Gpg check fail fedora cinnamon

Ask Fedora
,
1

Hi, I’m new to Linux and Fedora but security is important for me. I downloaded and verified the Fedora 44 Cinnamon spin iso file as having a good signature before burning it with Fedora Media Writer. I then installed it and ran the following:

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_workstation_l1 \
  --report /tmp/oscap-baseline.html \
  --results /tmp/oscap-baseline.xml \
  /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

The OpenScap report highlighted two failures with a high level of security risk:

  1. Ensure Fedora gpg key installed
  2. Ensure gpgcheck enabled in main dnf configuration.

I repeated this process with Fedora 44 Budgie spin and got the same result. Digging more deeply into the report showed the below:

release installed
release installed1834×731 160 KB

However, the report for Fedora 44 KDE desktop live using the same process said the gpg check wasn’t applicable.

I would be grateful if someone could explain:

  1. the discrepancy in results
  2. how much of a security concern this is
  3. how to fix it.

I tried to fix it by adding gpgcheck=1 to the /etc/dnf/dnf.conf in the main section (as recommended in the oscap report). This fixed the “Ensure gpgcheck enabled” but don’t know what to do about the “Ensure gpg key installed” fail.

The report does present a remediation script but I don’t know where to put it or what to do with it or even if it is appropriate. It is as follows.

if ! rpm -q --quiet "gpg" ; then
    dnf install -y "gpg"
fi

fedora_version=$(grep -oP '[[:digit:]]+' /etc/redhat-release)

function get_release_fingerprint {
    if [ "${fedora_version}" -eq "44" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6"

    else
        printf '%s\n' "This Fedora version '$fedora_version' is not supported anymore, please upgrade to a newer version." >&2
        return 1
    fi
}

# Location of the key we would like to import (once it's integrity verified)
readonly REDHAT_RELEASE_KEY="/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${fedora_version}-primary"

RPM_GPG_DIR_PERMS=$(stat -c %a "$(dirname "$REDHAT_RELEASE_KEY")")

function remediate_gpgkey_installed {
    # Return if there was an issue getting the release fingerprint
    get_release_fingerprint || return 1
    # Verify /etc/pki/rpm-gpg directory permissions are safe
    if [ "${RPM_GPG_DIR_PERMS}" -le "755" ]; then
        # If they are safe, try to obtain fingerprints from the key file
        # (to ensure there won't be e.g. CRC error).
        readarray -t GPG_OUT < <(gpg --show-keys --with-fingerprint --with-colons "${REDHAT_RELEASE_KEY}" | grep '^fpr' | cut -d ":" -f 10)
        GPG_RESULT=$?
        # No CRC error, safe to proceed
        if [ "${GPG_RESULT}" -eq "0" ]; then
            echo "${GPG_OUT[*]}" | grep -vE "${FEDORA_RELEASE_FINGERPRINT}" || {
            # If file doesn't contain any keys with unknown fingerprint, import it
            rpm --import "${REDHAT_RELEASE_KEY}"
            }
        fi
    fi
}

remediate_gpgkey_installed

I’d appreciate any help. Thank you