9

I am trying to add an external repository inside the yum.repos.d directory. The packages and metadata for that repository are signed with a gpg key. In case it's relevant, I'm on CentOS 7.2

So far as I can tell, the traditional way to set up the repository is to include a link to the gpg key inside the repository file.

That is, the file example.repo inside /etc/yum.repos.d contains the line:

gpgkey = https://example.com/repo/key

Then if you run yum update, you get a [y/N] prompt to import the GPG key, and if instead you run yum -y update the key gets imported automatically. So far so normal.

As an experiment, I tried removing the gpg-key download link from the repo file, and instead adding the key manually.

wget -O key https://example.com/repo/key
rpm --import key
and verify with
rpm -qa gpg-pubkey*

My expectation was that this would enable yum update to go through without raising the [y/N] prompt. But it didn't work - I still got the prompt asking me to import the key which I already imported. I tried in addition, removing the gpgkey entry from the repo file, but in that case yum update simply threw an error (since I also have gpgcheck = 1 and repo_gpgcheck = 1).

Why does this matter? Well, it seems to me that if you want to automate this process, then you are required to trust the https transport through which the key is downloaded. That's fine, but then the GPG key is not really adding any security, beyond verifying that the package downloaded properly.

In short, I think either I'm missing a trick to make yum recognize that I already imported the key, or the GPG keys really aren't adding much beyond plain old https. Any clues?

Improve this question
3
  • That prompt will only show up once. After you tell it 'y', it will not ask about that repo again. It does this on every new installation I've ever encountered.
    – Sokel
    Jan 14, 2017 at 1:50
  • True - I'm referring to the situation where you're looking at automating the whole thing.
    – SauceCode
    Jan 14, 2017 at 1:55
  • Thanks @SauceCode and @davor-cubranic for posting. Every other article suggests that if you do rpm --import key you'll be fine. After digging, I can see that after you run Davor's yum command or type "Y" to accept, a directory is created: /var/lib/yum/repos/<arch>/<class>/<reponame>/gpgdir. It contains a GPG public keyring and trustdb which yum uses to verify trust. Anyway, thanks again for this question & solution!
    – Liczyrzepa
    Sep 19, 2018 at 15:52

2 Answers 2

Reset to default
2

This is a cargo-cult workaround that seems to work for automating key import:

yum -q makecache -y --disablerepo='*' --enablerepo=THENEWREPO
Improve this answer
2
  • This is untrue; the yum.conf man page makes no mention of any repo_gpgkey field. There's repo_gpgcheck, which controls whether the GPG check is done, but no repo_gpgkey field specifying the keys used for that check.
    – Eric Dand
    Mar 3, 2021 at 22:08
  • Thanks @EricDand. It's been a while since I wrote that answer, and now I've no idea where I got that info. (It's definitely not in the linked yum.conf man page.) I'll take out that part of the answer, but the "cargo-cult" way of automating it still stands.
    – Davor Cubranic
    Mar 4, 2021 at 23:42
1

Keys imported using rpm --import are only used to verify RPM packages, not YUM repos. yum stashes its own keys deep in /var/lib/yum/repos. It keeps a separate keyring for each repo.

What you could do, if you really don't want to trust the remote keys at repo installation time, is download the keys separately, then set a local path as the gpgkey field for the repo. Then it'll use the local file full of (trusted) keys for the repository. Keep in mind that if (when) the keys are rotated, you'll need to manually go and grab the new ones.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .