From c2fc3cd01871fd0f62ddd53a9fbb8355f6bdceaa Mon Sep 17 00:00:00 2001 From: Jeremy Stanley Date: Fri, 29 Jul 2016 18:44:52 +0000 Subject: [PATCH] Set the gitpgpkey for signing nodes Since our infrastructure signing key includes a unique comment field in its name which changes with the key each cycle when it's rotated, we need to explicitly let Git know how to identify the key (it doesn't automatically rely on the default secret key in the keychain and instead expects that any optional comment be part of the name). Use an E-mail address to identify the signing key to Git since this will remain the same through rotation, and since the jenkins::jenkinsuser module completely replaces the keyring files we can simply insure our process only ever sets one key for that address in the provided keyring contents (which is how we document doing it already). Change-Id: I78fe7fa331ae9b51ff0fbf91c0c2f8961b09eb88 Depends-On: Id577c4479abd2f443f73c630a12e94d3ebe63660 --- modules/openstack_project/manifests/signing_node.pp | 2 ++ modules/openstack_project/manifests/slave.pp | 2 ++ 2 files changed, 4 insertions(+) diff --git a/modules/openstack_project/manifests/signing_node.pp b/modules/openstack_project/manifests/signing_node.pp index deaa3577b6..3b97b7de49 100644 --- a/modules/openstack_project/manifests/signing_node.pp +++ b/modules/openstack_project/manifests/signing_node.pp @@ -21,6 +21,7 @@ class openstack_project::signing_node ( $secring, $gitfullname = 'OpenStack Release Bot', $gitemail = 'infra-root@openstack.org', + $gitpgpkey = 'infra-root@openstack.org', $gerrituser = 'release', $gerritkey = undef, $project_config_repo = 'https://git.openstack.org/openstack-infra/project-config', @@ -31,6 +32,7 @@ class openstack_project::signing_node ( ssh_key => $jenkins_ssh_public_key, jenkins_gitfullname => $gitfullname, jenkins_gitemail => $gitemail, + jenkins_gitpgpkey => $gitpgpkey, jenkins_gerrituser => $gerrituser, jenkins_gerritkey => $gerritkey, project_config_repo => $project_config_repo, diff --git a/modules/openstack_project/manifests/slave.pp b/modules/openstack_project/manifests/slave.pp index bd8c49d900..a6d7034e86 100644 --- a/modules/openstack_project/manifests/slave.pp +++ b/modules/openstack_project/manifests/slave.pp @@ -7,6 +7,7 @@ class openstack_project::slave ( $sysadmins = [], $jenkins_gitfullname = 'OpenStack Jenkins', $jenkins_gitemail = 'jenkins@openstack.org', + $jenkins_gitpgpkey = 'jenkins@openstack.org', $jenkins_gerrituser = 'jenkins', $jenkins_gerritkey = undef, $project_config_repo = 'https://git.openstack.org/openstack-infra/project-config', @@ -28,6 +29,7 @@ class openstack_project::slave ( ssh_key => $ssh_key, gitfullname => $jenkins_gitfullname, gitemail => $jenkins_gitemail, + gitpgpkey => $jenkins_gitpgpkey, gerrituser => $jenkins_gerrituser, gerritkey => $jenkins_gerritkey, }