Infrastructure/infra-docs-fpo
1
0
Fork 0
Code Issues 100 Pull requests 6 Projects Releases Packages Wiki Activity Actions

Review pesign-upgrade SOP

Browse source 
Signed-off-by: Michal Konečný <mkonecny@redhat.com>
This commit is contained in:
Michal Konečný 2021-09-09 15:16:31 +02:00
parent 6de335abf0
commit 47d5ea6fcd
2 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/sysadmin_guide/nav.adoc
View file

@ -87,7 +87,7 @@
** xref:packagereview.adoc[Package Review - SOP] ** xref:packagereview.adoc[Package Review - SOP]
** xref:pagure.adoc[Pagure Infrastructure - SOP] ** xref:pagure.adoc[Pagure Infrastructure - SOP]
** xref:pdc.adoc[PDC - SOP] ** xref:pdc.adoc[PDC - SOP]
** xref:pesign-upgrade.adoc[pesign-upgrade - SOP in review ] ** xref:pesign-upgrade.adoc[Pesign upgrades/reboots - SOP]
** xref:planetsubgroup.adoc[planetsubgroup - SOP in review ] ** xref:planetsubgroup.adoc[planetsubgroup - SOP in review ]
** xref:publictest-dev-stg-production.adoc[publictest-dev-stg-production - SOP in review ] ** xref:publictest-dev-stg-production.adoc[publictest-dev-stg-production - SOP in review ]
** xref:rabbitmq.adoc[rabbitmq - SOP in review ] ** xref:rabbitmq.adoc[rabbitmq - SOP in review ]

14
modules/sysadmin_guide/pages/pesign-upgrade.adoc
View file

@ -2,7 +2,7 @@
Fedora has (currently) 2 special builders. These builders are used to Fedora has (currently) 2 special builders. These builders are used to
build a small set of packages that need to be signed for secure boot. build a small set of packages that need to be signed for secure boot.
These packages include: grub2, shim, kernel, pesign-test-app These packages include: _grub2_, _shim_, _kernel_, _pesign-test-app_
When rebooting or upgrading pesign on these machines, you have to follow When rebooting or upgrading pesign on these machines, you have to follow
a special process to unlock the signing keys. a special process to unlock the signing keys.
@ -20,15 +20,15 @@ Purpose::
== Procedure == Procedure
{empty}0. Coordinate with pesign maintainers or pesign-test-app [arabic]
. Coordinate with pesign maintainers or _pesign-test-app_
commiters as well as releng folks that have the pin to unlock the commiters as well as releng folks that have the pin to unlock the
signing key. signing key.
[arabic] . Remove builder from koji:
. remove builder from koji:
+ +
.... ....
koji disable-host bkernel01.phx2.fedoraproject.org koji disable-host bkernel01.iad2.fedoraproject.org
.... ....
. Make sure all builds have completed. . Make sure all builds have completed.
. Stop existing processes: . Stop existing processes:
@ -54,8 +54,8 @@ pesign-client -t "OpenSC Card (Fedora Signer)" -u
remove other builder: remove other builder:
+ +
.... ....
koji enable-host bkernel01.phx2.fedoraproject.org koji enable-host bkernel01.iad2.fedoraproject.org
koji disable-host bkernel02.phx2.fedoraproject.org koji disable-host bkernel02.iad2.fedoraproject.org
.... ....
. Have a commiter send a build of pesign-test-app and make sure it's . Have a commiter send a build of pesign-test-app and make sure it's
signed correctly. signed correctly.