I'm stumped by this update killing error.

This error squashes all updates until I disable gpgcheck on the updates repo. IE /etc/yum.repos.d/CentOS-Base.repo|[updates].gpgcheck=0

It's happening on Every machine I have - I thought at first that it was a 'pet/snowflake' type issue but no, it's affecting the whole herd.

warning: /var/cache/yum/x86_64/7/updates/packages/scap-security-guide-0.1.36-9.el7.centos.noarch.rpm: Header V3 RSA/SHA256 Signature, key ID f533f4fa: NOKEY
Public key for scap-security-guide-0.1.36-9.el7.centos.noarch.rpm is not installed
scap-security-guide-0.1.36-9.el7.centos.noarch.rpm                               | 4.4 MB  00:00:03
Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

The GPG keys listed for the "CentOS-7 - Updates" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.

 Failing package is: scap-security-guide-0.1.36-9.el7.centos.noarch
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

gpg --quiet --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7 shows the correct fingerprint.

diff says /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7 and http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-7 match.

file says /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7 is PGP public key block.

stat says it's a regular file.

ls -lZa /etc/pki/rpm-gpg/ shows all files owned by root:root with security Context: system_u:object_r:cert_t:s0

lsattr /etc/pki/rpm-gpg/ shows no attributes set.

No errors have been reported for the disk.

There's no memory nor record of any other update failing since the OS was installed in 2016.

The package's URL is http://mirror.centos.org/centos/7.5.1804/updates/x86_64/Packages/scap-security-guide-doc-0.1.36-9.el7.centos.noarch.rpm

yum provides scap-security-guide says: scap-security-guide-0.1.36-9.el7.centos.noarch is in Repo : updates

/etc/yum.repos.d/CentOS-Base.repo (excerpt)
name=CentOS-$releasever - Base

#released updates
name=CentOS-$releasever - Updates


# Added after installing deltarpm

After rebooting, I ran yum clean all which cleaned all active repos: base epel extras mariadb psychotic updates
followed by rm -rf /var/cache/yum
before re-running yum update
It threw the error again and continues to do so

Centos 7.4
Centos 7.5

5 Answers 5


I've seen the problem (LOL - sorry, not MITM or corrupt mirrors). I tracked it down to the version of gpg installed and linked on the system. Usually you'll want gpg2. But, gpg can end up being your default if (for instance) you're missing the gpg2 binary, missing or wrongly ordered PATH entries, missing a link to the binary, and so on.


Some people ending up here might be able to solve their problem with this:

sudo yum install https://$(rpm -E '%{?centos:centos}%{!?centos:rhel}%{rhel}').iuscommunity.org/ius-release.rpm


sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm -E '%{rhel}').noarch.rpm

Then yum update and you're ready to go

  • Thanks, this worked for me when using IUS community packages!
    – Tim
    Apr 2, 2020 at 18:46
  • 1
    Adding the IUS or EPEL repository won't have any effect on the errors for the "CentOS-7 - Updates" repository. They are totally separate things. Jul 30, 2020 at 2:02

Maybe there is really a issue with the mirror or some kind of MITM.

First (with intact cache, so before removing /var/cache/yum) get Key ID (the last 8 chars of the Key ID, the 9th is the newline)

rpm -qpi /var/cache/yum/x86_64/7/updates/packages/scap-security-guide-0.1.36-9.el7.centos.noarch.rpm | tail -c9

In my case this is f4a80eb5 (and i think it should be the same in your case)

Next we list all to rpm known gpg pubkeys and search for the one used our package

rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n' | grep f4a80eb5

which should give us one result

gpg-pubkey-f4a80eb5-53a7ff4b    gpg(CentOS-7 Key (CentOS 7 Official Signing Key) <[email protected]>)

If you don't have an output from the rpm -q gpg-pubkey command, this could be one of two things

  1. rpm can not see the pubkey and you may need to import it with

    rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
  2. The package from the mirror is NOT signed with correct key, which could be a MITM-Attack or a mirror overtake.

If you get exactly one result i don't really know what could be the problem right now. I would go for an strace to dig deeper into and to actually figure what's the problem.


Best solution for me was:

yum install --nogpgcheck your_package

as sudo type in: yum install \ https://repo.ius.io/ius-release-el7.rpm \ https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

followed by a yum update

worked for me.

  • 1
    Adding the IUS repository won't have any effect on the errors for the "CentOS-7 - Updates" repository. They are totally separate things. Jul 30, 2020 at 2:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .