Skip to content

Use Sequoia in RHEL 10 instead of GPG#14193

Merged
jan-cerny merged 16 commits intoComplianceAsCode:masterfrom
vojtapolasek:add_sq_to_rhel10
Dec 12, 2025
Merged

Use Sequoia in RHEL 10 instead of GPG#14193
jan-cerny merged 16 commits intoComplianceAsCode:masterfrom
vojtapolasek:add_sq_to_rhel10

Conversation

@vojtapolasek
Copy link
Collaborator

@vojtapolasek vojtapolasek commented Nov 28, 2025 •
edited
Loading

Description:

  • create a new rule package_sequoia-sq_installed
  • enhance rule ensure_redhat_gpgkey_installed so that it uses the sq command instead of gpg n RHEL 10
  • check for new PQC key in RHEL >= 10
  • The build system ordering takes care that the sq package is installed so that it can be later used. So in case rule ensure_redhat_gpgkey_installed exists in the profile, the rule package_sequoia-sq_installed should be present in the profile as well.
  • Modify all RHEL 10 profiles so that the new rule is there. This involved also exempting the rule from many other profiles which are based on the same control file (ANSSI, PCI-DSS, OSPP etc)

Rationale:

  • There are two reasons for this change.
    • there is a new RPM release key in RHEL >= 10 and it needs to be checked that it exists
    • in case this key is shipped, the regular gpg command cannot handle it and it needs to be inspected with the sq command

Review Hints:

Test with Automatus. But ensure that the RHEL machine contains all three keys.

@vojtapolasek vojtapolasek added this to the 0.1.80 milestone Nov 28, 2025
@vojtapolasek vojtapolasek added New Rule Issues or pull requests related to new Rules. Update Profile Issues or pull requests related to Profiles updates. RHEL10 Red Hat Enterprise Linux 10 product related. labels Nov 28, 2025
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Nov 28, 2025
@openshift-ci
Copy link

openshift-ci bot commented Nov 28, 2025

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@vojtapolasek vojtapolasek changed the title WIP: Use Sequoia in RHEL 10 instead of GPG Use Sequoia in RHEL 10 instead of GPG Dec 2, 2025
@vojtapolasek vojtapolasek marked this pull request as ready for review December 2, 2025 13:48
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Dec 2, 2025
@jan-cerny jan-cerny self-assigned this Dec 2, 2025
jan-cerny
jan-cerny reviewed Dec 2, 2025
View reviewed changes
components/rpm.yml Outdated
name: rpm
packages:
- rpm
- sequoia-sq
Copy link
Collaborator

@jan-cerny jan-cerny Dec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should it be a new separate component file instead?

Copy link
Collaborator Author

@vojtapolasek vojtapolasek Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably yes, I did that in c79b55d

linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml
{{% endif %}}

- name: Import RedHat GPG key
- name: "{{{ rule_title }}}: Import RedHat GPG key"
Copy link
Collaborator

@jan-cerny jan-cerny Dec 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In automatus tests, I'm still getting this fail. Is it expected? Is it the bug in Ansible?

"gpg: directory '/root/.gnupg' created\ngpg: WARNING: no command supplied.  Trying to guess what you mean ...\ngpg: /root/.        gnupg/trustdb.gpg: trustdb created\ngpg: packet(6) with unknown version 6\n"

Copy link
Collaborator Author

@vojtapolasek vojtapolasek Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is caused by the Ansible rpm_key module.
Here is their issue: ansible/ansible#86157

jan-cerny
jan-cerny requested changes Dec 4, 2025
View reviewed changes
products/rhel10/profiles/e8.profile Outdated
- '!package_rsh-server_removed'
- '!security_patches_up_to_date'
# the rule ensure_redhat_gpgkey_installed needs a special package on RHEL 10 which is not installed by default
- package_sequoia-sq_installed
Copy link
Collaborator

@jan-cerny jan-cerny Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You have two options how to solve the failing static-checks reference test.

  1. Add the rule to the control file and then deselect it in profile files in products where this shouldn't be present.
  2. Add an ISM_O reference to the rule.yml file in package_sequoia-sq_installed.

Copy link
Member

@Mab879 Mab879 Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Option 2 will not work, you cannot mix control file references and in file references.

@vojtapolasek vojtapolasek requested review from a team as code owners December 8, 2025 14:40
@openshift-merge-robot openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Dec 8, 2025
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Dec 8, 2025
@vojtapolasek
Copy link
Collaborator Author

vojtapolasek commented Dec 9, 2025

@jan-cerny I added the rule to all relevant RHEL 10 profiles.

@jan-cerny
Copy link
Collaborator

jan-cerny commented Dec 9, 2025

@vojtapolasek Unfortunately, the static-checks test still has problems with some references. See the test output https://artifacts.dev.testing-farm.io/992274c6-fdf8-4db5-821f-21487b721236/

@openshift-ci
Copy link

openshift-ci bot commented Dec 11, 2025

@vojtapolasek: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-openshift-node-compliance ac9f4e3 link true /test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@jan-cerny
Copy link
Collaborator

jan-cerny commented Dec 11, 2025

@ComplianceAsCode/suse-maintainers @ComplianceAsCode/ubuntu-maintainers @ComplianceAsCode/oracle-maintainers Can you please review this? It shouldn't add anything to your product's profiles.

@vojtapolasek
Copy link
Collaborator Author

vojtapolasek commented Dec 11, 2025

@jan-cerny I believe I solved all problems with missing references.

mrkanon
mrkanon approved these changes Dec 11, 2025
View reviewed changes
Copy link
Contributor

@mrkanon mrkanon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

teacup-on-rockingchair
teacup-on-rockingchair approved these changes Dec 11, 2025
View reviewed changes
Copy link
Contributor

@teacup-on-rockingchair teacup-on-rockingchair left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@jan-cerny jan-cerny merged commit 1b3a792 into ComplianceAsCode:master Dec 12, 2025
134 of 140 checks passed
@ggbecker ggbecker added the Highlight This PR/Issue should make it to the featured changelog. label Mar 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@teacup-on-rockingchair teacup-on-rockingchair teacup-on-rockingchair approved these changes

@mpurg mpurg mpurg approved these changes

@jan-cerny jan-cerny jan-cerny approved these changes

@mrkanon mrkanon mrkanon approved these changes

@matusmarhefka matusmarhefka Awaiting requested review from matusmarhefka matusmarhefka is a code owner

@Mab879 Mab879 Awaiting requested review from Mab879 Mab879 is a code owner

Assignees

@jan-cerny jan-cerny

Labels

Highlight This PR/Issue should make it to the featured changelog. New Rule Issues or pull requests related to new Rules. RHEL10 Red Hat Enterprise Linux 10 product related. Update Profile Issues or pull requests related to Profiles updates.

Projects

None yet

Milestone

0.1.80

Development

Successfully merging this pull request may close these issues.

8 participants

@vojtapolasek @jan-cerny @Mab879 @teacup-on-rockingchair @mpurg @mrkanon @ggbecker @openshift-merge-robot