I deleted the “extra” key, then tried to refresh the “extra” repo, but same message.
So then I deleted ALL the keys.
Now it’s saying,
Import Untrusted GnuPG Key
The following GnuPG key has been found in repository
Main Update Repository
....
I cannot remember if this is normal when I first installed the system or not. The fingerprint and expiration matches what you gave.
I said trust.
But then it pops up with Validation Check Failed
File repomd.xml from …
is signed with the following GnuPG key, but the integrity check failed:
…
There is a Snapper snapshot on 6/21/17 which is the last time I was able to update the system.
There is also a snapshot at 6/20. Should I select all items at the 6/20 or 6/21 snapshot and click restore selected? Could that fix the problem without causing others? There was a kernel update then.
Repository priorities are without effect. All enabled repositories share the same priority.
Meaning meaningless? I wanted my local large downloads to be used before using my slow internet for others. Not exactly sure that ever worked, though.
I deleted all repositories, did a
zypper ls
No services defined. Use the 'zypper addservice' command to add one or more services.
zypper clean -a
Could not clean the repositories because of errors.
Maybe expected?
Then added only:
zypper ar -f -n "Main Update Repository" -t rpm-md http://download.opensuse.org/update/leap/42.2/oss download.opensuse.org-oss_1
zypper --gpg-auto-import-keys ref
Retrieving repository 'Main Update Repository' metadata -------------------------------------------------------------------------\]
Automatically importing the following key:
Repository: Main Update Repository
Key Name: openSUSE Project Signing Key <opensuse@opensuse.org>
Key Fingerprint: 22C07BA5 34178CD0 2EFE22AA B88B2FD4 3DBDC284
Key Created: Mon May 5 03:37:40 2014
Key Expires: Thu May 2 03:37:40 2024
Rpm Name: gpg-pubkey-3dbdc284-53674dd4
Signature verification failed for file 'repomd.xml' from repository 'Main Update Repository'.
Warning: This might be caused by a malicious change in the file!
Continuing might be risky. Continue anyway? [yes/no] (no):
zypper ref
Retrieving repository 'KDE:Extra' metadata --------------------------------------------------------------------------------------|]
New repository or package signing key received:
Repository: KDE:Extra
Key Name: KDE:Extra OBS Project <KDE:Extra@build.opensuse.org>
Key Fingerprint: 1A04160E 8C77D8FE 43CA364B 20F8C4F4 0D210A40
Key Created: Thu Oct 27 14:38:47 2016
Key Expires: Sat Jan 5 13:38:46 2019
Rpm Name: gpg-pubkey-0d210a40-581257c7
Do you want to reject the key, trust temporarily, or trust always? [r/t/a/? shows all options] (r): t
Signature verification failed for file 'repomd.xml' from repository 'KDE:Extra'.
Warning: This might be caused by a malicious change in the file!
Continuing might be risky. Continue anyway? [yes/no] (no): n
Seems like something’s not being cleared out or set up.
rpm -qa |grep pubkey
(nothing)
rpm -e gpg-pubkey-3dbdc284-53674dd4
error: package gpg-pubkey-3dbdc284-53674dd4 is not installed
zypper ref
Retrieving repository 'KDE:Extra' metadata --------------------------------------------------------------------------------------|]
New repository or package signing key received:
Repository: KDE:Extra
Key Name: KDE:Extra OBS Project <KDE:Extra@build.opensuse.org>
Key Fingerprint: 1A04160E 8C77D8FE 43CA364B 20F8C4F4 0D210A40
Key Created: Thu Oct 27 14:38:47 2016
Key Expires: Sat Jan 5 13:38:46 2019
Rpm Name: gpg-pubkey-0d210a40-581257c7
Do you want to reject the key, trust temporarily, or trust always? [r/t/a/? shows all options] (r): t
Signature verification failed for file 'repomd.xml' from repository 'KDE:Extra'.
Warning: This might be caused by a malicious change in the file!
Continuing might be risky. Continue anyway? [yes/no] (no):
The local repos didn’t have the verification message. I assume no verification needed. Since Packman is included, it’s not opensuse issue, besides no one else having it. It’s almost like my system is calculating the verification incorrectly. Or using a different charset. Is there some verification program/script which could have gotten damaged and I could download a new copy?
