koji-f30-build is enabled with gpgcheck: 1 but packages are not signed

[Jan Pazdziora]

Hello,

I'm testing libdnf plugin and as part of the tests, I want to install
some packages from the current Fedora-configured repositories.

However, looking at

	https://jenkins-continuous-infra.apps.ci.centos.org/blue/organizations/je...

repository

	Problem repository: [koji-f30-build]
	baseurl: [https://kojipkgs.fedoraproject.org/repos/f30-build/latest/x86_64/]

is enabled with

	gpgcheck: 1
and
	gpgkey: []

but rpms in that repository are not signed, as mentioned by microdnf
in

	https://jenkins-continuous-infra.apps.ci.centos.org/blue/organizations/je...

	Downloading packages...
	error: package info-6.6-1.fc30.x86_64 cannot be verified and repo koji-f30-build is GPG
enabled: package not signed: info-6.6-1.fc30.x86_64.rpm

(Looking at the /tmp/package-test.sh outputs in both cases.)

Shouldn't the repositories in Fedora CI environments be configured
with gpgcheck: 0 if the packages in

	https://kojipkgs.fedoraproject.org/repos/*-build/latest/*/

are not signed?

-- 
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat