V Tue, Nov 14, 2023 at 08:16:39AM -0500, Christopher napsal(a):
On Tue, Nov 14, 2023 at 8:03 AM Jaroslav Mracek jmracek@redhat.com wrote:
I believe that one of the strong complains was related to not signed packages. The use case is that when I build RPMs locally and then I install them (see bellow).
dnf install *.rpm --setopt=localpkg_gpgcheck=true ... Package dnf-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package dnf-automatic-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package dnf-data-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package python3-dnf-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package yum-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Error: GPG check FAILED
Jaroslav
I think for the sake of security, it'd be better if this were on by default, and you just had to specify the --nogpgcheck
Technical note: --nogpgcheck does not imply localpkg_gpgcheck=false. Both of them operate independently. That's another painful property of the current code and documentation.
-- Petr