Description of problem: I am also filing this here because I think this might be a security problem. On a freshly installed Fedora 27 system, DNF installs packages without having an appropriate key installed. This seems to be due to a bug in RPM, please see: https://github.com/rpm-software-management/rpm/issues/330 Version-Release number of selected component (if applicable): dnf.noarch 2.7.3-1.fc27 @updates-testing rpm.x86_64 4.14.0-0.rc2.3.fc27 @updates-testing How reproducible: Always Steps to Reproduce: 1. Install Fedora 27 (beta) 2. dnf install $package Actual results: DNF installs the package without prompting to import the key Expected results: DNF only installs the package if the appropriate key is imported first
This is a bug (regression) in rpm, switching component.
Fixed upstream: https://github.com/rpm-software-management/rpm/commit/e6c88eaeab3661f5fb180b970cafba233bcd999a Will fix Fedora tomorrowish.
rpm-4.14.0-2.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-0d1c2f84a4
rpm-4.14.0-2.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-0d1c2f84a4
rpm-4.14.0-2.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.