Package does not verify: no digest

Hi All,

I’m from the Artifactory Team. We usually validate with Fedora images to ensure compliance with the latest changes, and I’ve observed an issue recently.

Test Case:

The test case will install an old version of a package from Artifactory and then upgrading it to the latest version.

Contents of artifactory.repo File:

[root@ebb087fc4d9b /]# cat /etc/yum.repos.d/artifactory.repo
[Artifactory]
name=Artifactory
baseurl=https://admin:<password token>@jfrtpit768x189024.jfrogdev.org/artifactory/yum-local-umkfnt00kn
enabled=1
gpgcheck=0
gpgkey=file:///etc/yum.repos.d/keys/public.key
group=MyGroup

Testing on Fedora 42 Image:

I pulled the Fedora 42 image and configured it with the above artifactory.repo configuration.

Installing Package:

[root@ebb087fc4d9b /]# yum install -y nano-1.3.12
Updating and loading repositories:
Artifactory                                                                                                                                                                                                                            100% |   4.1 KiB/s |   1.9 KiB |  00m00s
Repositories loaded.
Package                                                                                       Arch                Version                                                                                       Repository                                                  Size
Installing:
nano                                                                                         x86_64              1.3.12-1.1                                                                                    Artifactory                                            674.1 KiB
Transaction Summary:
Installing:         1 package
Total size of inbound packages is 244 KiB. Need to download 244 KiB.
After this operation, 674 KiB extra will be used (install 674 KiB, remove 0 B).
[1/1] nano-0:1.3.12-1.1.x86_64                                                                                                                                                                                                          100% | 543.1 KiB/s | 244.4 KiB |  00m00s
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[1/1] Total                                                                                                                                                                                                                             100% | 538.3 KiB/s | 244.4 KiB |  00m00s
Running transaction
[1/3] Verify package files                                                                                                                                                                                                              100% | 500.0   B/s |   1.0   B |  00m00s
[2/3] Prepare transaction                                                                                                                                                                                                               100% |  71.0   B/s |   1.0   B |  00m00s
[3/3] Installing nano-0:1.3.12-1.1.x86_64                                                                                                                                                                                               100% |  10.1 MiB/s | 679.2 KiB |  00m00s
Warning: skipped OpenPGP checks for 1 package from repository: Artifactory
Complete!
[root@ebb087fc4d9b /]# yum clean all
Removed 3 files, 5 directories. 0 errors occurred.

Upgrading Package:

[root@ebb087fc4d9b /]# yum -y update
Updating and loading repositories:
Artifactory                                                                                                                                                                                                                            100% |   3.3 KiB/s |   1.9 KiB |  00m01s
Repositories loaded.
Package                                                                                       Arch                Version                                                                                       Repository                                                  Size
Upgrading:
nano                                                                                         x86_64              2.0.9-1                                                                                       Artifactory                                              1.5 MiB
   replacing nano                                                                             x86_64              1.3.12-1.1                                                                                    Artifactory                                            674.1 KiB
Transaction Summary:
Upgrading:          1 package
Replacing:          1 package
Total size of inbound packages is 582 KiB. Need to download 582 KiB.
After this operation, 891 KiB extra will be used (install 2 MiB, remove 674 KiB).
[1/1] nano-0:2.0.9-1.x86_64                                                                                                                                                                                                             100% |   1.1 MiB/s | 581.6 KiB |  00m01s
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[1/1] Total                                                                                                                                                                                                                             100% |   1.1 MiB/s | 581.6 KiB |  00m01s
Running transaction
[1/4] Verify package files                                                                                                                                                                                                              100% |   1.0 KiB/s |   1.0   B |  00m00s
[2/4] Prepare transaction                                                                                                                                                                                                               100% | 125.0   B/s |   2.0   B |  00m00s
[3/4] Upgrading nano-0:2.0.9-1.x86_64                                                                                                                                                                                                   100% |  35.8 MiB/s |   1.5 MiB |  00m00s
[4/4] Removing nano-0:1.3.12-1.1.x86_64                                                                                                                                                                                                 100% | 857.0   B/s |  36.0   B |  00m00s
Warning: skipped OpenPGP checks for 1 package from repository: Artifactory
Complete!

Results:

After executing these steps, the package was installed and upgraded successfully in Fedora 42. Here’s the info on the installed package:

[root@ebb087fc4d9b /]# yum info nano
Updating and loading repositories:
Repositories loaded.
Installed packages
Name            : nano
Epoch           : 0
Version         : 2.0.9
Release         : 1
Architecture    : x86_64
Installed size  : 1.5 MiB
Source          : nano-2.0.9-1.src.rpm
From repository : Artifactory
Summary         : Pico editor clone with enhancements
URL             : http://www.nano-editor.org/
License         : GPL
Description     : GNU nano is a small and friendly text editor.  It aims to emulate the
                : Pico text editor while also offering a few enhancements.
Vendor          : <NULL>

Testing on Fedora Rawhide Image:

I tried the same steps in the Fedora Rawhide container created using docker run --platform linux/amd64 -it registry.fedoraproject.org/fedora:rawhide /bin/bash with the same artifactory.repo configuration. Installation was successful, but the upgrade failed with a ‘no digest’ error.

Installation Logs:

bash-5.2# yum clean all
Removed 0 files, 1 directories. 0 errors occurred.
bash-5.2# yum install -y nano-1.3.12
Updating and loading repositories:
Artifactory                                                                                                                                                                                                                            100% |   2.3 KiB/s |   1.9 KiB |  00m01s
Repositories loaded.
Package                                                                                       Arch                Version                                                                                       Repository                                                  Size
Installing:
nano                                                                                         x86_64              1.3.12-1.1                                                                                    Artifactory                                            674.1 KiB
Transaction Summary:
Installing:         1 package
Total size of inbound packages is 244 KiB. Need to download 244 KiB.
After this operation, 674 KiB extra will be used (install 674 KiB, remove 0 B).
[1/1] nano-0:1.3.12-1.1.x86_64                                                                                                                                                                                                          100% | 232.8 KiB/s | 244.4 KiB |  00m01s
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[1/1] Total                                                                                                                                                                                                                             100% | 231.9 KiB/s | 244.4 KiB |  00m01s
Running transaction
[1/3] Verify package files                                                                                                                                                                                                              100% |   1.0 KiB/s |   1.0   B |  00m00s
[2/3] Prepare transaction                                                                                                                                                                                                               100% | 125.0   B/s |   1.0   B |  00m00s
[3/3] Installing nano-0:1.3.12-1.1.x86_64                                                                                                                                                                                               100% |  12.1 MiB/s | 679.2 KiB |  00m00s
Warning: skipped OpenPGP checks for 1 package from repository: Artifactory
Complete!

Upgrade Logs:

bash-5.2# yum clean all
Removed 3 files, 4 directories. 0 errors occurred.
bash-5.2# yum -y update
Updating and loading repositories:
Artifactory                                                                                                                                                                                                                            100% |   4.1 KiB/s |   1.9 KiB |  00m00s
Repositories loaded.
Package                                                                                       Arch                Version                                                                                       Repository                                                  Size
Upgrading:
nano                                                                                         x86_64              2.0.9-1                                                                                       Artifactory                                              1.5 MiB
   replacing nano                                                                             x86_64              1.3.12-1.1                                                                                    Artifactory                                            674.1 KiB
Transaction Summary:
Upgrading:          1 package
Replacing:          1 package
Total size of inbound packages is 582 KiB. Need to download 582 KiB.
After this operation, 891 KiB extra will be used (install 2 MiB, remove 674 KiB).
[1/1] nano-0:2.0.9-1.x86_64                                                                                                                                                                                                             100% |   1.0 MiB/s | 581.6 KiB |  00m01s
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[1/1] Total                                                                                                                                                                                                                             100% | 995.9 KiB/s | 581.6 KiB |  00m01s
Running transaction
Transaction failed: Rpm transaction failed.
Warning: skipped OpenPGP checks for 1 package from repository: Artifactory
  - package nano-2.0.9-1.x86_64 does not verify: no digest

The upgrade failed due to an RPM transaction error.

Observations:

The RPM version in Fedora 42 is 4.20.1, while Fedora Rawhide has upgraded to 5.99.90. This version difference might be contributing to the issue.

bash-5.2# rpm --version
RPM version 5.99.90

Please advise on how to fix this issue.

Thank you!

1 Like

Rpm 6 no longer verifies obsolete crypto by default, see rpm.org - Releases

The issue here is that the “nano” package appears ancient and built with rpm < 4.14 so it only has MD5 and SHA1 digests.

1 Like