PATCH: Setup for coreos-pool and coreos-release tags

[Mohan Boddu]

CoreOS needs coreos-pool and coreos-release tags to build backported builds
and tag the builds that go into the release.

More info: https://pagure.io/releng/issue/8294

Please review the following patch and let me know if it needs any changes.

diff --git a/roles/koji_hub/templates/hub.conf.j2
b/roles/koji_hub/templates/hub.conf.j2
index 0bf00ce..db8df35 100644
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@@ -97,6 +97,8 @@ tag =
     fromtag *infra* :: deny
     # CoreOS continuous builds, https://pagure.io/releng/issue/8165
     tag f{{FedoraRawhideNumber}}-coreos-continuous
f{{FedoraBranchedNumber}}-coreos-continuous
f{{FedoraCycleNumber}}-coreos-continu
+    # CoreOS coreos-pool and coreos-release tags,
https://pagure.io/releng/issue/8294
+    tag coreos-pool coreos-release && has_perm coreos-continuous :: allow
     all :: allow

channel =
@@ -149,5 +151,7 @@ package_list =
     tag *infra* && has_perm infra && match action add unblock block ::
allow
     # CoreOS continuous builds, https://pagure.io/releng/issue/8165
     tag f{{FedoraRawhideNumber}}-coreos-continuous
f{{FedoraBranchedNumber}}-coreos-continuous
f{{FedoraCycleNumber}}-coreos-continu
+    # CoreOS coreos-pool and coreos-release tags,
https://pagure.io/releng/issue/8294
+    tag coreos-pool coreos-release && has_perm coreos-continuous && match
action add unblock block :: allow
     # Catch-all rule.
     all :: deny
diff --git a/roles/robosignatory/files/robosignatory.production.py
b/roles/robosignatory/files/robosignatory.production.py
index 196243a..e2a6b23 100644
--- a/roles/robosignatory/files/robosignatory.production.py
+++ b/roles/robosignatory/files/robosignatory.production.py
@@ -111,6 +111,14 @@ config = {
                     "keyid": "47dd8ef9"
                 },

+                # Gated coreos-pool tag
+                {
+                    "from": "f30-coreos-signing-pending",
+                    "to": "coreos-pool",
+                    "key": "fedora-30",
+                    "keyid": "cfc659b9"
+                },
+
                 # Gated rawhide and branched
                 {
                     "from": "f31-pending",

[Mohan Boddu]

FYI, I am using the coreos-continuous permission since its the same people
who will be working on this as well.

On Wed, May 1, 2019 at 1:24 PM Mohan Boddu  wrote:
> CoreOS needs coreos-pool and coreos-release tags to build backported
> builds and tag the builds that go into the release.
>
> More info: https://pagure.io/releng/issue/8294
>
> Please review the following patch and let me know if it needs any changes.
>
> diff --git a/roles/koji_hub/templates/hub.conf.j2
> b/roles/koji_hub/templates/hub.conf.j2
> index 0bf00ce..db8df35 100644
> --- a/roles/koji_hub/templates/hub.conf.j2
> +++ b/roles/koji_hub/templates/hub.conf.j2
> @@ -97,6 +97,8 @@ tag =
>      fromtag *infra* :: deny
>      # CoreOS continuous builds, https://pagure.io/releng/issue/8165
>      tag f{{FedoraRawhideNumber}}-coreos-continuous
> f{{FedoraBranchedNumber}}-coreos-continuous
> f{{FedoraCycleNumber}}-coreos-continu
> # CoreOS coreos-pool and coreos-release tags,
>
> https://pagure.io/releng/issue/8294
> tag coreos-pool coreos-release && has_perm coreos-continuous :: allow
> all :: allow
>
> channel =
> @@ -149,5 +151,7 @@ package_list =
>      tag *infra* && has_perm infra && match action add unblock block ::
> allow
>      # CoreOS continuous builds, https://pagure.io/releng/issue/8165
>      tag f{{FedoraRawhideNumber}}-coreos-continuous
> f{{FedoraBranchedNumber}}-coreos-continuous
> f{{FedoraCycleNumber}}-coreos-continu
> # CoreOS coreos-pool and coreos-release tags,
>
> https://pagure.io/releng/issue/8294
> tag coreos-pool coreos-release && has_perm coreos-continuous && match
>
> action add unblock block :: allow
>      # Catch-all rule.
>      all :: deny
> diff --git a/roles/robosignatory/files/robosignatory.production.py
> b/roles/robosignatory/files/robosignatory.production.py
> index 196243a..e2a6b23 100644
> --- a/roles/robosignatory/files/robosignatory.production.py
> +++ b/roles/robosignatory/files/robosignatory.production.py
> @@ -111,6 +111,14 @@ config = {
>                      "keyid": "47dd8ef9"
>                  },
>            # Gated coreos-pool tag
>            {
>                "from": "f30-coreos-signing-pending",
>                "to": "coreos-pool",
>                "key": "fedora-30",
>                "keyid": "cfc659b9"
>            },
>            # Gated rawhide and branched
>            {
>                "from": "f31-pending",

[Kevin Fenzi]

Looks ok to me at a quick glance...

Thanks.

kevin

[Dusty Mabe]

On 5/1/19 1:24 PM, Mohan Boddu wrote:
> CoreOS needs coreos-pool and coreos-release tags to build backported builds and tag the builds that go into the release.
>
> More info: https://pagure.io/releng/issue/8294
>
> Please review the following patch and let me know if it needs any changes.

LGTM - but two questions below:
> diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2
> index 0bf00ce..db8df35 100644
> --- a/roles/koji_hub/templates/hub.conf.j2
> +++ b/roles/koji_hub/templates/hub.conf.j2
> @@ -97,6 +97,8 @@ tag =
>      fromtag *infra* :: deny
>      # CoreOS continuous builds, https://pagure.io/releng/issue/8165
>      tag f{{FedoraRawhideNumber}}-coreos-continuous f{{FedoraBranchedNumber}}-coreos-continuous f{{FedoraCycleNumber}}-coreos-continu

this line looks truncated - caused my patch to not apply (copy/paste error?)
> +    # CoreOS coreos-pool and coreos-release tags, https://pagure.io/releng/issue/8294
> +    tag coreos-pool coreos-release && has_perm coreos-continuous :: allow
>      all :: allow
>  
>  channel =
> @@ -149,5 +151,7 @@ package_list =
>      tag *infra* && has_perm infra && match action add unblock block :: allow
>      # CoreOS continuous builds, https://pagure.io/releng/issue/8165
>      tag f{{FedoraRawhideNumber}}-coreos-continuous f{{FedoraBranchedNumber}}-coreos-continuous f{{FedoraCycleNumber}}-coreos-continu

line truncated like above
> +    # CoreOS coreos-pool and coreos-release tags, https://pagure.io/releng/issue/8294
> +    tag coreos-pool coreos-release && has_perm coreos-continuous && match action add unblock block :: allow
>      # Catch-all rule.
>      all :: deny
> diff --git a/roles/robosignatory/files/robosignatory.production.py http://robosignatory.production.py b/roles/robosignatory/files/robosignatory.production.py http://robosignatory.production.py
> index 196243a..e2a6b23 100644
> --- a/roles/robosignatory/files/robosignatory.production.py http://robosignatory.production.py
> +++ b/roles/robosignatory/files/robosignatory.production.py http://robosignatory.production.py
> @@ -111,6 +111,14 @@ config = {
>                      "keyid": "47dd8ef9"
>                  },
>  
> +                # Gated coreos-pool tag
> +                {
> +                    "from": "f30-coreos-signing-pending",
> +                    "to": "coreos-pool",
> +                    "key": "fedora-30",
> +                    "keyid": "cfc659b9"
> +                },
>
> # Gated rawhide and branched
>                  {
>                      "from": "f31-pending",
>
> infrastructure mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]...