Skip to content

go: fix RPM signature verification in signing-ticket script #357

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
prestist merged 2 commits into from
Mar 3, 2026
+2 −2
Merged

go: fix RPM signature verification in signing-ticket script #357

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a16c7dc
go: fix RPM signature verification in signing-ticket script
prestist Feb 19, 2026
60efc87
release-checklist: fix releng ticket link
prestist Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go/release-checklist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ GitHub release:
{%- if sample_signing_key_update_tag %}
- [ ] Wait until the Bodhi update shows "Signed :heavy_check_mark:" in the Metadata box.
- [ ] Verify that the signing script can fetch the release binaries by running `./signing-ticket.sh test <x.y.z-r> <output-dir>`, where `r` is the Release of the Fedora package without the dist tag (probably `1`)
- [ ] Run `./signing-ticket.sh ticket <x.y.z-r>` and paste the output into a [releng ticket](forge.fedoraproject.org/releng/tickets/issues/new).
- [ ] Run `./signing-ticket.sh ticket <x.y.z-r>` and paste the output into a [releng ticket](https://forge.fedoraproject.org/releng/tickets/issues/new).
- [ ] Wait for the ticket to be closed
- [ ] Download the artifacts and signatures
- [ ] Verify the signatures
Expand Down
2 changes: 1 addition & 1 deletion go/signing-ticket.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ do_sign() {
# Grab the binaries out of the redistributable rpm
rpm="{{ signing_base }}-redistributable-${VR}.noarch.rpm"
koji download-build --key $RPMKEY --rpm $rpm
rpm -qip $rpm | grep -P "^Signature.*${RPMKEY}$" # Verify the output has the key in it
rpm -Kv "$rpm" 2>&1 | grep -qi "${RPMKEY}" # Verify the output has the key in it
rpm2cpio $rpm | cpio -idv './usr/share/{{ fedora_package }}/{{ signing_base }}-*'

# Rename the binaries
Expand Down