def process_queue():
                 env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
                 env['CREDENTIALS_DIRECTORY'] = '/etc/credstore'
 
-                # Sign using rpmsign command with Sequoia backend macro definitions
+                # Sign using rpmsign command with GnuPG backend using PKCS#11 module
                 cmd = [
                     'rpmsign',
-                    '--define', '_openpgp_sign sq',
+                    '--define', f'_gpg_name {sig_key_id}',
-                    '--define', f'_openpgp_sign_id {sig_key_id}',
                     '--addsign', full_rpm_path
                 ]
                 
@@ -235,7 +234,7 @@ def process_queue():
                 else:
                     logger.info(f"Successfully signed RPM {rpm_nvr} on disk. Extracting signature header.")
                     sig_data = koji.rip_rpm_sighdr(full_rpm_path)
-                    kojihub.add_rpm_sig(rpm_id, sig_data, sigkey=sig_key_id)
+                    kojihub.add_rpm_sig(rpm_id, sig_data)
                     logger.info(f"Successfully imported signature for {rpm_nvr} with key {sig_key_id}")
             except Exception as e:
                 logger.error(f"Error signing RPM {rpm_nvr}: {e}")

roles/koji_hub/files/koji-sign-spooler.service

@@ -7,6 +7,8 @@ Type=simple
 ExecStart=/usr/libexec/koji-sign-spooler
 User=root
 Group=apache
+Environment="SIGULDRY_SOCKET=/run/siguldry-client-proxy/siguldry-client-proxy.socket"
+Environment="CREDENTIALS_DIRECTORY=/etc/credstore"
 Restart=always
 RestartSec=5
 

roles/siguldry/tasks/main.yaml

@@ -264,3 +264,50 @@
       kojiadmin mxos-signing-key
       --password-file <(echo "{{ gpg_key_passphrase }}")
   when: "'mxos-signing-key' not in siguldry_keys_list.stdout"
+
+- name: Ensure GnuPG directory exists for root user
+  ansible.builtin.file:
+    path: /root/.gnupg
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Deploy GnuPG gpg-agent.conf for root user
+  ansible.builtin.copy:
+    dest: /root/.gnupg/gpg-agent.conf
+    owner: root
+    group: root
+    mode: "0600"
+    content: |
+      scdaemon-program /usr/bin/gnupg-pkcs11-scd
+
+- name: Deploy GnuPG gnupg-pkcs11-scd.conf for root user
+  ansible.builtin.copy:
+    dest: /root/.gnupg/gnupg-pkcs11-scd.conf
+    owner: root
+    group: root
+    mode: "0600"
+    content: |
+      providers siguldry
+      provider-siguldry-library /usr/lib64/pkcs11/libsiguldry_pkcs11.so
+
+- name: Kill running gpg-agent to apply PKCS#11 configuration
+  ansible.builtin.command: gpgconf --kill gpg-agent
+  failed_when: false
+  changed_when: false
+
+- name: Check if Siguldry signing key is imported in root keyring
+  ansible.builtin.command: gpg --list-keys koji@cs10-koji-00.mx-os
+  register: siguldry_gpg_key_check
+  failed_when: false
+  changed_when: false
+
+- name: Import Siguldry signing key into root keyring
+  ansible.builtin.shell:
+    cmd: >
+      SIGULDRY_SOCKET=/run/siguldry-client-proxy/siguldry-client-proxy.socket
+      CREDENTIALS_DIRECTORY=/etc/credstore
+      siguldry-client --credentials-directory /etc/credstore -c /etc/siguldry/client.toml key get mxos-signing-key --certificates
+      | gpg --import
+  when: siguldry_gpg_key_check.rc != 0