Packit-service: Packit build getting: ActionNotAllowed: policy violation (build_from_srpm)

[jlebon]

I'm trying to hook up Packit to OSTree, but it seems like Packit is hitting ACL issues in Koji.

Packit config: https://github.com/ostreedev/ostree/blob/master/.packit.yaml
Dist-git repo: https://src.fedoraproject.org/rpms/ostree
Koji task: https://koji.fedoraproject.org/koji/taskinfo?taskID=52957745

Result | ActionNotAllowed: policy violation (build_from_srpm)

Is there anything we have to do on our side?

[TomasTomecek]

Interesting. This is definitely something which we need to bring to Fedora rel-eng to get understanding what exactly is going on.

After a brief investigation, it seems that production builds from SRPM are not allowed:

$ fedpkg build --srpm ./packit-0.17.1.dev10+gbe9bb0a-1.20201008081714458688.master.10.gbe9bb0a.fc33.src.rpm
[====================================] 100% 00:00:03   2.81 MiB 914.06 KiB/sec
Building packit-0.17.1.dev10+gbe9bb0a-1.20201008081714458688.master.10.gbe9bb0a.fc33.src.rpm for rawhide
Created task: 52982633
Task info: https://koji.fedoraproject.org/koji/taskinfo?taskID=52982633
Watching tasks (this may be safely interrupted)...
52982633 build (rawhide, packit-0.17.1.dev10+gbe9bb0a-1.20201008081714458688.master.10.gbe9bb0a.fc33.src.rpm): free
52982633 build (rawhide, packit-0.17.1.dev10+gbe9bb0a-1.20201008081714458688.master.10.gbe9bb0a.fc33.src.rpm): free -> FAILED: ActionNotAllowed: policy violation (build_from_srpm)
  0 free  0 open  0 done  1 failed

52982633 build (rawhide, packit-0.17.1.dev10+gbe9bb0a-1.20201008081714458688.master.10.gbe9bb0a.fc33.src.rpm) failed

...

ActionNotAllowed: policy violation (build_from_srpm)

I wonder if the policy can be tweaked and allow this for your koji target.

[jlebon]

I opened https://pagure.io/releng/issue/9801.

[csomh]

Sorry for the noise, pressed the wrong button. :confused:

[stale[bot]]

This issue has been marked as stale because it hasn't seen any
activity for the last 60 days.

Stale issues are closed after 14 days, unless the label is removed
by a maintainer or someone comments on it.

This is done in order to ensure that open issues are still relevant.

Thank you for your contribution! :unicorn: :rocket: :robot:

(Note: issues labeled with pinned or EPIC are
never marked as stale.)

[lachmanfrantisek]

The request is still valid. @TomasTomecek What can we do to move this forward? It looks like there is not much response in the linked issue.

[TomasTomecek]

reach out to Fedora rel-eng and get a possible solution

[TomasTomecek]

We've just discussed this card and sadly there is nothing we can do on our side - there needs to be a way for rel-eng to grant permissions to perform builds and since this is not our stake we can't lead such discussions.

Once you have more concrete requests, we'd be glad to discuss and implement them, but so far I am closing this.