removeobsoletegpgkeys: Adjust for converting

When doing upgrade + conversion, removing obsolete GPG from the current
(or target for that matter) distro doesn't make sense, because we are
moving to a different distro.
Instead, all distro provided keys from the source distro need to be
removed, as the target distro uses it's own keys. Those are imported
elsewhere later during the upgrade.

A new list is added to the gpg-signatures.json maps, which contains the
names of the fake RPMs "generated" upon importing a GPG key into the RPM
DB.
These are in the order the key IDs ("keys" in the map) are in, however
the mapping is not always 1:1 (e.g. the Centos SIG Extras keys).

The key id could be mapped to the RPM names, however since the RPM NVR
format is:
gpg-pubkey-<last 8 chars from key ID>-<creation time of the signature packet>
there could be a collision between the key IDs.

Some key RPMs are missing in Alma Linux map as I couldn't find out what
keys some the fingerprints correspond to.

Jira: RHEL-110190

I addded annotations to the keys at:
https://github.com/oamg/leapp-repository/wiki/gpg%E2%80%90signatures.json-key-annotations.

(cherry picked from commit 37a071d)

Keep in the map:
 - CloudLinux TuxCare key "d07bf2a08d50eb66": ["gpg-pubkey-8d50eb66-64061978"]
 - CentOS7 (AltArch) key "6c7cb6ef305d49d6": ["gpg-pubkey-305d49d6-55b78768"]

Author: matejmatuska

repos/system_upgrade/common/actors/removeobsoletegpgkeys/actor.py

@@ -8,9 +8,14 @@ class RemoveObsoleteGpgKeys(Actor):
     """
     Remove obsoleted RPM GPG keys.
 
-    New version might make existing RPM GPG keys obsolete. This might be caused
-    for example by the hashing algorithm becoming deprecated or by the key
-    getting replaced.
+    The definition of what keys are considered obsolete depends on whether the
+    upgrade also does a conversion:
+    - If not converting, the obsolete keys are those that are no longer valid
+      on the target version. This might be caused for example by the hashing
+      algorithm becoming deprecated or by the key getting replaced. Note that
+      only keys provided by the vendor of the OS are handled.
+    - If converting, the obsolete keys are all of the keys provided by the
+      vendor of the source distribution.
 
     A DNFWorkaround is registered to actually remove the keys.
     """

repos/system_upgrade/common/actors/removeobsoletegpgkeys/libraries/removeobsoleterpmgpgkeys.py

@@ -1,3 +1,5 @@
+import itertools
+
 from leapp.libraries.common.config import get_source_distro_id, get_target_distro_id
 from leapp.libraries.common.config.version import get_target_major_version
 from leapp.libraries.common.distro import get_distribution_data
@@ -6,25 +8,48 @@
 from leapp.models import DNFWorkaround, InstalledRPM
 
 
+def _is_key_installed(key):
+    """
+    :param key: The NVR of the gpg key RPM (e.g. gpg-pubkey-1d997668-61bae63b)
+    """
+    name, version, release = key.rsplit("-", 2)
+    return has_package(InstalledRPM, name, version=version, release=release)
+
+
 def _get_obsolete_keys():
     """
-    Return keys obsoleted in target and previous versions
+    Get keys obsoleted in target and previous major versions
     """
     distribution = get_target_distro_id()
-    obsoleted_keys_map = get_distribution_data(distribution).get('obsoleted-keys', {})
+    obsoleted_keys_map = get_distribution_data(distribution).get("obsoleted-keys", {})
     keys = []
     for version in range(7, int(get_target_major_version()) + 1):
         try:
             for key in obsoleted_keys_map[str(version)]:
-                name, version, release = key.rsplit("-", 2)
-                if has_package(InstalledRPM, name, version=version, release=release):
+                if _is_key_installed(key):
                     keys.append(key)
         except KeyError:
             pass
 
     return keys
 
 
+def _get_source_distro_keys():
+    """
+    Get all known keys of the source distro
+
+    This includes keys from all relevant previous OS versions as all of those
+    might be present on the system.
+    """
+    distribution = get_source_distro_id()
+    keys = get_distribution_data(distribution).get("keys", {})
+    return [
+        key
+        for key in itertools.chain.from_iterable(keys.values())
+        if _is_key_installed(key)
+    ]
+
+
 def register_dnfworkaround(keys):
     api.produce(
         DNFWorkaround(
@@ -36,13 +61,12 @@ def register_dnfworkaround(keys):
 
 
 def process():
-    if get_source_distro_id() != get_target_distro_id():
-        # TODO adjust for conversions, in the current state it would not have
-        # any effect, just skip it
-        return
-
-    keys = _get_obsolete_keys()
-    if not keys:
-        return
+    if get_source_distro_id() == get_target_distro_id():
+        # only upgrading - remove keys obsoleted in previous versions
+        keys = _get_obsolete_keys()
+    else:
+        # also converting - we need to remove all keys from the source distro
+        keys = _get_source_distro_keys()
 
-    register_dnfworkaround(keys)
+    if keys:
+        register_dnfworkaround(keys)