~kanarip

As you may know the Feature Proposal to extend the life cycle of Fedora with security updates only, appropriately proposed on July 4th, has been reviewed by the Fedora Engineering Steering Committee, and was ruled "Not a Feature". A decision on this was relayed to the Fedora Project Board, who has discussed it, but not made their ruling yet.

In 8 days (July 28th), Feature Freeze hits the Fedora 12 development cycle, and that is also the milestone when the Extended Life Cycle plans would have to be approved -in the lose, general term of the word-, so that we can actually start work on getting everything ready before Fedora 12 goes End-of-Support.

Meanwhile, I would like to ask you that if you are interested, you enlist at the Wiki page:

https://fedoraproject.org/wiki/Features/Extended_Life_Cycle#Interested_P...

Please also indicate whether you are just interested (as a consumer maybe?) and whether willing and/or able to participate (as a packager, pusher, signer, advocate, ambassador, tracker, manager or in selling this feature to the corporate world?).

Install the postgresql-server package:

# yum install postgresql-server

Then, initialize the server, and start the postgres service:

# service postgres initdb
# service postgres start

Add a koji user account, and remove it's password:

# useradd koji
# passwd -d koji

Set up postgres by adding a koji user, initialize the database for koji:

# su - postgres
$ createuser koji
Shall the new role be a superuser? (y/n) n
Shall the new role be allowed to create databases? (y/n) n
Shall the new role be allowed to create more new roles? (y/n) n
$ createdb -O koji koji
$ logout
# su - koji
$ psql koji koji < /usr/share/doc/koji*/docs/schema.sql
$ exit

asdasd

Like I said before, we're going to have all the Koji components authenticate to other Koji components using SSL certificates. Likewise, users are going to use certificates to authenticate themselves to Koji.

To generate the CA, create some temporary directory and a ssl.cnf file containing the following:

HOME                    = .
RANDFILE                = .rand

[ca] 
default_ca              = ca_default

[ca_default] 
dir                     = .
certs                   = $dir/certs
crl_dir                 = $dir/crl
database                = $dir/index.txt
new_certs_dir           = $dir/newcerts
certificate             = $dir/organisation_ca_cert.pem
private_key             = $dir/private/organisation_ca_key.pem
serial                  = $dir/serial
crl                     = $dir/organisation_crl.pem
x509_extensions         = usr_cert
name_opt                = ca_default
cert_opt                = ca_default
default_days            = 3650
default_crl_days        = 30
default_md              = md5
preserve                = no
policy                  = policy_match

[policy_match] 
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[req] 
default_bits            = 1024
default_keyfile         = privkey.pem
distinguished_name      = req_distinguished_name
attributes              = req_attributes
x509_extensions         = v3_ca # The extentions to add to the self signed cert
string_mask             = MASK:0x2002

[req_distinguished_name] 
countryName                     = Country Name (2 letter code)
countryName_default             = NL
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Utrecht
localityName                    = Locality Name (eg, city)
localityName_default            = Utrecht
0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = kanarip.com
organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = Koji Infrastructure
commonName                      = Common Name (eg, your name or your server\'s hostname)
commonName_max                  = 64
emailAddress                    = Email Address
emailAddress_default            = emailaddress@kanarip.com
emailAddress_max                = 64

[req_attributes] 
challengePassword               = A challenge password
challengePassword_min           = 4
challengePassword_max           = 20
unstructuredName                = An optional company name

[usr_cert] 
basicConstraints                = CA:FALSE
nsComment                       = "OpenSSL Generated Certificate"
subjectKeyIdentifier            = hash
authorityKeyIdentifier          = keyid,issuer:always

[v3_ca] 
subjectKeyIdentifier            = hash
authorityKeyIdentifier          = keyid:always,issuer:always
basicConstraints                = CA:true

Edit the contents of this file where necessary; you'll probably want your own organisation name rather then organisation or kanarip.com.

Generate the CA Certificate

To generate the CA certificate, do:

$ mkdir {certs,private}
$ touch index.txt
$ echo 01 > serial
$ export caname=koji
$ openssl genrsa -out private/${caname}_ca_cert.key 2048
$ openssl req -config ssl.cnf -new -x509 -days 3650 -key private/${caname}_ca_cert.key -out ${caname}_ca_cert.crt -extensions v3_ca

Now that you've generated the CA certificate, it's time to generate the service certificates;

$ for service in kojiweb kojira kojihub; do
    openssl genrsa -out certs/${service}.key 2048
    openssl req -config ssl.cnf -new -nodes -out certs/${service}.csr -key certs/${service}.key
    openssl ca -config ssl.cnf -keyfile private/${caname}_ca_cert.key -cert ${caname}_ca_cert.crt -out certs/${service}.crt -outdir certs -infiles certs/${service}.csr
    cat certs/${service}.crt certs/${service}.key > ${service}.pem
done

You might also want a kojiadmin user certificate for the Koji Administrator, and a personal certificate for using Koji:

$ for user in kojiadmin kanarip; do
    openssl genra -out certs/${user}.key 2048
    openssl req -config ssl.cnf -new -nodes -out certs/${user}.csr -key certs/${user}.key
    openssl ca -config ssl.cnf -keyfile private/${caname}_ca_cert.key -cert ${caname}_ca_cert.crt -out certs/${user}.crt -outdir certs -infiles certs/${user}.csr
    cat certs/${user}.crt certs/${user}.key > ${user}.pem
done

While I have a kojiadmin user account, you may just want a different Koji configuration file (in ~/.koji/admin-config?).