| |
@@ -1,9 +1,9 @@
|
| |
- %global rawhide_release 34
|
| |
+ %global rawhide_release 35
|
| |
|
| |
Summary: Fedora package repositories
|
| |
Name: fedora-repos
|
| |
Version: 33
|
| |
- Release: 3%{?_module_build:%{?dist}}
|
| |
+ Release: 4%{?_module_build:%{?dist}}
|
| |
License: MIT
|
| |
URL: https://fedoraproject.org/
|
| |
|
| |
@@ -72,6 +72,10 @@
|
| |
Source53: RPM-GPG-KEY-fedora-33-primary
|
| |
Source54: RPM-GPG-KEY-fedora-34-primary
|
| |
Source55: RPM-GPG-KEY-fedora-35-primary
|
| |
+ Source56: RPM-GPG-KEY-fedora-36-primary
|
| |
+ # When bumping Rawhide to fN, create N+1 key (and update archmap). (This
|
| |
+ # ensures users have the next future key installed and referenced, even if they
|
| |
+ # don't update very often. This will smooth out Rawhide N->N+1 transition for them).
|
| |
|
| |
Source100: fedora-modular.repo
|
| |
Source101: fedora-updates-modular.repo
|
| |
@@ -163,12 +167,18 @@
|
| |
# says "fedora-19-primary: i386 x86_64",
|
| |
# RPM-GPG-KEY-fedora-19-{i386,x86_64} will be symlinked to that key.
|
| |
pushd $RPM_BUILD_ROOT/etc/pki/rpm-gpg/
|
| |
- # Also add a symlink for ELN keys
|
| |
+ # Also add a symlink for Rawhide and ELN keys
|
| |
+ ln -s RPM-GPG-KEY-fedora-%{rawhide_release}-primary RPM-GPG-KEY-fedora-rawhide-primary
|
| |
ln -s RPM-GPG-KEY-fedora-%{rawhide_release}-primary RPM-GPG-KEY-fedora-eln-primary
|
| |
for keyfile in RPM-GPG-KEY*; do
|
| |
- key=${keyfile#RPM-GPG-KEY-} # e.g. 'fedora-20-primary'
|
| |
- arches=$(sed -ne "s/^${key}://p" %{_sourcedir}/archmap) \
|
| |
- || echo "WARNING: no archmap entry for $key"
|
| |
+ # resolve symlinks, so that we don't need to keep duplicate entries in archmap
|
| |
+ real_keyfile=$(basename $(readlink -f $keyfile))
|
| |
+ key=${real_keyfile#RPM-GPG-KEY-} # e.g. 'fedora-20-primary'
|
| |
+ if ! grep -q "^${key}:" %{_sourcedir}/archmap; then
|
| |
+ echo "ERROR: no archmap entry for $key"
|
| |
+ exit 1
|
| |
+ fi
|
| |
+ arches=$(sed -ne "s/^${key}://p" %{_sourcedir}/archmap)
|
| |
for arch in $arches; do
|
| |
# replace last part with $arch (fedora-20-primary -> fedora-20-$arch)
|
| |
ln -s $keyfile ${keyfile%%-*}-$arch # NOTE: RPM replaces %% with %
|
| |
@@ -178,6 +188,17 @@
|
| |
ln -s RPM-GPG-KEY-fedora-%{version}-primary RPM-GPG-KEY-%{version}-fedora
|
| |
popd
|
| |
|
| |
+ # Adjust Rawhide repo files to include Rawhide+1 GPG key.
|
| |
+ # This is necessary for the period when Rawhide gets bumped to N+1 and packages
|
| |
+ # start to be signed with a newer key. Without having the key specified in the
|
| |
+ # repo file, the system would consider the new packages as untrusted.
|
| |
+ rawhide_next=$((%{rawhide_release}+1))
|
| |
+ for repo in %{_sourcedir}/fedora-rawhide*.repo; do
|
| |
+ sed -ir "s@^gpgkey=.*@& file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${rawhide_next}-\$basearch@" \
|
| |
+ $repo || exit 1
|
| |
+ done
|
| |
+
|
| |
+ # Install repo files
|
| |
install -d -m 755 $RPM_BUILD_ROOT/etc/yum.repos.d
|
| |
for file in %{_sourcedir}/fedora*repo ; do
|
| |
install -m 644 $file $RPM_BUILD_ROOT/etc/yum.repos.d
|
| |
@@ -199,6 +220,28 @@
|
| |
%endif
|
| |
done
|
| |
|
| |
+ # make sure the Rawhide+1 key wasn't forgotten to be created
|
| |
+ rawhide_next=$((%{rawhide_release}+1))
|
| |
+ if ! test -f $RPM_BUILD_ROOT/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${rawhide_next}-primary; then
|
| |
+ echo "ERROR: GPG key for Fedora ${rawhide_next} is not present"
|
| |
+ exit 1
|
| |
+ fi
|
| |
+
|
| |
+ # make sure the Rawhide+1 key is present in Rawhide repo files
|
| |
+ for repo in $RPM_BUILD_ROOT/etc/yum.repos.d/fedora-rawhide*.repo; do
|
| |
+ gpg_lines=$(grep '^gpgkey=' $repo)
|
| |
+ if test -z "$gpg_lines"; then
|
| |
+ echo "ERROR: No gpgkey= lines in $repo"
|
| |
+ exit 1
|
| |
+ fi
|
| |
+ while IFS= read -r line; do
|
| |
+ if ! echo "$line" | grep -q "RPM-GPG-KEY-fedora-${rawhide_next}"; then
|
| |
+ echo "ERROR: Fedora ${rawhide_next} GPG key missing in $repo"
|
| |
+ exit 1
|
| |
+ fi
|
| |
+ done <<< "$gpg_lines"
|
| |
+ done
|
| |
+
|
| |
|
| |
%files
|
| |
%dir /etc/yum.repos.d
|
| |
@@ -237,6 +280,9 @@
|
| |
|
| |
|
| |
%changelog
|
| |
+ * Mon Feb 22 2021 Kamil Páral <kparal@redhat.com> - 33-4
|
| |
+ - Sync with Rawhide (mostly gpg keys)
|
| |
+
|
| |
* Tue Feb 09 2021 Mohan Boddu <mboddu@bhujji.com> - 33-3
|
| |
- Fixing archmap for F35
|
| |
|
| |
kparal
commented 2 months ago
Most importantly the RPM-GPG-KEY-fedora-rawhide-primary symlink.