On Tue, Nov 14 2023 at 08:16:39 AM -0500, Christopher ctubbsii@fedoraproject.org wrote:
I think for the sake of security, it'd be better if this were on by default, and you just had to specify the --nogpgcheck For convenience, the error message should probably say "Error: GPG check FAILED (try again with '--nogpgcheck' to ignore)" I don't think this use case is so important that everybody's security should be lowered to avoid the minor inconvenience of passing a simple flag.
Thing is, when manually installing RPMs that don't come from a repository, 98% of the time they are not expected to be signed by a GPG key that you have installed, so the check is expected to fail. GPG check is just not the right thing to do in this case. If we enable GPG checking when not appropriate, ***we will train users to reflexively ignore GPG errors.***
(We have already trained users to approve importing new GPG keys as long as they claim to be from Fedora, since this is required every Fedora release. This is bad enough.)
GPG check makes sense when installing RPMs from a configured repository, not when manually installing RPMs from a filesystem path or URL.
Michael