What means warning: rpmts_HdrFromFdno when installing from rpmfusion?

Question

Installing a media player from rpmfusion (via yum) yields following output:

Transaction Summary
================================================================================
Install  3 Packages (+32 Dependent packages)

Total download size: 21 M
Installed size: 68 M
Is this ok [y/N]: y
Downloading Packages:
warning: rpmts_HdrFromFdno: Header V3 RSA/SHA256 Signature,
                            key ID 8296fa0f: NOKEY
Public key for a52dec-0.7.4-16.fc17.x86_64.rpm is not installed
(1/35): a52dec-0.7.4-16.fc17.x86_64.rpm                  |  50 kB
(2/35): faad2-libs-2.7-2.fc17.x86_64.rpm                 | 145 kB

What is that supposed to mean?

I've enabled rpmfusion via:

 yum localinstall rpmfusion-free-release-stable.noarch.rpm

(downloaded the rpm from the rpmfusion site)

I have /etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-17-primary (and symlinks) which has the right key id:

# gpg --with-fingerprint RPM-GPG-KEY-rpmfusion-free-fedora-17-primary
pub  4096R/8296FA0F  [...]

But rpm -qa gpg-pubkey* does not display an entry for 8296FA0F.

I am not really sure how /etc/pki/rpm-gpg and rpmkeys --import and friends work together.

And btw, why is yum just issuing a warning and not an error that the key is not available?

Answer 1

You're not doing anything wrong. The package is incorrectly signed.

From a thread on lists.rpmfusion.org:

Are you aware of the other packages that would need to be re-signed, too? a52dec is just one example.

Once the changed package arrives at the mirrors, installing it most likely will work fine (requiring a "yum clean packages", however, to purge the package cache).

While this was in reference to the Fedora 16 packages, in all likelihood - your package too suffers from the same fate of a bad signature. Read the rest on lists.rpmfusion.org.