Hi All,
I am from the Artifactory Team, and we usually validate Fedora images to ensure compliance with the latest changes. Recently, I observed an issue during our validation.
Test Case
The test case involves enabling the repo_gpgcheck flag and installing a package from Artifactory. The steps are as follows:
yum update -y && yum install -y curl info && dnf install -y --skip-broken dnf-utils libxcrypt-compat gzipyum update -y dnf-data && rm -rf /etc/yum.repos.d/ fedora*- Create a local repo & upload the package
- Assign the GPG key to the Artifactory local repo
- Create the directory:
mkdir -p /etc/yum.repos.d - Configure the Artifactory local repo using
vi /etc/yum.repos.d/artifactory.repo - Install the package:
yum install -y vche
Contents of artifactory.repo File
[Artifactory]
name=Artifactory
baseurl=https://admin:<access token>@jfrtpit7x325595.jfrogdev.org/artifactory/local-yum-6887-1
enabled=1
gpgcheck=0
gpgkey=https://admin:<access token>@jfrtpit7x325595.jfrogdev.org/artifactory/local-yum-6887-1/repodata/repomd.xml.key
repo_gpgcheck=1
In fedora:latest Image i.e. fedora 42, It is throwing a warning but working fine
[root@55ed4332a011 /]# yum install -y vche
Updating and loading repositories:
Artifactory 100% | 3.4 KiB/s | 1.8 KiB | 00m01s
>>> Librepo error: repomd.xml GPG signature verification error: Signing key not found
https://admin:<access token>@jfrtpit7x325595.jfrogdev.org/artifactory/local-yum-6887-1/repodata/repomd.xml.key 100% | 9.5 KiB/s | 3.1 KiB | 00m00s
Importing OpenPGP key 0x6DAB06A8:
UserID : "<User ID> "
Fingerprint: 70686988C60593A83B5FF099C410CAAE6DAB06A8
From : https://admin:<access token>@jfrtpit7x325595.jfrogdev.org/artifactory/local-yum-6887-1/repodata/repomd.xml.key
The key was successfully imported.
Artifactory 100% | 2.9 KiB/s | 2.7 KiB | 00m01s
Repositories loaded.
Package Arch Version Repository Size
Installing:
vche x86_64 1.7.2-1.el5.rf Artifactory 159.7 KiB
Transaction Summary:
Installing: 1 package
Total size of inbound packages is 63 KiB. Need to download 63 KiB.
After this operation, 160 KiB extra will be used (install 160 KiB, remove 0 B).
[1/1] vche-0:1.7.2-1.el5.rf.x86_64 100% | 154.7 KiB/s | 63.4 KiB | 00m00s
[1/1] Total 100% | 153.6 KiB/s | 63.4 KiB | 00m00s
Running transaction
[1/3] Verify package files 100% | 0.0 B/s | 1.0 B | 00m00s
[2/3] Prepare transaction 100% | 76.0 B/s | 1.0 B | 00m00s
[3/3] Installing vche-0:1.7.2-1.el5.rf.x86_64 100% | 3.2 MiB/s | 162.0 KiB | 00m00s
Warning: skipped OpenPGP checks for 1 package from repository: Artifactory
Complete!
but in rawhide image from “registry.fedoraproject.org/fedora:rawhide” , It is failing with this error
bash-5.2# yum install -y vche
Updating and loading repositories:
Artifactory-Local 100% | 3.7 KiB/s | 1.8 KiB | 00m00s
>>> repomd.xml GPG signature verification error: Signing key not found
Repositories loaded.
Failed to resolve the transaction:
No match for argument: vche
You can try to add to command line:
--skip-unavailable to skip unavailable packages
Please note that I used the same artifactory.repo configuration in Rawhide, and it is not working. This scenario passed in the Rawhide image yesterday morning (25th June), but we observed this issue in today’s nightly run.
Please let me know how to resolve this issue