🐛 Fix microdnf segfault by removing unsupported GPG keys

[elfosardo]

Remove problematic GPG keys (CentOS-SIG-Extras, centosofficial-PQC)
and explicitly import valid keys before package installation in
both Dockerfile wheel-builder stages and prepare-image.sh.
This preventsa microdnf segfault caused by attempting to use
unsupported keys.

[elfosardo]

/cc @tuminoid @Rozzii @dtantsur @lentzi90

[elfosardo]

/hold
testing a different workaround

[elfosardo]

/test metal3-centos-e2e-integration-test-main metal3-ubuntu-e2e-integration-test-main

[Copilot]

Pull request overview

This PR addresses a microdnf segfault issue in CentOS environments by removing problematic GPG keys and dynamically importing available official CentOS keys to ensure compatibility across CentOS 9 and 10.

Changes:

• Remove two specific GPG keys (RPM-GPG-KEY-CentOS-SIG-Extras and RPM-GPG-KEY-centosofficial-PQC) that cause microdnf to segfault
• Dynamically import remaining CentOS GPG keys using a wildcard pattern to handle naming variations between CentOS versions
• Refactor dnf configuration in Dockerfile to use printf with overwrite instead of echo with append

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 11 comments.

File	Description
prepare-image.sh	Adds GPG key cleanup and dynamic import logic before package installation in the main image preparation script
Dockerfile	Applies the same GPG key fix to the deps-wheel-builder stage and updates the dnf.conf creation approach

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tuminoid]

IMO this level failure at DNF should not be worked around as it surely is major issue over all. This has been reported to microdnf maintainers, so I'd like to wait for some comments/timeline estimates before merging this, regardless that it might block ironic-image release for a day or two.

[Rozzii]

I have no additional comments on top of the co-pilote comments, co-pilote concers seem to be very minor issues or rather considerations.

But I can't argue against @tuminoid 's request either as it is reasonable. I agree that we should not rush the release or the CI unblocking until at least we have an ETA for a real fix.

[elfosardo]

/test metal3-centos-e2e-integration-test-main metal3-ubuntu-e2e-integration-test-main

[elfosardo]

a new CS base image has been uploaded, local builds work again
let's leave this on hold for the time being, just in case

[Rozzii]

@elfosardo should we close this?

[elfosardo]

closing as the new images have fixed the gpg keys

[elfosardo]

/test metal3-centos-e2e-integration-test-main metal3-ubuntu-e2e-integration-test-main

[tuminoid]

Do we plan to backport this? At least 34.0 needs this.

[elfosardo]

/unhold

[elfosardo]

Do we plan to backport this? At least 34.0 needs this.

@tuminoid we could, I hope this is not actually needed for too long though

[tuminoid]

OK, builds passed. I'm not going to nit about the bash as we hopefully revert this in nearby future.

/lgtm

[Rozzii]

/approve

[metal3-io-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Rozzii

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Rozzii]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tuminoid]

/cherry-pick release-34.0

[metal3-io-bot]

@tuminoid: #894 failed to apply on top of branch "release-34.0":

Applying: Fix microdnf segfault by removing unsupported GPG keys
Using index info to reconstruct a base tree...
M	Dockerfile
Falling back to patching base and 3-way merge...
Auto-merging Dockerfile
CONFLICT (content): Merge conflict in Dockerfile
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Fix microdnf segfault by removing unsupported GPG keys

Details

In response to this:

/cherry-pick release-34.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.