releng

#13027 F44 system wide-change: Enforcing signature checking by default
Opened by pmatilai. Modified

Open
Close Issue

Please review the Fedora 44 system-wide change of changing RPM to default to enforcing signature checking by default: https://fedoraproject.org/wiki/Changes/Enforcing_signature_checking_by_default

This was initially planned to happen as a side-effect of the RPM 6.0 change in F43 (https://pagure.io/releng/issue/12616) but was postponed due to time and resource limits.

Releng could be affected by this change. I'm not intimately aware of how exactly signing works in the Fedora infrastructure, but it's easy to see this could affect build-systems trying to install freshly built but not yet signed packages. That can be fairly easily worked around with a macro override to the previous default (%_pkgverify_level digest) if necessary.

In contrast to the initial #12616 ticket, dnf+rpm now have the necessary integration to support installing packages from repos with gpgcheck=0, so tooling built on top of dnf and repositories should "just work".

Metadata Update from @james:
- Issue tagged with: meeting

Marked this to discuss in the weekly releng meeting. You just missed that by a couple of hours, feel free to turn up next week though.

As you said the initial idea is that we just turn this off on koji.

Note the last paragraph: the dnf integration changes things a lot from the initial 6.0 change proposal. I don't think koji needs to change anything, unless there's some corner that I don't know about (entirely possible) that does dnf or rpm install on local rpms directly. This change does not affect reading packages at all (something I need to clarify in the proposal), so createrepo and all continue to work normally.

Koji and kiwi will need changes. I already know what kiwi changes need to be done, but if we want signatures working inside the build environment, then Koji and its image builder plugins (kiwi, image-builder, etc.) all need updating to do the right thing for that.

Nothing here requires signatures inside the build environment. Just that unsigned packages are treated as such, eg in gpgcheck=0 repositories like mock already does.
Edited by pmatilai

Yes, but that setting is not currently propagated to the tools, so even if we don't want it, it still needs adjustments.
Edited by ngompa

@ngompa propagated to what tools, where? Are you telling me these tools are using plain rpm to do the install job? I would assume image-builder and friends to be using dnf for the job, and in that case they already need to have a configuration that allows unsigned packages, and in that case there should be no changes needed.

If I'm missing something, please point to specifics so I can look at it.
Edited by pmatilai

Metadata Update from @jnsamyak:
- Issue tagged with: changes, f44

@ngompa propagated to what tools, where? Are you telling me these tools are using plain rpm to do the install job? I would assume image-builder and friends to be using dnf for the job, and in that case they already need to have a configuration that allows unsigned packages, and in that case there should be no changes needed.

If I'm missing something, please point to specifics so I can look at it.

image-builder (osbuild) uses plain rpm to do installs (it uses dnf to download packages), kiwi uses dnf like normal (download and install).
Edited by ngompa

We'll take a look at our (image-builder)'s compatibility with this change and I'll update when we know :)
Metadata
None

changes f44 meeting

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.