Description of problem: new published client RPMs can't be installed on EL5 system because of broken signature Version-Release number of selected component (if applicable): osad-5.11.57-1.el5.noarch.rpm (and others) How reproducible: always Steps to Reproduce: 1. download //spacewalk.redhat.com/yum/2.3-client/RHEL/5/i386/osad-5.11.57-1.el5.noarch.rpm 2. try to install Actual results: # rpm -Uhv --test /tmp/osad-5.11.57-1.el5.noarch.rpm error: /tmp/osad-5.11.57-1.el5.noarch.rpm: Header V4 RSA/SHA1 signature: BAD, key ID 066e5810 error: /tmp/osad-5.11.57-1.el5.noarch.rpm cannot be installed Expected results: Working install Additional info: something changed in the the signature: osad-5.11.33-1.el5.noarch.rpm: Header V3 DSA/SHA1 Signature, key ID 863a853d osad-5.11.43-1.el5.noarch.rpm: Header V4 DSA/SHA1 Signature, key ID 863a853d osad-5.11.57-1.el5.noarch.rpm: Header V4 RSA/SHA1 Signature, key ID 066e5810 -> has RSA instead of DSA and also the new Spacewalk key was MD5 selected during signing packets for EL5 channels?
Well...ugh. The -2016 (v4, RSA) signing key is not compatible with RHEL5 GPG. We will fix this by creating a new (RHEL5-compatible) key and re-signing the RHEL5-client-repos. Will update the BZ when that's done.
[NB: replace "-2016" in c#1 with "-2014"] As a (very temporary) workaround, you can specify yum --nogpgcheck or set gpgcheck=0 in /etc/yum.repos.d/spacewalk-client.repo. Using rpm, specify --nosignature.
Try this in your .rpmmacros: %__gpg_sign_cmd %{__gpg} \ gpg --batch --no-verbose --no-armor --passphrase-fd 3 --force-v3-sigs --no-secmem-warning \ -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}
Thanks - we ended up generating a new RPM-GPG-KEY, the 2048/RSA of 2014 was (part of) the problem. (In addition, I ended up with .rpmmacros almost exactly the same as you mention before seeing your comment; clearly we were on the same track :) ) SPACEWALK-2.3 RHEL5 client-pieces have been signed with the new RHEL5-compatible key, and should work for you now. You will want to install the new version of the spacewalk-client-repo.rpm: # rpm -Uvh http://yum.spacewalkproject.org/2.3-client/RHEL/5/x86_64/spacewalk-client-repo-2.3-3.el5.noarch.rpm Or, you may import the new public-key directly: # wget http://yum.spacewalkproject.org/RPM-GPG-KEY-spacewalk-2015 # rpm --import RPM-GPG-KEY-spacewalk-2015 Thanks for the catch!
This BZ closed some time during 2.5, 2.6 or 2.7. Adding to 2.7 tracking bug.