7

When I tried to upgrade a Fedora 26 Server earlier today, I got this error message after downloading packages:

warning: /var/cache/dnf/forensics-5e8452ee3a114fbe/packages/protobuf-c-1.3.0-1.fc26.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID 87e360b8: NOKEY
Importing GPG key 0x87E360B8:
Userid     : "CERT Forensics Operations and Investivations Team <forensics@cert.org>"
 Fingerprint: 26A0 829D 5C01 FC51 C304 9037 E97F 3E0A 87E3 60B8
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-cert-forensics-2018-04-07
Is this ok [y/N]: n
Didn't install any keys
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

So I aborted the upgrade, and I tried to dnf clean packages and redownload, but I still got the same error.

It seems that the protobuf packaged does not have a valid signature so dnf cannot continue, is that correct?

3 Answers 3

8

Use this command to solve this: dnf update --nogpgcheck

1
  • 2
    This would work, but it’s rather unfortunate to skip the GPG checks; the other answer is much better... Mar 10, 2018 at 19:37
6

But... you are saying "No":

Is this ok [y/N]: n

...when asked to install the key!

Try with yes (y) instead!

5
  • I was trying to identify what went wrong that I got a warning. And is it safe to choose y to install the key?
    – jackxujh
    Dec 10, 2017 at 13:24
  • Yes, you can even see where it is coming from. I would consider it safe. Best regards. Dec 10, 2017 at 13:25
  • The part I don't understand is key ID 87e360b8: NOKEY in the first line. what does the NOKEY mean? And is 87e360b8 the newly downloaded key?
    – jackxujh
    Dec 10, 2017 at 13:28
  • 1
    When I am asked a similar question on upgrade I always compare the fingerprint with the fingerprint I find on the Fedora / Rpmfusion site (loaded via https of course) and up to now they always matched. I am not sure about this key (not using Fedora Server) and wasn't able to find it on the net. Also note the typo "Investivations Team". I guess it's all okay since the key is already stored on your machine as @maulinglawns pointed out but I'd ask the maintainer to publish the fingerprints as well as information on the typo on their website so anyone can double check if they want to.
    – dreua
    Dec 10, 2017 at 21:14
  • @dreua Yeah, the typo is quite funny. LOL
    – jackxujh
    Mar 29, 2019 at 20:02
3

I'm getting the following message

Package code-1.40.1-1573664332.el7.x86_64.rpm is not signed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

So the code package isn't signed.

Let's see which repo provides it:

dnf provides code | grep "Repo" | sort | uniq

Repo        : code
Repo        : @System

I can proceed by disabling the code repository:

sudo dnf update --refresh --verbose --disablerepo code

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.