Describe the bug
The AL2027 container images (standard and minimal) ship the Amazon Linux GPG public key at /etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2027 but do not import it into the RPM database.
Package signature checking is still enforced. All repositories set gpgcheck=1 and point at the shipped key file, so dnf imports the key on first use and verifies every package it installs. The visible effects:
- Interactive
dnf prompts once to import the key (Is this ok [y/N]). It is safe to accept: the fingerprint dnf shows matches the key file shipped in the image.
- Security scanners that check the RPM database for imported GPG keys flag the images, because the database has none.
- Non-interactive installs, such as
RUN dnf -y install ... in Dockerfiles and CI, work unchanged.
Affected images (both release 2027.0.20260903):
public.ecr.aws/amazonlinux/amazonlinux:2027public.ecr.aws/amazonlinux/amazonlinux:2027-minimal
To Reproduce
Steps to reproduce the behavior:
- Run
docker run --rm public.ecr.aws/amazonlinux/amazonlinux:2027 rpm -qa gpg-pubkey. It prints nothing.
- Run
docker run --rm public.ecr.aws/amazonlinux/amazonlinux:2027-minimal rpm -qa gpg-pubkey. It prints nothing.
- Compare with AL2023:
docker run --rm public.ecr.aws/amazonlinux/amazonlinux:2023 rpm -qa gpg-pubkey prints gpg-pubkey-d832c631-6515c85e.
Expected behavior
The Amazon Linux GPG key is imported into the RPM database at image build time, as in AL2 and AL2023 container images: rpm -qa gpg-pubkey on a fresh container lists the key.
Additional context
Workaround: import the shipped key before installing packages. This removes the prompt and makes the key visible to scanners. It works offline because the key is already in the image, at the same path in both images:
FROM public.ecr.aws/amazonlinux/amazonlinux:2027
RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2027
Verify:
$ rpmkeys --list
37ce7c3833e5a33c4a1e4b0d5408eaa4b1e92e3d Amazon Linux amazon-linux@amazon.com public key
Note for scanning tools: AL2027 uses RPM 6, which stores imported keys under the full 40-character fingerprint:
gpg-pubkey-37ce7c3833e5a33c4a1e4b0d5408eaa4b1e92e3d-693a0f48
AL2 and AL2023 use the short 8-character key ID (gpg-pubkey-c87f5b1a-593863f8, gpg-pubkey-d832c631-6515c85e). Tools that parse gpg-pubkey-<8 hex chars>-... need updating for AL2027. rpmkeys --list works on both formats.
Fix: we will update the image build to import the key into the RPM database, matching AL2 and AL2023. This issue will be updated when a fixed image is published.
Describe the bug
The AL2027 container images (standard and minimal) ship the Amazon Linux GPG public key at
/etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2027but do not import it into the RPM database.Package signature checking is still enforced. All repositories set
gpgcheck=1and point at the shipped key file, sodnfimports the key on first use and verifies every package it installs. The visible effects:dnfprompts once to import the key (Is this ok [y/N]). It is safe to accept: the fingerprint dnf shows matches the key file shipped in the image.RUN dnf -y install ...in Dockerfiles and CI, work unchanged.Affected images (both release 2027.0.20260903):
public.ecr.aws/amazonlinux/amazonlinux:2027public.ecr.aws/amazonlinux/amazonlinux:2027-minimalTo Reproduce
Steps to reproduce the behavior:
docker run --rm public.ecr.aws/amazonlinux/amazonlinux:2027 rpm -qa gpg-pubkey. It prints nothing.docker run --rm public.ecr.aws/amazonlinux/amazonlinux:2027-minimal rpm -qa gpg-pubkey. It prints nothing.docker run --rm public.ecr.aws/amazonlinux/amazonlinux:2023 rpm -qa gpg-pubkeyprintsgpg-pubkey-d832c631-6515c85e.Expected behavior
The Amazon Linux GPG key is imported into the RPM database at image build time, as in AL2 and AL2023 container images:
rpm -qa gpg-pubkeyon a fresh container lists the key.Additional context
Workaround: import the shipped key before installing packages. This removes the prompt and makes the key visible to scanners. It works offline because the key is already in the image, at the same path in both images:
Verify:
Note for scanning tools: AL2027 uses RPM 6, which stores imported keys under the full 40-character fingerprint:
AL2 and AL2023 use the short 8-character key ID (
gpg-pubkey-c87f5b1a-593863f8,gpg-pubkey-d832c631-6515c85e). Tools that parsegpg-pubkey-<8 hex chars>-...need updating for AL2027.rpmkeys --listworks on both formats.Fix: we will update the image build to import the key into the RPM database, matching AL2 and AL2023. This issue will be updated when a fixed image is published.