#6234: Requesting koji service account for Cockpit

[Fedora Release Engineering]

#6234: Requesting koji service account for Cockpit
----------------------------+------------------------
 Reporter:  sgallagh        |       Owner:  rel-eng@…
     Type:  task            |      Status:  new
Milestone:  Fedora 23 Beta  |   Component:  koji
 Keywords:  meeting         |  Blocked By:
 Blocking:                  |
----------------------------+------------------------
 The Cockpit Project has a CI/CD infrastructure that regularly tests
 Cockpit very heavily. At each upstream release tagging, we would like to
 be able to submit the new updates to Koji (assuming that the CI run
 completes successfully).

To do this today, we would need to put someone's real Koji credentials
 into the CI infrastructure (where it could potentially be stolen and used
 to interact with other packages that the user has privilege on). We would
 like to request a set of dedicated credentials (likely in the form of a
 new FAS account) that we can use for submitting these builds.

Such a FAS account should be shared by the team and thus using the
 [e-mail] mailing list as its identity.

I spoke to Kevin Fenzi about this briefly on IRC and he asked me to file
 this ticket (and add the meeting keyword) to track this request.

[Fedora Release Engineering]

#6234: Requesting koji service account for Cockpit
-----------------------------+-----------------------
  Reporter:  sgallagh        |      Owner:  rel-eng@…
      Type:  task            |     Status:  new
 Milestone:  Fedora 23 Beta  |  Component:  koji
Resolution:                  |   Keywords:  meeting
Blocked By:                  |   Blocking:
-----------------------------+-----------------------

Comment (by stefw):

Likely workflow.

All steps here taken by Cockpit continuous delivery (CD) scripts. The
 scripts do much more than this, but we just focus on the Fedora (and non
 COPR) specific steps here.

1. CD notices a new signed git tag in upstream git.
  2. CD checks with Cockpit CI to see whether it's tested.
  3. CD does (fedpkg clone), updates spec file, performs a scratch build
 (and many other non-Fedora release tasks in parallel)
  4. CD checks if other release tasks are green
  5. CD commits to koji git and pushes (ie: fedpkg push)
  6. CD performs real build (ie: fedpkg build)

Steps 3, 5 and 6 done for Fedora branched + rawhide.

Currently the CD scripts are run with a packager's credentials.

[Fedora Release Engineering]

#6234: Requesting koji service account for Cockpit
-----------------------+-----------------------
  Reporter:  sgallagh  |      Owner:  rel-eng@…
      Type:  task      |     Status:  new
 Milestone:            |  Component:  koji
Resolution:            |   Keywords:
Blocked By:            |   Blocking:
-----------------------+-----------------------
Changes (by ausil):

* milestone:  Fedora 23 Beta =>
 * keywords:  meeting =>

Comment:

removing the meeting keyword. we have no way to do this today and will
 need to sit down and figure something out.

[Fedora Release Engineering]

#6234: Requesting koji service account for Cockpit
-----------------------+-----------------------
  Reporter:  sgallagh  |      Owner:  rel-eng@…
      Type:  task      |     Status:  new
 Milestone:            |  Component:  koji
Resolution:            |   Keywords:
Blocked By:            |   Blocking:
-----------------------+-----------------------

Comment (by stefw):

We have implemented this here: https://github.com/cockpit-
 project/cockpituous/tree/master/release

We have team credentials that we are currently using to accomplish this.