Bug 2356237 - packages on Fedora-Workstation-Live-42-20250330.n.0.x86_64.iso are not signed
Summary: packages on Fedora-Workstation-Live-42-20250330.n.0.x86_64.iso are not signed
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: distribution
Version: 42
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kevin Fenzi
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: RejectedBlocker
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-03-31 15:09 UTC by Kamil Páral
Modified: 2025-03-31 18:41 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Kamil Páral 2025-03-31 15:09:36 UTC
Description of problem:
On a completely fresh F42 installation, I can't make abrt work. For anything I crash, it says "Package isn't signed with proper key".

Example:

$ gnome-calculator
$ killall -SEGV gnome-calculator

Mar 31 17:03:17 localhost-live systemd-coredump[3547]: Process 3504 (gnome-calculato) of user 1000 terminated abnormally with signal 11/SEGV, processing...
Mar 31 17:03:17 localhost-live audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@2-3547-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Mar 31 17:03:17 localhost-live systemd[1]: Started systemd-coredump - Process Core Dump (PID 3547/UID 0).
Mar 31 17:03:17 localhost-live abrt-dump-journal-core[948]: Failed to obtain all required information from journald
Mar 31 17:03:18 localhost-live systemd-coredump[3549]: [🡕] Process 3504 (gnome-calculato) of user 1000 dumped core.
...
Mar 31 17:03:18 localhost-live systemd[1]: systemd-coredump: Deactivated successfully.
Mar 31 17:03:18 localhost-live audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@2-3547-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Mar 31 17:03:18 localhost-live systemd[1]: systemd-coredump: Consumed 576ms CPU time, 382.8M memory peak.
Mar 31 17:03:18 localhost-live abrt-server[3566]: Package 'gnome-calculator' isn't signed with proper key
Mar 31 17:03:18 localhost-live abrt-server[3566]: 'post-create' on '/var/spool/abrt/ccpp-2025-03-31-17:03:18.136559-3504' exited with 1
Mar 31 17:03:18 localhost-live abrt-server[3566]: Deleting problem directory '/var/spool/abrt/ccpp-2025-03-31-17:03:18.136559-3504'


Version-Release number of selected component (if applicable):
abrt-2.17.6-4.fc42.x86_64
abrt-addon-ccpp-2.17.6-4.fc42.x86_64
abrt-addon-kerneloops-2.17.6-4.fc42.x86_64
abrt-addon-pstoreoops-2.17.6-4.fc42.x86_64
abrt-addon-vmcore-2.17.6-4.fc42.x86_64
abrt-addon-xorg-2.17.6-4.fc42.x86_64
abrt-cli-2.17.6-4.fc42.x86_64
abrt-dbus-2.17.6-4.fc42.x86_64
abrt-desktop-2.17.6-4.fc42.x86_64
abrt-gui-2.17.6-4.fc42.x86_64
abrt-gui-libs-2.17.6-4.fc42.x86_64
abrt-libs-2.17.6-4.fc42.x86_64
abrt-plugin-bodhi-2.17.6-4.fc42.x86_64
abrt-tui-2.17.6-4.fc42.noarch
gnome-abrt-1.5.0-2.fc42.x86_64
python3-abrt-2.17.6-4.fc42.x86_64
python3-abrt-addon-2.17.6-4.fc42.noarch


How reproducible:
always

Steps to Reproduce:
1. perform a clean installation from Fedora-Workstation-Live-42-20250330.n.0.x86_64.iso (I really had to do a clean installation, it worked fine on an upgraded system)
2. $ gnome-calculator
3. $ killall -SEGV gnome-calculator

Comment 2 Kamil Páral 2025-03-31 15:48:16 UTC
In F42 Beta, it works fine. When I upgrade Beta to the latest stable packages (including these abrt package versions), it still works fine. This is really only broken for fresh installs of the latest compose(s), for some reason.

Comment 3 Michal Srb 2025-03-31 15:50:19 UTC
Yeah, I was about to write that it works for me fine. Are those RPMs actually signed?

Comment 4 Kamil Páral 2025-03-31 16:23:29 UTC
Thanks Michal, those packages are actually not signed on that Live image:

$ rpm -qi gnome-calculator | grep Signature
Signature   : (none)

It seems to be an infra problem.

Comment 5 Kamil Páral 2025-03-31 16:33:28 UTC
This problem seems to affect just Fedora-Workstation-Live-42-20250330.n.0.x86_64.iso. Workstation image from 0329 is OK, from 0331 is also OK. KDE image from 0330 is also OK.

Comment 6 Geraldo Simião 2025-03-31 16:41:16 UTC
tested the new compose (Fedora-Workstation-Live-42-20250331.n.0.x86_64.iso) and all packages seems to be correctly signed, confirmed that calculator, gnome-software, nautilus and firefox are all signed at the new compose.

Comment 7 Kevin Fenzi 2025-03-31 16:57:07 UTC
FYI, I prefer my home account for bug assignments. ;)

I looked at this and somehow kiwi pulled (unsigned) things from the f42-kiwi-build repo. But I don't see why it did that. ;( 

https://kojipkgs.fedoraproject.org//work/tasks/1910/130901910/image-root.x86_64.log

https://koji.fedoraproject.org/koji/taskinfo?taskID=130901910

Very strange.

Comment 8 Lukas Brabec 2025-03-31 18:41:11 UTC
Discussed during the 2025-03-31 blocker review meeting [1]:

* AGREED: 2356237 - RejectedBlocker (Final) - this appears to have been a blip with unsigned packages appearing in a single ISO in a single compose. If we see it repeat, or figure out the cause and decide it endangers the official compose, we will re-consider this. We will check this in all RC releases before signing off

[1] https://meetbot.fedoraproject.org/blocker-review_matrix_fedoraproject-org/2025-03-31/f42-blocker-review.2025-03-31-16.01.log.html


Note You need to log in before you can comment on or make changes to this bug.