Bug 2184659

Summary: CentOS Stream 9 - BaseOS GPG verification is broken
Product: Red Hat Enterprise Linux 9 Reporter: Nikita Uvarov <nuvarov>
Component: gnupg2Assignee: Jakub Jelen <jjelen>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: CentOS StreamCC: bstinson, jwboyer
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-04-05 11:26:52 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nikita Uvarov 2023-04-05 11:22:59 UTC
Description of problem:
I *think* that after release of gnupg2-2.3.3-3.el9 which deprecated SHA-1, CentOS Stream 9 - BaseOS repo verification was broken.

I haven't verified that it's specifically due to gnupg2 release, but the timing seem suspicious.

Version-Release number of selected component (if applicable):
gnupg2-2.3.3-3.el9

How reproducible:
Every time

Steps to Reproduce:
1. docker pull quay.io/centos/centos:stream9
2. docker run --rm -it quay.io/centos/centos:stream9 bash
3. dnf install -y vim
4. Get error:
The GPG keys listed for the "CentOS Stream 9 - BaseOS" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: vim-filesystem-2:8.2.2637-20.el9.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

Actual results:
The GPG keys listed for the "CentOS Stream 9 - BaseOS" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: vim-filesystem-2:8.2.2637-20.el9.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
Public key for which-2.21-28.el9.x86_64.rpm is not installed. Failing package is: which-2.21-28.el9.x86_64
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
The GPG keys listed for the "CentOS Stream 9 - AppStream" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: gpm-libs-1.20.7-29.el9.x86_64
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
Public key for vim-common-8.2.2637-20.el9.x86_64.rpm is not installed. Failing package is: vim-common-2:8.2.2637-20.el9.x86_64
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
Public key for vim-enhanced-8.2.2637-20.el9.x86_64.rpm is not installed. Failing package is: vim-enhanced-2:8.2.2637-20.el9.x86_64
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

Expected results:
vim package installed

Additional info:
This issue can be related: https://bugzilla.redhat.com/show_bug.cgi?id=2070722

Comment 1 Nikita Uvarov 2023-04-05 11:26:32 UTC
OK, seems like it just has been reported by someone else here https://bugzilla.redhat.com/show_bug.cgi?id=2184640.
Can be closed as a duplicate, sorry about that.

Comment 2 Nikita Uvarov 2023-04-05 11:26:52 UTC

*** This bug has been marked as a duplicate of bug 2184640 ***