Unable to install locally built rpms

[Ralf Corsépius]

Hi,

[Resending here, because the test list doesn't allow me to post, there]

on f38, I am unable to install any locally built package (signed with a 
local key, I have been using for many years):

# rpm -U xpetri-0.4.8-0.fc38.x86_64.rpm
error: xpetri-0.4.8-0.fc38.x86_64.rpm: Header V4 RSA/SHA256 Signature, 
key ID a6b9312e: BAD
error: xpetri-0.4.8-0.fc38.x86_64.rpm cannot be installed

# rpm -qip xpetri-0.4.8-0.fc38.x86_64.rpm
error: xpetri-0.4.8-0.fc38.x86_64.rpm: Header V4 RSA/SHA256 Signature, 
key ID a6b9312e: BAD
error: xpetri-0.4.8-0.fc38.x86_64.rpm: not an rpm package (or package 
manifest)


# dnf install xpetri-0.4.8-0.fc38.x86_64.rpm
Last metadata expiration check: 1:30:47 ago on Tue 28 Feb 2023 06:25:45 
AM CET.
Dependencies resolved.
...
     0.4.8-0.fc38                              @commandline
...
Installing dependencies:
...
Downloading Packages:
(1/6): XXX.rpm ...
Total                                                           1.2 MB/s 
| 130 kB     00:00
...
Problem opening package XXX.rpm
...
The downloaded packages were saved in cache until the next successful 
transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED



Worse, after trying forcefully to install packages using rpm -U --nogpg 
this happens:

# rpm -qa
gpg-pubkey-d651ff2e-5dadbbc1
gpg-pubkey-8ff214b4-3afa5d46
gpg-pubkey-a6b9312e-5227e975
gpg-pubkey-94843c65-5dadbc64
error: rpmdbNextIterator: skipping h#       5
Header V4 DSA/SHA1 Signature, key ID 8ff214b4: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#       6
Header V3 RSA/SHA1 Signature, key ID d651ff2e: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
gpg-pubkey-5323552a-6112bcdc
...
=> nogpg is not ignored, as it is supposed to be.


What are people supposed to do?


Ralf

[Kamil Paral]

On Tue, Feb 28, 2023 at 9:39 AM Ralf Corsépius <rc040203(a)freenet.de&gt; wrote:

>  Hi,
>
>  [Resending here, because the test list doesn't allow me to post, there]
>
>  on f38, I am unable to install any locally built package (signed with a
>  local key, I have been using for many years):
>
>  # rpm -U xpetri-0.4.8-0.fc38.x86_64.rpm
>  error: xpetri-0.4.8-0.fc38.x86_64.rpm: Header V4 RSA/SHA256 Signature,
>  key ID a6b9312e: BAD
>  error: xpetri-0.4.8-0.fc38.x86_64.rpm cannot be installed
>
>  # rpm -qip xpetri-0.4.8-0.fc38.x86_64.rpm
>  error: xpetri-0.4.8-0.fc38.x86_64.rpm: Header V4 RSA/SHA256 Signature,
>  key ID a6b9312e: BAD
>  error: xpetri-0.4.8-0.fc38.x86_64.rpm: not an rpm package (or package
>  manifest)
>
>
>  # dnf install xpetri-0.4.8-0.fc38.x86_64.rpm
>  Last metadata expiration check: 1:30:47 ago on Tue 28 Feb 2023 06:25:45
>  AM CET.
>  Dependencies resolved.
>  ...
>       0.4.8-0.fc38                              @commandline
>  ...
>  Installing dependencies:
>  ...
>  Downloading Packages:
>  (1/6): XXX.rpm ...
>  Total                                                           1.2 MB/s
>  | 130 kB     00:00
>  ...
>  Problem opening package XXX.rpm
>  ...
>  The downloaded packages were saved in cache until the next successful
>  transaction.
>  You can remove cached packages by executing 'dnf clean packages'.
>  Error: GPG check FAILED
>
>
>
>  Worse, after trying forcefully to install packages using rpm -U --nogpg
>  this happens:
>
>  # rpm -qa
>  gpg-pubkey-d651ff2e-5dadbbc1
>  gpg-pubkey-8ff214b4-3afa5d46
>  gpg-pubkey-a6b9312e-5227e975
>  gpg-pubkey-94843c65-5dadbc64
>  error: rpmdbNextIterator: skipping h#       5
>  Header V4 DSA/SHA1 Signature, key ID 8ff214b4: BAD
>  Header SHA256 digest: OK
>  Header SHA1 digest: OK
>  error: rpmdbNextIterator: skipping h#       6
>  Header V3 RSA/SHA1 Signature, key ID d651ff2e: BAD
>  Header SHA256 digest: OK
>  Header SHA1 digest: OK
>  gpg-pubkey-5323552a-6112bcdc
>  ...
>  => nogpg is not ignored, as it is supposed to be.
>
>
>  What are people supposed to do?
>  
That's most certainly this problem:
https://ask.fedoraproject.org/t/popular-third-party-rpms-fail-to-install-...

I don't understand these security measures much, but creating a new key
using modern tools should be sufficient to resolve this. See the article to
learn how to detect and uninstall already affected packages present on your
system first.

[Sérgio Basto]

On Tue, 2023-02-28 at 10:34 +0100, Kamil Paral wrote:
>  On Tue, Feb 28, 2023 at 9:39 AM Ralf Corsépius
> <rc040203(a)freenet.de&gt;
>  wrote:
>  > Hi,
>  > 
>  > [Resending here, because the test list doesn't allow me to post,
>  > there]
>  > 
>  > on f38, I am unable to install any locally built package (signed
>  > with a 
>  > local key, I have been using for many years):
>  > 
>  > # rpm -U xpetri-0.4.8-0.fc38.x86_64.rpm
>  > error: xpetri-0.4.8-0.fc38.x86_64.rpm: Header V4 RSA/SHA256
>  > Signature, 
>  > key ID a6b9312e: BAD
>  > error: xpetri-0.4.8-0.fc38.x86_64.rpm cannot be installed
>  > 
>  > # rpm -qip xpetri-0.4.8-0.fc38.x86_64.rpm
>  > error: xpetri-0.4.8-0.fc38.x86_64.rpm: Header V4 RSA/SHA256
>  > Signature, 
>  > key ID a6b9312e: BAD
>  > error: xpetri-0.4.8-0.fc38.x86_64.rpm: not an rpm package (or
>  > package 
>  > manifest)
>  > 
>  > 
>  > # dnf install xpetri-0.4.8-0.fc38.x86_64.rpm
>  > Last metadata expiration check: 1:30:47 ago on Tue 28 Feb 2023
>  > 06:25:45 
>  > AM CET.
>  > Dependencies resolved.
>  > ...
>  >      0.4.8-0.fc38                              @commandline
>  > ...
>  > Installing dependencies:
>  > ...
>  > Downloading Packages:
>  > (1/6): XXX.rpm ...
>  > Total                                                           1.2
>  > MB/s 
>  > | 130 kB     00:00
>  > ...
>  > Problem opening package XXX.rpm
>  > ...
>  > The downloaded packages were saved in cache until the next
>  > successful 
>  > transaction.
>  > You can remove cached packages by executing 'dnf clean packages'.
>  > Error: GPG check FAILED
>  > 
>  > 
>  > 
>  > Worse, after trying forcefully to install packages using rpm -U --
>  > nogpg 
>  > this happens:
>  > 
>  > # rpm -qa
>  > gpg-pubkey-d651ff2e-5dadbbc1
>  > gpg-pubkey-8ff214b4-3afa5d46
>  > gpg-pubkey-a6b9312e-5227e975
>  > gpg-pubkey-94843c65-5dadbc64
>  > error: rpmdbNextIterator: skipping h#       5
>  > Header V4 DSA/SHA1 Signature, key ID 8ff214b4: BAD
>  > Header SHA256 digest: OK
>  > Header SHA1 digest: OK
>  > error: rpmdbNextIterator: skipping h#       6
>  > Header V3 RSA/SHA1 Signature, key ID d651ff2e: BAD
>  > Header SHA256 digest: OK
>  > Header SHA1 digest: OK
>  > gpg-pubkey-5323552a-6112bcdc
>  > ...
>  > => nogpg is not ignored, as it is supposed to be.
>  > 
>  > 
>  > What are people supposed to do?
>  > 
>  
>  
>  That's most certainly this problem:
>
> https://ask.fedoraproject.org/t/popular-third-party-rpms-fail-to-install-...
>  
>  I don't understand these security measures much, but creating a new
>  key using modern tools should be sufficient to resolve this. See the
>  article to learn how to detect and uninstall already affected
>  packages present on your system first. 
I wrote this one reply in discussion.fedoraproject.org site , ATM
ask.fedoraproject.org site and discussion site are independent  sites. 

https://discussion.fedoraproject.org/t/header-v3-rsa-sha1-signature-key-i...

this issue definitely should go to the common bugs , IMO. 


>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue 
-- 
Sérgio M. B.

[Kamil Paral]

On Tue, Feb 28, 2023 at 11:56 AM Sérgio Basto <sergio(a)serjux.com&gt; wrote:

>  this issue definitely should go to the common bugs , IMO.
>  
See the link that I posted ;)

[Sérgio Basto]

On Tue, 2023-02-28 at 13:38 +0100, Kamil Paral wrote:
>  On Tue, Feb 28, 2023 at 11:56 AM Sérgio Basto
> <sergio(a)serjux.com&gt;
>  wrote:
>  > this issue definitely should go to the common bugs , IMO. 
>  > 
>  
>  
>  See the link that I posted ;) 
yeah sorry :) common bugs have moved to
https://ask.fedoraproject.org/c/common-issues/141/none


>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue 
-- 
Sérgio M. B.

[Ralf Corsépius]

Am 28.02.23 um 10:34 schrieb Kamil Paral:

>  That's most certainly this problem:
>
> https://ask.fedoraproject.org/t/popular-third-party-rpms-fail-to-install-...
> <https://ask.fedoraproject.org/t/popular-third-party-rpms-fail-to-install-...
>   
Yes, it certainly is this problem.

AFAICT, the cause seems to be my old gpg-signing key (created 2013) is 
using "digest algo 2" signature digests (whatever this means).

>  I don't understand these security measures much, but creating a
> new key 
>  using modern tools should be sufficient to resolve this. 
Which tools whould you suggest? So far, for me, all such attempts, using 
seahorse on fc37 failed.

Though the newly created key seems to comply to the new rules, now gpg 
-sign and rpm --resign fail:


# rpm --resign libmail-2.3.5-1.fc38.x86_64.rpm
libmail-2.3.5-1.fc38.x86_64.rpm:
gpg: signing failed: Permission denied
gpg: signing failed: Permission denied
error: gpg exec failed (2)

No idea, about what's going on.

>  See the article 
>  to learn how to detect and uninstall already affected packages present 
>  on your system first. 
Well, ...

IMHO, this stuff + FC38's rpm and dnf are not in a release-ready shape.
Too many cryptic and non-understandable/non-readable error messages, far 
too radical changes, far too little backward compatibility and far too 
little help.

Ralf

[Stephen Smoogen]

On Tue, 28 Feb 2023 at 07:18, Ralf Corsépius <rc040203(a)freenet.de&gt; wrote:

>  Am 28.02.23 um 10:34 schrieb Kamil Paral:
>
>  > That's most certainly this problem:
>  >
>
> https://ask.fedoraproject.org/t/popular-third-party-rpms-fail-to-install-...
>  <
>
> https://ask.fedoraproject.org/t/popular-third-party-rpms-fail-to-install-...
>  >
>  >
>  Yes, it certainly is this problem.
>
>  AFAICT, the cause seems to be my old gpg-signing key (created 2013) is
>  using "digest algo 2" signature digests (whatever this means).
>
>  
I think that means the key is using SHA-1 keys (going from
https://bfh.science/OLD/software/gnupg/best-practice.html) It looks like
you can update a GPG key to the newer hash with something like
https://wiki.ubuntu.com/SecurityTeam/GPGMigration (or
https://old.nixaid.com/gpg-migration-sha1-to-sha2/ though lots of ads )



>  > I don't understand these security measures much, but
> creating a new key
>  > using modern tools should be sufficient to resolve this.
>
>  Which tools whould you suggest? So far, for me, all such attempts, using
>  seahorse on fc37 failed.
>
>  Though the newly created key seems to comply to the new rules, now gpg
>  -sign and rpm --resign fail:
>
>
>  # rpm --resign libmail-2.3.5-1.fc38.x86_64.rpm
>  libmail-2.3.5-1.fc38.x86_64.rpm:
>  gpg: signing failed: Permission denied
>  gpg: signing failed: Permission denied
>  error: gpg exec failed (2)
>
>  No idea, about what's going on.
>
>  > See the article
>  > to learn how to detect and uninstall already affected packages present
>  > on your system first.
>
>  Well, ...
>
>  IMHO, this stuff + FC38's rpm and dnf are not in a release-ready shape.
>  Too many cryptic and non-understandable/non-readable error messages, far
>  too radical changes, far too little backward compatibility and far too
>  little help.
>
>  Ralf
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue
>  

-- 
Stephen Smoogen, Red Hat Automotive
Let us be kind to one another, for most of us are fighting a hard battle.
-- Ian MacClaren