gib/Panama
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pin Terra through repos.override.d so terra-release updates stop undoing it

Browse Source
This commit is contained in:
Gabriel Brown committed 2026-10-30 14:04:31 -04:00
1 parent 042885f113
commit c6fb2fa767
3 files changed
+94 -51
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

setup/provenance/README.md
+6 -2
View File
@@ -159,8 +159,12 @@ installed. Its effective `terra` configuration reported `gpgcheck = 1`,
`pkg_gpgcheck = 1`, and `repo_gpgcheck = 1`; no GPG-bypass option was used. `pkg_gpgcheck = 1`, and `repo_gpgcheck = 1`; no GPG-bypass option was used.
The package's own `/etc/yum.repos.d/terra.repo` uses its Terra metalink and The package's own `/etc/yum.repos.d/terra.repo` uses its Terra metalink and
`RPM-GPG-KEY-terra44`. That differs from Panama's deliberately staged local `RPM-GPG-KEY-terra44`. That differs from Panama's deliberately staged local
key/base-URL file in `install-packages`, which replaces the release-generated key and base URL. `install-packages` applies those after this verified
file only after this verified bootstrap step. bootstrap step as `/etc/dnf/repos.override.d/80-panama-terra.repo`, which dnf
lays over the package's file. The pin does not edit `terra.repo` itself,
because terra-release replaces that file on every update. Release 44-11 did
so on 2026-10-28, shipping `repo_gpgcheck=0`, and every Panama machine
stopped installing packages until the pin moved to the override directory.
Although the command runner returned after 30 seconds while DNF was still Although the command runner returned after 30 seconds while DNF was still
loading metadata, Podman's retained event log records the exact command's loading metadata, Podman's retained event log records the exact command's
setup/scripts/install-packages
+53 -33
View File
@@ -729,7 +729,8 @@ _publish_repository_pair() {
# Reads the gpgkey of the single enabled Terra identity out of dnf's effective # Reads the gpgkey of the single enabled Terra identity out of dnf's effective
# configuration, applying the structural safety rules either way: one enabled # configuration, applying the structural safety rules either way: one enabled
# identity, named terra, with every signature check turned on. # identity, named terra, with package signature checks turned on (and, in the
# pinned form, repository metadata checks too).
# #
# With require_pinned set it additionally demands Panama's own reviewed baseurl # With require_pinned set it additionally demands Panama's own reviewed baseurl
# and key path. Without it, the answer is just "what trust root is this machine # and key path. Without it, the answer is just "what trust root is this machine
@@ -772,7 +773,11 @@ _effective_terra_key() {
bad = 1 bad = 1
} }
if (values["gpgcheck"] != "1" || values["pkg_gpgcheck"] != "1" \ if (values["gpgcheck"] != "1" || values["pkg_gpgcheck"] != "1" \
|| values["repo_gpgcheck"] != "1" || values["gpgkey"] == "") bad = 1 || values["gpgkey"] == "") bad = 1
# Metadata signing is part of the pin, not of what adoption accepts:
# terra-release ships repo_gpgcheck=0, and the override adoption
# writes turns it back on.
if (require_pinned != "" && values["repo_gpgcheck"] != "1") bad = 1
trusted_key = values["gpgkey"] trusted_key = values["gpgkey"]
} }
BEGIN { BEGIN {
@@ -864,10 +869,12 @@ _terra_effective_status() {
# #
# The trust root is the signing key, not the URL it is served from. A machine # The trust root is the signing key, not the URL it is served from. A machine
# that installed Terra the way Terra documents has terra-release's own repo # that installed Terra the way Terra documents has terra-release's own repo
# file: a metalink instead of the reviewed baseurl, and the key at # file: a metalink instead of the reviewed baseurl, the key at
# RPM-GPG-KEY-terra44 rather than Panama's renamed copy. Every signature check # RPM-GPG-KEY-terra44 rather than Panama's renamed copy, and (since
# is already on, and that key is the same fingerprint this repository reviewed # terra-release 44-11) repo_gpgcheck=0. Package signature checks are on, and
# and pinned. Cosmetics, in other words -- not a compromised trust root. # that key is the same fingerprint this repository reviewed and pinned. The pin
# adoption writes restores metadata checking, so none of that is a compromised
# trust root.
# #
# Refusing it outright built a gate with no door. install_terra_repository # Refusing it outright built a gate with no door. install_terra_repository
# declined to touch a machine terra-release had already reached, so an ordinary # declined to touch a machine terra-release had already reached, so an ordinary
@@ -1002,33 +1009,51 @@ install_rpmfusion_repositories() {
# trust root rolls back. The effective state is re-read afterwards, because the # trust root rolls back. The effective state is re-read afterwards, because the
# only acceptable proof that adoption worked is the check that judged it. # only acceptable proof that adoption worked is the check that judged it.
# #
# terra-release owns /etc/yum.repos.d/terra.repo, so a later update to that # Panama's Terra pin, as a dnf repos.override.d drop-in on top of whatever
# package restores the stock file. That is fine and deliberate: the next run # /etc/yum.repos.d/terra.repo says. terra-release owns that file and replaces
# adopts it again, which is why adoption has to be repeatable rather than a # it on every update (an edited copy is set aside as terra.repo.rpmsave), so a
# one-time migration. # pin written there lasted only until the next terra-release release. Nothing
# owns the override directory, and its values win over the repo file's.
TERRA_OVERRIDE=/etc/dnf/repos.override.d/80-panama-terra.repo
_write_terra_pin() {
printf '%s\n' \
'[terra]' \
'name=Panama reviewed Terra 44' \
"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
'metalink=' \
'mirrorlist=' \
'enabled=1' \
'gpgcheck=1' \
'repo_gpgcheck=1' \
'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$1"
chmod 0600 "$1"
}
_ensure_override_dir() {
[[ -d "$PANAMA_SYSTEM_ETC/dnf/repos.override.d" ]] && return 0
sudo mkdir -p -- /etc/dnf/repos.override.d
}
# A stock terra-release file (or one an older Panama rewrote) gets the pin laid
# over it. Adoption stays repeatable: if the override is ever removed, the next
# run puts it back.
adopt_terra_repository() { adopt_terra_repository() {
local work staged_key staged_repo status=0 effective_status=0 local work staged_key staged_repo status=0 effective_status=0
work="$(mktemp -d)" || return 1 work="$(mktemp -d)" || return 1
chmod 0700 "$work" chmod 0700 "$work"
staged_key="$work/terra44.asc" staged_key="$work/terra44.asc"
staged_repo="$work/terra.repo" staged_repo="$work/80-panama-terra.repo"
if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \ if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \
TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then
rm -rf -- "$work" rm -rf -- "$work"
return 1 return 1
fi fi
printf '%s\n' \ _write_terra_pin "$staged_repo"
'[terra]' \ _ensure_override_dir || status=$?
'name=Panama reviewed Terra 44' \ (( status == 0 )) && { _publish_repository_pair \
"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
'enabled=1' \
'gpgcheck=1' \
'repo_gpgcheck=1' \
'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$staged_repo"
chmod 0600 "$staged_repo"
_publish_repository_pair \
"$staged_key" /etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \ "$staged_key" /etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \
"$staged_repo" /etc/yum.repos.d/terra.repo || status=$? "$staged_repo" "$TERRA_OVERRIDE" || status=$?; }
if (( status == 0 )); then if (( status == 0 )); then
_terra_effective_status || effective_status=$? _terra_effective_status || effective_status=$?
(( effective_status == 0 )) || status="$TERRA_TRUST_FAILURE_STATUS" (( effective_status == 0 )) || status="$TERRA_TRUST_FAILURE_STATUS"
@@ -1064,7 +1089,7 @@ install_terra_repository() {
work="$(mktemp -d)" || return 1 work="$(mktemp -d)" || return 1
chmod 0700 "$work" chmod 0700 "$work"
staged_key="$work/terra44.asc" staged_key="$work/terra44.asc"
staged_repo="$work/terra.repo" staged_repo="$work/80-panama-terra.repo"
if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \ if ! _stage_reviewed_key "$PANAMA_PATH/setup/provenance/keys/terra44.asc" "$staged_key" \
TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then TERRA_FINGERPRINT AE09157A4DE88B497EA1D5D300CDAB43DE226D6F; then
rm -rf -- "$work" rm -rf -- "$work"
@@ -1074,15 +1099,7 @@ install_terra_repository() {
rm -rf -- "$work" rm -rf -- "$work"
return 1 return 1
} }
printf '%s\n' \ _write_terra_pin "$staged_repo"
'[terra]' \
'name=Panama reviewed Terra 44' \
"baseurl=${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
'enabled=1' \
'gpgcheck=1' \
'repo_gpgcheck=1' \
'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' > "$staged_repo"
chmod 0600 "$staged_repo"
status=0 status=0
sudo dnf install -y \ sudo dnf install -y \
--repofrompath "terra,${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \ --repofrompath "terra,${INSTALLER_PROVENANCE[TERRA_BASEURL]}" \
@@ -1091,7 +1108,10 @@ install_terra_repository() {
--setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \ --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama \
terra-release || status=$? terra-release || status=$?
if (( status == 0 )); then if (( status == 0 )); then
sudo install -m 0644 "$staged_repo" /etc/yum.repos.d/terra.repo || status=$? _ensure_override_dir || status=$?
fi
if (( status == 0 )); then
sudo install -m 0644 "$staged_repo" "$TERRA_OVERRIDE" || status=$?
fi fi
if (( status == 0 )); then if (( status == 0 )); then
effective_status=0 effective_status=0
tests/setup/package-provenance-contract
+35 -16
View File
@@ -901,17 +901,26 @@ if [[ -n "$query" ]]; then
wrong-url) mode=override-url ;; wrong-url) mode=override-url ;;
stock|stock-wrong-key) mode=stock ;; stock|stock-wrong-key) mode=stock ;;
esac esac
# Adoption rewrites the repository file. Once it is the pinned form the # Adoption and a fresh install write the pin as a repos.override.d
# dump has to say so, or the re-verification adoption performs on itself # drop-in, which dnf lays over the repository file. Once it is there
# could never pass. # the dump has to say so, or the re-verification each performs on
if [[ "$mode" == stock && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \ # itself could never pass.
&& grep -q '^gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama$' \ override="$STUB_ETC/dnf/repos.override.d/80-panama-terra.repo"
"$STUB_ETC/yum.repos.d/terra.repo"; then pinned_override=0
if [[ -f "$override" ]] \
&& grep -q '^gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama$' "$override" \
&& grep -q '^baseurl=https://repos.fyralabs.com/terra44$' "$override" \
&& grep -qx 'metalink=' "$override"; then
pinned_override=1
fi
if [[ "$mode" == stock && "$pinned_override" == 1 ]]; then
mode=trusted mode=trusted
fi fi
if [[ "$mode" == auto && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \ if [[ "$mode" == auto && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \
&& grep -q '^baseurl=https://repos.fyralabs.com/terra44$' "$STUB_ETC/yum.repos.d/terra.repo"; then && grep -q '^baseurl=https://repos.fyralabs.com/terra44$' "$STUB_ETC/yum.repos.d/terra.repo"; then
mode=trusted mode=trusted
elif [[ "$mode" == auto && "$pinned_override" == 1 ]]; then
mode=trusted
elif [[ "$mode" == auto ]]; then elif [[ "$mode" == auto ]]; then
mode=absent mode=absent
fi fi
@@ -945,7 +954,7 @@ if [[ -n "$query" ]]; then
printf 'baseurl = \nenabled = 1\ngpgcheck = 1\n' printf 'baseurl = \nenabled = 1\ngpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n' printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n'
printf 'metalink = https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=x86_64\n' printf 'metalink = https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=x86_64\n'
printf 'mirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n' printf 'mirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 0\n'
;; ;;
override-url) override-url)
printf '======== "terra" repository configuration: ========\n' printf '======== "terra" repository configuration: ========\n'
@@ -1150,7 +1159,7 @@ run_installer_function() {
cp "$installer_fixture/setup/provenance/keys/flathub.asc" \ cp "$installer_fixture/setup/provenance/keys/flathub.asc" \
"$case_root/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44" "$case_root/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44"
fi fi
printf '[terra]\nmetalink=https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=$basearch\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n' \ printf '[terra]\nmetalink=https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=$basearch\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=0\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n' \
> "$case_root/etc/yum.repos.d/terra.repo" > "$case_root/etc/yum.repos.d/terra.repo"
;; ;;
wrong-key) wrong-key)
@@ -1663,7 +1672,8 @@ rpm:query:terra-release
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
sudo:install:terra44.asc:/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama sudo:install:terra44.asc:/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama
sudo:dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 --setopt=terra.pkg_gpgcheck=1 --setopt=terra.repo_gpgcheck=1 --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama terra-release sudo:dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 --setopt=terra.pkg_gpgcheck=1 --setopt=terra.repo_gpgcheck=1 --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama terra-release
sudo:install:terra.repo:/etc/yum.repos.d/terra.repo sudo:mkdir -p -- /etc/dnf/repos.override.d
sudo:install:80-panama-terra.repo:/etc/dnf/repos.override.d/80-panama-terra.repo
dnf:dump-all:locale=C dnf:dump-all:locale=C
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
@@ -1672,10 +1682,12 @@ EXPECTED
cmp -s "$installer_fixture/setup/provenance/keys/terra44.asc" \ cmp -s "$installer_fixture/setup/provenance/keys/terra44.asc" \
"$test_tmp/cases/terra/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama" \ "$test_tmp/cases/terra/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama" \
|| fail 'Terra privileged install did not preserve the fully staged reviewed key' || fail 'Terra privileged install did not preserve the fully staged reviewed key'
assert_file_bytes "$test_tmp/cases/terra/etc/yum.repos.d/terra.repo" "$(cat <<'EXPECTED' assert_file_bytes "$test_tmp/cases/terra/etc/dnf/repos.override.d/80-panama-terra.repo" "$(cat <<'EXPECTED'
[terra] [terra]
name=Panama reviewed Terra 44 name=Panama reviewed Terra 44
baseurl=https://repos.fyralabs.com/terra44 baseurl=https://repos.fyralabs.com/terra44
metalink=
mirrorlist=
enabled=1 enabled=1
gpgcheck=1 gpgcheck=1
repo_gpgcheck=1 repo_gpgcheck=1
@@ -1804,9 +1816,12 @@ for mode in nogpg wrong-url wrong-key absent; do
done done
# A machine that installed Terra the way Terra documents it. The repository file # A machine that installed Terra the way Terra documents it. The repository file
# is terra-release's own -- a metalink, and the key at its stock path -- so it is # is terra-release's own -- a metalink, the key at its stock path, and
# not Panama's pinned form, but it IS the fingerprint this repository reviewed, # repo_gpgcheck=0 as terra-release 44-11 ships it -- so it is not Panama's
# with every signature check on. That is an adoption, not a compromise. # pinned form, but it IS the fingerprint this repository reviewed, with package
# signature checks on. That is an adoption, not a compromise. The pin goes in a
# repos.override.d drop-in, because terra-release replaces its own repo file on
# every update and a pin written there did not survive the next one.
# #
# Refusing it was a gate with no door: the ordinary Fedora desktop could never # Refusing it was a gate with no door: the ordinary Fedora desktop could never
# reach the pinned state, and status 78 then stopped every stage of every run, # reach the pinned state, and status 78 then stopped every stage of every run,
@@ -1818,13 +1833,17 @@ STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock \
reset_installer_fixture reset_installer_fixture
STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock \ STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock \
expect_success run_installer_function terra-stock-adopt install_terra_repository expect_success run_installer_function terra-stock-adopt install_terra_repository
terra_adopted="$test_tmp/cases/terra-stock-adopt/etc/yum.repos.d/terra.repo" terra_adopted="$test_tmp/cases/terra-stock-adopt/etc/dnf/repos.override.d/80-panama-terra.repo"
grep -qx 'baseurl=https://repos.fyralabs.com/terra44' "$terra_adopted" \ grep -qx 'baseurl=https://repos.fyralabs.com/terra44' "$terra_adopted" \
|| fail 'adoption left Terra off the reviewed baseurl' || fail 'adoption left Terra off the reviewed baseurl'
grep -qx 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' "$terra_adopted" \ grep -qx 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' "$terra_adopted" \
|| fail 'adoption left Terra off the reviewed key path' || fail 'adoption left Terra off the reviewed key path'
grep -q 'metalink' "$terra_adopted" \ grep -qx 'metalink=' "$terra_adopted" \
&& fail 'adoption kept the metalink it was supposed to replace' || fail 'adoption did not clear the metalink it was supposed to replace'
grep -qx 'repo_gpgcheck=1' "$terra_adopted" \
|| fail 'adoption did not turn repository metadata checks back on'
grep -q 'RPM-GPG-KEY-terra44$' "$test_tmp/cases/terra-stock-adopt/etc/yum.repos.d/terra.repo" \
|| fail "adoption rewrote terra-release's own repository file"
[[ "$(<"$test_tmp/cases/terra-stock-adopt/commands.log")" != *'dnf:install'* ]] \ [[ "$(<"$test_tmp/cases/terra-stock-adopt/commands.log")" != *'dnf:install'* ]] \
|| fail 'adoption opened a DNF transaction it does not need' || fail 'adoption opened a DNF transaction it does not need'