Skip to content

Commit a725f93

Browse files
jan-cernyjan-cerny
committed
Check for PQC GPG key only on RHEL 9.7 and newer
The redhat-release RPM package in RHEL 9.6 and older won't contain the postquantum OpenPGP key. This key will be present in RHEL 9.7 and newer. This extends the existing RHEL 10.1+ PQC version gating to also cover RHEL 9.
1 parent 5ba4dca commit a725f93

5 files changed

Lines changed: 45 additions & 19 deletions

File tree

‎linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,21 +40,26 @@
4040

4141
{{% endif %}}
4242

43-
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
43+
{{% if "rhel" in families and major_version_ordinal >= 9 %}}
44+
{{% if major_version_ordinal >= 10 %}}
45+
{{% set pqc_min_version = "10.1" %}}
46+
{{% else %}}
47+
{{% set pqc_min_version = "9.7" %}}
48+
{{% endif %}}
4449
- name: "{{{ rule_title }}}: Set Fact - Valid fingerprints (without PQC)"
4550
ansible.builtin.set_fact:
4651
gpg_valid_fingerprints:
4752
- "{{{ release_key_fingerprint }}}"
4853
- "{{{ auxiliary_key_fingerprint }}}"
49-
when: ansible_distribution_version is version('10.1', '<')
54+
when: ansible_distribution_version is version('{{{ pqc_min_version }}}', '<')
5055

5156
- name: "{{{ rule_title }}}: Set Fact - Valid fingerprints (with PQC)"
5257
ansible.builtin.set_fact:
5358
gpg_valid_fingerprints:
5459
- "{{{ release_key_fingerprint }}}"
5560
- "{{{ auxiliary_key_fingerprint }}}"
5661
- "{{{ pqc_key_fingerprint }}}"
57-
when: ansible_distribution_version is version('10.1', '>=')
62+
when: ansible_distribution_version is version('{{{ pqc_min_version }}}', '>=')
5863
{{% else %}}
5964
- name: "{{{ rule_title }}}: Set Fact - Valid fingerprints"
6065
ansible.builtin.set_fact:

‎linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/bash/shared.sh‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# The two fingerprints below are retrieved from https://access.redhat.com/security/team/key
33
readonly REDHAT_RELEASE_FINGERPRINT="{{{ release_key_fingerprint }}}"
44
readonly REDHAT_AUXILIARY_FINGERPRINT="{{{ auxiliary_key_fingerprint }}}"
5-
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
5+
{{% if "rhel" in families and major_version_ordinal >= 9 %}}
66
readonly REDHAT_PQC_FINGERPRINT="{{{ pqc_key_fingerprint }}}"
77
{{% endif %}}
88

@@ -26,8 +26,13 @@ then
2626
if [ "${GPG_RESULT}" -eq "0" ]
2727
then
2828
# If $REDHAT_RELEASE_KEY file doesn't contain any keys with unknown fingerprint, import it
29-
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
30-
if {{{ bash_os_linux_conditional("rhel", expected_ver="10.1", op=">=") | trim }}}
29+
{{% if "rhel" in families and major_version_ordinal >= 9 %}}
30+
{{% if major_version_ordinal >= 10 %}}
31+
{{% set pqc_min_version = "10.1" %}}
32+
{{% else %}}
33+
{{% set pqc_min_version = "9.7" %}}
34+
{{% endif %}}
35+
if {{{ bash_os_linux_conditional("rhel", expected_ver=pqc_min_version, op=">=") | trim }}}
3136
then
3237
echo "${GPG_OUT[*]}" | grep -vE "${REDHAT_RELEASE_FINGERPRINT}|${REDHAT_AUXILIARY_FINGERPRINT}|${REDHAT_PQC_FINGERPRINT}" || rpm --import "${REDHAT_RELEASE_KEY}"
3338
else

‎linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,16 @@
1212
test_ref="test_redhat_package_gpgkey-{{{ pkg_version }}}-{{{ pkg_release }}}_installed" />
1313
<criterion comment="package gpg-pubkey-{{{ aux_pkg_version }}}-{{{ aux_pkg_release }}} is installed"
1414
test_ref="test_redhat_package_gpgkey-{{{ aux_pkg_version }}}-{{{ aux_pkg_release }}}_installed" />
15-
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
16-
<criteria comment="If RHEL is 10.1 or newer then PQC key must be installed" operator="OR">
17-
<criterion comment="RHEL is older than 10.1" test_ref="test_{{{ rule_id }}}_rhel_is_10_1_or_newer" negate="true" />
18-
<criteria comment="RHEL is 10.1 or newer AND PQC is installed" operator="AND">
19-
<criterion comment="RHEL is 10.1 or newer" test_ref="test_{{{ rule_id }}}_rhel_is_10_1_or_newer" />
15+
{{% if "rhel" in families and major_version_ordinal >= 9 %}}
16+
{{% if major_version_ordinal >= 10 %}}
17+
{{% set pqc_min_version = "10.1" %}}
18+
{{% else %}}
19+
{{% set pqc_min_version = "9.7" %}}
20+
{{% endif %}}
21+
<criteria comment="If RHEL is {{{ pqc_min_version }}} or newer then PQC key must be installed" operator="OR">
22+
<criterion comment="RHEL is older than {{{ pqc_min_version }}}" test_ref="test_{{{ rule_id }}}_rhel_pqc_version_check" negate="true" />
23+
<criteria comment="RHEL is {{{ pqc_min_version }}} or newer AND PQC is installed" operator="AND">
24+
<criterion comment="RHEL is {{{ pqc_min_version }}} or newer" test_ref="test_{{{ rule_id }}}_rhel_pqc_version_check" />
2025
<criterion comment="package gpg-pubkey-{{{ pqc_pkg_version }}}-{{{ pqc_pkg_release }}} is installed" test_ref="test_redhat_package_gpgkey-{{{ pqc_pkg_version }}}-{{{ pqc_pkg_release }}}_installed" />
2126
</criteria>
2227
</criteria>
@@ -64,7 +69,7 @@
6469
<linux:version>{{{ aux_pkg_version }}}</linux:version>
6570
</linux:rpminfo_state>
6671

67-
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
72+
{{% if "rhel" in families and major_version_ordinal >= 9 %}}
6873
<!-- Test for Red Hat post quantum cryptography key -->
6974
<linux:rpminfo_test check="only one" check_existence="at_least_one_exists"
7075
id="test_redhat_package_gpgkey-{{{ pqc_pkg_version }}}-{{{ pqc_pkg_release }}}_installed" version="1"
@@ -93,20 +98,25 @@
9398
</linux:rpminfo_state>
9499
{{%- endif %}}
95100

96-
{{% if "rhel" in families and major_version_ordinal >= 10 %}}
97-
<ind:textfilecontent54_test check="all" comment="VERSION_ID in os-release is greater than or equal 10.1" id="test_{{{ rule_id }}}_rhel_is_10_1_or_newer" version="1">
98-
<ind:object object_ref="obj_{{{ rule_id }}}_rhel_is_10_1_or_newer" />
99-
<ind:state state_ref="state_{{{ rule_id }}}_rhel_is_10_1_or_newer" />
101+
{{% if "rhel" in families and major_version_ordinal >= 9 %}}
102+
{{% if major_version_ordinal >= 10 %}}
103+
{{% set pqc_min_version = "10.1" %}}
104+
{{% else %}}
105+
{{% set pqc_min_version = "9.7" %}}
106+
{{% endif %}}
107+
<ind:textfilecontent54_test check="all" comment="VERSION_ID in os-release is greater than or equal {{{ pqc_min_version }}}" id="test_{{{ rule_id }}}_rhel_pqc_version_check" version="1">
108+
<ind:object object_ref="obj_{{{ rule_id }}}_rhel_pqc_version_check" />
109+
<ind:state state_ref="state_{{{ rule_id }}}_rhel_pqc_version_check" />
100110
</ind:textfilecontent54_test>
101111

102-
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_rhel_is_10_1_or_newer" version="1">
112+
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_rhel_pqc_version_check" version="1">
103113
<ind:filepath>/etc/os-release</ind:filepath>
104114
<ind:pattern operation="pattern match">^VERSION_ID=[&quot;&apos;]?([\w.]+)[&quot;&apos;]?$</ind:pattern>
105115
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
106116
</ind:textfilecontent54_object>
107117

108-
<ind:textfilecontent54_state id="state_{{{ rule_id }}}_rhel_is_10_1_or_newer" version="1">
109-
<ind:subexpression operation="greater than or equal" datatype="version">10.1</ind:subexpression>
118+
<ind:textfilecontent54_state id="state_{{{ rule_id }}}_rhel_pqc_version_check" version="1">
119+
<ind:subexpression operation="greater than or equal" datatype="version">{{{ pqc_min_version }}}</ind:subexpression>
110120
</ind:textfilecontent54_state>
111121
{{% endif %}}
112122

‎products/rhel9/product.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,12 @@ pkg_release: "4ae0493b"
3636
pkg_version: "fd431d51"
3737
aux_pkg_release: "6229229e"
3838
aux_pkg_version: "5a6340b3"
39+
pqc_pkg_release: "68e6a1f3"
40+
pqc_pkg_version: "05707a62"
3941

4042
release_key_fingerprint: "567E347AD0044ADE55BA8A5F199E2F91FD431D51"
4143
auxiliary_key_fingerprint: "7E4624258C406535D56D6F135054E4A45A6340B3"
44+
pqc_key_fingerprint: "FCD355B305707A62DA143AB6E422397E50FE8467A2A95343D246D6276AFEDF8F"
4245

4346
cpes_root: "../../shared/applicability"
4447
cpes:

‎tests/data/product_stability/rhel9.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,9 @@ pkg_manager_config_file: /etc/dnf/dnf.conf
5959
pkg_release: 4ae0493b
6060
pkg_system: rpm
6161
pkg_version: fd431d51
62+
pqc_key_fingerprint: "FCD355B305707A62DA143AB6E422397E50FE8467A2A95343D246D6276AFEDF8F"
63+
pqc_pkg_release: "68e6a1f3"
64+
pqc_pkg_version: "05707a62"
6265
platform_package_overrides:
6366
aarch64_arch: null
6467
grub2: grub2-common

0 commit comments

Comments
 (0)