Special Interest Groups

CentOS clearly defines what a SIG (Special Interest Group) is : a group of people sharing interest into a specific task/tech area, and willing to build/test/deliver artifacts (like RPM packages) that CentOS users can then consume.

Each SIG must be approved by the CentOS board, and no action should be taken before that. Once approved and CentOS board meeting minutes published, we can (Infra and Releng) proceed with next steps :

SIG onboarding

We first need to create the SIG group in IPA (if it doesn't exist yet) and it shouldn't of course conflict with any existing. Requirements:

• a user with admin right in IPA to be able to create the group
• a shell account on an enrolled machine (like ipa-shell.iad2.centos.org but can be any enrolled node within the @FEDORAPROJECT.ORG REALM (verify that you have a valid krb5 ticket or next steps will fail)
• a SIG name and description
• at least one SIG member that will be the chair (meaning that he'll be himself then able to add/remove other SIG users in that group

We can use either the IPA UI, or for automation purposes,just use the ipa cli. Basicall three commands:

• ipa group-add : to create the group
• ipa group-add-member : to add the first user
• ipa group-add-member-manager : to grant "sponsor" right to sig chair, himself then able to add users

Here is a full output/example about creating the sig-kmods with one chair (valid IPA/FAS account) :

# Defininig first some variables
sig_name="sig-kmods"
sig_description="The CentOS kmods SIG"
sig_chair="pjgeorg"

# Now creating group and granting rights
ipa group-add --desc="${sig_description}" --fasgroup ${sig_name}
-----------------------
Added group "sig-kmods"
-----------------------
  Group name: sig-kmods
  Description: The CentOS kmods SIG
  GID: 1494370508
  FAS group: True

ipa group-add-member ${sig_name} --users=${sig_chair}
  Group name: sig-kmods
  Description: The CentOS kmods SIG
  GID: 1494370508
  Member users: pjgeorg
  Membership managed by users: pjgeorg
-------------------------
Number of members added 1
-------------------------

ipa group-add-member-manager ${sig_name} --users=${sig_chair}
  Group name: sig-kmods
  Description: The CentOS kmods SIG
  GID: 1494370508
  Membership managed by users: pjgeorg
-------------------------
Number of members added 1
-------------------------

If you need to add later more "sponsor" user, just repeat the ipa group-add-member-manager operation with new user.

At this stage, the group should appear throug portal on https://accounts.centos.org

Worth knowing also that in the next minutes, an automatic email alias is created for the group following the naming convention sig-<name>@centosproject.org and that will automatically include all sig members email addresses, once added (and removed when removed)

Same for SIG members : an email alias following the <user>@centosproject.org alias is also created for all SIG members (and pointing to the email address they used when they registered their ACO/FAS account) More informations about this in the Ansible postfix role

While not fully needed, it's now a good idea to send mail to that new SIG to welcome them. Something like this :

To: <sig_name>@centosproject.org
Subject: Welcome to the new <sig_name> SIG !

Hi,

This welcome email means that your new group <sig_name> was created and granted some management rights to at least the SIG Chair.
The group should appear now on https://accounts.centos.org/group/<sig_name>/

Also worth knowing that each SIG member is also automatically granted an email alias following this convention : <user>@centosproject.org

If you have any needs, requests, feel free to contact the CentOS Infra and Releng team through https://pagure.io/centos-infra/issues.

Kind Regards,

Security GPG key for packages signing

Each SIG building RPM packages through https://cbs.centos.org community build service will need a GPG security key that will be then automatically be used by the signing service

We first need to create a new GPG key on the signing machine , protected with a strong passphrase, that will be needed to unlock signing service/agent.

To generate a strong passphrase you can for example use openssl rand -base64 30 (or any other strong/long passphrase generator)

Let's use the sig-kmods SIG as an example for the next steps (and of course adapt on each operation, manual step) We first need to ssh as the signing user (important for TTY) on the signing service machine. Then we can proceed like this :

# Let's define some variables first
sig_name="CentOS Kmods SIG"
sig_url="https://wiki.centos.org/SpecialInterestGroup/Kmods"
sig_key_passphrase="Of_Course_A_Real_Passphrase_generated_as_described_above" 
# Creating the key in keyring
gpg --batch --gen-key <<EOF
Key-Type: 1
Key-Length: 2048
Subkey-Type: 1
Subkey-Length: 2048
Name-Real: ${sig_name}
Name-Comment: ${sig_url}
Name-Email: security@centos.org
Passphrase: ${sig_key_passphrase}
Expire-Date: 0
EOF

gpg: key 7AE06D54 marked as ultimately trusted

As we can see the key was created but we have first to unlock it now (in gpg-agent) with the generated passphrase, otherwise CBS signing service will be blocked (replace obviously gpg key id with the output above) :

# Unlocking the key
key_id=$(gpg --list-keys | egrep -B 1 "${sig_name}"|head -n 1|awk '{print $2}'|cut -f 2 -d '/')
test_file=$(mktemp)
timeout 30 gpg --batch --sign -b --use-agent --local-user ${key_id} ${test_file} && rm ${test_file} || echo "Signing failed"

Now that CBS signing service is ready, we have to export the new key and so push it to the website (so that people can see it publicly to verify and also have it embedded in a centos-release-* rpm pkg :

# extract key
gpg --export --armor ${key_id} > /var/tmp/RPM-GPG-KEY-CentOS-SIG-$(echo ${sig_name/CentOS/}|sed 's/SIG//')
gpg --with-fingerprint /var/tmp/RPM-GPG-KEY-CentOS-SIG-$(echo ${sig_name/CentOS/}|sed 's/SIG//')

pub  2048R/7AE06D54 2021-06-22 CentOS Kmods SIG (https://wiki.centos.org/SpecialInterestGroup/Kmods) <security@centos.org>
      Key fingerprint = 48EF 712E C5DD B68B 5280  BE45 5B8E 1A76 7AE0 6D54
sub  2048R/E46DCBCB 2021-06-22

Now either submit a PR or directly do a git commit/push to CentOS.org git repository and key will be available on website automatically after. Simply drop the RPM-GPG-KEY-CentOS-SIG-<name> under /keys/ directory and update /keys.md to add the link to download the key and show fingerprint

Here is the Kmods SIG commit given a reference

Last step is to then play the stylo role with ansible after having updated the signing node stylo_gpg_sigs list in host_vars. Attention that gpg key id has to be written in lowercase though :

• update ansible inventory with new gpg keyid / sig name
• ansible-playbook playbooks/role-stylo.yml --tags "config"

Koji tags creation