Description of problem: Currently, DNF supports two flags: gpgcheck and repo_gpgcheck. However, it is not clear what "gpgcheck" actually covers. In DNF, gpgcheck only covers package signature checking, but in Zypper, it covers both package and repository metadata signature checking. Zypper has three options: 1. gpgcheck, covering repo and packages 2. pkg_gpgcheck, covering packages only (equivalent to current gpgcheck in Yum/DNF) 3. repo_gpgcheck, covering repo only (DNF supports this the same way Zypper does) Each of these can be set globally or per-repository. By default, Zypper does both repository and package checks, and the other two options can be used to override bits of that behavior in Zypper. We should implement the same options in DNF. This should not break Fedora 26 and newer because fedora-repos in F26+ has options set to be Zypper compatible (see bug 1373317). To ensure expectations are the same as before, we should globally switch off repo_gpgcheck in dnf.conf, so that third party repositories won't break. Version-Release number of selected component (if applicable): 2.1.0-1.fc26
Also, for reference: https://doc.opensuse.org/projects/libzypp/HEAD/group__ZyppConfig.html
In addition, COPR repos have the same assumptions as fedora-repos since September 2016: https://github.com/fedora-copr/copr/pull/12
According to my knowledge, DNF use the options: gpgcheck = covering packages only repo_gpgcheck = covering repo only We are sorry, but we cannot rename configuration options according to your request, due to introducing incompatibility with yum.
@Jaroslav: DNF currently has the ability to have this behavior changed in code. It currently defaults to not having repo_gpgcheck not inherit from gpgcheck, and it can remain that way for RHEL. I am saying that it should change for Fedora, and the pkg_gpgcheck config option should be introduced to offer the pkg equivalent of repo_gpgcheck. And "Yum incompatibility" is not a solid enough justification for allowing dumb behaviors to persist forever. One of the very distinct reasons DNF is not named Yum is so that it would be allowed to fix broken behavior. This is one of those broken behaviors. If you want to have RHEL support the Yum legacy behavior, that's fine, it's even configurable to do so! The Yum behavior would be easy to do. Just add to dnf.conf the following: gpgcheck = 1 repo_gpgcheck = 0 But I should be able to have "gpgcheck = 1" and then have package repos that are set up like the following: gpgcheck = 1 pkg_gpgcheck = 0 That is currently not possible. "gpgcheck = 0" doesn't work, because it forces "repo_gpgcheck = 0" too. Thus, I can't actually do "no signatures on packages, but signatures on repodata". And yes, this is a valid possibility in Zypper, and I have seen RPM repositories in the wild this way.
This message is a reminder that Fedora 26 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '26'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 26 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Removing the Triaged keyword so that it shows up in our queries for the next triaging meeting.
I discussed this issue with Michal Domonkos in #yum today, and we agreed the that following proposal makes sense to implement: In /etc/dnf/dnf.conf, a new option "gpgcheck_policy" would be implemented, with the following options: "legacy", "full", and "all". * "gpgcheck_policy=legacy" makes "gpgcheck=1" equivalent to setting "pkg_gpgcheck=1", "repo_gpgcheck=0", and "localpkg_gpgcheck=0". * "gpgcheck_policy=full" makes "gpgcheck=1" equivalent to setting "pkg_gpgcheck=1", "repo_gpgcheck=1", and "localpkg_gpgcheck=0". * "gpgcheck_policy=all" makes "gpgcheck=1" equivalent to setting "pkg_gpgcheck=1", "repo_gpgcheck=1", and "localpkg_gpgcheck=1". Regardless of modes, each configuration section ("[main]" or repo sections in dnf.conf or in repo files) can override the policy behavior by setting "pkg_gpgcheck" and "repo_gpgcheck" accordingly. Obviously "localpkg_gpgcheck" has no bearing in repo sections, but could be switched on separately in the main section in dnf.conf. The upstream default in the code (that is, when the "gpgcheck_policy" option is unset) would be the equivalent of setting "gpgcheck_policy=full". However, for the dnf.conf that will ship in Fedora and RHEL, it would be set to "gpgcheck_policy=legacy" to conform with the existing behavior and not break anything. This aligns our options and behaviors with other RPM package managers using rpm-md and makes the GPG checking policy coherent.
I'm returning this to the backlog (dropping "Triaged") for the DNF team to reconsider.
Moving to DNF 5.