Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2183038 - Rebuild to pull in cryptographic fixes for RPM (bug 2170878)
Summary: Rebuild to pull in cryptographic fixes for RPM (bug 2170878)
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora Container Images
Classification: Fedora
Component: fedora-toolbox
Version: 38
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Debarshi Ray
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: AcceptedFreezeException
Depends On:
Blocks: F38FinalFreezeException 2170878
TreeView+ depends on / blocked
 
Reported: 2023-03-30 09:44 UTC by Boyd
Modified: 2023-07-04 10:45 UTC (History)
10 users (show)

Fixed In Version: fedora-toolbox-38-15
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-07-04 10:45:24 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 2170878 0 unspecified CLOSED Insecure installed RPMs (like Google Chrome) prevent system updates in F38, can't be removed 2023-10-06 18:41:12 UTC

Description Boyd 2023-03-30 09:44:05 UTC 
Description of problem:  Seems to have issue related to https://bugzilla.redhat.com/show_bug.cgi?id=2170878


Version-Release number of selected component (if applicable):


How reproducible:
Install certain 3rd party packages fails.  Not possible to --nogpgcheck or --force rpm install


Steps to Reproduce:

1. toolbox create toolbox --release 38
2. toolbox enter fedora-toolbox-38
3. su -
4. dnf update -y
5. enable copr agriffis/neovim-nightly
6. dnf install python3-neovim

Actual results:
Problem opening package python3-neovim-0.4.3.0.git.601.71102c0-1.fc38.noarch.rpm
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED
⬢[root@toolbox ~]#


Expected results:
Install package successfully.


Additional info:
https://discussion.fedoraproject.org/t/talk-popular-third-party-rpms-fail-to-install-update-remove-due-to-security-policies-verification/70379/23
Comment 1 Debarshi Ray 2023-03-30 18:10:34 UTC 
Thanks for testing out the fedora-toolbox:38 image.

(In reply to Boyd from comment #0)
> Additional info:
> https://discussion.fedoraproject.org/t/talk-popular-third-party-rpms-fail-to-
> install-update-remove-due-to-security-policies-verification/70379/23

Yeah, it's been a month since the fedora-toolbox images were last rebuilt, and the images for Fedora 38 are missing the fixes for bug 2170878 which was marked as a Fedora 38 blocker.

Even under normal circumstances, it's time to rebuild them again, especially the one for Fedora 38 because of the Beta freeze, but this makes it really critical.  Unfortunately, the 'fedpkg container-build' is currently broken: https://pagure.io/releng/issue/11367
Comment 2 Debarshi Ray 2023-04-03 14:19:05 UTC 
I don't know why Bodhi didn't notify this bug, but a new image build was done three days ago:
https://bodhi.fedoraproject.org/updates/FEDORA-CONTAINER-2023-5046242970

Testing and karma welcome.
Comment 3 Geoffrey Marr 2023-04-03 20:33:49 UTC 
Discussed during the 2023-04-03 blocker review meeting: [0]

The decision to classify this bug as an "AcceptedFreezeException (Final)" was made as it'd be good to have the known cryptographic issues fixed in the toolbox image.

[0] https://meetbot.fedoraproject.org/fedora-blocker-review/2023-04-03/f38-blocker-review.2023-04-03-16.01.txt
Comment 4 Jens Petersen 2023-04-12 03:48:25 UTC 
This is actually fixed in the new fedora-toolbox-38-15 build (pushed yesterday - note it is actually already stable).

The previous fedora-toolbox-38-14 build probably didn't include the crypto fix yet.
Note You need to log in before you can comment on or make changes to this bug.