[releng] Issue #7880: New signing key for IoT

[Peter Robinson]

pbrobinson reported a new issue against the project: `releng` that you are following:
``
At the moment ostree doesn't have the ability to do key rollovers, which means it had
to be manually dealt with, which is no ideal for IoT endpoints that may not be able to do
this easily by some level of manual intervention. So as a short term to deal with this
@puiterwijk suggested that IoT have it's own signing key.
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Patrick "マルタインアンドレアス" Uiterwijk]

puiterwijk added a new comment to an issue you are following:
``
I would suggest using a key that's clearly intended to be cycled, but not per
release.
I would suggest a key like `Fedora IoT 2018`.
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Dusty Mabe]

dustymabe added a new comment to an issue you are following:
``
if we can get the upstream issue fixed in a timely manner (i.e. the next month) can we
prefer that solution over this one? 

I think we should just modify gpgkeypath to accept a directory and specify the directory
where the rpm gpg keys are like is done by dnf. 
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Peter Robinson]

pbrobinson added a new comment to an issue you are following:
``
@dustymabe if we can get proper key rollover fixed in time for F-29 GA sure, I have
timelines that make time frames that are hand wavey like "timely manner" a
problem. 
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Dusty Mabe]

dustymabe added a new comment to an issue you are following:
``
I don't think it will happen for f29 GA, which is a week away. How do you propose to
solve the rotation problem with a key like `Fedora IoT 2018`? Are you proposing to never
rotate it ? 
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Peter Robinson]

pbrobinson added a new comment to an issue you are following:
``
@dustymabe We have one key until we can do key roll overs and then we roll it over to the
Fedora release key.
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Dusty Mabe]

dustymabe added a new comment to an issue you are following:
``
I think what we need to do is bring the file in /etc/ostree/remotes.d/ under control of
rpm (or make a read-only /usr/lib/ostree/remotes.d/ for files delivered by rpms) so that
we can update the gpgkeypath without the user having to run a command. I think the **one
key until we can do key roll overs** doesn't help us because the mechanism for doing
the rollover (i.e.updating the `ostree/remotes.d` file) isn't in place.

I think the solution to this is two pronged.

1. bring the `/etc/ostree/remotes.d` file under rpm control so it can be updated
2. make it so multiple keys can be added to the file (or a directory)


I think `1` will help us in this cause more than creating a static key. So if we do `1`
for you for f29 iot then you don't really need a static key because we can do `2`
before Fedora 30. 

``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Dusty Mabe]

dustymabe added a new comment to an issue you are following:
``
Talked with peter today. The concerns I mentioned above can be taken care of by an ansible
run that will update the ostree remote configuration; I previously did not think this was
an option. The current plan is to use an iot key for fedora 29 and then hopefully switch
back to the release based keys for fedora 30. The iot key allows for a contingency plan in
case the rolling of keys is not ready by fedora 30. 
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Peter Robinson]

pbrobinson added a new comment to an issue you are following:
``
@kevin or @mohanboddu can you create this please, call it fedora-iot-2019 or similar
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Mohan Boddu]

mohanboddu added a new comment to an issue you are following:
``
@pbrobinson : @kevin is working on moving the signing vault to new hardware. He thinks it
should be done today or by end of this week. I hope that is okay.

Sorry to hold you up.
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Peter Robinson]

pbrobinson added a new comment to an issue you are following:
``
@kevin @mohanboddu no probs, ping me when you're ready to do it but before you do.
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Mohan Boddu]

mohanboddu added a new comment to an issue you are following:
``
@pbrobinson FYI, we are planning to make the iot key on Monday.
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880

[Mohan Boddu]

The status of the issue: `New signing key for IoT` of project: `releng` has been updated
to: Closed as Fixed by mohanboddu.

https://pagure.io/releng/issue/7880

[Mohan Boddu]

mohanboddu added a new comment to an issue you are following:
``
fedora-iot-2019 key is created.

Closing the ticket and please open if anything else needed.

Thanks.
``

To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/7880