Before I upgraded my Fedora 43 to Fedora 44 Zoom repo configured according to these instructions in Fedora Documentation worked properly. But in Fedora 44 the signature key of Zoom RPM repository isn’t recognized.
According to the following Zoom’s site there two versions of the key - for versions below 6.7.5 and for versions 6.7.5 and higher: https://zoom.us/download?os=linux
The Zoom installation instructions in the Fedora Documentation still use the old key. I tried both versions but all are incorrect:
$ sudo rpmkeys --import https://zoom.us/linux/download/pubkey?version=6-3-10
warning: Certificate DDE0E6222047091F:
Certificate does not have any usable signing keys
$ sudo rpmkeys --import https://zoom.us/linux/download/pubkey?version=6-7-5
warning: Certificate 4F2197399706AC24:
Certificate does not have any usable signing keys
$ sudo rpmkeys --import https://zoom.us/linux/download/pubkey
warning: Certificate 4F2197399706AC24:
Certificate does not have any usable signing keys
The key file is a little bit different but the key itself seems to be the same, at least its certificate id:
$ sudo rpmkeys --import https://repo.zoom.us/repo/rpm/release/repodata/repomd.xml.key
warning: Certificate 4F2197399706AC24:
Certificate does not have any usable signing keys
Could someone explain what happened and how should this be fixed properly? Should Zoom update their public key or should Fedora 44 be changed somehow to accept Zoom’s current public key of their RPM repo?
In general, I found zoom’s flatpak to work reliably on Fedora and be better isolated.
For the rpm key: Have you tried removing it (rpmkeys -e) and then importing it again? There is or was a bug where rpm would not update an existing key with new signatures, so it’s possible your copy of the key has expired signatures only.
Very well! So somebody will report this issue to Zoom eventually and ask them to regenerate signing key properly. I’m unable to do so because support of Zoom is a useless disaster with a completely useless AI chat that can’t create an issue report or do anything helpful besides talking. Either I can’t do it manually by myself because I use a free account without any rights. And I need Zoom just for interviews. I would prefer that Zoom Communications goes bankrupt and all people stop using this bloatware application, just like everybody already stopped using Skype.
Well, I hope you have Zoom installed now so you can use it.
You can pin rpm-sequoia with dnf versionlock if you want/need to. Or just don’t forget that you had to downgrade to install it. I guess you can also disable the gpg options for the Zoom repository (and remove the Zoom gpg key).
I have reported my findings to the e-mail on the key, but I don’t expect to hear anything back from them or even a reply asking for more details or questions. That just isn’t Zoom these days. And to be honest, I don’t think they really care about Linux. There use to be a time when they did, but that’s been a long time ago… Heck, they may like that it’s broken on Linux distros using the new RPM gpg back-end. The goal: get rid of Zoom Linux users.
I suspect that this will be an issue with many 3rd party repos. Many (most?) of the 3rd party gpg keys I have inspected over the years aren’t/weren’t created correctly. It seems there is a real “issue” with 3rd party repos and gpg keys. They can package correctly, but they can’t sign stuff correctly. (IMHO)
Yes it was always installable from the manually download RPM file. I just wanted to use RPM repo to get Zoom updates automatically, together with other Fedora updates.
I’ve been back-and-forth with Zoom’s technical support on this and they finally provided an answer. According to them, “the issue is caused by a cached repository-specific key [and] removing the key with rpmkeys does not clear this separate repository keyring” because “Zoom recently updated the published OpenPGP certificate used by the Linux RPM repository [and] the previous certificate did not explicitly mark the primary key as signing-capable, which can cause newer versions of rpm-sequoia to reject the repository metadata signature with the “invalid: not signing capable” error.”
Their solution was to force some of those changes via a script because the initial single-line command they sent me errored out; here’s the body of the script:
#!/bin/bash
set -euo pipefail
suffix="$(date +%Y%m%d%H%M%S).$$"
base_pattern="/var/cache/libdnf5/zoom-release-*/pubring"
shopt -s nullglob
pubring_dirs=(/var/cache/libdnf5/zoom-release-*/pubring)
shopt -u nullglob
if [ "${#pubring_dirs[@]}" -eq 0 ]; then
echo "No pubring directories matched: $base_pattern"
exit 0
fi
echo "Using backup suffix: $suffix"
for dir in "${pubring_dirs[@]}"; do
[ -d "$dir" ] || continue
backup_path="$dir.backup.$suffix"
echo "Backing up: $dir -> $backup_path"
mv -- "$dir" "$backup_path"
done
echo "Backup completed."
After executing that script, everything’s back to normal.
Thanks for sharing this information. Your message and the script helped me to find even a simpler solution. In addition to removing the previously imported key I removed the whole /var/cache/libdnf5/zoom-release-fbd352f5231b2f51 directory. Then I imported Zoom’s public key again:
I compared the old and new 4F2197399706AC24.pub using sq inspect 4F2197399706AC24.pub . It shows that they added the the certification and signing flags to it.
