Bug 1872248 - Rawhide upgrade fails on GPG signature verification
Summary: Rawhide upgrade fails on GPG signature verification
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: fedora-repos
Version: 34
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Mohan Boddu
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-08-25 09:32 UTC by Petr Menšík
Modified: 2021-05-29 18:06 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-05-29 18:06:48 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Petr Menšík 2020-08-25 09:32:26 UTC
Description of problem:
I have rawhide container, which intentionally has enabled only rawhide repo.
As every previous release, it got broken.

Version-Release number of selected component (if applicable):
fedora-repos-33-0.9.noarch
fedora-repos-rawhide-33-0.9.noarch
fedora-gpg-keys-33-0.9.noarch


How reproducible:
always

Steps to Reproduce:
1. dnf -y --enablerepo=updates --enablerepo=rawhide update fedora-gpg-keys
2. dnf -y --enablerepo=updates --disablerepo=rawhide update fedora-gpg-keys
3.

Actual results:
# sudo dnf -y --enablerepo=updates --enablerepo=rawhide update fedora-gpg-keys
Last metadata expiration check: 0:48:51 ago on Tue Aug 25 10:24:53 2020.
Dependencies resolved.
=====================================================================================================================================
 Package                               Architecture                 Version                      Repository                     Size
=====================================================================================================================================
Upgrading:
 fedora-gpg-keys                       noarch                       34-0.2                       rawhide                       105 k

Transaction Summary
=====================================================================================================================================
Upgrade  1 Package

Total size: 105 k
Downloading Packages:
[SKIPPED] fedora-gpg-keys-34-0.2.noarch.rpm: Already downloaded                                                                     
warning: /var/cache/dnf/rawhide-2d95c80a1fa0a67d/packages/fedora-gpg-keys-34-0.2.noarch.rpm: Header V4 RSA/SHA256 Signature, key ID 45719a39: NOKEY
Fedora - Rawhide - Developmental packages for the next Fedora release                                1.6 MB/s | 1.6 kB     00:00    
GPG key at file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-x86_64 (0x9570FF31) is already installed
The GPG keys listed for the "Fedora - Rawhide - Developmental packages for the next Fedora release" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: fedora-gpg-keys-34-0.2.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-x86_64
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

# sudo dnf -y --enablerepo=updates --disablerepo=rawhide update fedora-gpg-keys
Last metadata expiration check: 1:02:58 ago on Tue Aug 25 10:24:52 2020.
Dependencies resolved.
Nothing to do.
Complete!



Expected results:
Just upgrade fedora-gpg-keys first to last distribution keys. If they had current $basearch keys for rawhide, upgrade would pass.

Additional info:

Related to releng issue 7445 [1].

Please note, my repo files contain $basearch. But for some unknown reason, latest fedora-gpg-keys contain only new *-primary key, but no *-basearch.

# grep gpg /etc/yum.repos.d/fedora-{updates,rawhide}.repo
/etc/yum.repos.d/fedora-updates.repo:repo_gpgcheck=0
/etc/yum.repos.d/fedora-updates.repo:gpgcheck=1
/etc/yum.repos.d/fedora-updates.repo:gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
/etc/yum.repos.d/fedora-updates.repo:repo_gpgcheck=0
/etc/yum.repos.d/fedora-updates.repo:gpgcheck=1
/etc/yum.repos.d/fedora-updates.repo:gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
/etc/yum.repos.d/fedora-updates.repo:repo_gpgcheck=0
/etc/yum.repos.d/fedora-updates.repo:gpgcheck=1
/etc/yum.repos.d/fedora-updates.repo:gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
/etc/yum.repos.d/fedora-rawhide.repo:repo_gpgcheck=0
/etc/yum.repos.d/fedora-rawhide.repo:gpgcheck=1
/etc/yum.repos.d/fedora-rawhide.repo:gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
/etc/yum.repos.d/fedora-rawhide.repo:repo_gpgcheck=0
/etc/yum.repos.d/fedora-rawhide.repo:gpgcheck=1
/etc/yum.repos.d/fedora-rawhide.repo:gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
/etc/yum.repos.d/fedora-rawhide.repo:repo_gpgcheck=0
/etc/yum.repos.d/fedora-rawhide.repo:gpgcheck=1
/etc/yum.repos.d/fedora-rawhide.repo:gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch

1. https://pagure.io/releng/issue/7445

Comment 1 Petr Menšík 2020-08-25 13:24:47 UTC
Created test [1] to ensure it can be done from stable release. It fails with current stable branch.

1. https://src.fedoraproject.org/rpms/fedora-repos/pull-request/76

Comment 2 Petr Menšík 2020-08-25 13:52:21 UTC
It seems to be broken, because archmap was not updated, when key was addded. It resulted in just primary key was added, no architecture specific links.

That however makes it fail on upgrade to rawhide.

Comment 3 Kevin Fenzi 2020-08-25 19:38:07 UTC
(In reply to Petr Menšík from comment #2)
> It seems to be broken, because archmap was not updated, when key was addded.
> It resulted in just primary key was added, no architecture specific links.
> 
> That however makes it fail on upgrade to rawhide.

Yeah, sorry about that. I think that should be fixed now however?

and I like your test setup! Thanks for the PR... could you rebase it?

Comment 4 Petr Menšík 2020-08-26 15:41:48 UTC
rebased f32.

Comment 5 Ben Cotton 2021-02-09 16:11:16 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 34 development cycle.
Changing version to 34.

Comment 6 Kevin Fenzi 2021-05-29 18:06:48 UTC
This should be in and in use. Feel free to re-open if there's anything we missed here.


Note You need to log in before you can comment on or make changes to this bug.