On Thu, Nov 2, 2023 at 1:33 PM Brian C. Lane <bcl@redhat.com> wrote:

I think we should:

 * Switch the default local gpg check to true
  - this removes surprise when you learn you've been installing
    unchecked software for ... years? If they want it, it can be set
    back to false by the user.

 * Don't apply the local flag to rpms downloaded from a url by dnf.
   Treat them as if they came from a repo.
  - users (or me) don't know all the internal paths inside dnf, the
    expectation is that a url isn't a local file.

This seems like a reasonable default. Does it also make sense to add some CLI UI niceties that:

* Let's the user know this check may be skipped with "--nogpgcheck" with a brief explanation of the risk
* Allow the user to continue the transaction with only the specific package not being checked, default no

--
Jonathan Steffan