fuel doesn't install gpg keys for fuel-infra repos

[Roman Sokolkov]

Starting from MOS9 Fuel enables package sign checks ("AllowUnauthenticated 0").

But instead of putting gpg keys for fuel-infra repos it skips checks in puppet apt provider [1].

Later on cloud operators will see:

W: GPG error: http://mirror.fuel-infra.org mos9.0-holdback Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY BCE5CC461FA22B08
W: GPG error: http://mirror.fuel-infra.org mos9.0-security Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY BCE5CC461FA22B08
W: GPG error: http://mirror.fuel-infra.org mos9.0-updates Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY BCE5CC461FA22B08

1 - https://github.com/openstack/fuel-library/blob/stable/mitaka/deployment/puppet/osnailyfacter/lib/puppet/provider/package/apt_fuel.rb#L71

[Ruslan Khozinov (rkhozinov)]

I've found the same problem during update Fuel 9.0 -> 9.1 -> 9.2

[Oleksiy Molchanov (omolchanov)]

Build team, for trigger signing fuel repos from puppet we need to download it in format like

http://mirror.fuel-infra.org/mos-repos/ubuntu/%VERSION%/archive-mos%VERSION%.key

but this approach is not acceptable for 11 version, right now it is called master. Can you comment here?

[Roman Vyalov (r0mikiam)]

you can find the keys in the mos-repos reposiotries:
for example : http://mirror.fuel-infra.org/mos-repos/ubuntu/9.0/archive-mos9.0.key

also for master (fuel 11) you can find the key in the master repos:
http://mirror.fuel-infra.org/mos-repos/ubuntu/master/archive-mosmaster.key

[Oleksiy Molchanov (omolchanov)]

Roman,

I don't think that fetching key for fuel 11 with name master will work good. What will happen when fuel 12 will be master? It will break the deployment.

[Roman Vyalov (r0mikiam)]

Oleksiy, the mos 9 and mos 10 repositories were created and i dont understand why you move this bug to build team.
According to the openstack workflow , the next openstack version is contained in the master branch (before the creation of branches). Because of this we are using the master repository for master openstack

[Roman Vyalov (r0mikiam)]

when we will prepare the mos 11 (Fuel ocata) release, we create the mos11 repos

[Vladimir Kuklin (vkuklin)]

This bug consists of 2 issues:

1) absence of ability to safely transport fuel-infra repos public key - this should be done on infra side
2) after #1 is finished - we need to add a stanza in provsioning manifests to import this public key into the base and bootstrap image.

Thus, we need to create an https endpoint or distribut our public key over public trusted pgp servers or set up our own pgp server to do this. After that we will create required stanza on the provisioning side.

[Alexander Evseev (aevseev)]

We have package mos-release. I guess we should place PGP keys to this package.

[Roman Vyalov (r0mikiam)]

Guys,
we had the epic related to this task (PROD-4849) and i propose to close this feature-bug.