- Switched from systemd path monitoring to a custom wrapper script `mxos-trigger-dist-repo.sh` spawned by the Koji signing spooler.
- Wrapper script runs Koji `dist-repo` synchronously and triggers the `mxos-repo-sync.sh` script to perform an atomic rsync of packages to the Caddy server.
- Excluded reposerver from distro-sync to work around VM disk space constraints.
- Configured Koji tag `mxos0` to cancel older pending/running `distRepo` tasks when a new one is triggered.
- Verified successful repository generation, synchronization, and DNF resolution.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Configurar GnuPG con gnupg-pkcs11-scd y libsiguldry_pkcs11.so para el usuario root.
- Importar clave pública de firma de Siguldry al llavero GPG de root automáticamente.
- Modificar el spooler para usar rpmsign con la macro _gpg_name en lugar de Sequoia (_openpgp_sign).
- Remover el argumento keyword no soportado 'sigkey' de add_rpm_sig().
- Definir variables de entorno SIGULDRY_SOCKET y CREDENTIALS_DIRECTORY en el servicio systemd del spooler.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Add install-ca and remove-ca targets to GNUmakefile.
- Allows local installation/removal of certs/koji_ca_cert.crt into the system CA trust anchors.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Set SSLProtocol to disable TLS 1.3 in ssl.conf on Apache, enabling standard TLS 1.2 client certificate renegotiation.
- Revert the temporary global SSLVerifyClient/Depth optional configuration at VirtualHost level.
- Save DB connection to kojihub.context.cnx in sign spooler.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
- Configure mxos-packages DNF repository to allow siguldry-pkcs11 package resolution.
- Verify if rsvg-convert exists on localhost to bypass become/dnf installation check when passwordless sudo is unavailable.
- Align PKCS#11 module path to /usr/lib64/pkcs11/libsiguldry_pkcs11.so in spooler and docs.
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
* Implementación del rol de Ansible 'siguldry' para CentOS Stream 10
* Migración del plugin de firmas de Koji Hub a un spooler asíncrono
* Modificación de roles para utilizar empaquetamiento RPM nativo de siguldry-pkcs11
* Documentación de decisiones (ADRs) y roadmap en docs/technical/
* Limpieza de binarios locales pesados de PKCS#11 en Ansible
Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
