{"action":"opened","issue":{"url":"https://api.github.com/repos/CentOS/sig-atomic-buildscripts/issues/283","repository_url":"https://api.github.com/repos/CentOS/sig-atomic-buildscripts","labels_url":"https://api.github.com/repos/CentOS/sig-atomic-buildscripts/issues/283/labels{/name}","comments_url":"https://api.github.com/repos/CentOS/sig-atomic-buildscripts/issues/283/comments","events_url":"https://api.github.com/repos/CentOS/sig-atomic-buildscripts/issues/283/events","html_url":"https://github.com/CentOS/sig-atomic-buildscripts/issues/283","id":242161305,"number":283,"title":"CentOS AH 7.1705 commit is not signed","user":{"login":"miabbott","id":10236257,"avatar_url":"https://avatars1.githubusercontent.com/u/10236257?v=3","gravatar_id":"","url":"https://api.github.com/users/miabbott","html_url":"https://github.com/miabbott","followers_url":"https://api.github.com/users/miabbott/followers","following_url":"https://api.github.com/users/miabbott/following{/other_user}","gists_url":"https://api.github.com/users/miabbott/gists{/gist_id}","starred_url":"https://api.github.com/users/miabbott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miabbott/subscriptions","organizations_url":"https://api.github.com/users/miabbott/orgs","repos_url":"https://api.github.com/users/miabbott/repos","events_url":"https://api.github.com/users/miabbott/events{/privacy}","received_events_url":"https://api.github.com/users/miabbott/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-07-11T19:41:28Z","updated_at":"2017-07-11T19:41:28Z","closed_at":null,"body":"The commit for CentOS AH 7.1705 is not signed and this can interfere with `rpm-ostree deploy` and `ostree pull`\r\n\r\nSee below for the evidence of the unsigned commit and problems:\r\n\r\n```\r\n# ostree log centos-atomic-host:centos-atomic-host/7/x86_64/standard\r\ncommit 4620e591a76a44b624f6526bc6e8222d6db8de111e504ea50bbb544cd904a040\r\nDate:  2017-07-06 16:32:44 +0000\r\nVersion: 7.1706\r\n(no subject)\r\n\r\ncommit 08513c5fc2f22c9719e9257d9b5e4ebd14070a9ca1d94bb4002dd5e8cc09a2cb\r\nDate:  2017-07-05 23:01:43 +0000\r\nVersion: 7.1705.1\r\n(no subject)\r\n\r\ncommit 05b99304caa9e0871b76497460e3ee2a1cd4392bbfd5a186da6684a0b17aa5e3\r\nDate:  2017-07-05 16:52:03 +0000\r\nVersion: 7.1705\r\n(no subject)\r\n\r\n<< History beyond this commit not fetched >>\r\n\r\n# ostree show 4620e591a76a44b624f6526bc6e8222d6db8de111e504ea50bbb544cd904a040\r\ncommit 4620e591a76a44b624f6526bc6e8222d6db8de111e504ea50bbb544cd904a040\r\nDate:  2017-07-06 16:32:44 +0000\r\nVersion: 7.1706\r\n(no subject)\r\n\r\nFound 1 signature:\r\n\r\n  Signature made Thu 06 Jul 2017 04:33:03 PM UTC using RSA key ID F17E745691BA8335\r\n  Good signature from \"CentOS Atomic SIG <security@centos.org>\"\r\n\r\n# ostree show 08513c5fc2f22c9719e9257d9b5e4ebd14070a9ca1d94bb4002dd5e8cc09a2cb\r\ncommit 08513c5fc2f22c9719e9257d9b5e4ebd14070a9ca1d94bb4002dd5e8cc09a2cb\r\nDate:  2017-07-05 23:01:43 +0000\r\nVersion: 7.1705.1\r\n(no subject)\r\n\r\nFound 1 signature:\r\n\r\n  Signature made Wed 05 Jul 2017 11:02:25 PM UTC using RSA key ID F17E745691BA8335\r\n  Good signature from \"CentOS Atomic SIG <security@centos.org>\"\r\n\r\n# ostree show 05b99304caa9e0871b76497460e3ee2a1cd4392bbfd5a186da6684a0b17aa5e3\r\ncommit 05b99304caa9e0871b76497460e3ee2a1cd4392bbfd5a186da6684a0b17aa5e3\r\nDate:  2017-07-05 16:52:03 +0000\r\nVersion: 7.1705\r\n(no subject)\r\n\r\n# rpm-ostree deploy 08513c5fc2f22c9719e9257d9b5e4ebd14070a9ca1d94bb4002dd5e8cc09a2cb\r\nValidating checksum '08513c5fc2f22c9719e9257d9b5e4ebd14070a9ca1d94bb4002dd5e8cc09a2cb'\r\n  Signature made Thu 06 Jul 2017 04:33:03 PM UTC using RSA key ID F17E745691BA8335\r\n  Good signature from \"CentOS Atomic SIG <security@centos.org>\"\r\n\r\n\r\n1 metadata, 0 content objects fetched; 313 B transferred in 0 seconds                                                                                                                                                Signature made Wed 05 Jul 2017 11:02:25 PM UTC using RSA key ID F17E745691BA8335\r\n  Good signature from \"CentOS Atomic SIG <security@centos.org>\"\r\n\r\n                                                                                                                                                                                                                  \r\nerror: Commit 05b99304caa9e0871b76497460e3ee2a1cd4392bbfd5a186da6684a0b17aa5e3: GPG verification enabled, but no signatures found (use gpg-verify=false in remote config to disable)\r\n\r\n# ostree pull --commit-metadata-only --depth=-1 centos-atomic-host:centos-atomic-host/7/x86_64/standard\r\n\r\n\r\n\r\nGPG: Verification enabled, found 1 signature:\r\n\r\n  Signature made Thu 06 Jul 2017 04:33:03 PM UTC using RSA key ID F17E745691BA8335\r\n  Good signature from \"CentOS Atomic SIG <security@centos.org>\"\r\n\r\n\r\n\r\nGPG: Verification enabled, found 1 signature:\r\n\r\n  Signature made Wed 05 Jul 2017 11:02:25 PM UTC using RSA key ID F17E745691BA8335\r\n  Good signature from \"CentOS Atomic SIG <security@centos.org>\"\r\n\r\n\r\nerror: Commit 05b99304caa9e0871b76497460e3ee2a1cd4392bbfd5a186da6684a0b17aa5e3: GPG verification enabled, but no signatures found (use gpg-verify=false in remote config to disable)\r\n```"}}
{"actor":{"display_login":"miabbott"}}