When I tried to upgrade a Fedora 26 Server earlier today, I got this error message after downloading packages:

warning: /var/cache/dnf/forensics-5e8452ee3a114fbe/packages/protobuf-c-1.3.0-1.fc26.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID 87e360b8: NOKEY
Importing GPG key 0x87E360B8:
Userid     : "CERT Forensics Operations and Investivations Team <forensics@cert.org>"
 Fingerprint: 26A0 829D 5C01 FC51 C304 9037 E97F 3E0A 87E3 60B8
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-cert-forensics-2018-04-07
Is this ok [y/N]: n
Didn't install any keys
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

So I aborted the upgrade, and I tried to dnf clean packages and redownload, but I still got the same error.

It seems that the protobuf packaged does not have a valid signature so dnf cannot continue, is that correct?


But... you are saying "No":

Is this ok [y/N]: n

...when asked to install the key!

Try with yes (y) instead!

  • I was trying to identify what went wrong that I got a warning. And is it safe to choose y to install the key? – jackxujh Dec 10 '17 at 13:24
  • Yes, you can even see where it is coming from. I would consider it safe. Best regards. – maulinglawns Dec 10 '17 at 13:25
  • The part I don't understand is key ID 87e360b8: NOKEY in the first line. what does the NOKEY mean? And is 87e360b8 the newly downloaded key? – jackxujh Dec 10 '17 at 13:28
  • 1
    When I am asked a similar question on upgrade I always compare the fingerprint with the fingerprint I find on the Fedora / Rpmfusion site (loaded via https of course) and up to now they always matched. I am not sure about this key (not using Fedora Server) and wasn't able to find it on the net. Also note the typo "Investivations Team". I guess it's all okay since the key is already stored on your machine as @maulinglawns pointed out but I'd ask the maintainer to publish the fingerprints as well as information on the typo on their website so anyone can double check if they want to. – dreua Dec 10 '17 at 21:14
  • @dreua Yeah, the typo is quite funny. LOL – jackxujh Mar 29 at 20:02

Use this command to solve this: dnf update --nogpgcheck

  • 1
    This would work, but it’s rather unfortunate to skip the GPG checks; the other answer is much better... – Stephen Kitt Mar 10 '18 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.