Bug 2124857 - Flathub Selection repo can't be enabled and used in Gnome-Software, bad signature
Summary: Flathub Selection repo can't be enabled and used in Gnome-Software, bad signa...
Alias: None
Product: Fedora
Classification: Fedora
Component: flatpak
Version: 37
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: David King
QA Contact: Fedora Extras Quality Assurance
Whiteboard: AcceptedBlocker
Depends On:
Blocks: F37FinalBlocker
TreeView+ depends on / blocked
Reported: 2022-09-07 09:54 UTC by Kamil Páral
Modified: 2022-09-13 12:06 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2022-09-13 12:06:44 UTC
Type: Bug

Attachments (Terms of Use)
screenshot of the error (44.28 KB, image/png)
2022-09-07 09:54 UTC, Kamil Páral
no flags Details
journal (266.27 KB, text/plain)
2022-09-07 09:55 UTC, Kamil Páral
no flags Details
rpm -qa (61.82 KB, text/plain)
2022-09-07 09:55 UTC, Kamil Páral
no flags Details

System ID Private Priority Status Summary Last Updated
GNOME Gitlab GNOME gnome-software issues 1885 0 None opened BAD signature from "Flathub Repo Signing Key" (but the app installed fine) 2022-09-07 10:10:11 UTC
Red Hat Bugzilla 2124907 0 unspecified CLOSED gnome-software crashes while fedora-third-party enable is run 2022-09-12 17:47:20 UTC

Description Kamil Páral 2022-09-07 09:54:56 UTC
Created attachment 1910094 [details]
screenshot of the error

Description of problem:
If I try to enable Fedora Flathub Selection repo in gnome-software, I get an error about bad key signature, see the screenshot. When I try to search for apps included in that repo (minecraft, bitwarden, zoom), they are not found. However, the apps can be found using "flatpak search", and they also can be found if I kill gnome-software and start it again (or reboot).

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. install F37 Workstation (Beta 1.5 or earlier and update)
2. accept all defaults in initial setup (i.e. don't enable third-party repos when offered)
3. open gnome-software -> software repositories
4. enable Fedora Flathub Selection
5. see the error pop up after a while
6. search for minecraft/bitwarden/zoom, can't be found
7. use "flatpak search minecraft", see that it finds it
8. killall gnome-software, run gnome-software again and see that you can find the apps

Comment 1 Kamil Páral 2022-09-07 09:55:26 UTC
Created attachment 1910095 [details]

Comment 2 Kamil Páral 2022-09-07 09:55:34 UTC
Created attachment 1910096 [details]
rpm -qa

Comment 3 Kamil Páral 2022-09-07 09:59:15 UTC
Proposing as a Final blocker:
"The default graphical package manager for a given software type must appropriately: 
Configure software sources by enabling/disabling pre-defined official repositories and then adjust the available software pool accordingly"

A similar bug 2074121 was accepted as a blocker in the past.

Comment 4 Kamil Páral 2022-09-07 10:10:11 UTC
Possibly related:

Comment 5 Milan Crha 2022-09-07 11:09:22 UTC
I do not know how these things work. Where does it get the signature/keys? Let's move to the flatpak, I do not think gnome-software does any verification of this kind for the flatpak installations.

Comment 6 Kamil Páral 2022-09-07 11:37:37 UTC
When I try to sidestep gnome-software completely, I can enable third-party repos from the terminal (I'm not sure how to enable only fedora flathub selection repo, so I enable all of them) and searching works fine:

$ sudo fedora-third-party enable
$ fedora-third-party query
Third-party repositories are enabled.
$ flatpak remotes
Name    Options
fedora  system,oci
flathub system,filtered
$ flatpak search minecraft
Name   Description                     Application ID    Version  Branch Remotes
Minec… Create your own world in one o… …mojang.Minecraft 1.0.1221 stable flathub

Also, gnome-software seems to frequently crash while running "fedora-third-party enable", but abrt doesn't allow me to report it because of "low informational value". The FAF link is here:
Not sure if this is related to the "bad signature" error, but so far, this feels like a problem in gnome-software rather than the flatpak stack.

Comment 7 Milan Crha 2022-09-07 11:56:12 UTC
That FAF report is useless, no backtrace there.

Could you install debuginfo for flatpak/libflatpak and gnome-software, then:

   $ gnome-software --quit
   $ gdb gnome-software --batch --ex r --ex bt --ex "t a a bt" &>log.txt

and then reproduce the crash to get the backtrace, please? Ideally open a new bug for it, to not mix unrelated things together.

As long as flatpak is involved, I'd think of [1], because it can strike anywhere.

[1] https://github.com/flatpak/flatpak/issues/3701

Comment 8 Kamil Páral 2022-09-07 12:20:47 UTC
(In reply to Milan Crha from comment #7)
> and then reproduce the crash to get the backtrace, please? Ideally open a
> new bug for it, to not mix unrelated things together.

Done, see bug 2124907

Comment 9 Dan Robinson 2022-09-11 01:24:25 UTC
Just installed Silverblue 37 Beta and I'm getting the same warning about a key as in the original screenshot but when trying to install software. The software seems to end up installing fine though. Is that related or should I open a new bug on that?

Comment 10 Milan Crha 2022-09-12 05:27:31 UTC
I guess it's the same thing, but I do not know for sure.

Comment 11 Adam Williamson 2022-09-12 15:59:15 UTC
+5 in https://pagure.io/fedora-qa/blocker-review/issue/898 , marking accepted.

Comment 12 Adam Williamson 2022-09-12 18:34:44 UTC
Kamil, there's a request in the upstream issue for a `--verbose` log from gnome-software for this one...can you get it? I tried, but I couldn't reproduce the bug.

Comment 13 Milan Crha 2022-09-13 07:07:22 UTC
Please note that this is currently filled for flatpak. I need an information from the flatpak developers to explain where the error comes from. They may also know why and how to fix it. Meaning: the upstream bug is filled against gnome-software, but I'm not certain the problem is with the gnome-software itself.

Comment 14 Kamil Páral 2022-09-13 12:06:44 UTC
I can't reproduce the problem any longer, so I guess flatpak 1.14.0 fixed it.

Note You need to log in before you can comment on or make changes to this bug.