Installing a media player from rpmfusion (via yum) yields following output:

Transaction Summary
Install  3 Packages (+32 Dependent packages)

Total download size: 21 M
Installed size: 68 M
Is this ok [y/N]: y
Downloading Packages:
warning: rpmts_HdrFromFdno: Header V3 RSA/SHA256 Signature,
                            key ID 8296fa0f: NOKEY
Public key for a52dec-0.7.4-16.fc17.x86_64.rpm is not installed
(1/35): a52dec-0.7.4-16.fc17.x86_64.rpm                  |  50 kB
(2/35): faad2-libs-2.7-2.fc17.x86_64.rpm                 | 145 kB

What is that supposed to mean?

I've enabled rpmfusion via:

 yum localinstall rpmfusion-free-release-stable.noarch.rpm

(downloaded the rpm from the rpmfusion site)

I have /etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-17-primary (and symlinks) which has the right key id:

# gpg --with-fingerprint RPM-GPG-KEY-rpmfusion-free-fedora-17-primary
pub  4096R/8296FA0F  [...]

But rpm -qa gpg-pubkey* does not display an entry for 8296FA0F.

I am not really sure how /etc/pki/rpm-gpg and rpmkeys --import and friends work together.

And btw, why is yum just issuing a warning and not an error that the key is not available?


You're not doing anything wrong. The package is incorrectly signed.

From a thread on lists.rpmfusion.org:

Are you aware of the other packages that would need to be re-signed, too? a52dec is just one example.

Once the changed package arrives at the mirrors, installing it most likely will work fine (requiring a "yum clean packages", however, to purge the package cache).

While this was in reference to the Fedora 16 packages, in all likelihood - your package too suffers from the same fate of a bad signature. Read the rest on lists.rpmfusion.org.

  • Thanks for the link - a follow-up message gives me an idea how yum is supposed to work when it encounters an unknown key - first it warns with rpmts_HdrFromFdno ... NOKEY and after downloading all packages it asks if the missing keys should be imported from /etc/pki/rpm-gpg/.... I didn't get the 2nd part because the warning freaked me out and I Ctrl+C'd the process before that. – maxschlepzig Jun 15 '12 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.