Repository GPG Keys - RPM Keyring - YaST Software Repositorys - Myrlyn

English Open Chat
1

Today’s Tumbleweed snapshot 20260628 had an update for the openSUSE-build-key package.
That prompted me to check the current RPM Keyring for expired keys.

Opened Myrlyn – couldn’t find anything related to GPG Key management.
Checked the GitHub Myrlyn document – also nothing.
Checked the RPM CLI tools – I can list the details of the GPG Keys but, the expiration dates aren’t displayed.

Opened the YaST Repository Management and used that to clean up the Stygian Stables …

After Zypper “refresh --force” I rechecked the GPG Keys – yes there are still some expired GPG Keys reintroduced into the RPM Keyring –

  • security:keepassxc OBS Project
  • graphics OBS Project
  • 69D1B2AAEE3D166A – security OBS Project – despite a newer key 5DA57BDD6DD785CA also being present …
  • openSUSE:Factory:zSystems OBS Project
  • 9C214D4065176565 – openSUSE:Backports OBS Project – despite a newer key 8A49EB0325DB7AE0 also being present …
  • B88B2FD43DBDC284 – openSUSE Project Signing Key – despite a newer key 35A2F86E29B700A4 with a creation date of 28.05.2026 also being present …
  • openSUSE:Factory:PowerPC OBS Project

As you can see, keeping an eye on the RPM Keyring ain’t fun and, also, it ain’t funny … :imp:

Before YaST is finally killed off, is there any WIP to introduce RPM Keyring maintenance into Myrlyn?

2

Why is this in Open Chat ? There is no discussion here, it’s a simple support question, that would be fine in Install/Boot/Login IMHO. That said, there are already a number of threads about this, with proper solution.

1 Like
3

Sorry but, searching for “Myrlyn” or/and “RPM Keyring” or/and “GPG Key” in Install/Boot/Login doesn’t, AFAICS, doesn’t find anything related to this issue.

  • AFAICS, none of the Posts related to Myrlyn in “Install/Boot/Login” have touched on the YaST capability to manage a machine’s (RPM) GPG Keys.

My Open Chat question remains:

  • Is there any Work In Progress to implement the YaST Repository Management “GPG Keys” feature in Myrlyn?
1 Like
4

You need to ping at least the Myrlyn maintainer if you want an answer…
@shundhammer

1 Like
5

… considering that Stefan might be on a trip / vacation if I recall correctly.

6

OK – I’ll create a Change Request Bug Report.

  • The ArchLinux “rpmkeys” man page suggests:

> rpmkeys --export 771b18d3d7baa28734333c424344591e1964c5fc | sq inspect

Where “sq” is the “Sequoia-sq” which is a frontend for the sequoia library used by RPM – <Keyring Management>

Extracting the PGP Public Key Block for a repository key with “rpm --query --info” doesn’t provide the format “sq inspect” wants and, the openSUSE/SUSE “rpmkeys” doesn’t provide an “export” option.

A DuckDuckGo search for “Linux RPM Keyring list expiry date” suggests the following AI result:

To check the expiry dates of GPG keys in the RPM Keyring, you can use the YaST Repository Management tool or the rpmkeys command to list the keys, but note that the expiration dates may not always be displayed directly. For detailed management, you may need to refer to specific documentation or tools related to your Linux distribution.

7 
:~> rpmkeys --list
db27fd5a-62589a51: NVIDIA Linux Driver Team <linux-bugs@nvidia.com> public key
09d9ea69-68595a8c: SUSE 16 Package Signing Key <build-suse16@suse.de> public key
287a0027-682477e3: openSUSE Backports for SUSE Linux 16 <sle-backports-202500514@opensuse.org> public key
29b700a4-6a17fa38: openSUSE Project Signing Key <opensuse@opensuse.org> public key
e38fb563-668b92ac: X11:Drivers:Video OBS Project <X11:Drivers:Video@build.opensuse.org> public key
39db7c82-66c5d91a: SuSE Package Signing Key <build@suse.de> public key
3fa1d6ce-67c856ee: SUSE Package Signing Key <build@suse.de> public key
1abd1afb-66d76fb0: PackMan Project (signing key) <packman@links2linux.de> public key
d38b4796-677d5bed: Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com> public key

(LANG=C has no effect on the output…). Expiry dates:
verfällt=expires

:~> rpm -qa gpg-pubkey --qf '%{Description}'|gpg --with-fingerprint
gpg: WARNING:  Kein Kommando angegeben.  Versuche zu raten was gemeint ist ...
pub   rsa4096 2022-04-14 [SC]
uid           NVIDIA Linux Driver Team <linux-bugs@nvidia.com>
pub   rsa4096 2023-05-10 [SC] [verfällt: 2029-08-01]
uid           SUSE 16 Package Signing Key <build-suse16@suse.de>
pub   rsa4096 2025-05-14 [SC] [verfällt: 2036-04-26]
uid           openSUSE Backports for SUSE Linux 16 <sle-backports-202500514@opensuse.org>
pub   rsa4096 2022-06-20 [SC] [verfällt: 2030-05-27]
uid           openSUSE Project Signing Key <opensuse@opensuse.org>
pub   rsa2048 2022-05-13 [SC] [verfällt: 2026-09-16]
uid           X11:Drivers:Video OBS Project <X11:Drivers:Video@build.opensuse.org>
pub   rsa2048 2013-01-31 [SC] [verfällt: 2028-10-02]
uid           SuSE Package Signing Key <build@suse.de>
pub   rsa4096 2023-01-19 [SC] [verfällt: 2029-03-05]
uid           SUSE Package Signing Key <build@suse.de>
pub   rsa4096 2006-09-18 [SC] [verfällt: 2026-09-03]
uid           PackMan Project (signing key) <packman@links2linux.de>
pub   rsa4096 2016-04-12 [SC]
uid           Google Inc. (Linux Packages Signing Authority) <linux-packages-keymaster@google.com>
sub   rsa4096 2016-04-12 [S] [verfallen: 2019-04-12]
sub   rsa4096 2017-01-24 [S] [verfallen: 2020-01-24]
sub   rsa4096 2019-07-22 [S] [verfallen: 2022-07-21]
sub   rsa4096 2021-10-26 [S] [verfallen: 2024-10-25]
sub   rsa4096 2023-02-15 [S] [verfallen: 2026-02-14]
sub   rsa4096 2024-01-30 [S] [verfällt: 2027-01-29]
sub   rsa4096 2025-01-07 [S] [verfällt: 2028-01-07]
8

@hui

Thanks for the second command, with both commands I was able to delete 4 expired keys.

9

> rpm --query --all gpg-pubkey --queryformat='%{Description}' | LANG=C.UTF8 gpg --with-fingerprint

10

@hui:

Thanks – that’s what I was looking for.

But, I’ll leave the Enhancement <Bug 1270093> Change Request open for the moment.

Did the exercise of –

# rpmkeys --delete ???-???

followed by –

# zypper refresh --force

Opposed to the method with YaST Repository Management “GPG Keys”, the duplicate expired Keys remain deleted and, the expired Key for the VLC openSUSE Repository (Dominique Leuenberger) has now been replaced by a Key due to expire 2026-10-22 …

11

Back from :croatia: …

See https://github.com/shundhammer/myrlyn/issues/139

(more flexible for editing, and more permanent to serve as documenation for others who might have a similar question)

2 Likes
12

Some musings why YaST has to be put out of its misery

Software archaeology uncovers some zombies lurking deep down in the basement:

(comment #7)

This is just scratching the surface. Digging just a little deeper might cause the Zombie Apocalypse. :grimacing:

If you have any comments about this specific part, please add them here in the forum, not in the GitHub issue; I’d like to keep that one on topic with the key managerment. TIA.

2 Likes
13

@shundhammer:

Stefan, I’ve reopened <Bug 1270093> with a request to document the RPM CLI commands needed to inspect a given system’s RPM GPG Keyring.

Specifically:

  1. The RPM GPG Key Management for the case of Service Repositories (http://cdn.opensuse.org/) is fine - no issues.
  2. The RPM GPG Key Management for the case of non-Service Repositories (Packman, KDE: Extra, GNOME: Next, etc, etc …) isn’t so wonderful.
  3. There’s also the Use Case of “Commercial Repositories” - companies who offer commercial products for the openSUSE/SUSE platform …
    The company “SoftMaker” «located not so many kilometres from SUSE’s Nürnberg office» offers a commercial Office suite and other products which execute on Linux – and other operating systems.
1 Like
14

@shundhammer:

Stefan, thanks for accepting my reopened Request and, for reassigning it to the SUSE Security Team.

For those gentle readers who’re wondering about what’s going on here, a central point of RPM Repository Management is, the RPM GPG Keyring and, the Repository GPG Keys stored there.
If, the Keys are expired and/or outdated then, the trust in the RPM Repository disappears …

  • Therefore, Security …
1 Like
15

FYI, today on the Factory IRC I saw mentions about some expired signing key showing up. So, there seems to be an issue there too.

2 Likes