Fedora 38 rpm policy violation #479
Comments
lah7
added
support
|
Polychromatic shares the OBS repository with OpenRazer. Other users had this problem too: openrazer/openrazer#2061 Apparently, Fedora 38 tightened some security policies affecting third party repos with the upgrade. One comment suggests to uninstall the Take a look at openrazer/openrazer#2061 and let us know the result. |
|
Everything I tried didn't work. I did everything on a clean fedora install. Here is my Ansible task: ---
- name: Get main user[1000] name
ansible.builtin.command: "id -un 1000"
register: user_name
changed_when: false
- name: Create plugdev group
ansible.builtin.group:
name: plugdev
state: present
- name: Add main user[1000] to plugdev
ansible.builtin.user:
name: "{{ user_name.stdout }}"
uid: 1000
group: plugdev
- name: Install kernel-devel
ansible.builtin.dnf:
name: kernel-devel
state: latest
- name: Add razer gpgkey
ansible.builtin.rpm_key:
state: present
key: https://download.opensuse.org/repositories/hardware:/razer/Fedora_{{ ansible_distribution_major_version }}/repodata/repomd.xml.key
- name: Add Razer repository
ansible.builtin.yum_repository:
name: razer
description: razer
baseurl: https://download.opensuse.org/repositories/hardware:razer/Fedora_{{ ansible_distribution_major_version }}/hardware:razer.repo
file: razer
gpgkey: https://download.opensuse.org/repositories/hardware:/razer/Fedora_{{ ansible_distribution_major_version }}/repodata/repomd.xml.key
gpgcheck: true
- name: Install openrazer-meta
ansible.builtin.dnf:
name: openrazer-meta
state: latest
# https://github.com/polychromatic/polychromatic/issues/479
- name: Install polychromatic
ansible.builtin.dnf:
name: polychromatic
state: latest
|
|
Sorry for the delay, my motherboard needed replacement ☠️ It seems the repository URL had changed. I got 404 for the old URL. -https://download.opensuse.org/repositories/hardware:razer/Fedora_$(rpm -E %fedora)/hardware:razer.repo
+https://download.opensuse.org/repositories/hardware:/razer/Fedora_$(rpm -E %fedora)/hardware:razer.repo
^In a clean Fedora 38 container, I was able to successfully add the repository with this corrected URL. I've updated the instructions on the website. Does this work if you update the |
|
Booth URLs returned the same repo, so nothing changed -https://download.opensuse.org/repositories/hardware:razer/Fedora_$(rpm -E %fedora)/hardware:razer.repo
+https://download.opensuse.org/repositories/hardware:/razer/Fedora_$(rpm -E %fedora)/hardware:razer.repo
^ |
I'm testing it in a clean Fedora 38 VM |
|
Looks like openSUSE Build Service quietly fixed the old URL, so that's no problem now. Apologies, I can reproduce the same error now. I wrongly assumed RPM behaved like Debian in that the keys would be imported at the time of adding the repository, not after downloading packages... Well that's really annoying. I tried a combination of things I could find around the web: [1] No go. All I know is that Fedora 38 doesn't accept SHA-1 signed packages. Being completely unfamiliar with RPM, I don't know how to delete old GPG keys or how to fix it either. It could be the key itself, but this repository is managed by openSUSE Build Service. Like, why doesn't this work!? That's all I know for now. If any one knows a solution, please let us know! |
This comment was marked as off-topic.
This comment was marked as off-topic.
If the key is present on the system, the --nogpgcheck will still fail. To me, I had to first delete the key (rpm -e gpg-pubkey-d6d11ce4-5418547d), then run |
|
Thanks @guidugli for the tip. This worked in a Fedora 38 Docker container: sudo dnf install 'dnf-command(config-manager)' # might only needed for the container
sudo dnf config-manager --add-repo https://download.opensuse.org/repositories/hardware:/razer/Fedora_$(rpm -E %fedora)/hardware:razer.repo
sudo rpm -e gpg-pubkey-d6d11ce4-5418547d
sudo dnf install --nogpgcheck polychromaticAt least it's a workaround that allows the software to be installed until the managed repository key gets updated, or the security policy on the system can allow the older mechanism (SHA-1) like in Fedora 37. Kind of ironic the strictness of the new security policy ends up resulting in weak security for this third party repository, for now anyway. That said, I have no idea how this will work for the OP's Ansible, hopefully there are config values that allow for it. |
|
This worked fine for me outside a Docker container. Thank you so much! |
|
How do you know the key to be erased? I tried that command but it still doesn't work. |
|
Not a Fedora user. From what I found, this lists something related to keys: This is the current key for our repository: -- https://www.redhat.com/sysadmin/rpm-gpg-verify-packages I tried again with a fresh Fedora 38 container, it seems to be able to install the package normally now. Maybe the recent v0.8.2 release triggered something relating to the key. It's all managed by OpenSUSE Build Service. This works for me, in a clean container: |
Seems like Fedora 38 accepts the key and can be installed normally. See also: polychromatic/polychromatic#479
|
@lah7 Thanks I get this output (apologies for the verbosity): same without |
|
Thankfully, it's a different error to the original issue. Your system just has an old copy of the key, which has an expiry date. After deleting the key, maybe you need to re-add the repository and run This looks like it describes the problem and should help: |
|
@lah7 It worked! Thanks a lot. |
|
It's all good! Marking issue as completed as the "No binding signature" issue was fixed last month for Fedora 38: |
Details about the problem
Operating System / Desktop Environment / Version(s)
Fedora 38
Affected Devices
The text was updated successfully, but these errors were encountered: