To upgrade from Fedora-37 to Fedora-38 the instructions (https://docs.fedoraproject.org/en-US/quick-docs/dnf-system-upgrade/)%C2%A0sa y: ... 5. When the new GPG key is imported, you are asked to verify the key’s fingerprint. Refer to https://getfedora.org/security to do so. Which never happened. I have continued with the upgrade. Is this safe?
Jonathan Ryshpan wrote:
To upgrade from Fedora-37 to Fedora-38 the instructions (https://docs.fedoraproject.org/en-US/quick-docs/dnf-system-upgrade/)%C2%A0sa y: ... 5. When the new GPG key is imported, you are asked to verify the key’s fingerprint. Refer to https://getfedora.org/security to do so. Which never happened. I have continued with the upgrade. Is this safe?
Short answer: Yes.
Long answer: While it's good to verify things, it's not a large risk if you skipped it. The fedora-gpg-keys package ships the signing keys for new releases. That is when used by the upgrade process to install the key for the new release.
Let's say you started with Fedora 36 and did a clean install. You download the install image and verify it. Once installed, all the package updates are checked using the Fedora 36 signing key. That includes updates to the fedora-gpg-keys package.
When you eventually upgrade to either Fedora 37 or 38, the upgrade process uses the signing key from the local disk, which has already been verified by the package signature of the current release.
There's a clear chain from the Fedora 36 key to the Fedora 38 key in this case. Unless the Fedora infrastructure has been badly compromised, you're perfectly safe to perform the system upgrade without manually verifying the key fingerprints. It doesn't hurt to verify them, but it's not the end of the world if you don't.
And if the Fedora infrastructure is compromised, then checking the fingerprints on what might be a compromised web site isn't really going to help. :)
On Wed, May 17, 2023 at 9:43 PM Todd Zullinger tmz@pobox.com wrote:
Jonathan Ryshpan wrote:
To upgrade from Fedora-37 to Fedora-38 the instructions (https://docs.fedoraproject.org/en-US/quick-docs/dnf-system-upgrade/) sa y: ... 5. When the new GPG key is imported, you are asked to verify the key’s fingerprint. Refer to https://getfedora.org/security to do so. Which never happened. I have continued with the upgrade. Is this safe?
Short answer: Yes.
Long answer: While it's good to verify things, it's not a large risk if you skipped it. The fedora-gpg-keys package ships the signing keys for new releases. That is when used by the upgrade process to install the key for the new release.
Let's say you started with Fedora 36 and did a clean install. You download the install image and verify it. Once installed, all the package updates are checked using the Fedora 36 signing key. That includes updates to the fedora-gpg-keys package.
When you eventually upgrade to either Fedora 37 or 38, the upgrade process uses the signing key from the local disk, which has already been verified by the package signature of the current release.
There's a clear chain from the Fedora 36 key to the Fedora 38 key in this case. Unless the Fedora infrastructure has been badly compromised, you're perfectly safe to perform the system upgrade without manually verifying the key fingerprints. It doesn't hurt to verify them, but it's not the end of the world if you don't.
And if the Fedora infrastructure is compromised, then checking the fingerprints on what might be a compromised web site isn't really going to help. :)
This always baffles me... Fedora includes irrelevant keys. For example, old keys and keys for different arches. Something feels wrong about trusting them.
$ ls /etc/pki/rpm-gpg RPM-GPG-KEY-38-fedora RPM-GPG-KEY-fedora-26-i386 RPM-GPG-KEY-fedora-10-i386 RPM-GPG-KEY-fedora-26-ppc64 RPM-GPG-KEY-fedora-10-ppc RPM-GPG-KEY-fedora-26-ppc64le RPM-GPG-KEY-fedora-10-ppc64 RPM-GPG-KEY-fedora-26-primary RPM-GPG-KEY-fedora-10-primary RPM-GPG-KEY-fedora-26-s390x RPM-GPG-KEY-fedora-10-x86_64 RPM-GPG-KEY-fedora-26-secondary RPM-GPG-KEY-fedora-11-i386 RPM-GPG-KEY-fedora-26-x86_64 RPM-GPG-KEY-fedora-11-ppc RPM-GPG-KEY-fedora-27-aarch64 RPM-GPG-KEY-fedora-11-ppc64 RPM-GPG-KEY-fedora-27-armhfp RPM-GPG-KEY-fedora-11-primary RPM-GPG-KEY-fedora-27-i386 RPM-GPG-KEY-fedora-11-x86_64 RPM-GPG-KEY-fedora-27-ppc64 RPM-GPG-KEY-fedora-12-i386 RPM-GPG-KEY-fedora-27-ppc64le RPM-GPG-KEY-fedora-12-ppc RPM-GPG-KEY-fedora-27-primary RPM-GPG-KEY-fedora-12-ppc64 RPM-GPG-KEY-fedora-27-s390x RPM-GPG-KEY-fedora-12-primary RPM-GPG-KEY-fedora-27-x86_64 RPM-GPG-KEY-fedora-12-x86_64 RPM-GPG-KEY-fedora-28-aarch64 RPM-GPG-KEY-fedora-13-arm RPM-GPG-KEY-fedora-28-armhfp RPM-GPG-KEY-fedora-13-armhfp RPM-GPG-KEY-fedora-28-i386 RPM-GPG-KEY-fedora-13-i386 RPM-GPG-KEY-fedora-28-ppc64 RPM-GPG-KEY-fedora-13-mips RPM-GPG-KEY-fedora-28-ppc64le RPM-GPG-KEY-fedora-13-primary RPM-GPG-KEY-fedora-28-primary RPM-GPG-KEY-fedora-13-secondary RPM-GPG-KEY-fedora-28-s390x RPM-GPG-KEY-fedora-13-x86_64 RPM-GPG-KEY-fedora-28-x86_64 RPM-GPG-KEY-fedora-14-arm RPM-GPG-KEY-fedora-29-aarch64 RPM-GPG-KEY-fedora-14-i386 RPM-GPG-KEY-fedora-29-armhfp RPM-GPG-KEY-fedora-14-primary RPM-GPG-KEY-fedora-29-i386 RPM-GPG-KEY-fedora-14-secondary RPM-GPG-KEY-fedora-29-ppc64 RPM-GPG-KEY-fedora-14-x86_64 RPM-GPG-KEY-fedora-29-ppc64le RPM-GPG-KEY-fedora-15-arm RPM-GPG-KEY-fedora-29-primary RPM-GPG-KEY-fedora-15-armhfp RPM-GPG-KEY-fedora-29-s390x RPM-GPG-KEY-fedora-15-i386 RPM-GPG-KEY-fedora-29-x86_64 RPM-GPG-KEY-fedora-15-ppc RPM-GPG-KEY-fedora-30-aarch64 RPM-GPG-KEY-fedora-15-ppc64 RPM-GPG-KEY-fedora-30-armhfp RPM-GPG-KEY-fedora-15-primary RPM-GPG-KEY-fedora-30-i386 RPM-GPG-KEY-fedora-15-s390 RPM-GPG-KEY-fedora-30-ppc64le RPM-GPG-KEY-fedora-15-s390x RPM-GPG-KEY-fedora-30-primary RPM-GPG-KEY-fedora-15-secondary RPM-GPG-KEY-fedora-30-s390x RPM-GPG-KEY-fedora-15-x86_64 RPM-GPG-KEY-fedora-30-x86_64 RPM-GPG-KEY-fedora-16-arm RPM-GPG-KEY-fedora-31-aarch64 RPM-GPG-KEY-fedora-16-armhfp RPM-GPG-KEY-fedora-31-armhfp RPM-GPG-KEY-fedora-16-i386 RPM-GPG-KEY-fedora-31-i386 RPM-GPG-KEY-fedora-16-ppc RPM-GPG-KEY-fedora-31-ppc64le RPM-GPG-KEY-fedora-16-ppc64 RPM-GPG-KEY-fedora-31-primary RPM-GPG-KEY-fedora-16-primary RPM-GPG-KEY-fedora-31-s390x RPM-GPG-KEY-fedora-16-s390 RPM-GPG-KEY-fedora-31-x86_64 RPM-GPG-KEY-fedora-16-s390x RPM-GPG-KEY-fedora-32-aarch64 RPM-GPG-KEY-fedora-16-secondary RPM-GPG-KEY-fedora-32-armhfp RPM-GPG-KEY-fedora-16-x86_64 RPM-GPG-KEY-fedora-32-i386 RPM-GPG-KEY-fedora-17-arm RPM-GPG-KEY-fedora-32-ppc64le RPM-GPG-KEY-fedora-17-armhfp RPM-GPG-KEY-fedora-32-primary RPM-GPG-KEY-fedora-17-i386 RPM-GPG-KEY-fedora-32-s390x RPM-GPG-KEY-fedora-17-ppc RPM-GPG-KEY-fedora-32-x86_64 RPM-GPG-KEY-fedora-17-ppc64 RPM-GPG-KEY-fedora-33-aarch64 RPM-GPG-KEY-fedora-17-primary RPM-GPG-KEY-fedora-33-armhfp RPM-GPG-KEY-fedora-17-s390 RPM-GPG-KEY-fedora-33-i386 RPM-GPG-KEY-fedora-17-s390x RPM-GPG-KEY-fedora-33-ppc64le RPM-GPG-KEY-fedora-17-secondary RPM-GPG-KEY-fedora-33-primary RPM-GPG-KEY-fedora-17-x86_64 RPM-GPG-KEY-fedora-33-s390x RPM-GPG-KEY-fedora-18-arm RPM-GPG-KEY-fedora-33-x86_64 RPM-GPG-KEY-fedora-18-armhfp RPM-GPG-KEY-fedora-34-aarch64 RPM-GPG-KEY-fedora-18-i386 RPM-GPG-KEY-fedora-34-armhfp RPM-GPG-KEY-fedora-18-ppc RPM-GPG-KEY-fedora-34-i386 RPM-GPG-KEY-fedora-18-ppc64 RPM-GPG-KEY-fedora-34-ppc64le RPM-GPG-KEY-fedora-18-primary RPM-GPG-KEY-fedora-34-primary RPM-GPG-KEY-fedora-18-s390 RPM-GPG-KEY-fedora-34-s390x RPM-GPG-KEY-fedora-18-s390x RPM-GPG-KEY-fedora-34-x86_64 RPM-GPG-KEY-fedora-18-secondary RPM-GPG-KEY-fedora-35-aarch64 RPM-GPG-KEY-fedora-18-x86_64 RPM-GPG-KEY-fedora-35-armhfp RPM-GPG-KEY-fedora-19-armhfp RPM-GPG-KEY-fedora-35-ppc64le RPM-GPG-KEY-fedora-19-i386 RPM-GPG-KEY-fedora-35-primary RPM-GPG-KEY-fedora-19-ppc RPM-GPG-KEY-fedora-35-s390x RPM-GPG-KEY-fedora-19-ppc64 RPM-GPG-KEY-fedora-35-x86_64 RPM-GPG-KEY-fedora-19-primary RPM-GPG-KEY-fedora-36-aarch64 RPM-GPG-KEY-fedora-19-s390 RPM-GPG-KEY-fedora-36-armhfp RPM-GPG-KEY-fedora-19-s390x RPM-GPG-KEY-fedora-36-ppc64le RPM-GPG-KEY-fedora-19-secondary RPM-GPG-KEY-fedora-36-primary RPM-GPG-KEY-fedora-19-x86_64 RPM-GPG-KEY-fedora-36-s390x RPM-GPG-KEY-fedora-20-armhfp RPM-GPG-KEY-fedora-36-x86_64 RPM-GPG-KEY-fedora-20-i386 RPM-GPG-KEY-fedora-37-aarch64 RPM-GPG-KEY-fedora-20-ppc RPM-GPG-KEY-fedora-37-armhfp RPM-GPG-KEY-fedora-20-ppc64 RPM-GPG-KEY-fedora-37-ppc64le RPM-GPG-KEY-fedora-20-primary RPM-GPG-KEY-fedora-37-primary RPM-GPG-KEY-fedora-20-s390 RPM-GPG-KEY-fedora-37-s390x RPM-GPG-KEY-fedora-20-s390x RPM-GPG-KEY-fedora-37-x86_64 RPM-GPG-KEY-fedora-20-secondary RPM-GPG-KEY-fedora-38-aarch64 RPM-GPG-KEY-fedora-20-x86_64 RPM-GPG-KEY-fedora-38-ppc64le RPM-GPG-KEY-fedora-21-aarch64 RPM-GPG-KEY-fedora-38-primary RPM-GPG-KEY-fedora-21-armhfp RPM-GPG-KEY-fedora-38-s390x RPM-GPG-KEY-fedora-21-i386 RPM-GPG-KEY-fedora-38-x86_64 RPM-GPG-KEY-fedora-21-ppc64 RPM-GPG-KEY-fedora-39-aarch64 RPM-GPG-KEY-fedora-21-ppc64le RPM-GPG-KEY-fedora-39-ppc64le RPM-GPG-KEY-fedora-21-primary RPM-GPG-KEY-fedora-39-primary RPM-GPG-KEY-fedora-21-s390 RPM-GPG-KEY-fedora-39-s390x RPM-GPG-KEY-fedora-21-s390x RPM-GPG-KEY-fedora-39-x86_64 RPM-GPG-KEY-fedora-21-secondary RPM-GPG-KEY-fedora-40-aarch64 RPM-GPG-KEY-fedora-21-x86_64 RPM-GPG-KEY-fedora-40-ppc64le RPM-GPG-KEY-fedora-22-aarch64 RPM-GPG-KEY-fedora-40-primary RPM-GPG-KEY-fedora-22-armhfp RPM-GPG-KEY-fedora-40-s390x RPM-GPG-KEY-fedora-22-i386 RPM-GPG-KEY-fedora-40-x86_64 RPM-GPG-KEY-fedora-22-ppc64 RPM-GPG-KEY-fedora-7-i386 RPM-GPG-KEY-fedora-22-ppc64le RPM-GPG-KEY-fedora-7-ppc RPM-GPG-KEY-fedora-22-primary RPM-GPG-KEY-fedora-7-ppc64 RPM-GPG-KEY-fedora-22-s390 RPM-GPG-KEY-fedora-7-primary RPM-GPG-KEY-fedora-22-s390x RPM-GPG-KEY-fedora-7-x86_64 RPM-GPG-KEY-fedora-22-secondary RPM-GPG-KEY-fedora-8-i386 RPM-GPG-KEY-fedora-22-x86_64 RPM-GPG-KEY-fedora-8-ppc RPM-GPG-KEY-fedora-23-aarch64 RPM-GPG-KEY-fedora-8-ppc64 RPM-GPG-KEY-fedora-23-armhfp RPM-GPG-KEY-fedora-8-primary RPM-GPG-KEY-fedora-23-i386 RPM-GPG-KEY-fedora-8-primary-original RPM-GPG-KEY-fedora-23-ppc64 RPM-GPG-KEY-fedora-8-x86_64 RPM-GPG-KEY-fedora-23-ppc64le RPM-GPG-KEY-fedora-9-i386 RPM-GPG-KEY-fedora-23-primary RPM-GPG-KEY-fedora-9-ia64 RPM-GPG-KEY-fedora-23-s390 RPM-GPG-KEY-fedora-9-ppc RPM-GPG-KEY-fedora-23-s390x RPM-GPG-KEY-fedora-9-ppc64 RPM-GPG-KEY-fedora-23-secondary RPM-GPG-KEY-fedora-9-primary RPM-GPG-KEY-fedora-23-x86_64 RPM-GPG-KEY-fedora-9-primary-original RPM-GPG-KEY-fedora-24-aarch64 RPM-GPG-KEY-fedora-9-secondary RPM-GPG-KEY-fedora-24-armhfp RPM-GPG-KEY-fedora-9-x86_64 RPM-GPG-KEY-fedora-24-i386 RPM-GPG-KEY-fedora-eln-aarch64 RPM-GPG-KEY-fedora-24-ppc64 RPM-GPG-KEY-fedora-eln-ppc64le RPM-GPG-KEY-fedora-24-ppc64le RPM-GPG-KEY-fedora-eln-primary RPM-GPG-KEY-fedora-24-primary RPM-GPG-KEY-fedora-eln-s390x RPM-GPG-KEY-fedora-24-s390x RPM-GPG-KEY-fedora-eln-x86_64 RPM-GPG-KEY-fedora-24-secondary RPM-GPG-KEY-fedora-iot-2019 RPM-GPG-KEY-fedora-24-x86_64 RPM-GPG-KEY-fedora-iot-aarch64 RPM-GPG-KEY-fedora-25-aarch64 RPM-GPG-KEY-fedora-iot-armhfp RPM-GPG-KEY-fedora-25-armhfp RPM-GPG-KEY-fedora-iot-i386 RPM-GPG-KEY-fedora-25-i386 RPM-GPG-KEY-fedora-iot-ppc64le RPM-GPG-KEY-fedora-25-ppc64 RPM-GPG-KEY-fedora-iot-s390x RPM-GPG-KEY-fedora-25-ppc64le RPM-GPG-KEY-fedora-iot-x86_64 RPM-GPG-KEY-fedora-25-primary RPM-GPG-KEY-fedora-modularity RPM-GPG-KEY-fedora-25-s390x RPM-GPG-KEY-fedora-rawhide-aarch64 RPM-GPG-KEY-fedora-25-secondary RPM-GPG-KEY-fedora-rawhide-ppc64le RPM-GPG-KEY-fedora-25-x86_64 RPM-GPG-KEY-fedora-rawhide-primary RPM-GPG-KEY-fedora-26-aarch64 RPM-GPG-KEY-fedora-rawhide-s390x RPM-GPG-KEY-fedora-26-armhfp RPM-GPG-KEY-fedora-rawhide-x86_64
Once upon a time, Jeffrey Walton noloader@gmail.com said:
This always baffles me... Fedora includes irrelevant keys. For example, old keys and keys for different arches. Something feels wrong about trusting them.
The arch-specific keys are symlinks.
The files in /etc/pki/rpm-gpg are not all in your RPM database either; they're just made available (so more just kind of a history thing). They're normally only installed if a repo file in /etc/yum.repos.d references one and you try to install a package from the repo (and so accept the key when prompted).
Jeffrey Walton wrote:
This always baffles me... Fedora includes irrelevant keys. For example, old keys and keys for different arches. Something feels wrong about trusting them.
You don't have to trust them if you don't want. :)
Other than for upgrades, they're not automatically used, so trust isn't really an issue. Having them there won't cause you to use them for installing packages.
For that, they'd need to be installed in the rpm database -- which they likely are if you continuously upgrade.
It's not a bad idea to prune them occasionally. There's a script to do that in the remove-retired-packages package.
It isn't too aggressive though. In f37, it removes f30-f33 keys. The script is /sbin/fedora-remove-old-gpg-keys.