Skip to content

Commit 5957d57

Browse files
damacusdamacus
committed
fix(install): resolve GPG key verification failures on RHEL platforms
- Add execute resource to import GPG key into RPM database - Set repo_gpgcheck=false to work around metadata signature issues - Add KITCHEN_LOCAL_YAML to mise.toml for Dokken driver - Enhance TESTING.md with comprehensive local development guide - Create FAILING_TESTS.md to track test failures and fixes Root cause: DNF on RHEL 9+ requires GPG keys to be imported into the RPM database, not just present as files. Additionally, repo metadata signatures can cause issues even when package signatures are valid. This fix enables all RHEL-based platform testing which were previously blocked. Signed-off-by: Dan Webb <[email protected]>
1 parent 7402b68 commit 5957d57

File tree

4 files changed

+253
-0
lines changed

4 files changed

+253
-0
lines changed

‎FAILING_TESTS.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Failing Tests Tracking
2+
3+
## Status: In Progress
4+
5+
Last Updated: 2025-10-16
6+
7+
## P0 - Blocking Issues
8+
9+
### 1. GPG Key Verification Failure on RHEL-based Platforms
10+
11+
**Affected Suites**: All suites on RHEL-based platforms (centos-stream-9, rockylinux-*, almalinux-*, oraclelinux-*)
12+
13+
**Platforms Affected**:
14+
15+
- centos-stream-9
16+
- centos-stream-10
17+
- rockylinux-8
18+
- rockylinux-9
19+
- rockylinux-10
20+
- almalinux-8
21+
- almalinux-9
22+
- almalinux-10
23+
- oraclelinux-8
24+
- oraclelinux-9
25+
26+
**Error Message**:
27+
```
28+
Public key for postgresql16-16.10-1PGDG.rhel9.aarch64.rpm is not installed
29+
GPG Keys are configured as: file:///etc/pki/rpm-gpg/PGDG-RPM-GPG-KEY
30+
Error: GPG check FAILED
31+
```
32+
33+
**Root Cause**:
34+
The GPG key file is created via `remote_file` resource, but DNF doesn't immediately trust it. The key needs to be imported into the RPM database before package installation.
35+
36+
**Reproduction Steps**:
37+
```bash
38+
kitchen test ident-16-centos-stream-9
39+
```
40+
41+
**Fix Strategy**:
42+
- Import GPG key into RPM database using `rpm --import` after downloading
43+
- Add execute resource to import key before yum_repository resources
44+
- Ensure key is imported during :repository action
45+
46+
**Priority**: P0 - Blocks all RHEL testing
47+
48+
**Status**: Identified, fix in progress
49+
50+
---
51+
52+
### 2. Ident Authentication Test Failure (CI Only)
53+
54+
**Affected Suites**: ident-* suites
55+
56+
**Platforms Affected**:
57+
- Seen in CI on centos-stream-9 (from CI logs)
58+
- **NOT reproducible locally on debian-12** (test passes)
59+
- Need to verify on RHEL platforms once GPG issue is fixed
60+
61+
**Error Message** (from CI):
62+
```
63+
Command: `sudo -u shef bash -c "psql -U sous_chef -d postgres -c 'SELECT 1;'"`
64+
exit_status is expected to eq 0
65+
got: 1
66+
```
67+
68+
**Root Cause**: Unknown - may be related to:
69+
- Service reload vs restart for ident changes
70+
- Timing issue with ident file application
71+
- Platform-specific peer authentication behavior
72+
73+
**Reproduction Steps**:
74+
```bash
75+
# Passes locally:
76+
kitchen test ident-16-debian-12
77+
78+
# Need to test on RHEL after fixing GPG issue:
79+
kitchen test ident-16-centos-stream-9
80+
```
81+
82+
**Fix Strategy**:
83+
- First fix GPG issue to test on RHEL platforms
84+
- Compare working Debian vs failing RHEL behavior
85+
- May need to change from `:reload` to `:restart` for ident changes
86+
- Add verification step before testing authentication
87+
88+
**Priority**: P0 - Blocks ident test suite
89+
90+
**Status**: Needs investigation after GPG fix
91+
92+
---
93+
94+
## P1 - Important but Not Blocking
95+
96+
None identified yet.
97+
98+
---
99+
100+
## P2 - Nice to Fix
101+
102+
None identified yet.
103+
104+
---
105+
106+
## Test Results Summary
107+
108+
### Passing Platforms
109+
- debian-12 (ident-16 suite confirmed passing)
110+
- ubuntu-* (likely passing, not yet tested)
111+
112+
### Failing Platforms
113+
- All RHEL-based platforms (GPG issue)
114+
115+
### Not Yet Tested
116+
- amazonlinux-2023
117+
- fedora-latest
118+
- opensuse-leap-15
119+
120+
---
121+
122+
## Next Steps
123+
124+
1. ✅ Document failing tests (this file)
125+
2. 🔄 Fix GPG key import issue for RHEL platforms
126+
3. ⏳ Re-test ident suite on RHEL after GPG fix
127+
4. ⏳ Audit remaining test suites for other failures
128+
5. ⏳ Run full test matrix on representative platforms

‎TESTING.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,114 @@
11
# Testing
22

33
Please refer to [the community cookbook documentation on testing](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/main/TESTING.MD).
4+
5+
## Quick Start for Local Testing
6+
7+
### Prerequisites
8+
9+
- **Chef Workstation**: Install from [Chef Downloads](https://www.chef.io/downloads/tools/workstation)
10+
- **Docker**: Required for Dokken driver (faster local testing)
11+
- macOS: [Docker Desktop](https://www.docker.com/products/docker-desktop)
12+
- Linux: Install via package manager
13+
14+
### Setup
15+
16+
1. **Enable Dokken driver** (faster than Vagrant):
17+
18+
```bash
19+
export KITCHEN_LOCAL_YAML=kitchen.dokken.yml
20+
```
21+
22+
Or add to your shell profile (`~/.bashrc`, `~/.zshrc`, or use `mise.toml`):
23+
24+
```bash
25+
echo 'export KITCHEN_LOCAL_YAML=kitchen.dokken.yml' >> ~/.zshrc
26+
```
27+
28+
2. **Verify setup**:
29+
30+
```bash
31+
kitchen list
32+
```
33+
34+
You should see Dokken as the driver for all instances.
35+
36+
### Running Tests
37+
38+
#### Run a single suite on one platform
39+
40+
```bash
41+
kitchen test ident-16-debian-12
42+
```
43+
44+
#### Run all platforms for a suite
45+
46+
```bash
47+
kitchen test ident-16
48+
```
49+
50+
#### Run specific suite on multiple platforms for verification
51+
52+
```bash
53+
kitchen test ident-16-debian-12 ident-16-ubuntu-2204 ident-16-rockylinux-9
54+
```
55+
56+
#### Debug a failing test
57+
58+
```bash
59+
# Create and converge the instance
60+
kitchen converge ident-16-debian-12
61+
62+
# Login to inspect
63+
kitchen login ident-16-debian-12
64+
65+
# Inside the container, check PostgreSQL status
66+
systemctl status postgresql-16
67+
cat /var/lib/pgsql/16/data/pg_ident.conf
68+
cat /var/lib/pgsql/16/data/pg_hba.conf
69+
tail -f /var/lib/pgsql/16/data/log/postgresql-*.log
70+
71+
# Run tests manually
72+
kitchen verify ident-16-debian-12
73+
74+
# Cleanup when done
75+
kitchen destroy ident-16-debian-12
76+
```
77+
78+
### Troubleshooting
79+
80+
#### Docker permission errors
81+
82+
```bash
83+
# Linux: Add your user to docker group
84+
sudo usermod -aG docker $USER
85+
# Then logout and login again
86+
```
87+
88+
#### Kitchen hangs or fails to start
89+
90+
```bash
91+
# Clean up old containers
92+
docker ps -a | grep kitchen | awk '{print $1}' | xargs docker rm -f
93+
94+
# Clean up dokken network
95+
docker network prune
96+
```
97+
98+
#### Tests pass locally but fail in CI
99+
100+
- Ensure you're using the same PostgreSQL version (check `node['test']['pg_ver']`)
101+
- Check platform differences (RHEL vs Debian package names, paths)
102+
- Review CI logs for specific error messages
103+
104+
### Test Suite Overview
105+
106+
- **access-\***: Tests `postgresql_access` resource (pg_hba.conf management)
107+
- **client-install-\***: Tests client-only installation
108+
- **extension-\***: Tests PostgreSQL extension installation
109+
- **ident-\***: Tests `postgresql_ident` resource (pg_ident.conf management)
110+
- **initdb-locale-\***: Tests database initialization with custom locale
111+
- **server-install-\***: Tests full server installation
112+
- **all-repos-install-\***: Tests installation with all repository options enabled
113+
- **no-repos-install-\***: Tests installation without PGDG repositories
114+
- **repo-\***: Tests repository configuration only

‎mise.toml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# .mise.toml
2+
3+
[env]
4+
PATH = "/opt/chef-workstation/bin:/opt/chef-workstation/embedded/bin:{{env.PATH}}"
5+
KITCHEN_LOCAL_YAML = "kitchen.dokken.yml"

‎resources/install.rb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,13 @@ def do_repository_action(repo_action)
126126
remote_file '/etc/pki/rpm-gpg/PGDG-RPM-GPG-KEY' do
127127
source new_resource.yum_gpg_key_uri
128128
sensitive new_resource.sensitive
129+
notifies :run, 'execute[import-pgdg-gpg-key]', :immediately
130+
end
131+
132+
execute 'import-pgdg-gpg-key' do
133+
command 'rpm --import /etc/pki/rpm-gpg/PGDG-RPM-GPG-KEY'
134+
action :nothing
135+
not_if 'rpm -q gpg-pubkey-08b40d20-* 2>/dev/null'
129136
end
130137

131138
yum_repository "PostgreSQL #{new_resource.version}" do
@@ -134,6 +141,7 @@ def do_repository_action(repo_action)
134141
baseurl yum_repo_url('https://download.postgresql.org/pub/repos/yum')
135142
enabled new_resource.repo_pgdg
136143
gpgcheck true
144+
repo_gpgcheck false
137145
gpgkey 'file:///etc/pki/rpm-gpg/PGDG-RPM-GPG-KEY'
138146
action repo_action
139147
only_if { new_resource.repo_pgdg || new_resource.setup_repo_pgdg }
@@ -145,6 +153,7 @@ def do_repository_action(repo_action)
145153
baseurl yum_common_repo_url
146154
enabled new_resource.repo_pgdg_common
147155
gpgcheck true
156+
repo_gpgcheck false
148157
gpgkey 'file:///etc/pki/rpm-gpg/PGDG-RPM-GPG-KEY'
149158
action repo_action
150159
only_if { new_resource.repo_pgdg_common || new_resource.setup_repo_pgdg_common }

0 commit comments

Comments
 (0)