From 542bbcdb6b2827812e529c29f4a44f542ec1f801 Mon Sep 17 00:00:00 2001 From: Marcin Juszkiewicz Date: Wed, 21 Sep 2022 16:28:56 +0200 Subject: grafana: ignore SHA1 gpg key on CentOS Stream 9 (and family) RHEL 9 refuses to use SHA1 gpg keys. Grafana team still did not handled key upgrade: https://github.com/grafana/grafana/issues/41036 Change-Id: Id963271103ce1397b7a5498d032e8f797edfcc70 --- docker/base/Dockerfile.j2 | 2 +- docker/grafana/Dockerfile.j2 | 5 +++++ kolla/image/build.py | 1 - 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index 13af63149..1da98d7fc 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -65,10 +65,10 @@ COPY dnf.conf /etc/dnf/dnf.conf {# Repo files not available for CentOS Stream 9: 'elasticsearch.repo', # signed with SHA1 key https://github.com/elastic/elasticsearch/issues/85876 - 'grafana.repo', # signed with SHA1 key https://github.com/grafana/grafana/issues/41036 'proxysql.repo', # no repository yet for RHEL9 family #} {% set base_yum_repo_files = [ + 'grafana.repo', 'mariadb.repo', 'rabbitmq_rabbitmq-server.repo', 'td.repo', diff --git a/docker/grafana/Dockerfile.j2 b/docker/grafana/Dockerfile.j2 index d0af1a0e6..92c957757 100644 --- a/docker/grafana/Dockerfile.j2 +++ b/docker/grafana/Dockerfile.j2 @@ -13,6 +13,11 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build {{ macros.configure_user(name='grafana', homedir='/usr/share/grafana') }} +{# NOTE(hrw): RHEL 9 disallows SHA1 gpg keys but grafana still not updated #} +{% if base_package_type == 'rpm' %} +RUN update-crypto-policies --set DEFAULT:SHA1 +{% endif %} + {{ macros.install_packages(grafana_packages | customizable("packages")) }} WORKDIR /usr/share/grafana diff --git a/kolla/image/build.py b/kolla/image/build.py index 48e5d9731..b0c828036 100755 --- a/kolla/image/build.py +++ b/kolla/image/build.py @@ -92,7 +92,6 @@ UNBUILDABLE_IMAGES = { # https://github.com/grafana/grafana/issues/41036 'centos': { "elasticsearch", # SHA1 gpg key - "grafana", # SHA1 gpg key "hacluster-pcs", # Missing crmsh package "kibana", # SHA1 gpg key "logstash", # SHA1 gpg key -- cgit v1.2.3