Results 1 to 10 of 10

Thread: Signature verification failed

  1. #1

    Default Signature verification failed

    Hi
    When I started my computer today, I got a message pop-up that said:
    Code:
    Fatal Error:Signature verification failed for file 'repomd.xml' from repository 'nVidia Graphics Drivers'.
    When I run zypper it showed this:
    Code:
    Retrieving repository 'nVidia Graphics Drivers' metadata ------------------------[\]
    Signature verification failed for file 'repomd.xml' from repository 'nVidia Graphics Drivers'.
    
        Note: Signing data enables the recipient to verify that no modifications
        occurred after the data were signed. Accepting data with no, wrong or unknown
        signature can lead to a corrupted system and in extreme cases even to a system
        compromise.
    
        Note: File 'repomd.xml' is the repositories master index file. It ensures the
        integrity of the whole repo.
    
        Warning: This file was modified after it has been signed. This may have been a
        malicious change, so it might not be trustworthy anymore! You should not
        continue unless you know it's safe.
    
    Signature verification failed for file 'repomd.xml' from repository 'nVidia Graphics Drivers'. Continue? [yes/no] (no):
    Here are my repos:
    Code:
    Leap15:~ # zypper lr -d
    #  | Alias                            | Name                                    | Enabled | GPG Check | Refresh | Priority | Type   | URI                                                                      | Service
    ---+----------------------------------+-----------------------------------------+---------+-----------+---------+----------+--------+--------------------------------------------------------------------------+--------
     1 | download.nvidia.com-leap         | nVidia Graphics Drivers                 | Yes     | (r ) Yes  | Yes     |   99     | rpm-md | https://download.nvidia.com/opensuse/leap/15.0                           |        
     2 | http-opensuse-guide.org-8702b9e7 | libdvdcss repository                    | Yes     | (r ) Yes  | Yes     |   99     | rpm-md | http://opensuse-guide.org/repo/openSUSE_Leap_15.0/                       |        
     3 | http-packman.inode.at-abdee5d1   | Packman Repository                      | Yes     | (r ) Yes  | Yes     |   99     | rpm-md | http://packman.inode.at/suse/openSUSE_Leap_15.0/                         |        
     4 | openSUSE-Leap-15.0-1             | openSUSE-Leap-15.0-1                    | Yes     | (r ) Yes  | No      |   99     | rpm-md | cd:/?devices=/dev/disk/by-id/ata-DRW-24D5MT_K2OG5KA2357                  |        
     5 | repo-debug                       | openSUSE-Leap-15.0-Debug                | No      | ----      | ----    |   99     | NONE   | http://download.opensuse.org/debug/distribution/leap/15.0/repo/oss/      |        
     6 | repo-debug-non-oss               | openSUSE-Leap-15.0-Debug-Non-Oss        | No      | ----      | ----    |   99     | NONE   | http://download.opensuse.org/debug/distribution/leap/15.0/repo/non-oss/  |        
     7 | repo-debug-update                | openSUSE-Leap-15.0-Update-Debug         | No      | ----      | ----    |   99     | NONE   | http://download.opensuse.org/debug/update/leap/15.0/oss/                 |        
     8 | repo-debug-update-non-oss        | openSUSE-Leap-15.0-Update-Debug-Non-Oss | No      | ----      | ----    |   99     | NONE   | http://download.opensuse.org/debug/update/leap/15.0/non-oss/             |        
     9 | repo-non-oss                     | openSUSE-Leap-15.0-Non-Oss              | Yes     | (r ) Yes  | Yes     |   99     | rpm-md | http://download.opensuse.org/distribution/leap/15.0/repo/non-oss/        |        
    10 | repo-oss                         | openSUSE-Leap-15.0-Oss                  | Yes     | (r ) Yes  | Yes     |   99     | rpm-md | http://download.opensuse.org/distribution/leap/15.0/repo/oss/
    Should I press yes|no at the prompt?
    thank you, your help in always appreciated

  2. #2

    Unhappy Re: Signature verification failed

    I got the same notice on my Leap 15.0 system that the NVIDIA graphics drivers' GPG key failed the integrity check.

    Is the signature below the correct, authentic one for the NVIDIA graphics drivers?

    If the NVIDIA key was signed with the openSUSE Project Signing Key (Key ID: B88B2FD43DBDC284), which it is not, we could know with some certainty NVIDA's key is authentic; saving many people from wondering if NVIDIA's key is genuine.

    I also noticed whan manually checking the NVIDA repositories for Leap 15.0 and Leap 15.1 that the exact same key in Leap 15.0 is used in Leap 15.1, so the GPG key integrity check failure in Leap 15.0 is highly likely to be present in Leap 15.1 too. No?

    Data for the GPG key in question:
    Code:
    Key: F5113243C66B6EAE
    Name: NVIDIA Corporation <linux-bugs@nvidia.com>
    Finger Print: 9B763D49D8A5C892FC178BACF5113243C66B6EAE
    Created: 06/15/2006
    Searching NVIDIA.com, including the developer part, did not yield any reference nor answers about this specific key.

    The only place this specific key shows up on the entire Internet outside of opensuse.org, and publicly accessible key servers, which are not an authoritative answers to whether the key is genuine and valid is:
    https://www.mythtv.org/wiki/Opensuse_10.2

  3. #3
    Join Date
    Aug 2010
    Location
    Chicago suburbs
    Posts
    13,191
    Blog Entries
    3

    Default Re: Signature verification failed

    I just enable the nVidia repo on Leap 15.1 system, and attempted to refresh. And I get the same error. I then disabled (I don't have an nvidia graphics card, so I don't actually need that repo).

    I checked that. If the problem was only for 15.0, I would remind you that it is past end-of-life. But since the problem also applies to 15.1, I guess that's not the answer.

    My usual advice, when I see this problem, is to wait a few hours and then try again. The repo may have some incomplete updates underway.

    If this is holding up other updates, then I suggest that you temporarily disable the nvidia repo, and then do your other updates. You can re-enable and retest after a day or two. And if still broken at that time, maybe a bug report would be appropriate.
    openSUSE Leap 15.1; KDE Plasma 5;
    testing Leap 15.2Alpha

  4. #4
    Join Date
    Mar 2011
    Location
    Sauerland
    Posts
    4,146

    Default AW: Signature verification failed


  5. #5

    Wink Re: NVIDIA signature verification failed

    When I refresh the NVIDIA repository today on my Leap 15.0 system, the NVIDIA graphics drivers' GPG key does not fail the integrity check. So, the problem appears to be solved at least for Leap 15.0.

  6. #6

    Default Re: Signature verification failed

    nrickert, please do us a favor and check on your Leap 15.1 system if the the NVIDIA graphics drivers' GPG key still fails the integrity check. I expect the problem will be resolved for Leap 15.1 too.

    Thanks in advance.

  7. #7
    Join Date
    Aug 2010
    Location
    Chicago suburbs
    Posts
    13,191
    Blog Entries
    3

    Default Re: Signature verification failed

    Yes, it is fine now for Leap 15.1. So it looks as if the repos have been properly rebuilt and the problem solved.

    Somebody with Tumbleweed might want to chime in on the status there.
    openSUSE Leap 15.1; KDE Plasma 5;
    testing Leap 15.2Alpha

  8. #8

    Cool Re: Signature verification failed

    Quote Originally Posted by nrickert View Post
    Yes, it is fine now for Leap 15.1. So it looks as if the repos have been properly rebuilt and the problem solved.
    Thank you nrickert!

    I'm glad to know I can upgrade now to Leap 15.1 without the graphics repo being a problem.

  9. #9
    Join Date
    Aug 2010
    Location
    Chicago suburbs
    Posts
    13,191
    Blog Entries
    3

    Default Re: Signature verification failed

    Quote Originally Posted by Max314 View Post
    I'm glad to know I can upgrade now to Leap 15.1 without the graphics repo being a problem.
    And you probably should upgrade, given that 15.0 is out of support.
    openSUSE Leap 15.1; KDE Plasma 5;
    testing Leap 15.2Alpha

  10. #10

    Default Re: Signature verification failed

    Quote Originally Posted by nrickert View Post
    And you probably should upgrade, given that 15.0 is out of support.
    I was intending to upgrade just before the signature verification problem. When the Software Update applet notified me of the signature problem, I decided to delay the upgrade to make sure the problem would not be present in Leap 15.1.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •