Infrastructure/ansible
3
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

robosignatory: enable ima signing for eln

Browse source 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2022-07-29 09:20:00 -07:00
parent f94ab9a54b
commit ba5f21fc48
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/robosignatory/templates/robosignatory.toml.j2
View file

@ -332,6 +332,7 @@ handlers = ["console"]
to = "eln-updates-testing-pending" to = "eln-updates-testing-pending"
key = "{{ (env == 'production')|ternary('fedora-37', 'testkey') }}" key = "{{ (env == 'production')|ternary('fedora-37', 'testkey') }}"
keyid = "{{ (env == 'production')|ternary('5323552a', 'd300e724') }}" keyid = "{{ (env == 'production')|ternary('5323552a', 'd300e724') }}"
file_signing_key = "fedora-37-ima"
[[consumer_config.koji_instances.primary.tags]] [[consumer_config.koji_instances.primary.tags]]
from = "eln-modular-updates-candidate" from = "eln-modular-updates-candidate"
@ -339,6 +340,7 @@ handlers = ["console"]
key = "{{ (env == 'production')|ternary('fedora-37', 'testkey') }}" key = "{{ (env == 'production')|ternary('fedora-37', 'testkey') }}"
keyid = "{{ (env == 'production')|ternary('5323552a', 'd300e724') }}" keyid = "{{ (env == 'production')|ternary('5323552a', 'd300e724') }}"
type = "modular" type = "modular"
file_signing_key = "fedora-37-ima"
# ELN Mass Rebuild # ELN Mass Rebuild
@ -347,6 +349,7 @@ handlers = ["console"]
to = "eln-rebuild" to = "eln-rebuild"
key = "{{ (env == 'production')|ternary('fedora-37', 'testkey') }}" key = "{{ (env == 'production')|ternary('fedora-37', 'testkey') }}"
keyid = "{{ (env == 'production')|ternary('5323552a', 'd300e724') }}" keyid = "{{ (env == 'production')|ternary('5323552a', 'd300e724') }}"
file_signing_key = "fedora-37-ima"
# ELN Side tags # ELN Side tags
@ -355,6 +358,7 @@ handlers = ["console"]
from = '<sidetag>-signing-pending' from = '<sidetag>-signing-pending'
to = '<sidetag>-testing-pending' to = '<sidetag>-testing-pending'
trusted_taggers = ['bodhi'] trusted_taggers = ['bodhi']
file_signing_key = "fedora-37-ima"
# openh264 signing # openh264 signing