Bug 2329497

Summary:	DNF has no default enabled gpgcheck setting
Product:	[Fedora] Fedora	Reporter:	fanyt+fedora
Component:	fedora-release	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	41	CC:	alciregi, fedoraproject, jkolarik, kevin, mboddu, nsella, pbrobinson, pkratoch, ppisar, rpm-software-management, samyak.jn11, sgallagh, thrcka, zbyszek
Target Milestone:	---	Keywords:	Patch, Triaged
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	fedora-release-41-29	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-12-05 02:23:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description fanyt+fedora 2024-11-29 15:40:27 UTC

When adding a repository without specified gpgcheck=1 in the repo file, I noticed that it skipped the PGP check: Warning: skipped PGP checks for 1 package from repository.

This behavior didn't happen on Fedora 40, so after some digging F40 shipped with different defaults as Fedora 41.

I would expect to at least have some kind of same defaults, where possible. And it seems gpgcheck=True would be one.

Reproducible: Always

Steps to Reproduce:
1. Add repository without gpgcheck=1
2. Install package

Actual Results:  
Warning: skipped PGP checks for 1 package from repository

Expected Results:  
Importing PGP key 0x123456:
Is this ok [y/N]: y

user@fedora-40:~$ cat /etc/dnf/dnf.conf 
# see `man dnf.conf` for defaults and possible options

[main]
gpgcheck=True
installonly_limit=3
clean_requirements_on_remove=True
best=False
skip_if_unavailable=True

And the defaults on F41
user@fedora-41:~$ cat /usr/share/dnf5/libdnf.conf.d/20-fedora-defaults.conf 
[main]
best=False
skip_if_unavailable=True

Comment 1 Peter Robinson 2024-11-30 12:17:45 UTC

Should be against dnf5

Comment 2 Petr Pisar 2024-12-02 12:56:11 UTC

Indeed, it defaults the false. That's not good.

Comment 3 Petr Pisar 2024-12-02 13:24:28 UTC

I checked both DNF4 and DNF5. They both as software without a configuration default to false.

However, you are right that /etc/dnf/dnf.conf file as distributed with DNF4 Fedora package sets gpgcheck to true. That's a difference from DNF5 Fedora package.

I will ask DNF5 upstream whether the want to change a default to true, or whether we will override the settings within a distribution-wide configuration. I guess the latter will happen in the name of compatibility.

Comment 4 fanyt+fedora 2024-12-02 13:38:58 UTC

Thank you very much for looking into this. Which ever option makes the most sense, I'm happy with it. Thanks again.

Comment 5 Petr Pisar 2024-12-02 14:20:31 UTC

DNF5 upstream said that the change should be done on Fedora distribution level in /usr/share/dnf5/libdnf.conf.d/20-fedora-defaults.conf file maintained in fedora-release component where similar Fedora-specific tunes reside.

Affected package is fedora-release-common-41-28.noarch.

Comment 6 Petr Pisar 2024-12-02 14:38:11 UTC

I opened two pull requests in dist-git.

Comment 7 Fedora Update System 2024-12-02 15:21:32 UTC

FEDORA-2024-6c3a93ab2c (fedora-release-41-29) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-6c3a93ab2c

Comment 8 Fedora Update System 2024-12-04 02:23:27 UTC

FEDORA-2024-6c3a93ab2c has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-6c3a93ab2c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-6c3a93ab2c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2024-12-05 02:23:03 UTC

FEDORA-2024-6c3a93ab2c (fedora-release-41-29) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.