OpenShift release signature is armored which is a GnuPG extension to OpenPGP and doesn't work on FIPS enabled RHEL 9 systems

    100%

    1.Deploy RHEL 9.4 System
    2.Enable FIPS
    3.Run the following command

oc adm release mirror --apply-release-image-signature=false --from=quay.io/openshift-release-dev/ocp-release:4.16.3-x86_64 --to file://openshift/release --to-dir=/home/ec2-user/mirror

error: Unable to load configmap verifier: the config map openshift-config-managed/release-verification has an invalid key "verifier-public-key-redhat" that must be a GPG public key: unable to read keyring with armor (openpgp: invalid data: user ID self-signature invalid: openpgp: invalid signature: RSA verification failure) or without armor (openpgp: invalid data: tag byte does not have MSB set): unable to read keyring with armor (openpgp: invalid data: user ID self-signature invalid: openpgp: invalid signature: RSA verification failure) or without armor (openpgp: invalid data: tag byte does not have MSB set)

OpenShift release images are mirroed to disk    

This has started happening within the last few weeks. It seems that when the oc binary started using the underlying OS libraries for FIPS compliance instead of the GOlang embedded libraries, this error started happening    

We can see that the release key is armored here on a 4.17 cluster.


oc get -o yaml cm release-verification
apiVersion: v1
data:
  store-openshift-official-release: https://storage.googleapis.com/openshift-release/official/signatures/openshift/release
  store-openshift-official-release-mirror: https://mirror.openshift.com/pub/openshift-v4/signatures/openshift/release
  verifier-public-key-redhat: |
    -----BEGIN PGP PUBLIC KEY BLOCK-----
    Comment: Use "gpg --dearmor" for unpacking


Also note, the release being mirrored does not change the behavior. Same error message if we mirror 4.12.20 or 4.17.6. The error goes away if I use an older 4.12.20 oc binary. The armored GPG key has been there a long time. Only when oc started using the system libraries for FIPS support correctly did the armored key become an issue.

This is a huge problem for a ton of customers who has FIPS requirements.