Bug 2124735

Summary: podman pull registry.access.redhat.com/ubi8:latest image failed due to signature not accepted
Product: Red Hat Enterprise Linux 9 Reporter: Xiaofeng Wang <xiaofwan>
Component: podmanAssignee: Tom Sweeney <tsweeney>
Status: CLOSED DUPLICATE QA Contact: atomic-bugs <atomic-bugs>
Severity: unspecified Docs Contact:
Priority: high    
Version: CentOS StreamCC: bbaude, bstinson, ddarrah, dwalsh, jnovy, jwboyer, lsm5, mboddu, mheon, pthomas, qzhang, umohnani, ypu
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-09-07 04:42:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Xiaofeng Wang 2022-09-07 01:10:54 UTC
Description of problem:
Run "podman run --log-level debug ubi8:latest cat /etc/redhat-release" failed with error:
DEBU[0000] Error pulling candidate registry.access.redhat.com/ubi9:latest: copying system image from manifest list: Source image rejected: None of the signatures were accepted, reasons: open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory
Error: copying system image from manifest list: Source image rejected: None of the signatures were accepted, reasons: open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory; open /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta: no such file or directory

Check /etc/pki/rpm-gpg
[admin@centos-stream-9-220906 rhel-edge]$ ll /etc/pki/rpm-gpg/
total 16
-rw-r--r--. 1 root root 1683 Mar  2  2022 RPM-GPG-KEY-centosofficial
-rw-r--r--. 1 root root 2182 Mar  2  2022 RPM-GPG-KEY-CentOS-SIG-Extras
-rw-r--r--. 1 root root 2182 Mar  2  2022 RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
-rw-r--r--. 1 root root 1855 Aug 23 10:01 RPM-GPG-KEY-redhat-release

Check /etc/containers/policy.json
[admin@centos-stream-9-220906 rhel-edge]$ cat /etc/containers/policy.json
{
    "default": [
        {
            "type": "insecureAcceptAnything"
        }
    ],
    "transports": {
        "docker": {
	    "registry.access.redhat.com": [
		{
		    "type": "signedBy",
		    "keyType": "GPGKeys",
		    "keyPaths": ["/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release", "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta"]
		}
	    ],
	    "registry.redhat.io": [
		{
		    "type": "signedBy",
		    "keyType": "GPGKeys",
		    "keyPaths": ["/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release", "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta"]
		}
	    ]
	},
        "docker-daemon": {
	    "": [
		{
		    "type": "insecureAcceptAnything"
		}
	    ]
	}
    }
}
Version-Release number of selected component (if applicable):
CentOS Stream 9
podman 4.2.0

How reproducible:
Steps to Reproduce:
1. Run "podman run --log-level debug ubi8:latest cat /etc/redhat-release"

Actual results:
Error pulling candidate registry.access.redhat.com/ubi9:latest: copying system image from manifest list: Source image rejected: None of the signatures were accepted

Expected results:
Run image without any error

Additional info:

Comment 1 Xiaofeng Wang 2022-09-07 04:42:30 UTC

*** This bug has been marked as a duplicate of bug 2123611 ***