osbuild-compose: Building RHEL 8.x from RHEL 9.5 system - SHA1 issues

[justin-davisibm]

Hey all-

I'm starting this as a discussion vs. a issue as I'm hoping this is more of a version issue that may be resolved with updated packages or a config to be documented vs. an actual issue/bug.

I'm running a RHEL 9.5 ppc64le osbuild system (118-2.el9_5) for building images. This is the most recent version available via the appstream repo- but if this is a version issue I can build from source if needed.

RHEL 9.x images build without issue, but all RHEL 8.X images fail with the following errors:

Pipeline: build
Stage: org.osbuild.rpm
Output:
Failed to open file "/sys/fs/selinux/checkreqprot": Read-only file system
warning: Signature not supported. Hash algorithm SHA1 not available.
error: /tmp/gpgkey.kdhfn215: key 2 import failed.
Traceback (most recent call last):
  File "/run/osbuild/bin/org.osbuild.rpm", line 251, in <module>
    r = main(args["tree"], args["inputs"], args["options"])
  File "/run/osbuild/bin/org.osbuild.rpm", line 150, in main
    subprocess.run([
  File "/usr/lib64/python3.9/subprocess.py", line 528, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['rpmkeys', '--root', '/run/osbuild/tree', '--import', '/tmp/gpgkey.kdhfn215']' returned non-zero exit status 1.

I've done some poking, enabled SHA1 (against my better judgement) as a test with no change in behavior. I was under the impression that RHEL8 repos were no longer using SHA1 and had all moved to SHA256 for support on RH9.x versions.

So- any help appreciated on this, and happy to open up an issue if needed.

[achilleas-k]

I was under the impression that RHEL8 repos were no longer using SHA1 and had all moved to SHA256 for support on RH9.x versions.

I thought so too, so maybe there's something else going on.
Do you know which repositories you were using to get the RHEL 8 RPMs? Regular RH CDN?

[justin-davisibm]

Yes, we use the RH CDN for these.

https://matrix.to/#/!yAOrVhosqfnOcdXiYb:fedoraproject.org/$xQmk142xhWk1vn4ZCgNMbzZa6MYcPESmD7izSexkrE8?via=fedoraproject.org&via=matrix.org&via=fedora.im is our discussion over on Matrix- didn't find a good resolution.

[achilleas-k]

This PR explains the origin of the issue and includes a fix: osbuild/images#1330
It will take some time to reach osbuild-composer and the other frontends, but for now you can work around this issue by copying the RHEL 8 repository configurations from the images source tree to /etc/osbuild-composer/repositories/.

[justin-davisibm]

Looks like we are moving here, I've got a successful build of RH8.10 from a RH9.5 osbuild composer host!

Thanks for the followup @achilleas-k, much appreciated.