Wrong GPG key is populated in DNF/YUM repo file

[mihai-preda]

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 8.10.0
• Ruby: 3.2.5 /opt/puppetlabs/puppet/bin/ruby
• Distribution: Oracle Linux 9
• Module version: 10.0.0'

How to reproduce (e.g Puppet code you use)

class profile::zabbix {
class { 'zabbix::web':
manage_repo => true,
zabbix_version => '7.0',
}

What are you seeing

In '/etc/yum.repos.d/Zabbix9.repo', the GPG key listed is:
"https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD"
Which is incorrect for Zabbix v7.0.
The OS fails to upgrade Zabbix Server, Zabbix Agent, etc. Because of incorrect GPG key.

What behaviour did you expect instead

For the packages to be upgraded to version 7.0

Output log

Upgrading:
zabbix-agent x86_64 7.0.7-release1.el9 Zabbix_9_x86_64 615 k
zabbix-server-mysql x86_64 7.0.7-release1.el9 Zabbix_9_x86_64 2.3 M
zabbix-sql-scripts noarch 7.0.7-release1.el9 Zabbix_9_x86_64 7.2 M
zabbix-web noarch 7.0.7-release1.el9 Zabbix_9_x86_64 8.3 M
zabbix-web-deps noarch 7.0.7-release1.el9 Zabbix_9_x86_64 12 k
zabbix-web-mysql noarch 7.0.7-release1.el9 Zabbix_9_x86_64 11 k

Transaction Summary

Upgrade 6 Packages

Total download size: 18 M
Is this ok [y/N]: y
Downloading Packages:
(1/6): zabbix-agent-7.0.7-release1.el9.x86_64.rpm 225 kB/s | 615 kB 00:02
(2/6): zabbix-sql-scripts-7.0.7-release1.el9.noarch.rpm 2.5 MB/s | 7.2 MB 00:02
(3/6): zabbix-server-mysql-7.0.7-release1.el9.x86_64.rpm 804 kB/s | 2.3 MB 00:02
(4/6): zabbix-web-deps-7.0.7-release1.el9.noarch.rpm 116 kB/s | 12 kB 00:00
(5/6): zabbix-web-mysql-7.0.7-release1.el9.noarch.rpm 112 kB/s | 11 kB 00:00
(6/6): zabbix-web-7.0.7-release1.el9.noarch.rpm 19 MB/s | 8.3 MB 00:00

Total 5.8 MB/s | 18 MB 00:03
Zabbix_9_x86_64 1.4 kB/s | 3.1 kB 00:02
GPG key at https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD (0x08EFA7DD) is already installed
The GPG keys listed for the "Zabbix_9_x86_64" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: zabbix-agent-7.0.7-release1.el9.x86_64
GPG Keys are configured as: https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD
Public key for zabbix-server-mysql-7.0.7-release1.el9.x86_64.rpm is not installed. Failing package is: zabbix-server-mysql-7.0.7-release1.el9.x86_64
GPG Keys are configured as: https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD
Public key for zabbix-sql-scripts-7.0.7-release1.el9.noarch.rpm is not installed. Failing package is: zabbix-sql-scripts-7.0.7-release1.el9.noarch
GPG Keys are configured as: https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD
Public key for zabbix-web-7.0.7-release1.el9.noarch.rpm is not installed. Failing package is: zabbix-web-7.0.7-release1.el9.noarch
GPG Keys are configured as: https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD
Public key for zabbix-web-deps-7.0.7-release1.el9.noarch.rpm is not installed. Failing package is: zabbix-web-deps-7.0.7-release1.el9.noarch
GPG Keys are configured as: https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD
Public key for zabbix-web-mysql-7.0.7-release1.el9.noarch.rpm is not installed. Failing package is: zabbix-web-mysql-7.0.7-release1.el9.noarch
GPG Keys are configured as: https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-08EFA7DD
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

Any additional information you'd like to impart

When installing Zabbix "latest" manually from "https://repo.zabbix.com/zabbix/7.0/rhel/9/x86_64/zabbix-release-latest-7.0.el9.noarch.rpm", the GPG key in "/etc/yum.repos.d/zabbix.repo" is pointing to: "gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-B5333005"

[anthonysomerset]

it looks like the main repo for EL9 is now also signed by https://repo.zabbix.com/RPM-GPG-KEY-ZABBIX-B5333005 - not just the nonsupported repo

[anthonysomerset]

this appears to be fixed in v11.0.0 of the module