I have a repository and a package and want to install it from that repository on Fedora 39.
The repository is here for (testing purposes, ignore the bucket name ubuntu, it contains rpm repo) https://storage.googleapis.com/repotestubuntu2204 created via createrepo
The package sample_project-1.3.5-1.fc39.x86_64.rpm is just C hello world signed via rpm --addsign, the keys generated via gpg --gen-key (RSA 4096 bits, no passphrase, no expire)
Adding this repository
dnf config-manager --add-repo https://storage.googleapis.com/repotestubuntu2204/sample_project.repo
Adding repo from: https://storage.googleapis.com/repotestubuntu2204/sample_project.repo
Seems to be ok. Now trying to install the package
dnf install -yv sample_project
...
Using rpmkeys executable at /usr/bin/rpmkeys to verify signatures
Package sample_project-1.3.5-1.fc39.x86_64.rpm is not signed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED
So it is telling me that the package is unsigned and that it's using rpmkeys to verify this. Ok, downloading the rpm itself ang checking the signature
wget https://storage.googleapis.com/repotestubuntu2204/sample_project-1.3.5-1.fc39.x86_64.rpm
rpmkeys -Kv sample_project-1.3.5-1.fc39.x86_64.rpm
sample_project-1.3.5-1.fc39.x86_64.rpm:
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
MD5 digest: OK
I tried gpg import and rpm --import - nothing helps, and afaik it shouldn't b/c there's link to gpgkey in .repo file which seems to be imported successfully upon adding the repository.
The rpm built for openSUSE with the exact same procedure works, zypper adds repository, asks to trust the public key, and that's it. Fedora does not ask trust or not the key, however, which is a bit suspicios. But manually downloading the key file and importing it doesn't help either.
yum install gives the same error. rpm -i works without any issues. What's wrong with the signature?
