Bug 890616

Summary:	Cannot install unsigned packages
Product:	[Fedora] Fedora	Reporter:	Adam Williamson <awilliam>
Component:	PackageKit	Assignee:	Richard Hughes <rhughes>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	18	CC:	eagleton, jonathan, jreznik, keramidasceid, knkberry77, maurizio.antillon, nsoranzo, py, rdieter, redhat, rhughes, rvitale, smparrish
Target Milestone:	---	Keywords:	CommonBugs
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:	https://fedoraproject.org/wiki/Common_F18_bugs#packagekit-unsigned
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-01-18 20:46:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Adam Williamson 2012-12-28 06:19:29 UTC

gnome-packagekit in Fedora 18 no longer seems to have any mechanism for installing unsigned packages or packages signed with an unknown key. It used to allow you to do this with warnings and root password entry and so on, but in F18, it just pops up a window that says 'Missing security signature...The package security signature is missing and this package is untrusted. This package was not signed when created." (it seems to pop this up even for packages that *are* signed, but with an unknown key - there's a 'More details' expander which shows "Public key for foo.rpm is not installed" in this case). The dialog just has a 'Close' button, and you're done. No option to override and install the package.

I assumed this was an intentional policy change and didn't report it as a bug before, but Richard said it wasn't, so I'm filing a bug now.

This has been noted in the forums, and will cause trouble for people enabling popular third-party repositories and downloading RPM packages provided directly by third-party projects.

Comment 1 Richard Hughes 2013-01-02 14:01:14 UTC

I've fixed this upstream with:

commit 9db3c60866e17a2cae60725106c2addc21f24ee8
Author: Richard Hughes <richard>
Date:   Wed Jan 2 13:59:41 2013 +0000

    If a simulated only-trusted transaction returns with need-untrusted then re-simulate with only-trusted=FALSE

:100644 100644 0a1f295... 4fc1587... M  lib/packagekit-glib2/pk-task.c

I don't know why it wasn't picked up in the unit tests, so apologies there. I've built a test (f18ish) package here: http://people.freedesktop.org/~hughsient/fedora/17/

I'd appreciate some testing. If it works, I'll roll an F18 update ASAP. Thanks.

Richard.

Comment 2 Adam Williamson 2013-01-04 04:08:00 UTC

Test confirmed, it prompts for admin password then installs the package. Thanks.

Comment 3 Adam Williamson 2013-01-15 00:51:26 UTC

Richard: can you please build the F18 update with the fix? Thanks! It would be nice to have this available ASAP.

Comment 4 Fedora Update System 2013-01-16 18:20:30 UTC

PackageKit-0.8.7-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/PackageKit-0.8.7-1.fc18

Comment 5 Fedora Update System 2013-01-18 20:46:28 UTC

PackageKit-0.8.7-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Ken Berry 2013-01-19 09:38:56 UTC

What's up with the PackageKit-0.8.7-1.fc18.x86_64.rpm? Can not install with the installer and can not install through a terminal yet either yet. I downloaded and same error as any other package that is unsigned. Please advise.

Comment 7 DanielS 2013-02-14 02:36:28 UTC

The following page links here:
http://fedoraproject.org/wiki/Common_F18_bugs#PackageKit_cannot_install_unsigned_packages_or_packages_signed_with_an_untrusted_key

According to the bug title, this issue is fixed. But it only fixes half of the problem described above.
- Unsigned packages (e.g. Skype) can now be installed.
- Signed packages with unknown key (e.g. TeamViewer unless you import the key from http://www.teamviewer.com/en/help/363-How-do-I-install-TeamViewer-on-my-Linux-distribution.aspx) can not be installed. Very annoying as there is no error indication. Should that be a separate issue?

Comment 8 Rex Dieter 2013-02-14 13:49:24 UTC

separate issue, yes (please)