Description of problem: I have added https://dl.google.com/linux/chrome/rpm/stable/x86_64 as a custom medium in mcc (configure media sources for install and update). I have also downloaded and installed the package signing key using wget https://dl.google.com/linux/linux_signing_key.pub and as root rpm --import linux_signing_key.pub To make urpmi aware of the key(s) I've added them in mcc->configure media->manage keys and they are present in /etc/urpmi/urpmi.cfg. If I now try to install google-chrome (via command -line or gui) urpmi complains about an invalid key: urpmi google-chrome-stable The following package has bad signature: /var/cache/urpmi/rpms/google-chrome-stable-115.0.5790.170-1.x86_64.rpm: Invalid Key ID (OK (RSA/SHA512, Di 01 Aug 2023 20:23:56 CEST, Key ID 4eb27db2a3b88b8b)) However, if I check the package with: rpm --verbose --checksig -v google-chrome-stable-115.0.5790.170-1.x86_64.rpm everything is ok: D: loading keyring from rpmdb D: PRAGMA secure_delete = OFF: 0 D: PRAGMA case_sensitive_like = ON: 0 D: read h# 1 Header SHA256 digest: OK Header SHA1 digest: OK D: added key gpg-pubkey-80420f66-4d4fe123 to keyring D: read h# 2296 Header SHA256 digest: OK Header SHA1 digest: OK D: added key gpg-pubkey-7fac5991-45f06f46 to keyring D: read h# 2297 Header SHA256 digest: OK Header SHA1 digest: OK D: added key gpg-pubkey-d38b4796-570c8cd3 to keyring D: added subkey 0 of main key gpg-pubkey-d38b4796-570c8cd3 to keyring D: added subkey 1 of main key gpg-pubkey-d38b4796-570c8cd3 to keyring D: added subkey 2 of main key gpg-pubkey-d38b4796-570c8cd3 to keyring D: added subkey 3 of main key gpg-pubkey-d38b4796-570c8cd3 to keyring D: added subkey 4 of main key gpg-pubkey-d38b4796-570c8cd3 to keyring google-chrome-stable-115.0.5790.170-1.x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID a3b88b8b: OK Header SHA256 digest: OK Header SHA1 digest: OK Payload SHA256 digest: OK V4 RSA/SHA512 Signature, key ID a3b88b8b: OK MD5 digest: OK Version-Release number of selected component (if applicable): urpmi 8.131 The google-chrome-stable package is signed with a subkey of the signing key. My guess is therefore that urpmi cannot handle the subkey correctly. How reproducible: Every time when installing or updating google-chrome-stable from https://dl.google.com/linux/chrome/rpm/stable/x86_64 Steps to Reproduce: 1.Add https://dl.google.com/linux/chrome/rpm/stable/x86_64 as custom medium 2.Import and install signing keys 3.Add the keys to /etc/urpmi/urpmi.cfg 4.Try to install google-chrome-stable via urpmi
Also discussed at https://bugs.chromium.org/p/chromium/issues/detail?id=1456806 Workaround is to skip signature verification during the package install ... rpm -i --nosignature google-chrome-stable_current_x86_64.rpm
Source RPM: (none) => urpmi-8.131-1.mga9.src.rpmAssignee: bugsquad => thierry.vignaudCC: (none) => davidwhodgins
*** Bug 32405 has been marked as a duplicate of this bug. ***
CC: (none) => surfzoid
(In reply to Dave Hodgins from comment #1) > Also discussed at > https://bugs.chromium.org/p/chromium/issues/detail?id=1456806 > > Workaround is to skip signature verification during the package install ... > > rpm -i --nosignature google-chrome-stable_current_x86_64.rpm No, most user, use graphical not terminal.
CC: (none) => anaselli
According to: gpg2 --keyid-format=long --list-options show-unusable-subkeys --list-keys d38b4796 pub rsa4096/7721F63BD38B4796 2016-04-12 [SC] EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796 uid [ sconosciuto] Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> sub rsa4096/1397BC53640DB551 2016-04-12 [S] [scaduto: 2019-04-12] sub rsa4096/6494C6D6997C215E 2017-01-24 [S] [scaduto: 2020-01-24] sub rsa4096/78BD65473CB3BD13 2019-07-22 [S] [scaduto: 2022-07-21] sub rsa4096/4EB27DB2A3B88B8B 2021-10-26 [S] [scadenza: 2024-10-25] sub rsa4096/E88979FB9B30ACF2 2023-02-15 [S] [scadenza: 2026-02-14] if you add to /etc/urpmi/urpmi.cfg subkeys a3b88b8b and 9b30acf2 should work at least until they expire or google revoke them. At the moment i have a patch that we are testing that uses rpmkeys as dnf does. An alternative way could be extracting those keys in the repository key management and add them to urpmi.cfg.
(In reply to Angelo Naselli from comment #4) > According to: > gpg2 --keyid-format=long --list-options show-unusable-subkeys --list-keys > d38b4796 > pub rsa4096/7721F63BD38B4796 2016-04-12 [SC] > EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796 > uid [ sconosciuto] Google Inc. (Linux Packages Signing > Authority) <linux-packages-keymaster@google.com> > sub rsa4096/1397BC53640DB551 2016-04-12 [S] [scaduto: 2019-04-12] > sub rsa4096/6494C6D6997C215E 2017-01-24 [S] [scaduto: 2020-01-24] > sub rsa4096/78BD65473CB3BD13 2019-07-22 [S] [scaduto: 2022-07-21] > sub rsa4096/4EB27DB2A3B88B8B 2021-10-26 [S] [scadenza: 2024-10-25] > sub rsa4096/E88979FB9B30ACF2 2023-02-15 [S] [scadenza: 2026-02-14] > > if you add to /etc/urpmi/urpmi.cfg subkeys a3b88b8b and 9b30acf2 should work > at least until they expire or google revoke them. > > At the moment i have a patch that we are testing that uses rpmkeys as dnf > does. > > An alternative way could be extracting those keys in the repository key > management and add them to urpmi.cfg. Do you mean: Google\ Miroir\ 64bit http://dl.google.com/linux/rpm/stable/x86_64 { key-ids: d38b4796 subkeys: a3b88b8b
I don't think subkyes is managed, I meant something like this: google-chrome http://dl.google.com/linux/chrome/rpm/stable/x86_64 { key-ids: 7fac5991,d38b4796,a3b88b8b,9b30acf2 update }
(In reply to Angelo Naselli from comment #6) > I don't think subkyes is managed, I meant something like this: > > google-chrome http://dl.google.com/linux/chrome/rpm/stable/x86_64 { > key-ids: 7fac5991,d38b4796,a3b88b8b,9b30acf2 > update > } Yes, as slightly different entry in urpmi.cfg works for me: Google\ Chrome http://dl.google.com/linux/chrome/rpm/stable/x86_64 { key-ids: 7fac5991,d38b4796,a3b88b8b,9b30acf2 update } No more complaints about bad package signatures when updating Google Chrome :-) Thank you for the workaround. Funnily if I check now the installed keys for the installation medium "Google Chrome" in mcc->configure media->manage keys I see a (wrong) warning for the subkeys I've added in urpmi.cfg that they do not exist in the rpm keyring...