Check for empty signature files

[garretwyman]

We have had an intermittent issue where pulp is uploading an empty (0 bytes) signature file.

Would like to add a simple check to confirm the signature file is not 0 bytes prior to publishing. If it is 0, raise an exception.

[dralley]

What version were you using? #2892 was fixed a good while ago, but if you're using an older release of Katello or Pulp I could see how you might run into it still?

[garretwyman]

pulp-rpm==3.25.1
pulpcore==3.51.2

The issue we were running into was the repomd.xml.asc file.

[dralley]

How was your signing service configured?

[daviddavis]

We have a signing service at Microsoft that we use. In Pulp, we've configured a SigningService to call a python script that makes a request to a container we've created that in turn submits requests to MS signing service and then waits for them to finish.

We haven't been able to pinpoint where we are ending up with an empty repomd.xml.asc file but it does look like we're getting back a non-empty file from the MS signing service so it's either a problem in our container, script, or possibly Pulp.

We've added a bunch of logging output to help us narrow down the problem, but we've also created this patch as a stopgap to prevent a publication from being created as clients can't download any packages if repomd.xml.asc is empty and then we get a call in the middle of the night to fix it.

We don't mind if you want to reject the change--we will just add this to our own fork of pulp_rpm--but it seems like validating the signing service result could be helpful?

[daviddavis]

@dralley I've looked through the Pulp code already and didn't see anything that could cause repomd.xml.asc to sometimes end up as empty but if you wanted to confirm, we'd appreciate it.

[sdherr]

We don't mind if you want to reject the change--we will just add this to our own fork of pulp_rpm--but it seems like validating the signing service result could be helpful?

Agreed and hopefully a temporary fork at that, once we actually track down the problem. But I also don't think there's any scenario where you'd want to publish an empty signature file, so maybe the patch has value. Either the signature file should not exist, or it should contain a valid signature.