Falco: Error Package falco-0.16.0-x86_64.rpm is not signed on Amazon Linux 2

[paulmilbank]

What happened: We are installing Falco via Ansible in our packer builds on Amazon Linux 2. We use largely the role from here: https://github.com/juju4/ansible-falco. This was working with builds until yesterday. Now we get the error Package falco-0.16.0-x86_64.rpm is not signed and yum exits.

What you expected to happen: Falco should install without error

How to reproduce it (as minimally and precisely as possible):

• Use an Amazon Linux 2 instance on AWS.
• sudo rpm --import https://s3.amazonaws.com/download.draios.com/DRAIOS-GPG-KEY.public
• sudo curl -s -o /etc/yum.repos.d/draios.repo https://s3.amazonaws.com/download.draios.com/stable/rpm/draios.repo
• sudo yum update
• sudo yum -y install kernel-devel-$(uname -r)
• sudo yum -y install falco

Anything else we need to know?:

Environment:

• Falco version (use falco --version): None, won't install

• Cloud provider or hardware configuration: AWS, Amazon Linux 2, running EC2. Tested T2, T3 and M4 instance types.
• OS (e.g: cat /etc/os-release):
  NAME="Amazon Linux"
  VERSION="2"
  ID="amzn"
  ID_LIKE="centos rhel fedora"
  VERSION_ID="2"
  PRETTY_NAME="Amazon Linux 2"
  ANSI_COLOR="0;33"
  CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
  HOME_URL="https://amazonlinux.com/"
• Kernel (e.g. uname -a): Linux ip-10-31-46-181.ponyformation.com 4.14.123-111.109.amzn2.x86_64 #1 SMP Mon Jun 10 19:37:57 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
• Install tools (e.g. in kubernetes, rpm, deb, from source): No
• Others: Tested post Ansible hardening and with a bare freshly provisioned image in AWS. Tested installing Falco with Ansible and installing with the commands from the terminal on a fresh instance.
  Result is the same: Package falco-0.16.0-x86_64.rpm is not signed

[paulmilbank]

To add to this, the images that succeeded over the last couple of days have a Falco version of 0.15.3

[leodido]

/assign @mstemm
Mark can you PTAL?

Anyway this is probably related to the fact that the 0.16.0 release is still on going.

[Vasil-Petrov]

Maybe rpm --addsign step wasn't executed when adding package to the repo.
I am having this issue as well and this affects everyone(worldwide) who uses install-falco script and getting the packages from draios.repo
This issue is causing bad/abnormal results for automation flows where falco install is part of.

[mstemm]

Sorry about this, the publishing of packages got interrupted during the signing step due to an internal config problem. We're working on the fix and I'll update this issue once the packages are fully published.

[paulmilbank]

Thanks very much for looking into this so quickly. Appreciate it.

[mstemm]

The packages should be fully signed now. I was able to install them on ubuntu 16.04 and centos 7 via apt-get and yum.