Zypper dup fails since a few days due to expired key signing file

English Install/Boot/Login
1

What it looks like in TW for days now for me:

sudo zypper ref -f
[sudo] password for root: 
Sorry, try again.
[sudo] password for root: 
Forcing raw metadata refresh
Warning: The gpg key signing file 'repomd.xml' has expired.
  Repository:       update
  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 16:03:14 CEST
  Key Expires:      Fri 19 Jun 2026 16:03:14 CEST (EXPIRED)
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22
Retrieving repository 'update' metadata .........................................................................................[done]
Forcing building of repository cache
Building repository 'update' cache ..............................................................................................[done]
Forcing raw metadata refresh
Retrieving repository 'NVIDIA' metadata .........................................................................................[done]
Forcing building of repository cache
Building repository 'NVIDIA' cache ..............................................................................................[done]
Forcing raw metadata refresh
Retrieving repository 'KDE:Unstable:Extra' metadata .............................................................................[done]
Forcing building of repository cache
Building repository 'KDE:Unstable:Extra' cache ..................................................................................[done]
Forcing raw metadata refresh
Warning: The gpg key signing file 'repomd.xml' has expired.
  Repository:       non-oss
  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 16:03:14 CEST
  Key Expires:      Fri 19 Jun 2026 16:03:14 CEST (EXPIRED)
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22
Retrieving repository 'non-oss' metadata ........................................................................................[done]
Forcing building of repository cache
Building repository 'non-oss' cache .............................................................................................[done]
Forcing raw metadata refresh
Warning: The gpg key signing file 'repomd.xml' has expired.
  Repository:       oss
  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 16:03:14 CEST
  Key Expires:      Fri 19 Jun 2026 16:03:14 CEST (EXPIRED)
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22
Retrieving repository 'oss' metadata ............................................................................................[done]
Forcing building of repository cache
Building repository 'oss' cache .................................................................................................[done]
Forcing raw metadata refresh
Retrieving repository 'packman' metadata ........................................................................................[done]
Forcing building of repository cache
Building repository 'packman' cache .............................................................................................[done]
All repositories have been refreshed.

…and dup fails with:

sudo zypper dup
Loading repository data...
Reading installed packages...
Warning: You are about to do a distribution upgrade with all enabled repositories. Make sure these repositories are compatible before you continue. See 'man zypper' for more information about this command.
Computing distribution upgrade...

The following 18 items are locked and will not be changed by any action:
 Available:
  akonadi-calendar akonadiconsole akonadi-contacts akonadi-search catfish discover6 geoclue2 kmail korganizer openSUSE-repos-Leap
  openSUSE-repos-Leap-NVIDIA openSUSE-repos-MicroOS openSUSE-repos-MicroOS-NVIDIA openSUSE-repos-Slowroll
  openSUSE-repos-Slowroll-NVIDIA openSUSE-repos-Tumbleweed openSUSE-repos-Tumbleweed-NVIDIA xf86-input-wacom

The following 258 packages are going to be upgraded:
  bash bash-doc bash-loadables bash-sh bind-utils blog branding-openSUSE checkmedia dracut ffmpeg-7 grub2-branding-openSUSE
  gstreamer-plugin-pipewire gstreamer-plugins-bad gstreamer-plugins-bad-lang ImageMagick ImageMagick-config-7-SUSE iproute2
  iproute2-bash-completion kaffeine kernel-firmware-amdgpu kernel-firmware-ath10k kernel-firmware-ath11k kernel-firmware-ath12k
  kernel-firmware-atheros kernel-firmware-bluetooth kernel-firmware-bnx2 kernel-firmware-brcm kernel-firmware-chelsio
  kernel-firmware-dpaa2 kernel-firmware-i915 kernel-firmware-intel kernel-firmware-iwlwifi kernel-firmware-liquidio
  kernel-firmware-marvell kernel-firmware-media kernel-firmware-mediatek kernel-firmware-mellanox kernel-firmware-mwifiex
  kernel-firmware-network kernel-firmware-nfp kernel-firmware-nvidia kernel-firmware-platform kernel-firmware-prestera
  kernel-firmware-qcom kernel-firmware-qlogic kernel-firmware-radeon kernel-firmware-realtek kernel-firmware-serial
  kernel-firmware-sound kernel-firmware-ti kernel-firmware-ueagle kernel-firmware-usb-network kquickimageeditor6-imports
  libavcodec58_134 libavcodec60 libavcodec61 libavcodec62 libavdevice61 libavfilter10 libavfilter11 libavfilter7_110 libavfilter9
  libavformat58_76 libavformat60 libavformat61 libavformat62 libavresample4_0 libavutil56_70 libavutil58 libavutil59 libavutil60
  libbacktrace0 libblogger2 libde265-0 libgbm1 libgbm1-32bit libgps32 libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0
  libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgsthip-1_0-0
  libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0
  libgstplayer-1_0-0 libgstsctp-1_0-0 libgsttranscoder-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0
  libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 libgtkmm-3_0-1 libidn12 libIex-3_4-33 libIex-3_4-33-x86-64-v3
  libIlmThread-3_4-33 libIlmThread-3_4-33-x86-64-v3 libixml11 libKQuickImageEditor1 libMagickCore-7_Q16HDRI10 libMagickWand-7_Q16HDRI10
  libmariadb3 libmozjs-140-0 libnm0 libnvidia-egl-gbm1 libnvidia-egl-gbm1-32bit libnvidia-egl-wayland1-32bit libnvidia-egl-x111
  libnvidia-egl-x111-32bit libopenconnect5 libOpenEXR-3_4-33 libOpenEXR-3_4-33-x86-64-v3 libOpenEXRCore-3_4-33
  libOpenEXRCore-3_4-33-x86-64-v3 libpipewire-0_3-0 libpostproc55_9 libpostproc57 libpostproc58 libpython3_11-1_0
  libpython3_11-1_0-x86-64-v3 libpython3_13-1_0 libpython3_13-1_0-x86-64-v3 libquicktime0 libreoffice-branding-openSUSE librtmp1
  libssh2-1 libstorage-ng1 libstorage-ng-lang libstorage-ng-ruby libswresample3_9 libswresample4 libswresample5 libswresample6
  libswscale5_9 libswscale7 libswscale8 libswscale9 liburing2 libvlc5 libvlccore9 libvmaf3 libvulkan_lvp libwireplumber-0_5-0
  libwireshark19 libwiretap16 libwsutil17 libxfce4ui-branding-openSUSE lrzip lsof Mesa Mesa-dri Mesa-libEGL1 Mesa-libGL1 Mesa-libva
  Mesa-vulkan-device-select MozillaFirefox MozillaFirefox-translations-common MozillaThunderbird MozillaThunderbird-openpgp-librnp
  MozillaThunderbird-translations-common NetworkManager NetworkManager-bluetooth NetworkManager-branding-openSUSE NetworkManager-lang
  NetworkManager-openvpn NetworkManager-openvpn-lang NetworkManager-tui NetworkManager-wwan nilfs-utils nmap nvidia-common-G06
  nvidia-compute-G06 nvidia-compute-G06-32bit nvidia-compute-utils-G06 nvidia-driver-G06-kmp-default nvidia-gl-G06 nvidia-gl-G06-32bit
  nvidia-modprobe nvidia-persistenced nvidia-userspace-meta-G06 nvidia-video-G06 nvidia-video-G06-32bit openconnect
  openconnect-bash-completion openconnect-lang openSUSE-build-key openSUSE-release openSUSE-release-appliance-custom
  patterns-base-apparmor patterns-base-base patterns-base-documentation patterns-base-enhanced_base patterns-base-minimal_base
  patterns-base-sw_management patterns-base-x11 patterns-base-x11_enhanced patterns-fonts-fonts patterns-fonts-fonts_opt pipewire
  pipewire-alsa pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools
  plymouth-branding-openSUSE postfix python311 python311-base python311-base-x86-64-v3 python311-curses python311-dbm
  python311-x86-64-v3 python313 python313-base python313-base-x86-64-v3 python313-curses python313-dbm python313-tk python313-x86-64-v3
  thunar-volman-branding-openSUSE typelib-1_0-NM-1_0 ucode-amd vim vim-data vim-data-common virtualbox virtualbox-qt vlc
  vlc-codec-gstreamer vlc-codecs vlc-lang vlc-noX vlc-qt wallpaper-branding-openSUSE wireplumber wireplumber-bash-completion wireshark
  wireshark-ui-qt xdg-desktop-portal xdg-desktop-portal-lang xkeyboard-config xkeyboard-config-lang xscreensaver xscreensaver-data
  xscreensaver-lang xxd yast2-qt-branding-openSUSE yast2-storage-ng

The following 10 patterns are going to be upgraded:
  apparmor base documentation enhanced_base fonts fonts_opt minimal_base sw_management x11 x11_enhanced

The following product is going to be upgraded:
  openSUSE Tumbleweed  20260618-0 -> 20260623-0

The following 6 NEW packages are going to be installed:
  libmediacheck7 libnilfs3 libnilfsgc3 libopenjph0_30 libupnp22 virtualbox-kmp-default-7.2.10_k7.0.12_1-1.1

The following 7 packages are going to be REMOVED:
  libmediacheck6 libnilfs0 libnilfscleaner0 libnilfsgc0 libopenjph0_29 libupnp20 virtualbox-kmp-default-7.2.8_k7.0.12_1-1.1

258 packages to upgrade, 6 new, 7 to remove.

Package download size:
            |      1.56 GiB  overall package size
       0 B  |  -   1.56 GiB  already in cache

Package install size change:
              |      3.57 GiB  required by packages that will be installed
    31.1 MiB  |  -   3.54 GiB  released by packages that will be removed

Backend:  classic_rpmtrans
Continue? [y/n/v/...? shows all options] (y): y
....
Checking for file conflicts: ....................................................................................................[done]
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
warning: /var/cache/zypp/packages/oss/noarch/ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch.rpm: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
        package ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch does not verify: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
(  1/271) Installing: ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch ............................................................[error]
Installation of ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch failed:
Error: Subprocess failed. Error: RPM failed: Command exited with status 2.
Abort, retry, ignore? [a/r/i] (a):

Help, please!

2

Post:
zypper lr -d

3

Force the installation of this package. It is in the update repo.

4

Here we go:

zypper lr -d
# | Alias                                | Name               | Enabled | GPG Check | Refresh | Keep | Priority | Type   | URI                                                                                    | Service
--+--------------------------------------+--------------------+---------+-----------+---------+------+----------+--------+----------------------------------------------------------------------------------------+--------
1 | NVIDIA                               | NVIDIA             | Yes     | (r ) Yes  | Yes     | -    |   99     | rpm-md | https://download.nvidia.com/opensuse/tumbleweed                                        | 
2 | https-download.opensuse.org-6cc0ac02 | KDE:Unstable:Extra | Yes     | (r ) Yes  | Yes     | -    |   92     | rpm-md | https://ftp.gwdg.de/pub/opensuse/repositories/KDE:/Unstable:/Extra/openSUSE_Tumbleweed | 
3 | non-oss                              | non-oss            | Yes     | (r ) Yes  | Yes     | -    |   99     | rpm-md | https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/                   | 
4 | oss                                  | oss                | Yes     | (r ) Yes  | Yes     | -    |   99     | rpm-md | https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/                       | 
5 | packman                              | packman            | Yes     | (r ) Yes  | Yes     | -    |   90     | rpm-md | https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Tumbleweed/                   | 
6 | update                               | update             | Yes     | (r ) Yes  | Yes     | -    |   99     | rpm-md | https://ftp.halifax.rwth-aachen.de/opensuse/update/tumbleweed/

I prefer to choose mirrors for “my” updates on my own, no CDN of any kind.

5

Have you done this?
zypper in -f https://download.opensuse.org/update/tumbleweed/x86_64/openSUSE-build-key-1.0-67.1.x86_64.rpm

1 Like
6 
sudo zypper in -f https://download.opensuse.org/update/tumbleweed/x86_64/openSUSE-build-key-1.0-67.1.x86_64.rpm
[sudo] password for root: 
'https://download.opensuse.org/update/tumbleweed/x86_64/openSUSE-build-key-1.0-67.1.x86_64.rpm' looks like an RPM file. Will try to use it.
Retrieving: openSUSE-build-key-1.0-67.1.x86_64.rpm .................................................[done]
Loading repository data...
Reading installed packages...
Forcing installation of 'openSUSE-build-key-1.0-67.1.x86_64' from repository 'Plain RPM files cache'.
Resolving package dependencies...

The following package is going to be upgraded:
  openSUSE-build-key

1 package to upgrade.

Package download size:    43.5 KiB

Package install size change:
            |      39.9 KiB  required by packages that will be installed
      -7 B  |  -   39.9 KiB  released by packages that will be removed

Backend:  classic_rpmtrans
Continue? [y/n/v/...? shows all options] (y): y
Retrieving: openSUSE-build-key-1.0-67.1.x86_64 (Plain RPM files cache)                (1/1),  43.5 KiB    
openSUSE-build-key-1.0-67.1.x86_64.rpm:
    Header V3 RSA/SHA512 Signature, key ID 35a2f86e29b700a4: NOTTRUSTED
    V3 RSA/SHA512 Signature, key ID 35a2f86e29b700a4: NOTTRUSTED

openSUSE-build-key-1.0-67.1.x86_64 (Plain RPM files cache): Signature verification failed [5-File does not exist or signature can't be checked]
Abort, retry, ignore? [a/r/i] (a): i

Checking for file conflicts: .......................................................................[done]
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
warning: /var/cache/zypper/RPMS/openSUSE-build-key-1.0-67.1.x86_64.rpm: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
        package openSUSE-build-key-1.0-67.1.x86_64 does not verify: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
(1/1) Installing: openSUSE-build-key-1.0-67.1.x86_64 ..............................................[error]
Installation of openSUSE-build-key-1.0-67.1.x86_64 failed:
Error: Subprocess failed. Error: RPM failed: Command exited with status 2.
Abort, retry, ignore? [a/r/i] (a): i

Doesn’t really help.

Forcing update in Yast → Software Management also fails with error

Screenshot_20260625_203405
Screenshot_20260625_2034051174×449 72.6 KB

so locked-in at old version of file

Screenshot_20260625_203255
Screenshot_20260625_2032551262×811 88.1 KB

7

Btw, I have this on about 6-7 TW installs, how to proceed?

Is there any way to force installation of this package without signingkey validation?

Help!

8

Just download the gpg key and import?

https://build.opensuse.org/projects/openSUSE:Factory/signing_keys

Or

wget https://build.opensuse.org/projects/openSUSE:Factory/signing_keys/download?kind=gpg -O openSUSE_Factory_key.gpg
rpm --import openSUSE_Factory_key.gpg
9

OK, I did:

> wget https://build.opensuse.org/projects/openSUSE:Factory/signing_keys/download?kind=gpg -O openSUSE_Factory_key.gpg
--2026-06-26 15:56:16--  https://build.opensuse.org/projects/openSUSE:Factory/signing_keys/download?kind=gpg
Resolving build.opensuse.org (build.opensuse.org)... 195.135.223.221, 2a07:de40:b250:131:10:151:131:20
Connecting to build.opensuse.org (build.opensuse.org)|195.135.223.221|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/octet-stream]
Saving to: ‘openSUSE_Factory_key.gpg’

openSUSE_Factory_key.gpg       [ <=>                                   ]   1.64K  --.-KB/s    in 0s      

2026-06-26 15:56:17 (562 MB/s) - ‘openSUSE_Factory_key.gpg’ saved [1680]

and then

> sudo rpm --import openSUSE_Factory_key.gpg
[sudo] password for root: 
>

But still get:

> sudo zypper dup
Retrieving repository 'KDE:Unstable:Extra' metadata ................................................[done]
Building repository 'KDE:Unstable:Extra' cache .....................................................[done]
Retrieving repository 'packman' metadata ...........................................................[done]
Building repository 'packman' cache ................................................................[done]
Loading repository data...
Reading installed packages...
Warning: You are about to do a distribution upgrade with all enabled repositories. Make sure these repositories are compatible before you continue. See 'man zypper' for more information about this command.
Computing distribution upgrade...

The following 18 items are locked and will not be changed by any action:
 Available:
  akonadi-calendar akonadiconsole akonadi-contacts akonadi-search catfish discover6 geoclue2 kmail
  korganizer openSUSE-repos-Leap openSUSE-repos-Leap-NVIDIA openSUSE-repos-MicroOS
  openSUSE-repos-MicroOS-NVIDIA openSUSE-repos-Slowroll openSUSE-repos-Slowroll-NVIDIA
  openSUSE-repos-Tumbleweed openSUSE-repos-Tumbleweed-NVIDIA xf86-input-wacom

The following 258 packages are going to be upgraded:
  bash bash-doc bash-loadables bash-sh bind-utils blog branding-openSUSE checkmedia dracut ffmpeg-7
  grub2-branding-openSUSE gstreamer-plugin-pipewire gstreamer-plugins-bad gstreamer-plugins-bad-lang
  ImageMagick ImageMagick-config-7-SUSE iproute2 iproute2-bash-completion kaffeine kernel-firmware-amdgpu
  kernel-firmware-ath10k kernel-firmware-ath11k kernel-firmware-ath12k kernel-firmware-atheros
  kernel-firmware-bluetooth kernel-firmware-bnx2 kernel-firmware-brcm kernel-firmware-chelsio
  kernel-firmware-dpaa2 kernel-firmware-i915 kernel-firmware-intel kernel-firmware-iwlwifi
  kernel-firmware-liquidio kernel-firmware-marvell kernel-firmware-media kernel-firmware-mediatek
  kernel-firmware-mellanox kernel-firmware-mwifiex kernel-firmware-network kernel-firmware-nfp
  kernel-firmware-nvidia kernel-firmware-platform kernel-firmware-prestera kernel-firmware-qcom
  kernel-firmware-qlogic kernel-firmware-radeon kernel-firmware-realtek kernel-firmware-serial
  kernel-firmware-sound kernel-firmware-ti kernel-firmware-ueagle kernel-firmware-usb-network
  kquickimageeditor6-imports libavcodec58_134 libavcodec60 libavcodec61 libavcodec62 libavdevice61
  libavfilter10 libavfilter11 libavfilter7_110 libavfilter9 libavformat58_76 libavformat60 libavformat61
  libavformat62 libavresample4_0 libavutil56_70 libavutil58 libavutil59 libavutil60 libbacktrace0
  libblogger2 libde265-0 libgbm1 libgbm1-32bit libgps32 libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0
  libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0
  libgstcuda-1_0-0 libgsthip-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0
  libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstplayer-1_0-0 libgstsctp-1_0-0
  libgsttranscoder-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0
  libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 libgtkmm-3_0-1 libidn12 libIex-3_4-33 libIex-3_4-33-x86-64-v3
  libIlmThread-3_4-33 libIlmThread-3_4-33-x86-64-v3 libixml11 libKQuickImageEditor1
  libMagickCore-7_Q16HDRI10 libMagickWand-7_Q16HDRI10 libmariadb3 libmozjs-140-0 libnm0 libnvidia-egl-gbm1
  libnvidia-egl-gbm1-32bit libnvidia-egl-wayland1-32bit libnvidia-egl-x111 libnvidia-egl-x111-32bit
  libopenconnect5 libOpenEXR-3_4-33 libOpenEXR-3_4-33-x86-64-v3 libOpenEXRCore-3_4-33
  libOpenEXRCore-3_4-33-x86-64-v3 libpipewire-0_3-0 libpostproc55_9 libpostproc57 libpostproc58
  libpython3_11-1_0 libpython3_11-1_0-x86-64-v3 libpython3_13-1_0 libpython3_13-1_0-x86-64-v3
  libquicktime0 libreoffice-branding-openSUSE librtmp1 libssh2-1 libstorage-ng1 libstorage-ng-lang
  libstorage-ng-ruby libswresample3_9 libswresample4 libswresample5 libswresample6 libswscale5_9
  libswscale7 libswscale8 libswscale9 liburing2 libvlc5 libvlccore9 libvmaf3 libvulkan_lvp
  libwireplumber-0_5-0 libwireshark19 libwiretap16 libwsutil17 libxfce4ui-branding-openSUSE lrzip lsof
  Mesa Mesa-dri Mesa-libEGL1 Mesa-libGL1 Mesa-libva Mesa-vulkan-device-select MozillaFirefox
  MozillaFirefox-translations-common MozillaThunderbird MozillaThunderbird-openpgp-librnp
  MozillaThunderbird-translations-common NetworkManager NetworkManager-bluetooth
  NetworkManager-branding-openSUSE NetworkManager-lang NetworkManager-openvpn NetworkManager-openvpn-lang
  NetworkManager-tui NetworkManager-wwan nilfs-utils nmap nvidia-common-G06 nvidia-compute-G06
  nvidia-compute-G06-32bit nvidia-compute-utils-G06 nvidia-driver-G06-kmp-default nvidia-gl-G06
  nvidia-gl-G06-32bit nvidia-modprobe nvidia-persistenced nvidia-userspace-meta-G06 nvidia-video-G06
  nvidia-video-G06-32bit openconnect openconnect-bash-completion openconnect-lang openSUSE-build-key
  openSUSE-release openSUSE-release-appliance-custom patterns-base-apparmor patterns-base-base
  patterns-base-documentation patterns-base-enhanced_base patterns-base-minimal_base
  patterns-base-sw_management patterns-base-x11 patterns-base-x11_enhanced patterns-fonts-fonts
  patterns-fonts-fonts_opt pipewire pipewire-alsa pipewire-modules-0_3 pipewire-pulseaudio
  pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools plymouth-branding-openSUSE postfix python311
  python311-base python311-base-x86-64-v3 python311-curses python311-dbm python311-x86-64-v3 python313
  python313-base python313-base-x86-64-v3 python313-curses python313-dbm python313-tk python313-x86-64-v3
  thunar-volman-branding-openSUSE typelib-1_0-NM-1_0 ucode-amd vim vim-data vim-data-common virtualbox
  virtualbox-qt vlc vlc-codec-gstreamer vlc-codecs vlc-lang vlc-noX vlc-qt wallpaper-branding-openSUSE
  wireplumber wireplumber-bash-completion wireshark wireshark-ui-qt xdg-desktop-portal
  xdg-desktop-portal-lang xkeyboard-config xkeyboard-config-lang xscreensaver xscreensaver-data
  xscreensaver-lang xxd yast2-qt-branding-openSUSE yast2-storage-ng

The following 10 patterns are going to be upgraded:
  apparmor base documentation enhanced_base fonts fonts_opt minimal_base sw_management x11 x11_enhanced

The following product is going to be upgraded:
  openSUSE Tumbleweed  20260618-0 -> 20260623-0

The following 6 NEW packages are going to be installed:
  libmediacheck7 libnilfs3 libnilfsgc3 libopenjph0_30 libupnp22
  virtualbox-kmp-default-7.2.10_k7.0.12_1-1.1

The following 7 packages are going to be REMOVED:
  libmediacheck6 libnilfs0 libnilfscleaner0 libnilfsgc0 libopenjph0_29 libupnp20
  virtualbox-kmp-default-7.2.8_k7.0.12_1-1.1

258 packages to upgrade, 6 new, 7 to remove.

Package download size:
            |      1.56 GiB  overall package size
       0 B  |  -   1.56 GiB  already in cache

Package install size change:
              |      3.57 GiB  required by packages that will be installed
    31.1 MiB  |  -   3.54 GiB  released by packages that will be removed

Backend:  classic_rpmtrans
Continue? [y/n/v/...? shows all options] (y): y
......
In cache kaffeine-2.0.40git.20260622T015035~592f5df-334.2.x86_64.rpm              (264/264),   2.3 MiB    

Checking for file conflicts: .......................................................................[done]
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
warning: /var/cache/zypp/packages/oss/noarch/ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch.rpm: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
error: Key 35a2f86e29b700a4 (openSUSE Project Signing Key <opensuse@opensuse.org>) expired on 2026-06-19 16:03:14
        package ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch does not verify: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED
(  1/271) Installing: ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch ...............................[error]
Installation of ImageMagick-config-7-SUSE-7.1.2.25-2.1.noarch failed:
Error: Subprocess failed. Error: RPM failed: Command exited with status 2.
Abort, retry, ignore? [a/r/i] (a):

Reboot or some magic needed?

10

I’d suggest a zypper -vvv ref -f and shouldn’t see any errors? Then try zypper -vvv dup

Note: I never use sudo, so have no idea of potential implications of using, all I can say I never have issues with updates or any admin tasks…

11

Did a reboot in the meantime, but:

There are still the expired keys!

~> sudo zypper -vvv ref -f
[sudo] password for root: 
Verbosity: 3
Initialising Target
Specified repositories: 
Forcing raw metadata refresh
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/update/tumbleweed/repodata/repomd.xml ......[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/update/tumbleweed/repodata/repomd.[done (827 B/s)]
Warning: The gpg key signing file 'repomd.xml' has expired.
  Repository:       update
  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 16:03:14 CEST
  Key Expires:      Fri 19 Jun 2026 16:03:14 CEST (EXPIRED)
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/update/tumbleweed/repodata/17dac3c403256d86d[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/update/tumbleweed/repodata/609fa446c6b028d2a[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/update/tumbleweed/repodata/1c5cd8e33993bd592[done]
Retrieving repository 'update' metadata ............................................................[done]
Forcing building of repository cache
Building repository 'update' cache .................................................................[done]
Forcing raw metadata refresh
Retrieving: https://download.nvidia.com/opensuse/tumbleweed/repodata/repomd.xml ....................[done]
Retrieving: https://download.nvidia.com/opensuse/tumbleweed/repodata/repomd.xml.asc ......[done (836 B/s)]
  Repository:       NVIDIA
  Key Fingerprint:  2FB0 3195 DECD 4949 2BD1 C17A B1D0 D788 DB27 FD5A
  Key Name:         NVIDIA Linux Driver Team <linux-bugs@nvidia.com>
  Key Algorithm:    RSA 4096
  Key Created:      Fri 15 Apr 2022 00:04:01 CEST
  Key Expires:      (does not expire)
  Rpm Name:         gpg-pubkey-db27fd5a-62589a51
Retrieving: https://download.nvidia.com/opensuse/tumbleweed/repodata/b097083ff67a04fcb[done (160.0 KiB/s)]
Retrieving: https://download.nvidia.com/opensuse/tumbleweed/repodata/susedata.xml.gz ...............[done]
Retrieving repository 'NVIDIA' metadata ............................................................[done]
Forcing building of repository cache
Building repository 'NVIDIA' cache .................................................................[done]
Forcing raw metadata refresh
Retrieving: https://ftp.gwdg.de/pub/opensuse/repositories/KDE:/Unstable:/Extra/openSUSE_Tumbleweed/r[done]
Retrieving: https://ftp.gwdg.de/pub/opensuse/repositories/KDE:/Unstable:/Extra/openSUSE_Tu[done (189 B/s)]
  Repository:       KDE:Unstable:Extra
  Key Fingerprint:  4A3E 0756 2634 7342 E1A3 F257 2E85 BAEE 9EBD 09C4
  Key Name:         KDE:Unstable OBS Project <KDE:Unstable@build.opensuse.org>
  Key Algorithm:    DSA 1024
  Key Created:      Fri 30 May 2025 20:59:16 CEST
  Key Expires:      Sun 08 Aug 2027 20:59:16 CEST
  Rpm Name:         gpg-pubkey-9ebd09c4-683a0004
Retrieving: https://ftp.gwdg.de/pub/opensuse/repositories/KDE:/Unstable:/Extra/openSUS[done (463.6 KiB/s)]
Retrieving: https://ftp.gwdg.de/pub/opensuse/repositories/KDE:/Unstable:/Extra/openSUSE_Tumbleweed/r[done]
Retrieving repository 'KDE:Unstable:Extra' metadata ................................................[done]
Forcing building of repository cache
Building repository 'KDE:Unstable:Extra' cache .....................................................[done]
Forcing raw metadata refresh
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/media.1/me[done (111 B/s)]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/repodata/repomd.xml [done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/repodata/r[done (827 B/s)]
Warning: The gpg key signing file 'repomd.xml' has expired.
  Repository:       non-oss
  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 16:03:14 CEST
  Key Expires:      Fri 19 Jun 2026 16:03:14 CEST (EXPIRED)
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/repodata/d9f1e692a7c[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/repodata/5c1bd0ce4a0[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/repodata/ca2bf2dc563[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/non-oss/repodata/4dbf5093c77[done]
Retrieving repository 'non-oss' metadata ...........................................................[done]
Forcing building of repository cache
Building repository 'non-oss' cache ................................................................[done]
Forcing raw metadata refresh
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/media.1/media .[done (85 B/s)]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/repodata/repomd.xml ....[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/repodata/repom[done (827 B/s)]
Warning: The gpg key signing file 'repomd.xml' has expired.
  Repository:       oss
  Key Fingerprint:  AD48 5664 E901 B867 051A B15F 35A2 F86E 29B7 00A4
  Key Name:         openSUSE Project Signing Key <opensuse@opensuse.org>
  Key Algorithm:    RSA 4096
  Key Created:      Mon 20 Jun 2022 16:03:14 CEST
  Key Expires:      Fri 19 Jun 2026 16:03:14 CEST (EXPIRED)
  Rpm Name:         gpg-pubkey-29b700a4-62b07e22
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/repodata/57c[done (6.8 MiB/s)]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/repodata/f3c[done (3.2 MiB/s)]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/repodata/06a00321035620d[done]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/repodata/39[done (15.0 MiB/s)]
Retrieving: https://ftp.halifax.rwth-aachen.de/opensuse/tumbleweed/repo/oss/repodata/808[done (4.2 MiB/s)]
Retrieving repository 'oss' metadata ...............................................................[done]
Forcing building of repository cache
Building repository 'oss' cache ....................................................................[done]
Forcing raw metadata refresh
Retrieving: https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Tumbleweed/repodata/repomd.xml [done]
Retrieving: https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Tumbleweed/repodata/r[done (836 B/s)]
  Repository:       packman
  Key Fingerprint:  F887 5B88 0D51 8B6B 8C53 0D13 45A1 D067 1ABD 1AFB
  Key Name:         PackMan Project (signing key) <packman@links2linux.de>
  Key Algorithm:    RSA 4096
  Key Created:      Tue 03 Sep 2024 22:21:04 CEST
  Key Expires:      Thu 03 Sep 2026 22:20:39 CEST (expires in 69 days)
  Rpm Name:         gpg-pubkey-1abd1afb-66d76fb0
Retrieving: https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Tumbleweed/repodata[done (1.6 MiB/s)]
Retrieving repository 'packman' metadata ...........................................................[done]
Forcing building of repository cache
Building repository 'packman' cache ................................................................[done]
All repositories have been refreshed.
12

Try a reboot, but likely a Mirror issue, so you would need to contact the mirror admin at halifax.rwth-aachen.de to find out.

Use download.opensuse.org or cdn and I suspect the error will go away…

13

There was a post on reddit about the expired keys.
Maybe the problem here is related to this.

Bildschirmfoto_20260626_164008
Bildschirmfoto_20260626_164008762×260 47 KB

14

Not had any issues here (four Tumbleweed systems)…

zypper if openSUSE-build-key

Information for package openSUSE-build-key:
-------------------------------------------
Repository     : Main Update Repository
Name           : openSUSE-build-key
Version        : 1.0-67.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 39.9 KiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : openSUSE-build-key-1.0-67.1.src
Upstream URL   : https://en.opensuse.org/openSUSE:Security_team
Summary        : The public gpg keys for rpm package signature verification

Key: 35A2F86E29B700A4
Name: openSUSE Project Signing Key <opensuse@opensuse.org>
Finger Print: AD485664E901B867051AB15F35A2F86E29B700A4
Created: 05/28/2026
Expires: 05/27/2030
15

I don’t want to use CDN or opensuse.download. There has to be a solution for this like with any other linux distri where I can choose dedicated, specific mirrors for updates.

16

fwiw:

:/usr/lib/rpm/gnupg/keys> ls -al
total 32
drwxr-xr-x 2 root root 4096 May 31 11:06 .
drwxr-xr-x 3 root root 4096 May 28 10:31 ..
-rw-r--r-- 1 root root 1680 May 28 10:31 gpg-pubkey-09d9ea69-68595a8c.asc
-rw-r--r-- 1 root root 1968 May 28 10:31 gpg-pubkey-287a0027-682477e3.asc
-rw-r--r-- 1 root root 1687 May 28 10:31 gpg-pubkey-29b700a4-62b07e22.asc
-rw-r--r-- 1 root root 1680 May 28 10:31 gpg-pubkey-29b700a4-6a17fa38.asc
-rw-r--r-- 1 root root  969 May 28 10:31 gpg-pubkey-39db7c82-66c5d91a.asc
-rw-r--r-- 1 root root 1665 May 28 10:31 gpg-pubkey-3fa1d6ce-67c856ee.asc
17

Is the build key version 1.0-67.1 installed?

Delete the old key and install the new one…

18

Show as root executed:
rpmkeys --list

19 
here we go:

sudo rpmkeys --list
[sudo] password for root:
3fa1d6ce-63c9481c: SUSE Package Signing Key build@suse.de public key
9ebd09c4-4c4eb9ea: KDE:Unstable OBS Project KDE:Unstable@build.opensuse.org public key
39db7c82-5f68629b: SuSE Package Signing Key build@suse.de public key
3dbdc284-53674dd4: openSUSE Project Signing Key opensuse@opensuse.org public key
09d9ea69-645b99ce: ALP Package Signing Key build-alp@suse.de public key
c66b6eae-4491871e: NVIDIA Corporation linux-bugs@nvidia.com public key
29b700a4-62b07e22: openSUSE Project Signing Key opensuse@opensuse.org public key
287a0027-682477e3: openSUSE Backports for SUSE Linux 16 sle-backports-202500514@opensuse.org public key
db27fd5a-62589a51: NVIDIA Linux Driver Team linux-bugs@nvidia.com public key
1abd1afb-450ef738: PackMan Project (signing key) packman@links2linux.de public key

20

As shown in screenshop above: 10.0-66.1 is installed and can’t be updated, due to expired signing key.