Issue

What were you trying to do that didn't work? During buidling image using image builder and utilizing local repositories osbuild-worker fails to during the build process when specifying GPG key URL instead of the complete block of GPG keys. The local repository I added as following, $ cat local-crb.toml check_gpg = true check_repogpg = false check_ssl = true gpgkeys = ["http://reposerver.test.local/pub/rhel/released/RHEL-8/8.8.0/CRB/x86_64/os/RPM-GPG-KEY-redhat-release"] id = "local-crb" name = "Local Codeready" rhsm = false system = false type = "yum-baseurl" url = "http://reposerver.test.local/pub/rhel/released/RHEL-8/8.8.0/CRB/x86_64/os/" This happens during the import of the GPG keys for the osbild-worker process and I see the following failure. Nov 07 00:30:47 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:47-05:00" level=info msg="Running job '80ae2b5e-7638-44ec-8fd8-4e191683347f' (osbuild)\n" Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg="build pipeline results:\n" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" org.osbuild.rpm failure:" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" [/usr/lib/tmpfiles.d/httpd.conf:1] Unknown group 'apache'." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" [/usr/lib/tmpfiles.d/httpd.conf:2] Unknown user 'apache'." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" [/usr/lib/tmpfiles.d/journal-nocow.conf:26] Failed to resolve specifier: uninitialized /etc detected, skipping" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" All rules containing unresolvable specifiers will be skipped." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" [/usr/lib/tmpfiles.d/radvd.conf:1] Unknown user 'radvd'." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" [/usr/lib/tmpfiles.d/rpcbind.conf:2] Unknown user 'rpc'." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" [/usr/lib/tmpfiles.d/setroubleshoot.conf:1] Unknown user 'setroubleshoot'." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" [/usr/lib/tmpfiles.d/tlog.conf:2] Unknown user 'tlog'." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" Failed to create file /sys/fs/selinux/checkreqprot: Read-only file system" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" imported gpg key" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" error: /tmp/gpgkey.9szuxoej: key 1 not an armored public key." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" Traceback (most recent call last):" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" File \"/run/osbuild/bin/org.osbuild.rpm\", line 399, in <module>" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" r = main(args[\"tree\"], args[\"inputs\"], args[\"options\"])" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" File \"/run/osbuild/bin/org.osbuild.rpm\", line 301, in main" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" ], check=True)" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" File \"/usr/lib64/python3.6/subprocess.py\", line 438, in run" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" output=stdout, stderr=stderr)" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" subprocess.CalledProcessError: Command '['rpmkeys', '--root', '/run/osbuild/tree', '--import', '/tmp/gpgkey.9szuxoej']' returned non-zero exit status 1." jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg=" " jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=error msg="osbuild job failed: osbuild build failed" jobId=80ae2b5e-7638-44ec-8fd8-4e191683347f Nov 07 00:30:55 rhel8.test.local osbuild-worker[5816]: time="2023-11-07T00:30:55-05:00" level=info msg="Job '80ae2b5e-7638-44ec-8fd8-4e191683347f' (osbuild) finished" If I replace gpgkeys field with the complete GPG key block without changing anything else it works $ composer-cli sources info local-crb check_gpg = true check_repogpg = false check_ssl = true gpgkeys = ["-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: GnuPG v1.2.6 (GNU/Linux)\n\nmQINBErgSTsBEACh2A4b0O9t+vzC9VrVtL1AKvUWi9OPCjkvR7Xd8DtJxeeMZ5eF\n0HtzIG58qDRybwUe89FZprB1ffuUKzdE+HcL3FbNWSSOXVjZIersdXyH3NvnLLLF\n0DNRB2ix3bXG9Rh/RXpFsNxDp2CEMdUvbYCzE79K1EnUTVh1L0Of023FtPSZXX0c\nu7Pb5DI5lX5YeoXO6RoodrIGYJsVBQWnrWw4xNTconUfNPk0EGZtEnzvH2zyPoJh\nXGF+Ncu9XwbalnYde10OCvSWAZ5zTCpoLMTvQjWpbCdWXJzCm6G+/hx9upke546H\n5IjtYm4dTIVTnc3wvDiODgBKRzOl9rEOCIgOuGtDxRxcQkjrC+xvg5Vkqn7vBUyW\n9pHedOU+PoF3DGOM+dqv+eNKBvh9YF9ugFAQBkcG7viZgvGEMGGUpzNgN7XnS1gj\n/DPo9mZESOYnKceve2tIC87p2hqjrxOHuI7fkZYeNIcAoa83rBltFXaBDYhWAKS1\nPcXS1/7JzP0ky7d0L6Xbu/If5kqWQpKwUInXtySRkuraVfuK3Bpa+X1XecWi24JY\nHVtlNX025xx1ewVzGNCTlWn1skQN2OOoQTV4C8/qFpTW6DTWYurd4+fE0OJFJZQF\nbuhfXYwmRlVOgN5i77NTIJZJQfYFj38c/Iv5vZBPokO6mffrOTv3MHWVgQARAQAB\ntDNSZWQgSGF0LCBJbmMuIChyZWxlYXNlIGtleSAyKSA8c2VjdXJpdHlAcmVkaGF0\nLmNvbT6JAjYEEwECACAFAkrgSTsCGwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAK\nCRAZni+R/UMdUWzpD/9s5SFR/ZF3yjY5VLUFLMXIKUztNN3oc45fyLdTI3+UClKC\n2tEruzYjqNHhqAEXa2sN1fMrsuKec61Ll2NfvJjkLKDvgVIh7kM7aslNYVOP6BTf\nC/JJ7/ufz3UZmyViH/WDl+AYdgk3JqCIO5w5ryrC9IyBzYv2m0HqYbWfphY3uHw5\nun3ndLJcu8+BGP5F+ONQEGl+DRH58Il9Jp3HwbRa7dvkPgEhfFR+1hI+Btta2C7E\n0/2NKzCxZw7Lx3PBRcU92YKyaEihfy/aQKZCAuyfKiMvsmzs+4poIX7I9NQCJpyE\nIGfINoZ7VxqHwRn/d5mw2MZTJjbzSf+Um9YJyA0iEEyD6qjriWQRbuxpQXmlAJbh\n8okZ4gbVFv1F8MzK+4R8VvWJ0XxgtikSo72fHjwha7MAjqFnOq6eo6fEC/75g3NL\nGht5VdpGuHk0vbdENHMC8wS99e5qXGNDued3hlTavDMlEAHl34q2H9nakTGRF5Ki\nJUfNh3DVRGhg8cMIti21njiRh7gyFI2OccATY7bBSr79JhuNwelHuxLrCFpY7V25\nOFktl15jZJaMxuQBqYdBgSay2G0U6D1+7VsWufpzd/Abx1/c3oi9ZaJvW22kAggq\ndzdA27UUYjWvx42w9menJwh/0jeQcTecIUd0d0rFcw/c1pvgMMl/Q73yzKgKYw==\n=zbHE\n-----END PGP PUBLIC KEY BLOCK-----\n-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBFsy23UBEACUKSphFEIEvNpy68VeW4Dt6qv+mU6am9a2AAl10JANLj1oqWX+\noYk3en1S6cVe2qehSL5DGVa3HMUZkP3dtbD4SgzXzxPodebPcr4+0QNWigkUisri\nXGL5SCEcOP30zDhZvg+4mpO2jMi7Kc1DLPzBBkgppcX91wa0L1pQzBcvYMPyV/Dh\nKbQHR75WdkP6OA2JXdfC94nxYq+2e0iPqC1hCP3Elh+YnSkOkrawDPmoB1g4+ft/\nxsiVGVy/W0ekXmgvYEHt6si6Y8NwXgnTMqxeSXQ9YUgVIbTpsxHQKGy76T5lMlWX\n4LCOmEVomBJg1SqF6yi9Vu8TeNThaDqT4/DddYInd0OO69s0kGIXalVgGYiW2HOD\nx2q5R1VGCoJxXomz+EbOXY+HpKPOHAjU0DB9MxbU3S248LQ69nIB5uxysy0PSco1\nsdZ8sxRNQ9Dw6on0Nowx5m6Thefzs5iK3dnPGBqHTT43DHbnWc2scjQFG+eZhe98\nEll/kb6vpBoY4bG9/wCG9qu7jj9Z+BceCNKeHllbezVLCU/Hswivr7h2dnaEFvPD\nO4GqiWiwOF06XaBMVgxA8p2HRw0KtXqOpZk+o+sUvdPjsBw42BB96A1yFX4jgFNA\nPyZYnEUdP6OOv9HSjnl7k/iEkvHq/jGYMMojixlvXpGXhnt5jNyc4GSUJQARAQAB\ntDNSZWQgSGF0LCBJbmMuIChhdXhpbGlhcnkga2V5KSA8c2VjdXJpdHlAcmVkaGF0\nLmNvbT6JAjkEEwECACMFAlsy23UCGwMHCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIX\ngAAKCRD3b2bD1AgnknqOD/9fB2ASuG2aJIiap4kK58R+RmOVM4qgclAnaG57+vjI\nnKvyfV3NH/keplGNRxwqHekfPCqvkpABwhdGEXIE8ILqnPewIMr6PZNZWNJynZ9i\neSMzVuCG7jDoGyQ5/6B0f6xeBtTeBDiRl7+Alehet1twuGL1BJUYG0QuLgcEzkaE\n/gkuumeVcazLzz7L12D22nMk66GxmgXfqS5zcbqOAuZwaA6VgSEgFdV2X2JU79zS\nBQJXv7NKc+nDXFG7M7EHjY3Rma3HXkDbkT8bzh9tJV7Z7TlpT829pStWQyoxKCVq\nsEX8WsSapTKA3P9YkYCwLShgZu4HKRFvHMaIasSIZWzLu+RZH/4yyHOhj0QB7XMY\neHQ6fGSbtJ+K6SrpHOOsKQNAJ0hVbSrnA1cr5+2SDfel1RfYt0W9FA6DoH/S5gAR\ndzT1u44QVwwp3U+eFpHphFy//uzxNMtCjjdkpzhYYhOCLNkDrlRPb+bcoL/6ePSr\n016PA7eEnuC305YU1Ml2WcCn7wQV8x90o33klJmEkWtXh3X39vYtI4nCPIvZn1eP\nVy+F+wWt4vN2b8oOdlzc2paOembbCo2B+Wapv5Y9peBvlbsDSgqtJABfK8KQq/jK\nYl3h5elIa1I3uNfczeHOnf1enLOUOlq630yeM/yHizz99G1g+z/guMh5+x/OHraW\niLkCDQRbMtt1ARAA1lNsWklhS9LoBdolTVtg65FfdFJr47pzKRGYIoGLbcJ155ND\nG+P8UrM06E/ah06EEWuvu2YyyYAz1iYGsCwHAXtbEJh+1tF0iOVx2vnZPgtIGE9V\nP95V5ZvWvB3bdke1z8HadDA+/Ve7fbwXXLa/z9QhSQgsJ8NS8KYnDDjI4EvQtv0i\nPVLY8+u8z6VyiV9RJyn8UEZEJdbFDF9AZAT8103w8SEo/cvIoUbVKZLGcXdAIjCa\ny04u6jsrMp9UGHZX7+srT+9YHDzQixei4IdmxUcqtiNR2/bFHpHCu1pzYjXj968D\n8Ng2txBXDgs16BF/9l++GWKz2dOSH0jdS6sFJ/Dmg7oYnJ2xKSJEmcnV8Z0M1n4w\nXR1t/KeKZe3aR+RXCAEVC5dQ3GbRW2+WboJ6ldgFcVcOv6iOSWP9TrLzFPOpCsIr\nnHE+cMBmPHq3dUm7KeYXQ6wWWmtXlw6widf7cBcGFeELpuU9klzqdKze8qo2oMkf\nrfxIq8zdciPxZXb/75dGWs6dLHQmDpo4MdQVskw5vvwHicMpUpGpxkX7X1XAfdQf\nyIHLGT4ZXuMLIMUPdzJE0Vwt/RtJrZ+feLSv/+0CkkpGHORYroGwIBrJ2RikgcV2\nbc98V/27Kz2ngUCEwnmlhIcrY4IGAAZzUAl0GLHSevPbAREu4fDW4Y+ztOsAEQEA\nAYkCHwQYAQIACQUCWzLbdQIbDAAKCRD3b2bD1AgnkusfD/9U4sPtZfMw6cII167A\nXRZOO195G7oiAnBUw5AW6EK0SAHVZcuW0LMMXnGe9f4UsEUgCNwo5mvLWPxzKqFq\n6/G3kEZVFwZ0qrlLoJPeHNbOcfkeZ9NgD/OhzQmdylM0IwGM9DMrm2YS4EVsmm2b\n53qKIfIyysp1yAGcTnBwBbZ85osNBl2KRDIPhMs0bnmGB7IAvwlSb+xm6vWKECkO\nlwQDO5Kg8YZ8+Z3pn/oS688t/fPXvWLZYUqwR63oWfIaPJI7Ahv2jJmgw1ofL81r\n2CE3T/OydtUeGLzqWJAB8sbUgT3ug0cjtxsHuroQBSYBND3XDb/EQh5GeVVnGKKH\ngESLFAoweoNjDSXrlIu1gFjCDHF4CqBRmNYKrNQjLmhCrSfwkytXESJwlLzFKY8P\nK1yZyTpDC9YK0G7qgrk7EHmH9JAZTQ5V65pp0vR9KvqTU5ewkQDIljD2f3FIqo2B\nSKNCQE+N6NjWaTeNlU75m+yZocKObSPg0zS8FAuSJetNtzXA7ouqk34OoIMQj4gq\nUnh/i1FcZAd4U6Dtr9aRZ6PeLlm6MJ/h582L6fJLNEu136UWDtJj5eBYEzX13l+d\nSC4PEHx7ZZRwQKptl9NkinLZGJztg175paUu8C34sAv+SQnM20c0pdOXAq9GKKhi\nvt61kpkXoRGxjTlc6h+69aidSg==\n=ls8J\n-----END PGP PUBLIC KEY BLOCK-----"] id = "local-crb" name = "Local Codeready" rhsm = false system = false type = "yum-baseurl" url = "http://reposerver.test.local/pub/rhel/released/RHEL-8/8.8.0/CRB/x86_64/os/" Our RHEL documentation for Image builder suggest that we can specify the GPG keys for the third party repository using the URL instead of the content of the GPG key block. 3.3. Checking repositories metadata with GPG https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/composing_a_customized_rhel_system_image/managing-repositories_composing-a-customized-rhel-system-image#proc_checking-repositories-metadata-with-gpg_managing-repositories If your key is available over https, set the gpgkeys field with the key URL for the key. You can add as many URL keys as you need The following is an example: check_gpg = true check_ssl = true id = "repository_id" name = "repository_name" system = false type = "repository_type" url = "repository_URL" check_repogpg = true gpgkeys=["_GPG_key_URL"] I remember that our documentation did not have this URL usage reference for GPG key earlier since so need to understand if such kind of syntax is actually supported by osbuild-composer or not and if need updated to the documentation for the correct syntax. Also the usage of URL is referenced in the Upstream documentation - https://www.osbuild.org/guides/image-builder-on-premises/managing-repositories.html Please provide the package NVR for which bug is seen: cockpit-composer-45-1.el8_8.noarch osbuild-81-1.el8.noarch osbuild-composer-75-1.el8.x86_64 osbuild-composer-core-75-1.el8.x86_64 osbuild-composer-dnf-json-75-1.el8.x86_64 osbuild-composer-worker-75-1.el8.x86_64 osbuild-luks2-81-1.el8.noarch osbuild-lvm2-81-1.el8.noarch osbuild-ostree-81-1.el8.noarch osbuild-selinux-81-1.el8.noarch python3-osbuild-81-1.el8.noarch How reproducible: Everytime Steps to reproduce My image blueprint $ composer-cli blueprints show RHEL-test name = "RHEL-test" description = "" version = "0.0.2" modules = [] groups = [] distro = "" [[packages]] name = "acl" [[packages]] name = "cockpit-podman" [[packages]] name = "kexec-tools" [[packages]] name = "usbguard" [[packages]] name = "libisofs-devel" <---- From Code ready. [customizations] hostname = "rhel-8-image-testing" [[customizations.user]] name = "root" password = "$6$3vPBbx.xfSL/Cvth$T/M4AecT5pAAUtU3oZw7UCN5J8lTeUR8VHRh34XEY61nBVjrkRM5oKeNTw2d2DCT9/E9KbTdMk3Rzmk1lVJuU0" groups = ["wheel"] [[customizations.user]] name = "ameya" password = "$6$n5rHCsmtHyptpj6Z$d.Uolk/hu9.rrRuCeMikTLUC9S3VDAJmtBWJhiykmfXWT1YoTidYHNxnjVKgUI/Y7K6rT0Yjn.BP3o1wQGn7h0" groups = ["wheel"] I added local repository for Code ready and here refrenced the GPG key using HTTP URL as suggested $ composer-cli sources info local-crb check_gpg = true check_repogpg = false check_ssl = true gpgkeys = ["http://reposerver.test.local/pub/rhel/released/RHEL-8/8.8.0/CRB/x86_64/os/RPM-GPG-KEY-redhat-release"] id = "local-crb" name = "Local Codeready" rhsm = false system = false type = "yum-baseurl" url = "http://reposerver.test.local/pub/rhel/released/RHEL-8/8.8.0/CRB/x86_64/os/" Start compose and see that the failure happens during the import of GPG keys. $ composer-cli compose start RHEL-test qcow2 Compose e8ada150-2f47-42c8-8464-325bef374d2b added to the queue $ composer-cli compose status ID Status Time Blueprint Version Type Size e8ada150-2f47-42c8-8464-325bef374d2b FAILED Tue Nov 7 00:30:55 2023 RHEL-test 0.0.2 qcow2 $ composer-cli compose log e8ada150-2f47-42c8-8464-325bef374d2b Pipeline build Stage org.osbuild.rpm Output: [/usr/lib/tmpfiles.d/httpd.conf:1] Unknown group 'apache'. [/usr/lib/tmpfiles.d/httpd.conf:2] Unknown user 'apache'. [/usr/lib/tmpfiles.d/journal-nocow.conf:26] Failed to resolve specifier: uninitialized /etc detected, skipping All rules containing unresolvable specifiers will be skipped. [/usr/lib/tmpfiles.d/radvd.conf:1] Unknown user 'radvd'. [/usr/lib/tmpfiles.d/rpcbind.conf:2] Unknown user 'rpc'. [/usr/lib/tmpfiles.d/setroubleshoot.conf:1] Unknown user 'setroubleshoot'. [/usr/lib/tmpfiles.d/tlog.conf:2] Unknown user 'tlog'. Failed to create file /sys/fs/selinux/checkreqprot: Read-only file system imported gpg key imported gpg key error: /tmp/gpgkey.9szuxoej: key 1 not an armored public key. Traceback (most recent call last): File "/run/osbuild/bin/org.osbuild.rpm", line 399, in <module> r = main(args["tree"], args["inputs"], args["options"]) File "/run/osbuild/bin/org.osbuild.rpm", line 301, in main ], check=True) File "/usr/lib64/python3.6/subprocess.py", line 438, in run output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '['rpmkeys', '--root', '/run/osbuild/tree', '--import', '/tmp/gpgkey.9szuxoej']' returned non-zero exit status 1. Expected results Osbuild-worker able to import and use the GPG key specified in the sources from a URL instead of failing. Actual results Currently osbuild-worker process is not able to import the GPG key specified in the sources from a URL instead of failing.

Release Notes

No. of Comments

Resolution

Won't Do