koji build fail with "certificate verify failed"

来源：互联网发布：js设置html标签隐藏编辑：程序博客网时间：2024/05/16 14:14

Many Fedora packagers are seeing koji build not working, starting from 12th of December 2016 at 00:00UTC.

Koji build appears to be blocked there, with no error message printed. By adding "-d" to koji build command, errors below is seen:

$ koji -d build --scratch rawhide ***.src.rpm

...

Error: [('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')]

It's due to koji authentication mechanism has been switched from SSL to Kerberos, and this change is impacting end user since yesterday. See links below for details:

https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org/message/JK267PSDD53I2KGONDLFA5D4JWYXKZTQ/

https://fedoraproject.org/wiki/ReleaseEngineering/FlagDay2016

To make koji works again, 2 actions needed:

1. $ kinit <your_fas_account_name>@FEDORAAPROJECT.ORG

2. update packages below to the specified versions(or newer):

python-cccolutils-1.4-1

fedpkg-1.26-2

fedora-packager-0.6.0.0-1

pyrpkg-1.47-3

koji-1.11.0-1

Note that most of above packages are not available in EPEL yet, so user need to get it from bodhi(https://bodhi.fedoraproject.org/), and install it manually.

Here are links to packages above that proves to be working under RHEL 7.3:

python-cccolutils-1.4-1: http://mirror.yandex.ru/epel/testing/7/x86_64/p/

fedpkg-1.26-2: https://koji.fedoraproject.org/koji/buildinfo?buildID=824830

fedora-packager-0.6.0.0-3 & fedora-cert-0.6.0.0-3: https://koji.fedoraproject.org/koji/buildinfo?buildID=824934

pyrpkg-1.47-5: https://koji.fedoraproject.org/koji/buildinfo?buildID=824854

koji-1.11.0-1: https://koji.fedoraproject.org/koji/buildinfo?buildID=823948

0 0