Test rpm-signing

.expeditor/verify.pipeline.yml

@@ -10,13 +10,6 @@ expeditor:
       timeout_in_minutes: 30
 
 steps:
-- label: run-lint-and-specs-ruby-2.7
-  command:
-    - .expeditor/run_linux_tests.sh rake
-  expeditor:
-    executor:
-      docker:
-        image: ruby:2.7-buster
 
 - label: run-lint-and-specs-ruby-3.0
   command:

lib/omnibus/packagers/rpm.rb

@@ -421,13 +421,15 @@ def create_rpm_file
 
       log.info(log_key) { "Creating .rpm file" }
       shellout!("#{command}")
-
+      log.info(log_key) { "<<<DEBUGGING Stmt  - omnibus-rpm.rb to check signing_passphrase : #{signing_passphrase} " }
       if signing_passphrase
         log.info(log_key) { "Signing enabled for .rpm file" }
-
+        log.info(log_key) { "<<<DEBUGGING Stmt  - omnibus-rpm.rb to  signing_passphrase : #{signing_passphrase} is enabled checking for RPM-macros " }
         if File.exist?("#{ENV["HOME"]}/.rpmmacros")
-          log.info(log_key) { "Detected .rpmmacros file at `#{ENV["HOME"]}'" }
+          log.info(log_key) { "Detected .rpmmacros file at `#{ENV["HOME"]}' \n rpmmacros:" }
           home = ENV["HOME"]
+          command2 = "cat #{ENV["HOME"]}/.rpmmacros "
+          shellout!("#{command2}")
         else
           log.info(log_key) { "Using default .rpmmacros file from Omnibus" }
 
@@ -441,15 +443,29 @@ def create_rpm_file
               gpg_path: "#{ENV["HOME"]}/.gnupg", # TODO: Make this configurable
             })
         end
-
+        # private_key_file = "/home/chef-ci/private_key"
+        # import_command = "gpg --import #{private_key_file}"
+        # stdout, stderr, status = Open3.capture3(import_command)
+        # if status.success?
+        #   puts "Key imported successfully"
+        # else
+        #   puts "Error importing key: #{stderr}"
+        # end
+        # gpg_key_id = "E3531A01"
+        # sign_cmd = "rpmsign --addsign --define '_gpg_name #{gpg_key_id}' #{rpm_file}"
         sign_cmd = "rpmsign --addsign #{rpm_file}"
+        log.info(log_key) { " DEBUGGING Stmt  - omnibus-rpm.rb Sign_cmd -#{sign_cmd} - rpm file - #{rpm_file}" }
         with_rpm_signing do |signing_script|
           log.info(log_key) { "Signing the built rpm file" }
 
           # RHEL 8 and Amazon-2023 has gpg-agent running so we can skip the expect script since the agent
           # takes care of the passphrase entering on the signing
           if dist_tag != ".el8" && dist_tag != ".el9" && dist_tag != ".amazon2023"
             sign_cmd.prepend("#{signing_script} \"").concat("\"")
+            log.info(log_key) { " DEBUGGING Stmt  - omnibus-rpm.rb RHEL 8 and Amazon-2023 has gpg-agent running so skipping the expect script -sign_cmd -  #{sign_cmd} AND signing_script -> #{signing_script}" }
+            log.info(log_key) { "<<<<<< signing_script - cat #{signing_script} " }
+            command1 = "cat #{signing_script} "
+            shellout!("#{command1}")
           end
 
           shellout!("#{sign_cmd}", environment: { "HOME" => home })
@@ -510,7 +526,7 @@ def rpm_file
     def with_rpm_signing(&block)
       directory   = Dir.mktmpdir
       destination = "#{directory}/sign-rpm"
-
+      log.info(log_key) { " <<<DEBUGGING Stmt  - omnibus-rpm.rb - with_rpm_signing defn - render signing.erb &  passphrase: signing_passphrase : #{signing_passphrase}" }
       render_template(resource_path("signing.erb"),
         destination: destination,
         mode: 0700,

omnibus.gemspec

@@ -31,6 +31,11 @@ Gem::Specification.new do |gem|
   gem.add_dependency "license_scout",    "~> 1.0"
   gem.add_dependency "contracts",        ">= 0.16.0", "< 0.17.0"
   gem.add_dependency "rexml",            "~> 3.2"
+  if Gem::Version.new(RUBY_VERSION) <= Gem::Version.new("3.1.0")
+    gem.add_dependency "ffi", "< 1.17.0"
+    gem.add_dependency "train-core", "< 3.12.5"
+    gem.add_dependency "public_suffix", "< 6.0.0"
+  end
 
   gem.add_dependency "mixlib-versioning"
   gem.add_dependency "pedump"

resources/rpm/rpmmacros.erb

@@ -1,3 +1,5 @@
 %_signature gpg
 %_gpg_path <%= gpg_path %>
 %_gpg_name <%= gpg_name %>
+%__gpg_sign_cmd %{__gpg} gpg --force-v3-sigs --batch --verbose --no-armor --passphrase-fd 3 --no-secmem-warning -u "%{_gpg_name}" -sbo %{__signature_filename} \
+--digest-algo sha256 %{__plaintext_filename}

resources/rpm/signing.erb

@@ -10,6 +10,7 @@ password = '<%= passphrase %>'
 require 'pty'
 
 puts rpm_cmd
+puts " <<< DEBUGGING Stmt  - omnibus-signing.erb  rpm_cmd - #{rpm_cmd}"
 PTY.spawn(rpm_cmd) do |r, w, pid|
   # Older versions of rpmsign will prompt right away for the passphrase
   prompt = r.read(19)