ComplianceAsCode / ComplianceAsCode/content

Bash/Ansible Remediation of `ensure_redhat_gpgkey_installed` doesn't consider CentOS Stream keys

Open
#8,480 1 comment 0 reactions 0 assignees View on GitHub
RHEL triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
[Bash](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/bash/shared.sh) and [Ansible](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml) remediation of rule [`ensure_redhat_gpgkey_installed`](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/rule.yml) do not remediate properly the CentOS Stream. It needs to be updated to remediate properly. The remediation needs to be aware of OS it's being executed on. Ansible already has a mechanism to check that: https://github.com/ComplianceAsCode/content/blob/68bc37a1905435aa39a00ca688e3a882945b1e0c/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml#L43

The bash remediation will need to check the /etc/os-release probably, similarly as it's done in: https://github.com/ComplianceAsCode/content/blob/68bc37a1905435aa39a00ca688e3a882945b1e0c/shared/checks/oval/installed_OS_is_centos9.xml#L27

Useful information:

Centos Stream 8/9 Key filepath: `/etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial`
Centos Stream 8/9 Key fingerprint: `99DB70FAE1D7CE227FB6488205B555B38483C65D`
It needs to be added to the product yaml: https://github.com/ComplianceAsCode/content/blob/master/products/rhel9/product.yml https://github.com/ComplianceAsCode/content/blob/master/products/rhel8/product.yml
A new yaml key needs to be added to the product yaml.

There's only one key in CentOS. No auxiliary key as in RHEL.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.