buildah pull registry.access.redhat.com/ubi9-beta/ubi:latest fails on FC35 and rhel-9-beta

[mh21]

Description

On both rhel-9-beta and FC35, buildah pull registry.access.redhat.com/ubi9-beta/ubi:latest gives the following error:

Source image rejected: None of the signatures were accepted, reasons: Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"938A80CAF21541EB", Status:gpgme.Error{err:0x9}, Timestamp:time.Time{wall:0x0, ext:63771440989, loc:(*time.Location)(0x559eed793140)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x559eed793140)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}; Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"938A80CAF21541EB", Status:gpgme.Error{err:0x9}, Timestamp:time.Time{wall:0x0, ext:63771440989, loc:(*time.Location)(0x559eed793140)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x559eed793140)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}; Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"938A80CAF21541EB", Status:gpgme.Error{err:0x9}, Timestamp:time.Time{wall:0x0, ext:63771440990, loc:(*time.Location)(0x559eed793140)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x559eed793140)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}; Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"938A80CAF21541EB", Status:gpgme.Error{err:0x9}, Timestamp:time.Time{wall:0x0, ext:63771440991, loc:(*time.Location)(0x559eed793140)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x559eed793140)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}; Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"938A80CAF21541EB", Status:gpgme.Error{err:0x9}, Timestamp:time.Time{wall:0x0, ext:63771440991, loc:(*time.Location)(0x559eed793140)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x559eed793140)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}; Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"938A80CAF21541EB", Status:gpgme.Error{err:0x9}, Timestamp:time.Time{wall:0x0, ext:63771440992, loc:(*time.Location)(0x559eed793140)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x559eed793140)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}

This seems to be the specific combination of buildah version and ubi9 image:

• works on FC34
• works when using docker/moby on FC35
• works for other container images

Steps to reproduce the issue:

1. podman run --rm -it registry.fedoraproject.org/fedora:35
2. dnf install buildah
3. buildah pull registry.access.redhat.com/ubi9-beta/ubi:latest

$ rpm -q buildah
buildah-1.23.1-1.fc35.x86_64

$ buildah version
Version:         1.23.1
Go Version:      go1.16.8
Image Spec:      1.0.1-dev
Runtime Spec:    1.0.2-dev
CNI Spec:        0.4.0
libcni Version:  v0.8.1
image Version:   5.16.0
Git Commit:      
Built:           Tue Sep 28 18:26:37 2021
OS/Arch:         linux/amd64
BuildPlatform:   linux/amd64

Output of cat /etc/*release:

For FC35:

$ cat /etc/*-release
Fedora release 35 (Thirty Five)
NAME="Fedora Linux"
VERSION="35 (Container Image)"
ID=fedora
VERSION_ID=35
VERSION_CODENAME=""
PLATFORM_ID="platform:f35"
PRETTY_NAME="Fedora Linux 35 (Container Image)"
ANSI_COLOR="0;38;2;60;110;180"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:35"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f35/system-administrators-guide/"
SUPPORT_URL="https://ask.fedoraproject.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=35
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=35
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
VARIANT="Container Image"
VARIANT_ID=container
Fedora release 35 (Thirty Five)
Fedora release 35 (Thirty Five)

For rhel-9-beta:

$ cat /etc/redhat-release 
Red Hat Enterprise Linux release 9.0 Beta (Plow)

[mh21]

Closing as this is documented in the RHEL 9 beta release notes.