Bug 1546065

Summary: gpg key issue while update from f27 to rawhide
Product: [Fedora] Fedora Reporter: Parag Nemade <pnemade>
Component: fedora-reposAssignee: Dennis Gilmore <dennis>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 27CC: dennis, dgilmore, kellin, kevin, mboddu, pbrobinson, puiterwijk
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-03-22 13:19:39 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Parag Nemade 2018-02-16 09:05:13 UTC 
Description of problem:
I want to update my system from existing Fedora 27 Workstation to Fedora 28 rawhide. I then only kept rawhide repo enabled on this f27 system. Then I just did following
[parag@f27 Downloads]$ sudo dnf update fedora-release
Last metadata expiration check: 0:01:34 ago on Fri 16 Feb 2018 02:28:57 PM IST.
Dependencies resolved.
===============================================================================
 Package                         Arch        Version        Repository    Size
===============================================================================
Upgrading:
 fedora-gpg-keys                 noarch      28-0.3         rawhide       93 k
 fedora-release                  noarch      28-0.2         rawhide       26 k
 fedora-release-workstation      noarch      28-0.2         rawhide       20 k
 fedora-repos                    noarch      28-0.3         rawhide      8.1 k
 fedora-repos-rawhide            noarch      28-0.3         rawhide      7.7 k

Transaction Summary
===============================================================================
Upgrade  5 Packages

Total size: 154 k
Is this ok [y/N]: y
Downloading Packages:
[SKIPPED] fedora-release-28-0.2.noarch.rpm: Already downloaded                
[SKIPPED] fedora-repos-28-0.3.noarch.rpm: Already downloaded                  
[SKIPPED] fedora-gpg-keys-28-0.3.noarch.rpm: Already downloaded               
[SKIPPED] fedora-repos-rawhide-28-0.3.noarch.rpm: Already downloaded          
[SKIPPED] fedora-release-workstation-28-0.2.noarch.rpm: Already downloaded    
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/fedora-release-28-0.2.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID 9db62fb1: NOKEY
Importing GPG key 0xF5282EE4:
 Userid     : "Fedora 27 (27) <fedora-27>"
 Fingerprint: 860E 19B0 AFA8 00A1 7518 81A6 F55E 7430 F528 2EE4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?
Public key for fedora-release-28-0.2.noarch.rpm is not installed. Failing package is: fedora-release-28-0.2.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
Public key for fedora-repos-28-0.3.noarch.rpm is not installed. Failing package is: fedora-repos-28-0.3.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
Public key for fedora-gpg-keys-28-0.3.noarch.rpm is not installed. Failing package is: fedora-gpg-keys-28-0.3.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
Public key for fedora-repos-rawhide-28-0.3.noarch.rpm is not installed. Failing package is: fedora-repos-rawhide-28-0.3.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
Public key for fedora-release-workstation-28-0.2.noarch.rpm is not installed. Failing package is: fedora-release-workstation-28-0.2.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED



Version-Release number of selected component (if applicable):
fedora-repos-27-1.noarch
fedora-repos-rawhide-27-1.noarch
fedora-release-workstation-27-1.noarch
fedora-release-27-1.noarch


How reproducible:
always

Steps to Reproduce:
1. Get some Fedora 27 system
2. Only keep rawhide repo enabled
3. dnf update fedora-release

Actual results:
failure

Expected results:
should update the package

Additional info:
Comment 1 Parag Nemade 2018-02-16 09:06:49 UTC 
It doesnot matter if I say Y/N to gpg import key, failure message is same
Comment 2 Patrick Uiterwijk 2018-02-16 09:17:23 UTC 
This is caused by the $releasever in the rawhide repo gpgkey.
We should either conflict fedora-repos and fedora-repos-rawhide and not allow using rawhide repos package on a stable release system, or we need to remove the $releasever, replace with what's currently rawhide, and update that on all supported releases everything we branch.
Comment 3 Dennis Gilmore 2018-02-19 03:14:25 UTC 
you need to add --releasever=28 to your command
Comment 4 Parag Nemade 2018-02-19 03:54:14 UTC 
Great this worked. I have not used such option before. I just changed

dnf update fedora-release
to 
dnf update fedora-release --releasever=28

this picked correct gpg key for me now. I can't decide then if there is any bug anywhere.
Comment 5 Dennis Gilmore 2018-03-22 13:19:39 UTC 
This just needs to be better communicated and documented