Bug 1456079 - Key f5282ee4 will not verify packages on system-upgrade from f26 to rawhide
Summary: Key f5282ee4 will not verify packages on system-upgrade from f26 to rawhide
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: fedora-repos
Version: 27
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Dennis Gilmore
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1469600 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-27 01:15 UTC by John Preston
Modified: 2018-09-07 04:40 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2018-08-31 10:50:26 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description John Preston 2017-05-27 01:15:01 UTC
I am trying to system-upgrade from f26 to rawhide, but I receive errors like the following:

warning: /var/lib/dnf/system-upgrade/NetworkManager-1.8.0-2.fc27.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f5282ee4: NOKEY
Curl error (37): Couldn't read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-x86_64 [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-x86_64]


Possibly the same problem as bug 1364581. I have tried working around this for now with:

ln -s /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-26-x86_64 /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-x86_64

but this gives me:

warning: /var/lib/dnf/system-upgrade/NetworkManager-1.8.0-2.fc27.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f5282ee4: NOKEY
Importing GPG key 0xF5282EE4:
 Userid     : "Fedora 27 (27) <fedora-27>"
 Fingerprint: 860E 19B0 AFA8 00A1 7518 81A6 F55E 7430 F528 2EE4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-x86_64
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: 


Public key for NetworkManager-1.8.0-2.fc27.x86_64.rpm is not installedFailing package is: NetworkManager-1:1.8.0-2.fc27.x86_64
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-x86_64


At this point I got confused, since the fingerprints match, so not sure why it's complaining the import didn't help.

I have seen the following entry on the DNF system upgrade talk page (https://fedoraproject.org/wiki/Talk:DNF_system_upgrade):

 Rawhide needs to include additional instruction

You need to install the fedora-repos-rawhide before you start this process, and apparently. "file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-x86_64" ... apparently that file doesn't exist anywhere and you have to --nogpg

--Taw (talk) 21:47, 11 February 2017 (UTC) 


so I am going to try --nogpg next, but I am wondering if there is a more correct solution to this.

Apologies if NOTABUG. Thanks for your help.

Comment 1 Kevin Fenzi 2017-05-27 17:02:36 UTC
So, IMHO the bug here is that we need to ship in fedora-repos a link from /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-rawhide-x86_64 to the actual key. Currently that is: /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-primary

So, your link would have worked, but you linked to the f26 key, which is not correct. rawhide and branched are signed by different keys and are different versions. 

I'll go correct the wiki, as you should NOT EVER use nogpg. ;)

Comment 2 Kevin Fenzi 2017-07-22 20:55:22 UTC
*** Bug 1469600 has been marked as a duplicate of this bug. ***

Comment 3 Dennis Gilmore 2017-07-31 22:10:59 UTC
using --releasever=27 on the command line will make everything work correctly. we do need to figure out a way to make things work without a ton of pain

Comment 4 Jan Kurik 2017-08-15 07:42:42 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.

Comment 5 Paul DeStefano 2017-08-23 17:12:06 UTC
I don't understand how I got back to this bug.  I experienced bug this bug when first tried to upgrade to rawhide (from F26) and fixed it making some symlinks, I think.  Things were okay for a couple updates and then packages were broken involving Libre Office and libpopler for a long time. I finally got dnf to initiate an upgrade with allowerasing, but after download, it asked to install GPG key F5282EE4, which I allowed, and now GPG check fails for all packages.  DNF said "Importing keys didn't help.  Wrong keys?" just as in bug 1469600.  In dnf.log I see:

2017-08-23T15:30:40Z CRITICAL Importing GPG key 0xF5282EE4:
 Userid     : "Fedora 27 (27) <fedora-27>"
 Fingerprint: 860E 19B0 AFA8 00A1 7518 81A6 F55E 7430 F528 2EE4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
...<errors>

Now, when I try to restart the upgrade, DNF says "Public key for <pkg> is not installed..." for all pkgs.  In subsequent tries, it continues to prompt for key import and says it imports, successfully, the same F27 key each time, but it also says "didn't help."  It also says this, which I don't understand:

warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/<pkg> Header V3 RSA/SHA256 Signature, key ID 9db62fb1: NOKEY

Isn't that the key ID i need?

Comment 6 John Preston 2017-08-23 18:16:42 UTC
(In reply to Paul DeStefano from comment #5)
> I don't understand how I got back to this bug.  I experienced bug this bug
> when first tried to upgrade to rawhide (from F26) and fixed it making some
> symlinks, I think.  Things were okay for a couple updates and then packages
> were broken involving Libre Office and libpopler for a long time. I finally
> got dnf to initiate an upgrade with allowerasing, but after download, it
> asked to install GPG key F5282EE4, which I allowed, and now GPG check fails
> for all packages.  DNF said "Importing keys didn't help.  Wrong keys?" just
> as in bug 1469600.  In dnf.log I see:
> 
> 2017-08-23T15:30:40Z CRITICAL Importing GPG key 0xF5282EE4:
>  Userid     : "Fedora 27 (27) <fedora-27>"
>  Fingerprint: 860E 19B0 AFA8 00A1 7518 81A6 F55E 7430 F528 2EE4
>  From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-27-x86_64
> ...<errors>
> 
> Now, when I try to restart the upgrade, DNF says "Public key for <pkg> is
> not installed..." for all pkgs.  In subsequent tries, it continues to prompt
> for key import and says it imports, successfully, the same F27 key each
> time, but it also says "didn't help."  It also says this, which I don't
> understand:
> 
> warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/<pkg> Header V3
> RSA/SHA256 Signature, key ID 9db62fb1: NOKEY
> 
> Isn't that the key ID i need?

I also had this problem recently due to the rawhide version number changing. It is caused by not having the key for f28, with which new builds are signed. I fixed this by upgrading the packages fedora-release, fedora-repos, and fedora-repos-rawhide, with --nogpgcheck. There may have been another package, I'm not sure, I just looked through the list of packages dnf was going to upgrade and pulled out the ones that sounded like they might have the new key. Once these are installed you will have the f28 key in /etc/pki/rpm-gpg/ and you will be able to upgrade the rest of your packages.

Comment 7 Peter Robinson 2017-08-23 20:12:20 UTC
> Isn't that the key ID i need?

rawhide is F28 now so if you've not updated for a while you might have issues, there's a different key, if you want to stay on F27 I'd do "dnf --releasever=27 --setopt=deltarpm=false distro-sync"

Comment 8 Paul DeStefano 2017-08-23 20:31:04 UTC
Grr.  I've been trying to upgrade every week for at least two months and it's been broken for other reasons the whole time.

So, what if I don't want to stay with 27?  Then what?

Comment 9 John Preston 2017-08-23 20:32:38 UTC
(In reply to Paul DeStefano from comment #8)
> Grr.  I've been trying to upgrade every week for at least two months and
> it's been broken for other reasons the whole time.
> 
> So, what if I don't want to stay with 27?  Then what?

My reply will allow you to stay with rawhide, which is the same as moving to f28. Otherwise you could dnf system-upgrade to f26?

Comment 10 Paul DeStefano 2017-08-23 20:55:53 UTC
Sure, I get that, but I'd like to know what Kevin was suggesting since he says not to do that.

Peter's suggested command fails with the exact same error (import didn't help).  I'm not sure why that was supposed to work as all pkg crypto is broken.

Comment 11 Kevin Fenzi 2017-08-23 21:42:29 UTC
I was suggesting no one should use --nogpgcheck. 

I'm definitely not seeing "all pkg crypto is broken" here. 

So, you imported the f27 key and ran Peters distro sync command and it errors talking about the f28 key? What repos do you have enabled? 

'dnf repolist' 

If you are going to f28 (rawhide currently) you can only have fedora-rawhide enabled and need the f28 key imported. 

If you are trying to go to f27, you need fedora, fedora-updates, fedora-updates-testing enabled and need the f27 key imported. 

Ditto for older releases. 

I suspect you only have the rawhide repo enabled?

Comment 12 Paul DeStefano 2017-08-23 22:01:26 UTC
Thanks Kevin.  Yes, you are correct.  rawhide only.

I ran Peter's command and it imports, again, F27 key, but cannot verify any pkgs.  I assume these are F28 signed from that previous error because dnf doesn't say which key it needs when it fails all the packages.

This install was dnf upgrade from F26 to rawhide.  I'm not trying to go to anywhere, I just want to stay with rawhide.  I guess that isn't a thing, though?  Or I don't know how to describe it to dnf, at least.

So, do I want to install fedora-repos-28, enable 28 only, then distro-sync?  If so, how do I install that package because it will not install now; I tried.

Comment 13 Kevin Fenzi 2017-08-23 22:07:43 UTC
You want to install the f28 key and then re-run the distro-sync. 

rpm --import https://pagure.io/fedora-repos/raw/master/f/RPM-GPG-KEY-fedora-28-primary

The real solution here is us updating all existing releases fedora-repos when we branch, so you could update your f26 (and get the f26 fedora repos with the f28 key and rawhide repo file) and then upgrade to f28.

Comment 14 Paul DeStefano 2018-08-18 22:18:35 UTC
Whee!  I'm here yet again and still don't understand why.

I see that F30 has branched and is the new rawhide.  I update my "rawhide" to F30 with DNF system-upgrade --releasever=30, since upgrading to releasever "rawhide" seemed to cause such a disaster the first time.  Now, DNF is totally confused and I cannot update any packages because DNF cannot verify any pkgs.

repolist shows

rawhide
rawhide-modular

dnf upgrade fedora-gpg-keys shows conflicts for that package and broken dependencies for generic-release

dnf upgrade --best --allowerasing fedora-gpg-keys tries to reimport F29 key, says "didn't help", then fails GPG check.


Also, on my other rawhide system, plain old dnf upgrade fails with the same behavior.

Comment 15 Kevin Fenzi 2018-08-19 17:34:54 UTC
what does: 

rpm -q fedora-release fedora-repos generic-relase

output? 

If something is preventing it from updating to the 30 versions, it would still be trying to use the 29 key.

Comment 16 Paul DeStefano 2018-08-19 18:42:33 UTC
Thanks again Kevin, you rock.

it says:

fedora-release-29-0.10.noarch
fedora-reopos-29-0.7.noarch
generic-release is not installed

Hmm, sounds bad.

Comment 17 Kevin Fenzi 2018-08-19 18:52:22 UTC
Right, so you are following f29, not rawhide. 

dnf --releasever=30 update fedora-release fedora-repos\*

should update you to the 30 versions, then dnf update from there should ask you to import the f30 key and be back on track.

Comment 18 Paul DeStefano 2018-08-20 03:44:32 UTC
Hmm, that gives me a an error from Curl, "cannot open file:// file file:///etc/pki/rpm-gpg/RPM-GPG-KEY-30-fedora" and so it cannot verify those packages, either.

I feel like the upgrade to F30 didn't actually complete. I'm going to try again.

Comment 19 Paul DeStefano 2018-08-20 04:06:41 UTC
Argh.  Okay, lets try this again.  My rawhide VM hasn't been updated in a couple weeks, so I know I haven't messed it up. (rpm -q fedora-release fedora-repos gives fedora-release-29-0.7.noarch fedora-repos-29-0.5.noarch).  I go there and I try to do just a normal update:


sudo -i dnf upgrade
Last metadata expiration check: 2:44:29 ago on Sun 19 Aug 2018 06:04:03 PM PDT.
Dependencies resolved.
 Problem 1: package rpmfusion-free-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - cannot install both fedora-release-30-0.1.noarch and fedora-release-29-0.7.noarch
  - package generic-release-29-0.2.fc29.noarch conflicts with fedora-release provided by fedora-release-30-0.1.noarch
  - cannot install the best update candidate for package rpmfusion-free-release-29-0.4.noarch
  - cannot install the best update candidate for package fedora-release-29-0.7.noarch
 Problem 2: package rpmfusion-nonfree-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - cannot install both fedora-release-30-0.1.noarch and fedora-release-29-0.7.noarch
  - package generic-release-29-0.2.fc29.noarch conflicts with fedora-release provided by fedora-release-30-0.1.noarch
  - package fedora-release-workstation-30-0.1.noarch requires fedora-release = 30-0.1, but none of the providers can be installed
  - cannot install the best update candidate for package rpmfusion-nonfree-release-29-0.4.noarch
  - cannot install the best update candidate for package fedora-release-workstation-29-0.7.noarch
 Problem 3: problem with installed package rpmfusion-nonfree-release-29-0.4.noarch
  - package rpmfusion-nonfree-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - package fedora-release-29-0.7.noarch requires fedora-repos(29), but none of the providers can be installed
  - package generic-release-29-0.2.fc29.noarch requires fedora-repos(29), but none of the providers can be installed
  - cannot install both fedora-repos-30-0.1.noarch and fedora-repos-29-0.5.noarch
  - cannot install the best update candidate for package fedora-repos-29-0.5.noarch
 Problem 4: problem with installed package rpmfusion-free-release-29-0.4.noarch
  - package rpmfusion-free-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - package fedora-release-29-0.7.noarch requires fedora-repos(29), but none of the providers can be installed
  - package generic-release-29-0.2.fc29.noarch requires fedora-repos(29), but none of the providers can be installed
  - package fedora-repos-29-0.5.noarch requires fedora-gpg-keys = 29-0.5, but none of the providers can be installed
  - cannot install both fedora-gpg-keys-30-0.1.noarch and fedora-gpg-keys-29-0.5.noarch
  - cannot install the best update candidate for package fedora-gpg-keys-29-0.5.noarch
...
...
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/freerdp-libs-2.0.0-42.20180405gita9ecd6a.fc29.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID cfc659b9: NOKEY
Fedora - Rawhide - Developmental packages for the next Fedora release           1.6 MB/s | 1.6 kB     00:00    
Importing GPG key 0x429476B4:
 Userid     : "Fedora 29 (29) <fedora-29>"
 Fingerprint: 5A03 B4DD 8254 ECA0 2FDA 1637 A20A A56B 4294 76B4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?

Okay, that makes no sense whatsoever.  But, I want to upgrade to F30 to stay on "rawhide", anyway, so I try this:

sudo -i dnf --releasever=30 system-upgrade download
Before you continue ensure that your system is fully upgraded by running "dnf --refresh upgrade". Do you want to continue [y/N]: y
Fedora - Rawhide - Developmental packages for the next Fedora release           2.2 MB/s |  62 MB     00:28    
RPM Fusion for Fedora Rawhide - Free                                            421 kB/s | 970 kB     00:02    
RPM Fusion for Fedora Rawhide - Nonfree                                         131 kB/s | 215 kB     00:01    
Last metadata expiration check: 0:00:00 ago on Sun 19 Aug 2018 08:51:48 PM PDT.
Error: 
 Problem 1: problem with installed package rpmfusion-free-release-29-0.4.noarch
  - package rpmfusion-free-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - package generic-release-29-0.2.fc29.noarch requires fedora-repos(29), but none of the providers can be installed
  - fedora-repos-29-0.5.noarch does not belong to a distupgrade repository
  - fedora-release-29-0.7.noarch does not belong to a distupgrade repository
 Problem 2: problem with installed package rpmfusion-nonfree-release-29-0.4.noarch
  - package rpmfusion-nonfree-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - package fedora-release-29-0.7.noarch requires fedora-repos(29), but none of the providers can be installed
  - package generic-release-29-0.2.fc29.noarch requires fedora-repos(29), but none of the providers can be installed
  - package fedora-repos-29-0.5.noarch requires fedora-gpg-keys = 29-0.5, but none of the providers can be installed
  - fedora-gpg-keys-29-0.5.noarch does not belong to a distupgrade repository

Okay, also completely confusing.  I'm on 29, so why can't any providers for system-release(29) not be found?

Let's try your suggestion (which I don't understand, why would I update my fedora-release pkg before running system upgrade?):

sudo -i dnf --releasever=30 update fedora-release fedora-repos\*
[sudo] password for pmouse: 
Fedora - Rawhide - Developmental packages for the next Fedora release           2.3 MB/s |  62 MB     00:27    
RPM Fusion for Fedora Rawhide - Free                                            209 kB/s | 970 kB     00:04    
RPM Fusion for Fedora Rawhide - Nonfree                                          99 kB/s | 215 kB     00:02    
Last metadata expiration check: 0:00:00 ago on Sun 19 Aug 2018 08:58:50 PM PDT.
Dependencies resolved.

 Problem 1: problem with installed package rpmfusion-nonfree-release-29-0.4.noarch
  - package rpmfusion-nonfree-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - cannot install both fedora-release-30-0.1.noarch and fedora-release-29-0.7.noarch
  - package generic-release-29-0.2.fc29.noarch conflicts with fedora-release provided by fedora-release-30-0.1.noarch
  - cannot install the best update candidate for package fedora-release-29-0.7.noarch
 Problem 2: problem with installed package rpmfusion-free-release-29-0.4.noarch
  - package rpmfusion-free-release-29-0.4.noarch requires system-release(29), but none of the providers can be installed
  - package fedora-release-29-0.7.noarch requires fedora-repos(29), but none of the providers can be installed
  - package generic-release-29-0.2.fc29.noarch requires fedora-repos(29), but none of the providers can be installed
  - cannot install both fedora-repos-30-0.1.noarch and fedora-repos-29-0.5.noarch
  - cannot install the best update candidate for package fedora-repos-29-0.5.noarch
================================================================================================================
 Package                        Arch                  Version                      Repository              Size
================================================================================================================
Skipping packages with conflicts:
(add '--best --allowerasing' to command line to force their upgrade):
 fedora-release                 noarch                30-0.1                       rawhide                 26 k
 fedora-repos                   noarch                30-0.1                       rawhide                8.7 k
 generic-release                noarch                29-0.2.fc29                  rawhide                 25 k

Transaction Summary
================================================================================================================
Skip  3 Packages

Nothing to do.
Complete!


So, do I just completely misunderstand how rawhide works?  I'm so sorry Kevin; you've been really great, but I don't understand a single thing I'm seeing.

Comment 20 Richard W.M. Jones 2018-08-20 08:09:58 UTC
(In reply to Paul DeStefano from comment #18)
> Hmm, that gives me a an error from Curl, "cannot open file:// file
> file:///etc/pki/rpm-gpg/RPM-GPG-KEY-30-fedora" and so it cannot verify those
> packages, either.
> 
> I feel like the upgrade to F30 didn't actually complete. I'm going to try
> again.

In theory this would work:

# dnf install /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-x86_64 --releasever=30

although I couldn't get it to install either.  The fundamental
problem seems to be at the moment that there has been no f29
compose at all, and the f30 compose seems a bit broken, so I suppose
the best advice is to wait a while.

Comment 21 Kevin Fenzi 2018-08-20 14:28:30 UTC
Paul: You have rpmfusion-free-release-29 and rpmfusion-nonfree-release-29 which require fedora-release-29. rpmfusion hasn't branched yet I don't think, so you will have to manually remove those two in order to update to get the fedora-release-30 package. 

Yeah, things are still in a bit of flux for sure. ;( Hopefully we will have composes back on track today for both 29 and rawhide.

Comment 22 Paul DeStefano 2018-08-21 01:37:46 UTC
Ah, yes, good catch.  My mistake.  I had removed those on my laptop, but forgot to when I started over on VM to show you.  I'll fix that and try again on the VM in just a minute.

But, on my laptop, on which I already ran dnf system-upgrade download & reboot, I see this:

sudo -i dnf upgrade fedora-release fedora-repos generic-release
[sudo] password for testuser2: 
Fedora - Modular Rawhide - Developmental packages for the nex  28 kB/s |  13 kB     00:00    
Fedora - Rawhide - Developmental packages for the next Fedora  43 kB/s |  13 kB     00:00    
Last metadata expiration check: 0:00:00 ago on Mon 20 Aug 2018 03:19:40 PM PDT.
Package generic-release available, but not installed.
No match for argument: generic-release
Dependencies resolved.
==============================================================================================
 Package                         Arch              Version           Repository          Size
==============================================================================================
Upgrading:
 fedora-gpg-keys                 noarch            30-0.1            rawhide             97 k
 fedora-release                  noarch            30-0.1            rawhide             26 k
 fedora-repos                    noarch            30-0.1            rawhide            8.7 k
 fedora-repos-rawhide            noarch            30-0.1            rawhide            7.9 k

Transaction Summary
==============================================================================================
Upgrade  4 Packages

Total download size: 140 k
Is this ok [y/N]: y
Downloading Packages:
(1/4): fedora-repos-30-0.1.noarch.rpm                          53 kB/s | 8.7 kB     00:00    
(2/4): fedora-release-30-0.1.noarch.rpm                       137 kB/s |  26 kB     00:00    
(3/4): fedora-repos-rawhide-30-0.1.noarch.rpm                 319 kB/s | 7.9 kB     00:00    
(4/4): fedora-gpg-keys-30-0.1.noarch.rpm                      488 kB/s |  97 kB     00:00    
----------------------------------------------------------------------------------------------
Total                                                         320 kB/s | 140 kB     00:00     
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/fedora-gpg-keys-30-0.1.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID cfc659b9: NOKEY
Fedora - Rawhide - Developmental packages for the next Fedora 1.1 MB/s | 1.6 kB     00:00    
Importing GPG key 0x429476B4:
 Userid     : "Fedora 29 (29) <fedora-29>"
 Fingerprint: 5A03 B4DD 8254 ECA0 2FDA 1637 A20A A56B 4294 76B4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?
Public key for fedora-gpg-keys-30-0.1.noarch.rpm is not installed. Failing package is: fedora-gpg-keys-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Public key for fedora-release-30-0.1.noarch.rpm is not installed. Failing package is: fedora-release-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Public key for fedora-repos-30-0.1.noarch.rpm is not installed. Failing package is: fedora-repos-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Public key for fedora-repos-rawhide-30-0.1.noarch.rpm is not installed. Failing package is: fedora-repos-rawhide-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

Just like before.  But, I cannot figureout how to install the new gpg-key pkg so I can import the new key.

Comment 23 Paul DeStefano 2018-08-21 03:48:13 UTC
Okay, so, after removing the rpmfusion repo pkgs on the otherwise clean VM, here's what I get.

sudo -i dnf upgrade fedora-repos fedora-release generic-release
Last metadata expiration check: 0:02:11 ago on Mon 20 Aug 2018 08:22:30 PM PDT.
Package generic-release available, but not installed.
No match for argument: generic-release
Dependencies resolved.
================================================================================================================
 Package                                  Arch                 Version              Repository             Size
================================================================================================================
Upgrading:
 fedora-gpg-keys                          noarch               30-0.1               rawhide                97 k
 fedora-release                           noarch               30-0.1               rawhide                26 k
 fedora-release-workstation               noarch               30-0.1               rawhide                19 k
 fedora-repos                             noarch               30-0.1               rawhide               8.7 k
 fedora-repos-rawhide                     noarch               30-0.1               rawhide               7.9 k

Transaction Summary
================================================================================================================
Upgrade  5 Packages

Total download size: 159 k
Is this ok [y/N]: y
Downloading Packages:
(1/5): fedora-release-workstation-30-0.1.noarch.rpm                              70 kB/s |  19 kB     00:00    
(2/5): fedora-release-30-0.1.noarch.rpm                                          89 kB/s |  26 kB     00:00    
(3/5): fedora-repos-30-0.1.noarch.rpm                                            88 kB/s | 8.7 kB     00:00    
(4/5): fedora-repos-rawhide-30-0.1.noarch.rpm                                    81 kB/s | 7.9 kB     00:00    
(5/5): fedora-gpg-keys-30-0.1.noarch.rpm                                        245 kB/s |  97 kB     00:00    
----------------------------------------------------------------------------------------------------------------
Total                                                                           158 kB/s | 159 kB     00:01     
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/fedora-gpg-keys-30-0.1.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID cfc659b9: NOKEY
Fedora - Rawhide - Developmental packages for the next Fedora release           1.6 MB/s | 1.6 kB     00:00    
Importing GPG key 0x429476B4:
 Userid     : "Fedora 29 (29) <fedora-29>"
 Fingerprint: 5A03 B4DD 8254 ECA0 2FDA 1637 A20A A56B 4294 76B4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?
Public key for fedora-gpg-keys-30-0.1.noarch.rpm is not installed. Failing package is: fedora-gpg-keys-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Public key for fedora-release-30-0.1.noarch.rpm is not installed. Failing package is: fedora-release-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Public key for fedora-release-workstation-30-0.1.noarch.rpm is not installed. Failing package is: fedora-release-workstation-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Public key for fedora-repos-30-0.1.noarch.rpm is not installed. Failing package is: fedora-repos-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Public key for fedora-repos-rawhide-30-0.1.noarch.rpm is not installed. Failing package is: fedora-repos-rawhide-30-0.1.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

  Which is exactly what happens when I just try a *regular* dnf upgrade.  ???

sudo -i dnf upgrade
Last metadata expiration check: 0:11:43 ago on Mon 20 Aug 2018 08:22:30 PM PDT.
Dependencies resolved.
...
Total                                                                           2.0 MB/s | 825 MB     06:46     
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/freerdp-libs-2.0.0-42.20180405gita9ecd6a.fc29.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID cfc659b9: NOKEY
Fedora - Rawhide - Developmental packages for the next Fedora release           1.6 MB/s | 1.6 kB     00:00    
Importing GPG key 0x429476B4:
 Userid     : "Fedora 29 (29) <fedora-29>"
 Fingerprint: 5A03 B4DD 8254 ECA0 2FDA 1637 A20A A56B 4294 76B4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Is this ok [y/N]: y
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?


  Now, that should work, right?  I mean, dnf update shouldn't break just because F30 has branched.  My VM is just a few weeks behind.  I think that is exactly the experience I had with F28-F29, too.  Why does DNF on old rawhide release need to verify packages signed by new rawhide release key?  And, even if it did, they could just be in the fedora-gpg-keys pkg for all releases; there's nothing illegal about that, AFAIK.  I don't see how to *ever* avoid this catch 22 problem, yet I cannot be the only person using rawhide this way.  That's what I mean by, "I don't understand rawhide."

Comment 24 Kevin Fenzi 2018-08-21 17:06:41 UTC
until/unless you have fedora-release-30 _INSTALLED_ your release is set by fedora-release-29, which means it looks for the wrong gpg key. 

you MUST use '--releasever=30' to get it to use the right key and that key must exist already. There should be a fedora-release-29 update today that has the f30 key in it, so 'dnf update' and get that, then 'dnf --releasever=30 update fedora-release fedora-repos' and you should be on rawhide. 

Note that a lot of this will be made simpiler when/if our proposal to make rawhide 'rawhide' instead of the number is implemented.

Comment 25 Paul DeStefano 2018-08-23 07:20:59 UTC
That all makes sense, I think. Except that the key isn't in fedora-release, right, it's in fedora-gpg-keys?

dnf upgrade is still not able to find a new fedora-release, so I tracked one down on koji that I think you had built:
 
https://kojipkgs.fedoraproject.org//packages/fedora-release/29/0.12/noarch/fedora-release-29-0.12.noarch.rpm

I downloaded it and tried to install it:

sudo -i dnf upgrade $PWD/fedora-release-29-0.12.noarch.rpm 
Last metadata expiration check: 0:06:01 ago on Mon 20 Aug 2018 10:12:41 PM PDT.
Dependencies resolved.

 Problem: problem with installed package fedora-release-workstation-29-0.7.noarch
  - package fedora-release-workstation-29-0.7.noarch requires fedora-release = 29-0.7, but none of the providers can be installed
  - package fedora-release-workstation-30-0.4.noarch requires fedora-release = 30-0.4, but none of the providers can be installed
  - cannot install both fedora-release-29-0.12.noarch and fedora-release-29-0.7.noarch
  - cannot install both fedora-release-29-0.12.noarch and fedora-release-30-0.4.noarch
  - cannot install the best update candidate for package fedora-release-29-0.7.noarch
================================================================================================================
 Package                                Arch               Version               Repository                Size
================================================================================================================
Skipping packages with conflicts:
(add '--best --allowerasing' to command line to force their upgrade):
 fedora-release                         noarch             29-0.12               @commandline              28 k
 fedora-release                         noarch             30-0.4                rawhide                   26 k
Skipping packages with broken dependencies:
 fedora-release-workstation             noarch             30-0.4                rawhide                   20 k

Transaction Summary
================================================================================================================
Skip  3 Packages

Nothing to do.
Complete!

So, I'm not sure I fully understand this output.  But, I'm guessing that I need to upgrade -workstation sub-package too.  So, I downloaded the corresponding 29-0.12 version of that from koji, too.  Seem reasonable?

sudo -i dnf upgrade $PWD/fedora-release-29-0.12.noarch.rpm  $PWD/fedora-release-workstation-29-0.12.noarch.rpm
Last metadata expiration check: 0:03:23 ago on Wed 22 Aug 2018 11:03:39 PM PDT.
Dependencies resolved.
================================================================================================================
 Package                                Arch               Version               Repository                Size
================================================================================================================
Upgrading:
 fedora-release                         noarch             29-0.12               @commandline              28 k
 fedora-release-workstation             noarch             29-0.12               @commandline              21 k

Transaction Summary
================================================================================================================
Upgrade  2 Packages
...
Upgraded:
  fedora-release-29-0.12.noarch                    fedora-release-workstation-29-0.12.noarch                   

Complete!

Am I ready now?

sudo -i dnf --refresh upgrade
Fedora - Rawhide - Developmental packages for the next Fedora release            23 kB/s |  14 kB     00:00    
Last metadata expiration check: 0:00:00 ago on Wed 22 Aug 2018 11:08:52 PM PDT.
Dependencies resolved.
...
Transaction Summary
================================================================================================================
Install   26 Packages
Upgrade  792 Packages
Remove     3 Packages

Total size: 1.0 G
Total download size: 565 M
Is this ok [y/N]: y
Downloading Packages:
...
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/freerdp-libs-2.0.0-44.rc3.fc30.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID cfc659b9: NOKEY
Fedora - Rawhide - Developmental packages for the next Fedora release           773 kB/s | 1.6 kB     00:00    
Importing GPG key 0x429476B4:
 Userid     : "Fedora 29 (29) <fedora-29>"
 Fingerprint: 5A03 B4DD 8254 ECA0 2FDA 1637 A20A A56B 4294 76B4
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-x86_64
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?

No, I'm not ready.  I can't even update, much less system-upgrade to F30.  (I mean, I'm behaving logically, right?  I think I'm doing what you say to do.  I feels like the twilight zone: I'm on an alien planet where Fedora looks like the Fedora I know well and everyone speaks English, but nothing I do is right.)

Can you tell me how to fix this?

BTW, I don't see this key cfc659b9 on keys.fedoraproject.org.  Shouldn't it be there?

Comment 26 Kevin Fenzi 2018-08-23 16:27:04 UTC
If you have fedora-release-29 installed and want to move to rawhide/f30, you MUST use dnf --releasever=30 upgrade to get the fedora-release-30 package(s). 

If you don't use --releasever=30 you will never be offered a upgrade to f30 packages. 

Not sure how to better explain it...

Comment 27 Paul DeStefano 2018-08-24 00:29:44 UTC
Ah, so, my confusion is that you previously mentioned that fedora-release-29 would be updated, and, I assumed that meant that the F30 key would be in there. Now, I know that's not the pkg that holds keys, so, that didn't make sense, but I didn't understand what else could be in that pkg that I needed.

While I had tried the --releasever=30 option on all my commands and it never helped, I didn't always show that, too, so, that was just a side effect of trying to make the comments smaller.

Finally, I don't understand the --releasever=30 option (for my VM, at least) since I'm not yet doing a system-upgrade.  Why would I need F30 packages on F29?  (I actually have seen cases where that is recommended, but without the keys I don't see how that would work, which is just what you said.)  Only now do I think you might be saying that is required for people following rawhide.  But, even that doesn't make sense since that is not how system-upgrade works for all other fedora releases, so...still not clear.

Regardless --releasever=30 has no effect.  So, I'm still confused.

sudo -i dnf upgrade --releasever=30 fedora-release
[sudo] password for pmouse: 
Fedora - Rawhide - Developmental packages for the next Fedora release            23 kB/s |  12 kB     00:00    
Fedora - Rawhide - Developmental packages for the next Fedora release           1.0 MB/s |  62 MB     01:01    
Last metadata expiration check: 0:00:54 ago on Thu 23 Aug 2018 07:34:10 AM PDT.
Dependencies resolved.
================================================================================================================
 Package                                  Arch                 Version              Repository             Size
================================================================================================================
Upgrading:
 fedora-gpg-keys                          noarch               30-0.1               rawhide                97 k
 fedora-release                           noarch               30-0.4               rawhide                26 k
 fedora-release-workstation               noarch               30-0.4               rawhide                20 k
 fedora-repos                             noarch               30-0.1               rawhide               8.7 k
 fedora-repos-rawhide                     noarch               30-0.1               rawhide               7.9 k

Transaction Summary
================================================================================================================
Upgrade  5 Packages

Total size: 160 k
Is this ok [y/N]: y
Downloading Packages:
[SKIPPED] fedora-gpg-keys-30-0.1.noarch.rpm: Already downloaded                                                
[SKIPPED] fedora-release-30-0.4.noarch.rpm: Already downloaded                                                 
[SKIPPED] fedora-release-workstation-30-0.4.noarch.rpm: Already downloaded                                     
[SKIPPED] fedora-repos-30-0.1.noarch.rpm: Already downloaded                                                   
[SKIPPED] fedora-repos-rawhide-30-0.1.noarch.rpm: Already downloaded                                           
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/fedora-gpg-keys-30-0.1.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID cfc659b9: NOKEY
Curl error (37): Couldn't read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-x86_64 [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-x86_64]
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.

I think this command has the right output, though, since it's trying to upgrade gpg-keys pkg, too.  After all of this, I it is still most logical that that package is the one that is not working for me.

Comment 28 Peter Robinson 2018-08-24 10:34:30 UTC
(In reply to Paul DeStefano from comment #27)
> Ah, so, my confusion is that you previously mentioned that fedora-release-29
> would be updated, and, I assumed that meant that the F30 key would be in
> there. Now, I know that's not the pkg that holds keys, so, that didn't make
> sense, but I didn't understand what else could be in that pkg that I needed.

The fedora-repos-27-4 and fedora-repos-28-5 have the Fedora 30 keys (well the fedora-gpg-keys subpackage of those) and they're both in updates-testing of their appropriate releases.

Comment 29 Peter Robinson 2018-08-24 10:36:07 UTC
> Regardless --releasever=30 has no effect.  So, I'm still confused.
> 
> sudo -i dnf upgrade --releasever=30 fedora-release

You want to do distro-sync not upgrade so:

dnf --releasever=30 --setopt=install_weak_deps=False --setopt=deltarpm=false distro-sync

Comment 30 Paul DeStefano 2018-08-28 07:38:11 UTC
(In reply to Peter Robinson from comment #29)
> You want to do distro-sync not upgrade so:
> 
> dnf --releasever=30 --setopt=install_weak_deps=False --setopt=deltarpm=false
> distro-sync

Why do I want distro-sync?

$ sudo -i dnf --releasever=30 distro-sync --setopt=install_weak_deps=False --setopt=deltarpm=False distro-sync
Last metadata expiration check: 0:01:27 ago on Thu 23 Aug 2018 10:18:38 AM PDT.
No package distro-sync installed.
Error: No packages marked for distribution synchronization.


Why not upgrade with --enablerepo=updates-testing in accordance with comment 28?  (It didn't work, either, but...)

Comment 31 Paul DeStefano 2018-08-28 07:40:57 UTC
Oops, bad command.  Let me try the right one...

Comment 32 Paul DeStefano 2018-08-28 07:54:44 UTC
$ sudo -i dnf --releasever=30 --setopt=install_weak_deps=False --setopt=deltarpm=false distro-sync
Last metadata expiration check: 0:10:47 ago on Thu 23 Aug 2018 10:18:38 AM PDT.
Dependencies resolved.
...
 fedora-gpg-keys                               noarch     30-0.1                              rawhide      97 k
...
Install   22 Packages
Upgrade  814 Packages
Remove     3 Packages

Total size: 990 M
Total download size: 990 M
Is this ok [y/N]: y
Downloading Packages:
...
Total                                                                           1.4 MB/s | 990 MB     11:43     
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/freerdp-libs-2.0.0-44.rc3.fc30.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID cfc659b9: NOKEY
Curl error (37): Couldn't read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-x86_64 [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-30-x86_64]
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.


Still not sure why I want distro-sync.  But, still no joy.

Comment 33 Peter Robinson 2018-08-28 08:03:31 UTC
> Still not sure why I want distro-sync.  But, still no joy.

To quote the manual "As  necessary  upgrades,  downgrades or keeps selected installed packages to match the latest version available from any enabled repository. If no package is given, all installed packages are considered."

And if you're going from 26 to 30 you're going to need to manually import the key first, F-26 was EOL before the 30 key was made. It can't import the key from the F-30 repo because it would need to install the package first to get the key, needs the key to install the package, for F-27+ it gets it from the installed system.

Comment 34 Paul DeStefano 2018-08-28 08:50:06 UTC
Thanks Peter,

Sorry, this bug is getting pretty long with my posts, but that's not my exact situation.  My system is F29 Rawhide...or formerly rawhide, whatever...and I'm trying to stay on rawhide by "upgrading" to F30.  This is the same situation as presented in the bug, just different versions.

The bug was filed on F26, but the core problem exited before that and still exists, today.  As he said, Kevin has proposed a solution.  But, until then, I'm looking for help, here.  I just figured another bug for the same core issue would get closed as a duplicate of this one.

Now, regarding your suggestion to manually import the key: yes!  I would love to do that and have tried multiple different methods to find the key, but I cannot find it anywhere.  It's not in the fedora-gpg-keys-29 package which I've tried to update like 10 times, it's not on fedora's PGP key server, and its not even on the Fedora web-page titled "Package Signing Keys".  In the past, I have been able to find the keys for myself; this isn't the first time I've needed them.  Do you know where there is a public copy?

$ pwd
/etc/pki/rpm-gpg
$ ls *fedora-29-primary *fedora-3*
ls: cannot access '*fedora-3*': No such file or directory
 RPM-GPG-KEY-fedora-29-primary
$ rpm --query fedora-gpg-keys
fedora-gpg-keys-29-0.5.noarch

Comment 35 Peter Robinson 2018-08-28 08:58:32 UTC
> Now, regarding your suggestion to manually import the key: yes!  I would
> love to do that and have tried multiple different methods to find the key,

What version of fedora-repos do you have installed?

Comment 36 Peter Robinson 2018-08-28 09:02:06 UTC
> $ rpm --query fedora-gpg-keys
> fedora-gpg-keys-29-0.5.noarch

The Fedora 30 key was added in 29-0.8

so "dnf upgrade --refresh fedora\*"

then:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-29-primary
dnf config-manager --set-disabled updates updates-testing
dnf --releasever=30 --setopt=deltarpm=false distro-sync

Should get you there.

Comment 37 Dennis Gilmore 2018-08-28 15:08:09 UTC
There is race conditions when we bump rawhide with no good way to make everything just smoothly work. Likely someone needs to write up some documentation on how to manually go through each of the different paths. every path  at branching requires some manual steps. the only way that we could get away with not doing a manual step to stay on rawhide would be to have a rawhide only key and resign all packages at branching with a release specific key or to go to a model where all releases get signed with one key and we never change it.

Comment 38 Paul DeStefano 2018-08-28 15:52:06 UTC
Thanks again, Peter.

> > Now, regarding your suggestion to manually import the key: yes!  I would
> > love to do that and have tried multiple different methods to find the key,
> 
> What version of fedora-repos do you have installed?

$ sudo -i dnf list installed fedora-release*
Installed Packages
fedora-release.noarch                                         29-0.12                              @@commandline
fedora-release-workstation.noarch                             29-0.12                              @@commandline(In reply to Peter Robinson from comment #35)

Okay, so that part about new F29 package makes sense to me!  You and Kevin both said the new key was in an updated F29 package with the key.  But, I just haven't been able to find it.  When I dnf upgrade I get F30 packages, not F29.  Even using --releasever=29 doesn't help, I still get F30 packages.
I think this is the core issue Kevin and Dennis are talking about.

To make things worse, I cannot find *any* gpg-keys or fedora-release pkgs on koji/packages, which is really weird.  Also, I see gpg-keys pkgs for F30 and F28 on rpmfind.net, but *none* for F29.  Why can't I get either the public key or new packages.  All avenues seem closed.

Comment 39 Peter Robinson 2018-08-28 16:26:09 UTC
> > What version of fedora-repos do you have installed?
> 
> $ sudo -i dnf list installed fedora-release*

I asked for fedora-repos not release ;-)

> Okay, so that part about new F29 package makes sense to me!  You and Kevin
> both said the new key was in an updated F29 package with the key.  But, I
> just haven't been able to find it.  When I dnf upgrade I get F30 packages,
> not F29.  Even using --releasever=29 doesn't help, I still get F30 packages.
> I think this is the core issue Kevin and Dennis are talking about.

I can't work out if you want to go to F-29 or F-30.

If you want to go to F-29 try this:
dnf config-manager --set-enabled fedora updates updates-testing
dnf config-manager --set-diabled rawhide
dnf --releasever=29 --setopt=install_weak_deps=False --setopt=deltarpm=false distro-sync

> To make things worse, I cannot find *any* gpg-keys or fedora-release pkgs on
> koji/packages, which is really weird.  Also, I see gpg-keys pkgs for F30 and
> F28 on rpmfind.net, but *none* for F29.  Why can't I get either the public
> key or new packages.  All avenues seem closed.

It's a subpackage of fedora-repos [1], you can work that out by using "rpm -qi fedora-gpg-keys" and it will list the source package in the output:

rpm -qi fedora-gpg-keys
Name        : fedora-gpg-keys
Version     : 29
Release     : 0.9
Architecture: noarch
Install Date: Sun 26 Aug 2018 09:58:37 BST
Group       : Unspecified
Size        : 98874
License     : MIT
Signature   : RSA/SHA256, Thu 23 Aug 2018 15:50:30 BST, Key ID a20aa56b429476b4
Source RPM  : fedora-repos-29-0.9.src.rpm
Build Date  : Thu 23 Aug 2018 15:50:00 BST
Build Host  : buildvm-14.phx2.fedoraproject.org
Relocations : (not relocatable)
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : https://fedoraproject.org/
Bug URL     : https://bugz.fedoraproject.org/fedora-repos
Summary     : Fedora RPM keys
Description :
This package provides the RPM signature keys.


[1] https://koji.fedoraproject.org/koji/packageinfo?packageID=18771

Comment 40 Dennis Gilmore 2018-08-28 20:44:57 UTC
in order to get a fedora-repos that is signed with the f29 key and has the f30 key in it you would have to run

dnf --disablerepo=* --enablerepo=fedora --releasever=29 update fedora*

after that if you wanted to stay on fedora 29 you would yum update, if you wanted to stay on rawhide you would need to do

dnf --enablerepo=rawhide --releasever=30 distro-sync

Comment 41 Paul DeStefano 2018-08-31 05:34:27 UTC
Thanks Peter.

$ rpm --query fedora-repos
fedora-repos-29-0.5.noarch

Sorry, I thought I was clear; I want F30 since I think that is the same as rawhide.

I originally installed rawhide (when it was F27) using system-upgrade releasever='rawhide'.  When F28 came out, I noticed this problem trying to stay on rawhide.  Kevin set me strait, I thought, and when F29 came around I did system-ugprade to releasever='29', which I figured would fix everything.

I know which package has the keys, I've been trying to get it for F29; but, just couldn't get fedora to fetch it, or find it manually, or find the key itself.  Still don't have any answers to the latter two problems.

I now realize that system-upgrade may not be the way to stay on rawhide.  That's why I was confused by distro-sync; I thought I was upgrading my system, but you and Peter are suggesting I use distro-sync, which seems like breaking the rules, but I can see how that makes sense for rawhide.  If that is the normal rawhide way, I'd never see it mentioned.  I don't see the connection in the man page description.

But, Dennis says I *can* fetch the right package using special options and...they turn up the correct packages during dep resolve.  So let's see...Yes!  It works!

And the next step, distro-sync from rawhide repo using F30...yes, it imported the correct key.  Phew!  I think we got it.  Thank you.

Okay!  I think I follow that.  So, it's not really a system upgrade to stay on rawhide.  You just swap repos and distro-sync.  See, I never heard that.  I was just treating it like a normal system upgrade.  But, you do have to use that strange --disablerepo=* option to get the "old" key pkg or else DNF tries to install from the next verion's repo.  Is see how that makes DNF do the thing I awnt, but I clearly couldn't think of it myself.  Many thanks, all!

Comment 42 Peter Robinson 2018-08-31 10:50:26 UTC
> Sorry, I thought I was clear; I want F30 since I think that is the same as
> rawhide.

Correct, rawhide is the leading tip of development.

> I originally installed rawhide (when it was F27) using system-upgrade
> releasever='rawhide'.  When F28 came out, I noticed this problem trying to
> stay on rawhide.  Kevin set me strait, I thought, and when F29 came around I
> did system-ugprade to releasever='29', which I figured would fix everything.

If you want 30 you need to put 30 for the releasever not 29. But first you need to do just a plain dnf upgrade to get the latest version of things on what ever stream you're on.

distro-sync is very similar to system-upgrade, it achieves mostly the same things but in a completely online fashion rather than rebooting.

> I know which package has the keys, I've been trying to get it for F29; but,
> just couldn't get fedora to fetch it, or find it manually, or find the key
> itself.  Still don't have any answers to the latter two problems.

You do have all the answers. The answers are all in the details above.

> I now realize that system-upgrade may not be the way to stay on rawhide. 
> That's why I was confused by distro-sync; I thought I was upgrading my
> system, but you and Peter are suggesting I use distro-sync, which seems like
> breaking the rules, but I can see how that makes sense for rawhide.  If that
> is the normal rawhide way, I'd never see it mentioned.  I don't see the
> connection in the man page description.

Don't think of it as breaking the rules, it's a more interactive way to achieve the same things.

> But, Dennis says I *can* fetch the right package using special options
> and...they turn up the correct packages during dep resolve.  So let's
> see...Yes!  It works!
> 
> And the next step, distro-sync from rawhide repo using F30...yes, it
> imported the correct key.  Phew!  I think we got it.  Thank you.

Yes, you need to basically apply the updates for the stream that you are on which gives you all the latest keys, then you switch streams. Basically it's quite straight forward.

What I suggest you do next cycle is wait for a week or so to let everything settle down before executing exactly what dennis has above obviously substituting the new version numbers.

> Okay!  I think I follow that.  So, it's not really a system upgrade to stay
> on rawhide.  You just swap repos and distro-sync.  See, I never heard that. 

It is a system upgrade, just a different way. Basically online not offline.

Comment 43 Paul DeStefano 2018-09-02 18:31:10 UTC
We keep talking past each other on a lot of issues.  But, ultimately, I got what I needed.  Thank you, all.

I *don't* think this bug is close, however, and certainly not NOTABUG.  The core issue is an acknowledged bug by Kevin and he just said the proposed fix has not been adopted by Fedora.

Comment 44 Paul DeStefano 2018-09-06 22:17:15 UTC
Hey Peter, I thought we were getting along, but perhaps not.  What's going on?

Comment 45 Peter Robinson 2018-09-06 22:35:12 UTC
(In reply to Paul DeStefano from comment #44)
> Hey Peter, I thought we were getting along, but perhaps not.  What's going
> on?

you set a need info with no details?

Yes, Kevin mentioned a problem. It's a process problem that has nothing to do with this particular issue. Most of the stuff covered above isn't an actual bug.

I'm not sure if the needinfo you set is to do with the point you raised 4 days earlier or something else. So in that context there's no problem, but there's also no bug in this particular package.

It might be that the documentation should be improved, or user education and associated docs for transitioning to rawhide on branch. But that's unrelated to this particular issue.

So ultimately I'm not sure what you meant by a random needinfo without any associated information so I cleared it because in that context it's pointless.

Comment 46 Paul DeStefano 2018-09-07 00:09:23 UTC
you closed a bug with no details? ;-)

Interesting, I've never heard of such a rule about needifnos.  I thought it quite obvious that it was related my immediately previous comment.  I'll try not to do that in the future.

Kevin's comments on this bug suggest the underlying root cause is real, unresolved, and that it is being worked on.  He left it open at that time, on purpose.  So, I *assumed*, it was to track the issue, since he mentioned that "process change" idea in this bug.  If that's wrong, okay, but that's how I had been thinking of this bug. Hence my shock when it was closed.

I don't understand why you say, the "process problem that has nothing to do with this particular issue."  I think it makes sense that this bug would remain open until the root cause is resolved.  But, if you think otherwise, I guess I cannot stop you.  I just don't find your argument for closing this bug convincing.

Are you saying that the workaround you and Dennis walked me through is actually the official upgrade method for rawhide and that I shouldn't have used system-upgrade?  Fine, but you said it was just an alternative method.  And why didn't anyone else mention it, before?  I remember when yum could do that for system upgrades.  But, then dnf got the system-upgrade sub-command and the old way was deprecated.  Right?  Am I mis-remembering it?

If Fedora is going to fix the root cause, then I don't care too much what happens to the bug.  But, it sounds more like WONTFIX, to me.  Kevin proposed a real solution; but now you say maybe some documentation changes.  That's very different.  So, that is my concern.  What is going to happen?  Is Fedora going to fix it so that the "normal" method of using DNF with 'upgrade' or 'system-upgrade' will not break when rawhide forks or not?

Comment 47 Kevin Fenzi 2018-09-07 00:35:03 UTC
I was talking about a proposed change we are working on that would help with some of the issues you hit in this bug. It's:

https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/5UVGSBRLX352A4S2CBZ2CGBXPAGQTYKB/

Once we land that change (and there is more work to do before we can): 

* fedora-release-rawhide goes away. Everyone just has fedora and fedora-updates repos normally enabled. A good deal of your difficulty was that you had just the rawhide repo enabled. 

* Because the rawhide fedora-release defines 'rawhide' as your version you will stay on rawhide forever once you upgrade to the rawhide fedora-release unless you take specific steps to follow branching. Unlike today where you follow the branch and that was another source of issues you hit. 

In any case, IMHO, this bug can be closed because you got to where you needed to go and the change I am talking about is tracked in other places.

Comment 48 Paul DeStefano 2018-09-07 04:40:38 UTC
Sweet, awesome.  Thank you.  Sorry to be pest about it.  You're handling it.  That's all I needed to hear.


Note You need to log in before you can comment on or make changes to this bug.