On Tue, Nov 14, 2023 at 8:03 AM Jaroslav Mracek jmracek@redhat.com wrote:
I believe that one of the strong complains was related to not signed packages. The use case is that when I build RPMs locally and then I install them (see bellow).
dnf install *.rpm --setopt=localpkg_gpgcheck=true ... Package dnf-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package dnf-automatic-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package dnf-data-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package python3-dnf-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Package yum-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed Error: GPG check FAILED
Jaroslav
I think for the sake of security, it'd be better if this were on by default, and you just had to specify the --nogpgcheck For convenience, the error message should probably say "Error: GPG check FAILED (try again with '--nogpgcheck' to ignore)" I don't think this use case is so important that everybody's security should be lowered to avoid the minor inconvenience of passing a simple flag.