Mock always copies distribution keys to the buildroot. Isn't it that enough? (Updating/installing own version of that package gpg-distribution-keys to the builder) /I've not tested it/

We've run into this with a buildroot based on rawhide as well, using bootstrap_chroot.

In the process of replicating this locally, the issue seems to be triggered by the behavior of the tools in the bootstrap chroot.

• dnf will unconditionally force repo.gpgcheck to True if %_pkgverify_level is signature or all
• the minimal rawhide installation for the bootstrap sets %_pkgverify_level all in /usr/lib/rpm/macros
• attempting to override this macro value in mock config does not help. Mock only defines these macros for the build, not for installation
• even adding an explicit gpgcheck=0 in the embedded dnf config does not get around this

I can work around locally by disabling bootstrap, but that is likely not an option in many cases.

They only way I see to handle this (short of changes to mock, dnf or rpm) is to add an extra package to the build tag that sets %_pkgverify_level digest when installed, add it both to the bootstrap_chroot_additional_packages mock config, and probably also add it to the build and srpm-build install groups.

In my case, the signing key is present in the bootstrap chroot (part of fedora-gpg-keys), but is not trusted by rpm. I don't see a sane way to programmatically determine which key to trust.

In short, the buildroot configuration defines a buildroot that requires gpg keys, but does not trust any.

Koji doesn't have a way to set bootstrap_chroot_additional_packages. I suppose we could add it if we can't find a better solution.

I thought about maybe adding the macros in a package that Supplements one of the base install package, but koji always sets install_weak_deps=0

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/4544

Please continue any further discussion there.