Bug 1213799 - [ALP] transactional_update fails on latest Milestone 2
Summary: [ALP] transactional_update fails on latest Milestone 2
Status: IN_PROGRESS
Alias: None
Product: Granite
Classification: SUSE ALP - SUSE Adaptable Linux Platform
Component: Security (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-31 06:14 UTC by Paolo Stivanin
Modified: 2023-08-03 07:10 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Paolo Stivanin 2023-07-31 06:14:54 UTC
While testing the latest Milestone 2, I've encountered the following issue with the transactional_update test (https://openqa.suse.de/tests/11704121#step/transactional_update/24):

2023-07-31 05:59:42 Options: callext 9 zypper -R {} install -y --auto-agree-with-product-licenses update-test-trivial/update-test-security-5.1-1.20.x86_64.rpm 
2023-07-31 05:59:43 Executing `zypper -R /tmp/transactional-update-udm6HA install -y --auto-agree-with-product-licenses update-test-trivial/update-test-security-5.1-1.20.x86_64.rpm`:
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following NEW package is going to be installed:
  update-test-security

1 new package to install.
Overall download size: 8.9 KiB. Already cached: 0 B. After the operation, additional 338.0 B will be used.
Continue? [y/n/v/...? shows all options] (y): y

Checking for file conflicts: [...done]
Warning: 1 package had to be excluded from file conflicts check because it is not yet download.

    Note: Checking for file conflicts requires not installed packages to be downloaded in advance in
    order to access their file lists. See option '--download-in-advance / --dry-run --download-only'
    in the zypper manual page for details.

Retrieving: update-test-security-5.1-1.20.x86_64 (Plain RPM files cache) (1/1),   8.9 KiB    
update-test-security-5.1-1.20.x86_64.rpm:
    Header V3 RSA/SHA512 Signature, key ID 35a2f86e29b700a4: NOKEY
    V3 RSA/SHA512 Signature, key ID 35a2f86e29b700a4: NOKEY

warning: /var/tmp/zypp.SZZNWK/zypper/_tmpRPMcache_/%CLI%/update-test-security-5.1-1.20.x86_64.rpm: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOKEY
Looking for gpg key ID 29B700A4 in cache /tmp/transactional-update-udm6HA/var/cache/zypp/pubkeys.
Repository Plain RPM files cache does not define additional 'gpgkey=' URLs.
update-test-security-5.1-1.20.x86_64 (Plain RPM files cache): Signature verification failed [4-Signatures public key is not available]
Abort, retry, ignore? [a/r/i] (a): a
Problem occurred during or after installation or removal of packages:
Installation has been aborted as directed.
Please see the above error message for a hint.
2023-07-31 05:59:44 Application returned with exit status 8.
ERROR: zypper install on /.snapshots/9/snapshot failed with exit code 8!



Repos present on the system:

# | Alias                       | Name                        | Enabled | GPG Check | Refresh | URI
--+-----------------------------+-----------------------------+---------+-----------+---------+------------------------------------------------------------------------------------
1 | ALP Build Repository        | ALP Build Repository        | Yes     | (r ) Yes  | No      | http://openqa.suse.de/assets/repo/ALP-Dolomite-1.0-x86_64-Build2.4-Media1
2 | ALP Source Build Repository | ALP Source Build Repository | Yes     | (r ) Yes  | No      | http://download.suse.de/ibs/SUSE:/ALP:/Source:/Standard:/Core:/1.0:/Build/standard/
3 | ALP-Dolomite-1.0            | ALP Dolomite 1.0 Repository | Yes     | (r ) Yes  | Yes     | https://updates.suse.com/SUSE/Products/ALP-Dolomite/1.0/x86_64/product/
Comment 1 Marcus Meissner 2023-08-02 12:49:32 UTC
it is signed by the 4k openSUSE key.

ALP does not know this key by default.
As you seem to impor tRPMs directly t and not the repo, you also cant import the key.

perhaps add some key import to the testcase?

rpm --import http://download.opensuse.org/tumbleweed/repo/oss/repodata/repomd.xml.key
Comment 2 Paolo Stivanin 2023-08-03 07:10:40 UTC
the test is skipping the gpg check though:

# Leap Micro misses the gpg key for openSUSE:Maintenance space
my $no_gpg_check = (is_leap_micro || is_alp) ? '-G' : '';
zypper_call "ar $no_gpg_check utt.repo" if (is_sle || is_sle_micro || is_leap_micro || is_alp);

and it was working on Bedrock :hmmm: