{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/1596","repository_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide","labels_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/1596/labels{/name}","comments_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/1596/comments","events_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/1596/events","html_url":"https://github.com/OpenSCAP/scap-security-guide/issues/1596","id":192400838,"number":1596,"title":"RHEL/7.2 setting repo_gpgcheck=1 causes yum update to fail","user":{"login":"openprivacy","id":157095,"avatar_url":"https://avatars0.githubusercontent.com/u/157095?v=3","gravatar_id":"","url":"https://api.github.com/users/openprivacy","html_url":"https://github.com/openprivacy","followers_url":"https://api.github.com/users/openprivacy/followers","following_url":"https://api.github.com/users/openprivacy/following{/other_user}","gists_url":"https://api.github.com/users/openprivacy/gists{/gist_id}","starred_url":"https://api.github.com/users/openprivacy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openprivacy/subscriptions","organizations_url":"https://api.github.com/users/openprivacy/orgs","repos_url":"https://api.github.com/users/openprivacy/repos","events_url":"https://api.github.com/users/openprivacy/events{/privacy}","received_events_url":"https://api.github.com/users/openprivacy/received_events","type":"User","site_admin":false},"labels":[{"id":96001992,"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/bugfix","name":"bugfix","color":"fbca04","default":false},{"id":96001994,"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-11-29T21:14:00Z","updated_at":"2017-06-14T23:17:15Z","closed_at":null,"body":"I believe this worked in RHEL/7.1 but now having `repo_gpgcheck=1` in /etc/yum.conf is failing on our AWS instances with e.g.,\r\n`http://mirror.es.its.nyu.edu/epel/7/x86_64/repodata/repomd.xml.asc: [Errno 14] HTTP Error 404 - Not Found`\r\n\r\nThis bug is reported here: https://bugzilla.redhat.com/show_bug.cgi?id=1360939\r\n\r\nMy question is: is this a bug in RHEL or should the SSG no longer test for this value?"},"comment":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/comments/308584715","html_url":"https://github.com/OpenSCAP/scap-security-guide/issues/1596#issuecomment-308584715","issue_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/1596","id":308584715,"user":{"login":"redhatrises","id":8398836,"avatar_url":"https://avatars1.githubusercontent.com/u/8398836?v=3","gravatar_id":"","url":"https://api.github.com/users/redhatrises","html_url":"https://github.com/redhatrises","followers_url":"https://api.github.com/users/redhatrises/followers","following_url":"https://api.github.com/users/redhatrises/following{/other_user}","gists_url":"https://api.github.com/users/redhatrises/gists{/gist_id}","starred_url":"https://api.github.com/users/redhatrises/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/redhatrises/subscriptions","organizations_url":"https://api.github.com/users/redhatrises/orgs","repos_url":"https://api.github.com/users/redhatrises/repos","events_url":"https://api.github.com/users/redhatrises/events{/privacy}","received_events_url":"https://api.github.com/users/redhatrises/received_events","type":"User","site_admin":false},"created_at":"2017-06-14T23:17:15Z","updated_at":"2017-06-14T23:17:15Z","body":"> somehow by default now any repos we add expect to have the metadata signed\r\n\r\nThat is correct. SSG is now setting `repo_gpgcheck=1`. \r\n\r\n> Having RHEL check for signed metadata is new to me, so I'm not really sure if (taking my specific example) whether that one GPG key (jenkins-ci.org.key) should have been enough to validate both the RPMs and the metadata or if it is typical to publish a second GPG key just for metadata. Any insights there?\r\n\r\nShould only require the one gpg key. If you go here: https://dl.fedoraproject.org/pub/epel/7/x86_64/repodata/, you can see that `repomd.xml.asc` does not exist. If `repomd.xml.asc` exists, the repo was signed with a GPG key much like an RPM is signed with a GPG key."}}
{"actor":{"display_login":"redhatrises"}}