Rpm signature verification failure

English Applications
1

Hi all, why does this RPM fail to install with zypper?
“proton-pass-1.38.1-1.x86_64 (Plain RPM files cache): Signature verification failed [6-File is unsigned]”
Is it safe to ignore this warning and proceed with the install?

2

You are installing an unsigned external package. You must decide if it is safe for you.

1 Like
3

Thank you, hui.
Roci

4

RPM packages should be signed and have a repo to get regular updates. :closed_lock_with_key:
If not, it’s better to get a flatpak or AppImage. :package:

5

Hi, all.
All sorted decided to install as from a very reputable source and they shouldn’t need updating that often.
Regards and thanks.
Roci

6

I’ve noticed essentially the same thing, only recently, when I use wget to fetch an rpm from standard repos, or copy from zypp cache after download-only up or dup, to save on LAN server and install on multiple local installations using rpm, that sometimes I have to use --noverify to get it installed or updated. Whether it happens using zypper instead of rpm I’ve yet to try to determine. It doesn’t seem to be readily reproducible. Whether both Leap and TW/SR or not I haven’t noticed either.

7

Just saying: a very reputable source signs their packages.

8

Still, a very reputable source though. Company associated with secure mobile apps, which is why I installed it!
Roci.

9

that does not do the basic thing of signing their apps. You trust them, but that does not make it a reputable, trustworthy source. And, “secure mobile apps”? “Contradictio in terminis” comes to mind.

10 
rpm -qip proton-pass-1.39.1-1.x86_64.rpm 
Name        : proton-pass
Version     : 1.39.1
Release     : 1
Architecture: x86_64
Install Date: (not installed)
Group       : Unspecified
Size        : 386847038
License     : GPL-3.0
Signature   : (none)
Source RPM  : proton-pass-1.39.1-1.src.rpm
Build Date  : Mo 10 Aug 2026 16:49:26 CEST
Build Host  : runner-tmd4pyruq-project-1368-concurrent-11-1pno4r89
URL         : https://proton.me/pass
Summary     : Proton Pass desktop application
Description :
Open-source and secure identity manager.
Distribution: (none)

No Signature

And this for a passordmanager…

1 Like
11

No, I don’t use Proton, but here’s a bit of assistance:

( and NO , I would NOT install an RPM that I could not verify ).

… from the webpage link below …

Fedora/ Red Hat-based distros

  1. Download the Proton Pass RPM file.
  2. Confirm the package’s integrity. To find the SHA512CheckSum for the latest version of this package, open this JSON file(new window) in a text editor. To verify its checksum, run this command:

echo “ ProtonPass.rpm” | sha512sum --check -

  1. Open a terminal window in the directory you downloaded the file to (typically your Downloads folder). Run:
    sudo rpm -i --force ProtonPass.rpm
  2. Sign into your Proton Pass account.
    … end
12

Hey, man. I’m getting on and like to live dangerously, now and then! It was interesting to do and experiencing the installation procedure for a rpm.
Just read your post @myswtest , thank you. I have now learnt to delve into the information sources available before committing myself to performing insecure tasks?

As it is I’m going to uninstall as I can’t see me using this that often!
Roci.