Use Sequoia in RHEL 10 instead of GPG #14193

vojtapolasek · 2025-11-28T14:37:50Z

Description:

create a new rule package_sequoia-sq_installed
enhance rule ensure_redhat_gpgkey_installed so that it uses the sq command instead of gpg n RHEL 10
check for new PQC key in RHEL >= 10
The build system ordering takes care that the sq package is installed so that it can be later used. So in case rule ensure_redhat_gpgkey_installed exists in the profile, the rule package_sequoia-sq_installed should be present in the profile as well.
Modify all RHEL 10 profiles so that the new rule is there. This involved also exempting the rule from many other profiles which are based on the same control file (ANSSI, PCI-DSS, OSPP etc)

Rationale:

There are two reasons for this change.
- there is a new RPM release key in RHEL >= 10 and it needs to be checked that it exists
- in case this key is shipped, the regular gpg command cannot handle it and it needs to be inspected with the sq command

Review Hints:

Test with Automatus. But ensure that the RHEL machine contains all three keys.

openshift-ci · 2025-11-28T14:37:55Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

jan-cerny · 2025-12-02T14:21:05Z

components/rpm.yml

 name: rpm
 packages:
 - rpm
+- sequoia-sq


Should it be a new separate component file instead?

Probably yes, I did that in c79b55d

linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/oval/shared.xml

jan-cerny · 2025-12-02T15:58:08Z

linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml

+{{% endif %}}

- name: Import RedHat GPG key
+- name: "{{{ rule_title }}}: Import RedHat GPG key"


In automatus tests, I'm still getting this fail. Is it expected? Is it the bug in Ansible?

"gpg: directory '/root/.gnupg' created\ngpg: WARNING: no command supplied. Trying to guess what you mean ...\ngpg: /root/. gnupg/trustdb.gpg: trustdb created\ngpg: packet(6) with unknown version 6\n"

This is caused by the Ansible rpm_key module.
Here is their issue: ansible/ansible#86157

jan-cerny · 2025-12-04T14:02:30Z

products/rhel10/profiles/e8.profile

    - '!package_rsh-server_removed'
    - '!security_patches_up_to_date'
+     # the rule ensure_redhat_gpgkey_installed needs a special package on RHEL 10 which is not installed by default
+    - package_sequoia-sq_installed


You have two options how to solve the failing static-checks reference test.

Add the rule to the control file and then deselect it in profile files in products where this shouldn't be present.

Add an ISM_O reference to the rule.yml file in package_sequoia-sq_installed.

Option 2 will not work, you cannot mix control file references and in file references.

…nstalled/oval/shared.xml Co-authored-by: Jan Černý <[email protected]>

and exclude it from other products which use ANSSI as well

vojtapolasek · 2025-12-09T09:43:25Z

@jan-cerny I added the rule to all relevant RHEL 10 profiles.

jan-cerny · 2025-12-09T10:15:12Z

@vojtapolasek Unfortunately, the static-checks test still has problems with some references. See the test output https://artifacts.dev.testing-farm.io/992274c6-fdf8-4db5-821f-21487b721236/

It seems that ospp reference is not autogenerated from the control file.

openshift-ci · 2025-12-11T12:08:35Z

@vojtapolasek: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	`ac9f4e3`	link	true	`/test e2e-aws-openshift-node-compliance`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jan-cerny · 2025-12-11T12:18:59Z

@ComplianceAsCode/suse-maintainers @ComplianceAsCode/ubuntu-maintainers @ComplianceAsCode/oracle-maintainers Can you please review this? It shouldn't add anything to your product's profiles.

vojtapolasek · 2025-12-11T12:52:19Z

@jan-cerny I believe I solved all problems with missing references.

mrkanon

LGTM

teacup-on-rockingchair

LGTM 👍

vojtapolasek added this to the 0.1.80 milestone Nov 28, 2025

vojtapolasek added New Rule Issues or pull requests related to new Rules. Update Profile Issues or pull requests related to Profiles updates. RHEL10 Red Hat Enterprise Linux 10 product related. labels Nov 28, 2025

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Nov 28, 2025

vojtapolasek changed the title ~~WIP: Use Sequoia in RHEL 10 instead of GPG~~ Use Sequoia in RHEL 10 instead of GPG Dec 2, 2025

vojtapolasek marked this pull request as ready for review December 2, 2025 13:48

vojtapolasek requested review from a team, Mab879, jan-cerny and matusmarhefka as code owners December 2, 2025 13:48

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Dec 2, 2025

jan-cerny self-assigned this Dec 2, 2025

jan-cerny reviewed Dec 2, 2025

View reviewed changes

vojtapolasek force-pushed the add_sq_to_rhel10 branch from 8bd67b6 to c79b55d Compare December 3, 2025 09:44

jan-cerny requested changes Dec 4, 2025

View reviewed changes

vojtapolasek force-pushed the add_sq_to_rhel10 branch from c79b55d to 7b4df39 Compare December 8, 2025 14:40

vojtapolasek requested review from a team as code owners December 8, 2025 14:40

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Dec 8, 2025

vojtapolasek and others added 8 commits December 8, 2025 15:41

add new rule package_sequoia-sq_installed

0bbc736

add new rule to rhel10 e8 profile for testing

707f025

modify the ansible remediation of ensure_redhat_gpgkey_installed

4d18b29

modify bash remediation to account for pqc release key in rhel 10

8971e61

modify oval to account for pqc key in rhel 10

5ea2a19

modify test scenarios so that they are applicable on RHEL 10 as well

b29599c

Update linux_os/guide/system/software/updating/ensure_redhat_gpgkey_i…

865ae56

…nstalled/oval/shared.xml Co-authored-by: Jan Černý <[email protected]>

create a separate component for sequoia and make appropriate chnages

50c9c05

vojtapolasek force-pushed the add_sq_to_rhel10 branch from 7b4df39 to 50c9c05 Compare December 8, 2025 14:41

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Dec 8, 2025

vojtapolasek added 5 commits December 8, 2025 16:33

add rule to RHEL 10 ANSSI profiles

d45768f

and exclude it from other products which use ANSSI as well

add rule to RHEL 10 HIPAA profile

0d70839

add rule to RHEL 10 PCI-DSS profile

920c92a

add rule to OSPP profile on RHEL 10

12951f5

add rule to RHEL 10 STIG profile

1cf38a3

vojtapolasek added 3 commits December 10, 2025 12:41

add ospp reference directly to the rule

ded1287

It seems that ospp reference is not autogenerated from the control file.

add the rule explicitly to ism_o profile

87a4300

add hipaa and srg references which are not autogenerated

ac9f4e3

jan-cerny approved these changes Dec 11, 2025

View reviewed changes

mpurg approved these changes Dec 11, 2025

View reviewed changes

mrkanon approved these changes Dec 11, 2025

View reviewed changes

teacup-on-rockingchair approved these changes Dec 11, 2025

View reviewed changes

jan-cerny merged commit 1b3a792 into ComplianceAsCode:master Dec 12, 2025
134 of 140 checks passed

Use Sequoia in RHEL 10 instead of GPG #14193

Use Sequoia in RHEL 10 instead of GPG #14193

Conversation

vojtapolasek commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

Uh oh!

openshift-ci bot commented Nov 28, 2025

Uh oh!

jan-cerny Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

vojtapolasek Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jan-cerny Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

vojtapolasek Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

Mab879 Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

vojtapolasek commented Dec 9, 2025

Uh oh!

jan-cerny commented Dec 9, 2025

Uh oh!

openshift-ci bot commented Dec 11, 2025

Uh oh!

jan-cerny commented Dec 11, 2025

Uh oh!

vojtapolasek commented Dec 11, 2025

Uh oh!

mrkanon left a comment

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

vojtapolasek commented Nov 28, 2025 •

edited

Loading