<div dir="ltr"><div>As i see it, it is up to the subclass (e.g. AptReleaseSigningService, YumMetadataSigninigService, ...) to provide a stable interface. And the way it is implemented, the script for an AptReleaseSigninigService is required to report the filenames of both created signatures. And that is verified by the service before saving to the database.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 5, 2020 at 11:51 PM Dennis Kliban <<a href="mailto:dkliban@redhat.com">dkliban@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 5, 2020 at 3:39 AM Quirin Pamp <<a href="mailto:pamp@atix.de" target="_blank">pamp@atix.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div id="gmail-m_8353932931649697431m_-59539944953056316gmail-m_-5405251358577567675divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p style="margin-top:0px;margin-bottom:0px">Could you explain the reasoning for a 'public.key' file?</p></div></div></blockquote><div><br></div><div>The public.key file is the file that a yum/dnf client can use to verify that the metadata in an RPM repository was signed by the signing service associated with the repository. The name of the file can be anything - the path to it needs to be specified in the repository config on the client. <br></div><div></div><div></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div id="gmail-m_8353932931649697431m_-59539944953056316gmail-m_-5405251358577567675divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr"><p style="margin-top:0px;margin-bottom:0px">In the case of the AptReleaseSigningService we built for pulp_deb we saw zero need for this file and consequently did not add it in.</p>
<p style="margin-top:0px;margin-bottom:0px">(It would not be hard to add it just to satisfy the interface, it just would not serve any useful purpose.)</p></div></div></blockquote><div><br></div><div>It is definitely up to each plugin if it wants to provide the public key as part of the publication. It is currently impossible for the plugin to know exactly what files are produced by the signing service. This is where I would like to see an improvement in the API. Pupcore should provide a guarantee to plugin writers that a signing service configured by an administrator is functioning in a predictable way. One possible way to do that is with an interface that lets a plugin writer inspect a signing service without executing it. Though I am looking for other ideas in this area. <br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div id="gmail-m_8353932931649697431m_-59539944953056316gmail-m_-5405251358577567675divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p style="margin-top:0px;margin-bottom:0px"><br>
</p>
<p style="margin-top:0px;margin-bottom:0px">Since we are on the topic of signing services, a colleague has had a PR relating to them just sitting their waiting for a review for quite a while now ;-):<br>
<a href="https://github.com/pulp/pulpcore/pull/659" id="gmail-m_8353932931649697431m_-59539944953056316gmail-m_-5405251358577567675LPlnk611168" target="_blank">https://github.com/pulp/pulpcore/pull/659<br>
</a></p>
<p style="margin-top:0px;margin-bottom:0px"><br>
</p>
<p style="margin-top:0px;margin-bottom:0px">It would be great if you (or somebody else) could have a look at it. I believe it is mostly ready, but probably needs the eyes of an experienced pulp core developer to look over it and suggest style consistency changes
and where and whether to add documentation. <span>;-)</span></p></div></div></blockquote><div><br></div><div>I'll take a look at this PR. <br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div id="gmail-m_8353932931649697431m_-59539944953056316gmail-m_-5405251358577567675divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p style="margin-top:0px;margin-bottom:0px"><span><br>
</span></p>
<p style="margin-top:0px;margin-bottom:0px"><span>Quirin</span><br>
</p>
</div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_8353932931649697431m_-59539944953056316gmail-m_-5405251358577567675divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> <a href="mailto:pulp-dev-bounces@redhat.com" target="_blank">pulp-dev-bounces@redhat.com</a> <<a href="mailto:pulp-dev-bounces@redhat.com" target="_blank">pulp-dev-bounces@redhat.com</a>> on behalf of Dennis Kliban <<a href="mailto:dkliban@redhat.com" target="_blank">dkliban@redhat.com</a>><br>
<b>Sent:</b> 04 May 2020 22:50:54<br>
<b>To:</b> Pulp-dev <<a href="mailto:pulp-dev@redhat.com" target="_blank">pulp-dev@redhat.com</a>><br>
<b>Subject:</b> [Pulp-dev] signing service interface</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>The Plugin API of Signing Services in Pulp 3 is too vague. I came to this conclusion while working with @lieter on an RPM plugin feature that allows users to download a repo config file from a distribution[0]. As a result, we decided to document that the
signing service needs to produce a public key file named 'public.key'[1]. <br>
</div>
<div><br>
</div>
<div>We should revisit the design of the signing service API to ensure that we enforce this naming convention.
<br>
</div>
<div></div>
<div><br>
</div>
<div>[0] <a rel="nofollow" href="https://pulp.plan.io/issues/5356" target="_blank">https://pulp.plan.io/issues/5356</a></div>
<div>[1] <a href="https://github.com/pulp/pulp_rpm/pull/1687/files#diff-c91893c1f4e7afe73e414d1a76162463R30" target="_blank">
https://github.com/pulp/pulp_rpm/pull/1687/files#diff-c91893c1f4e7afe73e414d1a76162463R30</a>
</div>
</div>
</div>
</div>
</blockquote></div></div>
_______________________________________________<br>
Pulp-dev mailing list<br>
<a href="mailto:Pulp-dev@redhat.com" target="_blank">Pulp-dev@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/pulp-dev" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pulp-dev</a><br>
</blockquote></div>