SUSE Linux Signature verification failed

Question

When I code, build and sign .rpm file for SUSE Linux, it is signed successfully as follows:

rpm --checksig -v xxx.rpm

Header V4 RSA/SHA256 Signature, key ID 7936b039: OK
Header SHA1 digest: OK
Header SHA256 digest: OK
Payload SHA256 digest: OK
V4 RSA/SHA256 Signature, key ID 7936b039: OK
MD5 digest: OK

But when I copy this file to a SUSE Linux Enterprise 12 SP3 PC and recheck, the result is as follows:

rpm --checksig -v xxx.rpm

Header V4 RSA/SHA256 Signature, key ID 7936b039: NOKEY
Header SHA1 digest: OK (62415d048bc9e59e70037e94e41e54e1087a93af)
V4 RSA/SHA256 Signature, key ID 7936b039: NOKEY
MD5 digest: OK (bde2174905b9e9b05953b148385ed99a)

And then while installing, I get an error:

xxx.rpm:

Header V4 RSA/SHA256 Signature, key ID 7936b039: NOKEY
V4 RSA/SHA256 Signature, key ID 7936b039: NOKEY

xxx-15.4.2.1-0.x86_64 (Plain RPM files cache): Signature verification failed [4-Signatures public key is not available]
Abort, retry, ignore? [a/r/i] (a):

I researched some solutions on the Internet and I tried to re-import public key file (I created when signing RPM file) before installing: sudo rpm --import RPM-GPG-KEY-faleman

But it's still failed.

What is the reason of this issue?

How can I sign my .RPM file to be able to install successfully on SUSE Linux without getting error messages?

Answer 1

You likely used incompatible GPG key (V4). Like this guy https://localsteve.wordpress.com/2013/02/06/signing-rpms-cause-unverifiable-v4-signatures-and-extreme-frustration/

Try to create different key with different crypto algo.

Answer 2

SLE12 has older version of RPM (4.11.2) which don't support V4 signatures. So change your build config to use V3 signatures:D

some help can be found in this https://adminotes.blogspot.com/2011/12/centos-6-rpm-sign-problem-v4-signatures.html