Bug 2417106 - Changes/Enforcing signature checking by default
Summary: Changes/Enforcing signature checking by default
Keywords:
Status: ON_QA
Alias: None
Product: Fedora
Classification: Fedora
Component: Changes Tracking
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Panu Matilainen
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: F45Changes
TreeView+ depends on / blocked
 
Reported: 2025-11-25 20:18 UTC by Allison King
Modified: 2026-04-01 16:50 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:
fedora-admin-xmlrpc: mirror+

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-2675 0 None None None 2025-12-12 04:04:03 UTC

Description Allison King 2025-11-25 20:18:00 UTC 
This is a tracking bug for Change: Changes/Enforcing signature checking by default
For more details, see: https://fedoraproject.org/wiki/Changes/Enforcing_signature_checking_by_default

Change the RPM default package verification mode to enforcing signature checking, to follow upstream RPM 6.0 default:
only packages with a verified signature can be installed, unless explicitly overridden by `--nosignature` or corresponding API.

If you encounter a bug related to this Change, please do not comment here. Instead create a new bug and set it to block this bug.
Comment 1 Panu Matilainen 2026-02-17 07:46:42 UTC 
Enabled in rawhide as of Feb 16 in rpm >= 6.0.1-5
Comment 2 Tomas 2026-03-24 09:35:04 UTC 
If anyone using mock seeing gpg check failed issue (eventho you have tried setting gpg check 0 on dnf.conf, repo etc.) :facepalm: 

you can override this value using:

config_opts['files']['/etc/rpm/macros.pkgverify'] = '%_pkgverify_level digest\n'

cc: @bcl
Note You need to log in before you can comment on or make changes to this bug.