Leap Micro updates failing due to expired signing keys (2026-06-19)

hdrum · June 21, 2026, 2:26pm

I have a couple of systems running Leap Micro 6.2 that now won’t update packages due to the packages apparently being signed with an expired signing key that expired on 2026-06-19. I’m not sure if this is a known issue, or if I’m missing something.

Here’s the full output from the nightly transactional-update runs:

Full logs

Jun 21 01:10:43 transactional-update[13115]: Checking for newer version.
Jun 21 01:10:45 transactional-update[13116]: Subprocess failed. Error: Failed to import public key [35A2F86E29B700A4-6a17fa38] [openSUSE Project Signing Key <opensuse@opensuse.org>] [expires: 2030-05-27]
Jun 21 01:10:45 transactional-update[13116]: History:
Jun 21 01:10:45 transactional-update[13116]:  - Command exited with status 1.
Jun 21 01:10:45 transactional-update[13116]:  - error: /var/tmp/zypp.tmp/zypp.5AHDkr/pubkey-35A2F86E29B700A4-vuKt5V: key 1 import failed.
Jun 21 01:10:45 transactional-update[13116]:  - error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock (Read-only file system)
Jun 21 01:10:51 transactional-update[13115]: transactional-update 5.0.7 started
Jun 21 01:10:51 transactional-update[13115]: Options: cleanup up reboot
Jun 21 01:10:51 transactional-update[13115]: Separate /var detected.
Jun 21 01:10:53 transactional-update[13115]: 2026-06-21 01:10:52 tukit 5.0.7 started
Jun 21 01:10:53 transactional-update[13115]: 2026-06-21 01:10:52 Options: -c111 open
Jun 21 01:10:53 transactional-update[13115]: 2026-06-21 01:10:52 Using snapshot 111 as base for new snapshot 112.
Jun 21 01:10:53 transactional-update[13115]: ID: 112
Jun 21 01:10:53 transactional-update[13115]: 2026-06-21 01:10:53 Transaction completed.
Jun 21 01:10:53 transactional-update[13115]: Calling zypper up
Jun 21 01:10:54 transactional-update[13549]: 2026-06-21 01:10:54 tukit 5.0.7 started
Jun 21 01:10:54 transactional-update[13549]: 2026-06-21 01:10:54 Options: callext 112 zypper -R {} up -y --auto-agree-with-product-licenses
Jun 21 01:10:54 transactional-update[13549]: 2026-06-21 01:10:54 Executing `zypper -R /tmp/transactional-update-S2MxtU up -y --auto-agree-with-product-licenses`:
Jun 21 01:10:54 transactional-update[13549]: Refreshing service 'openSUSE'.
Jun 21 01:10:54 transactional-update[13549]: Loading repository data...
Jun 21 01:10:54 transactional-update[13549]: Reading installed packages...
Jun 21 01:10:54 transactional-update[13549]: The following 46 packages are going to be upgraded:
Jun 21 01:10:54 transactional-update[13549]:   Leap-Micro-release NetworkManager-branding-openSUSE branding-openSUSE distribution-logos-openSUSE-LeapMicro gio-branding-openSUSE glib-networking grub2-branding-openSUSE hwinfo ignition iproute2 libgcc_s1 libgomp1 libgraphite2-3 libhd25 libncurses6 libnvme1 libselinux1 libsemanage-conf libsemanage2 libsolv-tools-base libsqlite3-0 libstdc++6 libzypp ncurses-utils netcfg openSUSE-build-key openSUSE-repos-LeapMicro opensuse-migration-tool patterns-base-base patterns-base-bootloader patterns-base-cockpit patterns-base-hardware patterns-base-kvm_host patterns-base-minimal_base patterns-base-salt_minion patterns-base-selinux patterns-base-transactional patterns-container-runtime_podman python313-selinux python313-semanage qemu-ovmf-x86_64 selinux-tools terminfo-base wallpaper-branding-openSUSE zypper zypper-needs-restarting
Jun 21 01:10:54 transactional-update[13549]: The following 10 patterns are going to be upgraded:
Jun 21 01:10:54 transactional-update[13549]:   base base_transactional bootloader cockpit container_runtime_podman hardware kvm_host minimal_base salt_minion selinux
Jun 21 01:10:54 transactional-update[13549]: The following product is going to be reinstalled:
Jun 21 01:10:54 transactional-update[13549]:   "openSUSE Leap Micro 6.2"
Jun 21 01:10:54 transactional-update[13549]: 46 packages to upgrade.
Jun 21 01:10:54 transactional-update[13549]: Package download size:    44.4 MiB
Jun 21 01:10:54 transactional-update[13549]: Package install size change:
Jun 21 01:10:54 transactional-update[13549]:               |     150.7 MiB  required by packages that will be installed
Jun 21 01:10:54 transactional-update[13549]:    167.9 KiB  |  -  150.6 MiB  released by packages that will be removed
Jun 21 01:10:54 transactional-update[13549]: Backend:  classic_rpmtrans
Jun 21 01:10:54 transactional-update[13549]: Continue? [y/n/v/...? shows all options] (y): y
Jun 21 01:10:54 transactional-update[13549]: Checking for file conflicts: [...done]
Jun 21 01:10:54 transactional-update[13549]: Warning: 46 packages had to be excluded from file conflicts check because they are not yet downloaded.
Jun 21 01:10:54 transactional-update[13549]:     Note: Checking for file conflicts requires not installed packages to be downloaded in advance in
Jun 21 01:10:54 transactional-update[13549]:     order to access their file lists. See option '--download-in-advance / --dry-run --download-only'
Jun 21 01:10:54 transactional-update[13549]:     in the zypper manual page for details.
Jun 21 01:10:54 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch (repo-main (6.2)) (1/46),  15.7 KiB
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [.not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [.not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [.not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [.not found]
Jun 21 01:10:55 transactional-update[13549]: Retrieving: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm [.done (3.9 KiB/s)]
Jun 21 01:10:55 transactional-update[13549]: ( 1/46) Installing: NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch [.
Jun 21 01:10:55 transactional-update[13549]: error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
Jun 21 01:10:55 transactional-update[13549]: warning: /tmp/transactional-update-S2MxtU/var/cache/zypp/packages/openSUSE:repo-main/noarch/NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch.rpm: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
Jun 21 01:10:55 transactional-update[13549]: .
Jun 21 01:10:55 transactional-update[13549]: error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
Jun 21 01:10:55 transactional-update[13549]: error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
Jun 21 01:10:56 transactional-update[13549]:         package NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch does not verify: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
Jun 21 01:10:56 transactional-update[13549]: error]
Jun 21 01:10:56 transactional-update[13549]: Installation of NetworkManager-branding-openSUSE-42.1-160000.1.178.noarch failed:
Jun 21 01:10:56 transactional-update[13549]: Error: Subprocess failed. Error: RPM failed: Command exited with status 2.
Jun 21 01:10:56 transactional-update[13549]: Abort, retry, ignore? [a/r/i] (a): a
Jun 21 01:10:56 transactional-update[13549]: Problem occurred during or after installation or removal of packages:
Jun 21 01:10:56 transactional-update[13549]: Installation has been aborted as directed.
Jun 21 01:10:56 transactional-update[13549]: Please see the above error message for a hint.
Jun 21 01:10:56 transactional-update[13549]: 2026-06-21 01:10:56 Application returned with exit status 8.
Jun 21 01:10:56 transactional-update[13116]: ERROR: zypper up on /.snapshots/112/snapshot failed with exit code 8!
Jun 21 01:10:56 transactional-update[13116]: Use '--interactive' for manual problem resolution.
Jun 21 01:10:56 transactional-update[13116]: Removing snapshot #112...
Jun 21 01:10:56 transactional-update[13620]: 2026-06-21 01:10:56 tukit 5.0.7 started
Jun 21 01:10:56 transactional-update[13620]: 2026-06-21 01:10:56 Options: abort 112
Jun 21 01:10:57 transactional-update[13620]: 2026-06-21 01:10:57 Discarding snapshot 112.
Jun 21 01:10:57 transactional-update[13620]: 2026-06-21 01:10:57 Transaction completed.
Jun 21 01:10:57 transactional-update[13115]: transactional-update finished

I’m not sure if it’s relevant, but in that output, the Error: Failed to import public key [35A2F86E29B700A4-6a17fa38] [openSUSE Project Signing Key <opensuse@opensuse.org>] [expires: 2030-05-27] lines seem to have cropped up in the nightly update attempt starting around June 6. However, updates were still being applied as expected until June 20 when I then started to get the more fatal error related to the expired signing keys (that expired on June 19):

( 1/34) Installing: NetworkManager-branding-openSUSE-42.1-160000.1.175.noarch [.
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org

warning: /tmp/transactional-update-jGPZxS/var/cache/zypp/packages/openSUSE:repo-main/noarch/NetworkManager-branding-openSUSE-42.1-160000.1.175.noarch.rpm: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
.
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
        package NetworkManager-branding-openSUSE-42.1-160000.1.175.noarch does not verify: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
error]
Installation of NetworkManager-branding-openSUSE-42.1-160000.1.175.noarch failed:

I was also able to reproduce this same issue with a fresh install of Leap Micro 6.2 in a VM from the latest ISO available. On that fresh install, I don’t get the Failed to import public key [35A2F86E29B700A4-6a17fa38] error first, but I do still get installation errors of packages. The error is on a different package, but I suspect that’s just because it’s further behind, so it has more packages to install. This is the similar error I get on this fresh VM related to expired signing keys:

(  2/243) Installing: branding-openSUSE-16.0.20240405-160000.1.209.noarch [.
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
warning: /tmp/transactional-update-uoDzfx/var/cache/zypp/packages/openSUSE:repo-main/noarch/branding-openSUSE-16.0.20240405-160000.1.209.noarch.rpm: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
.
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 14:03:14
        package branding-openSUSE-16.0.20240405-160000.1.209.noarch does not verify: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
error]
Installation of branding-openSUSE-16.0.20240405-160000.1.209.noarch failed:

Thanks!

stendler · June 25, 2026, 12:34am

I also had the issue of not being able to update on MicroOS for a couple of days now. Though, I did not notice any key import error.

What fixed it for me was manually forcing a refresh of the metadata using a transactional-update shell.
Or as a one-liner: sudo transactioal-update run zypper ref -f

The next manual sudo transactional-update dup --continue did then succeed for me.

I hope this works for you too!

Nam_tech · June 26, 2026, 8:10am

Thanks, this worked for me.

hdrum · June 27, 2026, 3:39pm

Thanks, @stendler! That did the trick for me too.

In case it helps anyone else that normally relies on automated transactional-update updates from the systemd timer and rebootmgr for scheduled reboots, here were the more specific steps I ran to update this and then schedule a nightly reboot during the maintenance window, as normal:

# Temporarily stop the normal timer, just to ensure it doesn't try
# updates of its own or create a new snapshot.
sudo systemctl stop transactional-update.timer

# Run the fixes and updates as noted by @stendler above.
sudo transactional-update run zypper refresh --force
sudo transactional-update --continue dup

# Use rebootmgr to schedule a reboot for later (or you could
# `systemctl reboot` instead, if you want to reboot immediately).
sudo rebootmgrctl reboot

system · July 4, 2026, 3:40pm

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.