Bug 1089408

Summary: Yumex should honour gpgcheck=0 in repo file
Product: [Fedora] Fedora Reporter: Raphael Groner <projects.rg>
Component: yumexAssignee: Tim Lauridsen <tim.lauridsen>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 20CC: tim.lauridsen
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: yumex-3.0.15-1.fc19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-15 01:52:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Raphael Groner 2014-04-18 19:03:32 UTC
Description of problem:
Yumex should honour gpgcheck=0 in repo file.

Version-Release number of selected component (if applicable):
yumex-3.0.14-1.fc20.noarch

How reproducible:
yes

Steps to Reproduce:
1. Add nonamedotc-xfce411.repo (see link) to /etc/yum.repos.d/
2. Restart yumex and activate (general) GPG check menu option
3. Try to install xfce packages

Actual results:
Yumex refuses to install an unsigned package.

Expected results:
Yumex ignores gpg checksum and installs anything.

Additional info:
https://copr.fedoraproject.org/coprs/nonamedotc/xfce411/
$ grep gpg nonamedotc-xfce411.repo 
gpgcheck=0

Comment 1 Raphael Groner 2014-06-04 04:29:37 UTC
ping?

Comment 2 Tim Lauridsen 2014-06-04 04:42:33 UTC
This sound very weird, yumex uses yum for all the repo handling and I have never experienced any problem with gpgcheck=0, I will do some testing and be back

Comment 3 Tim Lauridsen 2014-06-04 04:53:27 UTC
OK, Did some testing and I can reproduce the problem in yumex, but it works in yum on the command line, I will look into whats goes wrong.

Comment 4 Raphael Groner 2014-06-04 11:07:52 UTC
(In reply to Tim Lauridsen from comment #2)
> This sound very weird, yumex uses yum for all the repo handling and I have
> never experienced any problem with gpgcheck=0, I will do some testing and be
> back

It can be also seen as some kind of a security feature. Therefore, I am not sure if it's a real bug:
First do all signed installations, then carefully select all unsigned but trusted packages and start a second installation process.

(In reply to Tim Lauridsen from comment #3)
> OK, Did some testing and I can reproduce the problem in yumex, but it works
> in yum on the command line, I will look into whats goes wrong.

Maybe Yumex uses its own yum.conf? What settings come from /etc/yum.repos.d/ exactly?

Comment 5 Tim Lauridsen 2014-06-04 11:23:37 UTC
THe problem is yumex has an option to set gpgcheck=0 for all repos and currently it sets gpgcheck=1 for all repos, when the option is disabled, it is wrong
it should only set gpgcheck when the option is enabled

Comment 7 Fedora Update System 2014-06-06 06:23:08 UTC
yumex-3.0.15-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/yumex-3.0.15-1.fc20

Comment 8 Fedora Update System 2014-06-06 06:23:15 UTC
yumex-3.0.15-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/yumex-3.0.15-1.fc19

Comment 9 Fedora Update System 2014-06-10 02:53:31 UTC
Package yumex-3.0.15-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing yumex-3.0.15-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-7120/yumex-3.0.15-1.fc20
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2014-06-15 01:52:58 UTC
yumex-3.0.15-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-06-17 23:27:51 UTC
yumex-3.0.15-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.