I have a repository and a package and want to install it from that repository on Fedora 39.

The repository is here for (testing purposes, ignore the bucket name ubuntu, it contains rpm repo) https://storage.googleapis.com/repotestubuntu2204 created via createrepo

The package sample_project-1.3.5-1.fc39.x86_64.rpm is just C hello world signed via rpm --addsign, the keys generated via gpg --gen-key (RSA 4096 bits, no passphrase, no expire)

Adding this repository

dnf config-manager --add-repo https://storage.googleapis.com/repotestubuntu2204/sample_project.repo
Adding repo from: https://storage.googleapis.com/repotestubuntu2204/sample_project.repo

Seems to be ok. Now trying to install the package

dnf install -yv sample_project
Using rpmkeys executable at /usr/bin/rpmkeys to verify signatures
Package sample_project-1.3.5-1.fc39.x86_64.rpm is not signed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

So it is telling me that the package is unsigned and that it's using rpmkeys to verify this. Ok, downloading the rpm itself ang checking the signature

wget https://storage.googleapis.com/repotestubuntu2204/sample_project-1.3.5-1.fc39.x86_64.rpm

rpmkeys -Kv sample_project-1.3.5-1.fc39.x86_64.rpm 
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK

I tried gpg import and rpm --import - nothing helps, and afaik it shouldn't b/c there's link to gpgkey in .repo file which seems to be imported successfully upon adding the repository.

The rpm built for openSUSE with the exact same procedure works, zypper adds repository, asks to trust the public key, and that's it. Fedora does not ask trust or not the key, however, which is a bit suspicios. But manually downloading the key file and importing it doesn't help either.

yum install gives the same error. rpm -i works without any issues. What's wrong with the signature?

1 Answer 1


Figured out. While debugging rpm signatures for Fedora I've added --showrc option, so the sign command was rpm --showrc --verbose --addsign *.rpm and turns out this didn't sign the package header. rpm --addsign *.rpm works

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .