<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Clients can NOT auto-import keys (there’s an exception here for Red Hat keys, though, but I’m not going to cover that right now).<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">A human either must execute ‘rpm –import <key file or url>’, or import the key via yum the next time you install a package from the new channel/repo. There’s no other way around it. <o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The only way I’ve found to use the GPG key data in the Channel configuration, is to define the location as local to the client system (i.e. <a href="file:///\\etc\pki\rpm-gpg\key_file_name">file:////etc/pki/rpm-gpg/key_file_name</a>...) and when the first time you are on the host and run ‘yum install <some package from channel>’, RHN passes the GPG info to the host and then yum knows where to get the key from. However, it won’t auto import the key (this is a security/safety thing), you should be prompted to either import the key or you could have it auto-imported if you ran yum with the ‘-y’ (either way, a human still has to initiate the process).<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> spacewalk-list-bounces@redhat.com [mailto:spacewalk-list-bounces@redhat.com] <b>On Behalf Of </b>Frank Mikkelsen Blohmé<br> <b>Sent:</b> Wednesday, December 12, 2012 9:44 AM<br> <b>To:</b> spacewalk-list@redhat.com<br> <b>Subject:</b> Re: [Spacewalk-list] Hardware Vendor Repos<o:p></o:p></span></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">To my knowledge, the GPG key configured for a software channel doesn’t get imported by the clients. However I haven’t tested this thoroughly.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I download and place the GPG keys locally on the Spacewalk server, available over HTTP, distributed and imported by each client when they are kickstarted.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Anyone who knows if the clients can auto-import GPG keys based on the software channel configuration? If not, what are the configurable GPG software channel options good for?<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Best regards<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Frank Mikkelsen Blohmé<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Axis Communications AB – IT Group<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sweden, Lund <o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> spacewalk-list-bounces@redhat.com [mailto:spacewalk-list-bounces@redhat.com] <b>On Behalf Of </b>Ciro Iriarte<br> <b>Sent:</b> den 12 december 2012 14:18<br> <b>To:</b> spacewalk-list@redhat.com<br> <b>Subject:</b> Re: [Spacewalk-list] Hardware Vendor Repos<o:p></o:p></span></p> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal">2012/12/12 Ciro Iriarte <<a href="mailto:cyruspy@gmail.com" target="_blank">cyruspy@gmail.com</a>><o:p></o:p></p> <div> <div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt"> <div> <p class="MsoNormal">2012/12/12 Frank Mikkelsen Blohmé <<a href="mailto:frank.mikkelsen.blohme@axis.com" target="_blank">frank.mikkelsen.blohme@axis.com</a>><o:p></o:p></p> </div> <div> <div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt"> <div> <div> <div> <div> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">In Spacewalk you can only tie one RPM GPG key to a software channel, so syncing in RPM packages from various sources signed with different RPM GPG keys isn’t recommended. This can be circumvented by resigning all RPM packages with your own RPM GPG key before syncing them to Spacewalk. But then you will have to download the RPM packages somewhere before resigning them.</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">This is why a 1:1 relationship is most convenient, one repo (one RPM GPG key) to one Spacewalk software channel.</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">It’s easy to subscribe a host to a new channel in the GUI, can also be done on command line.</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">So if you have to add a new repo with RPM packages in the future:</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">1.</span><span style="font-size:7.0pt;color:#1F497D"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Create a new software channel in Spacewalk, a child channel to the base channel to which the host is subscribed.</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">2.</span><span style="font-size:7.0pt;color:#1F497D"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Configure the software channel using the repo’s RPM GPG key </span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">3.</span><span style="font-size:7.0pt;color:#1F497D"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sync the RPMs in the repo into the software channel.</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">4.</span><span style="font-size:7.0pt;color:#1F497D"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Subscribe the host to the new software channel</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">5.</span><span style="font-size:7.0pt;color:#1F497D"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Install the RPMs on the host</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I hope this help you.</span><o:p></o:p></p> <div> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Best regards</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Frank Mikkelsen Blohmé</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Axis Communications AB – IT Group</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sweden, Lund</span><o:p></o:p></p> <p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p> <div> <div> <div> <p> <o:p></o:p></p> </div> <div> <p>Hi!, isn't it easier to subscribe a server to one channel and add in the future the needed repositories?, that way you don't have to touch that node in the future (hmm, maybe rhel nodes would need GPG Keys for package from a new repository :s)<o:p></o:p></p> </div> <div> <p> <o:p></o:p></p> </div> <div> <p>I'm trying to understand the channel/repo relationship to cover the most common use cases...<o:p></o:p></p> </div> <div> <p> <o:p></o:p></p> </div> <div> <p>Regards,<o:p></o:p></p> </div> </div> <p><br clear="all"> <o:p></o:p></p> <div> <p> <o:p></o:p></p> </div> <p>-- <br> Ciro Iriarte<br> <a href="http://cyruspy.wordpress.com" target="_blank">http://cyruspy.wordpress.com</a><br> --<o:p></o:p></p> </div> </div> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> <div> <p class="MsoNormal">_______________________________________________<br> Spacewalk-list mailing list<br> <a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><o:p></o:p></p> </div> </blockquote> </div> <p class="MsoNormal"><br> Well, I was happy to split the repositories in different channels to solve the GPG key issue, but the management page gives me "invalid URL", apparently only local files are used, which defeats the purpose of adding the GPG URL for me...<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Ref:<o:p></o:p></p> </div> <div> <p class="MsoNormal"><a href="https://www.redhat.com/archives/spacewalk-list/2012-January/msg00202.html" target="_blank">https://www.redhat.com/archives/spacewalk-list/2012-January/msg00202.html</a><o:p></o:p></p> <div> <p class="MsoNormal"><br clear="all"> <o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Regards,<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <p class="MsoNormal">-- <br> Ciro Iriarte<br> <a href="http://cyruspy.wordpress.com" target="_blank">http://cyruspy.wordpress.com</a><br> --<o:p></o:p></p> </div> </div> </blockquote> </div> <p class="MsoNormal"><br> Well, the form didn't like FTP URLs (my bad?), but accepted a HTTP one. The clients wont import the key either way according to the mentioned thread, correct?.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Regards,<br clear="all"> <o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <p class="MsoNormal">-- <br> Ciro Iriarte<br> <a href="http://cyruspy.wordpress.com">http://cyruspy.wordpress.com</a><br> --<o:p></o:p></p> </div> </div> </body> </html>