Problem
Even if I provide --gpg-auto-import-keys option to the refresh command, zypper warns about me unknown key. Theoretically, it should be simply importing and trusting the key, but that is not happening.
bash-4.3# zypper --gpg-auto-import-keys refresh gitlab_gitlab-ee
Retrieving repository 'gitlab_gitlab-ee' metadata ----------------------------------------------------------------------------------------------------------------------------|]
Warning: File 'repomd.xml' from repository 'gitlab_gitlab-ee' is signed with an unknown key '14219A96E15E78F4'.
Note: Signing data enables the recipient to verify that no modifications occurred after the data
were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
and in extreme cases even to a system compromise.
Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
whole repo.
Warning: We can't verify that no one meddled with this file, so it might not be trustworthy
anymore! You should not continue unless you know it's safe.
File 'repomd.xml' from repository 'gitlab_gitlab-ee' is signed with an unknown key '14219A96E15E78F4'. Continue? [yes/no] (no):
I also tried the following to see if it fixed, with no luck.
Run the command in non-interactive mode. Because the man page says
--gpg-auto-import-keys
If new repository signing key is found, do not ask what to do; trust and import it automatically. This
option causes that the new key is imported also in non-interactive mode, where it would otherwise got
rejected.
Manually get the keys to my keychain using gpg --recv-keys and then trying zypper refresh
Any help would be appreciated as I fail to see why this happens. Thanks.
Nothing wrong catches my eye although I’d suggest running your refresh command without specifying the repo name… The command without specifying the repo will automatically accept keys for all repos as needed, and removes a possible point of error (specifying the repo correctly).
So, as follows(see if the following works)
zypper --gpg-auto-import-keys ref
Also,
To make your provided info complete (and incidentally possibly confirming mis-identifying the repo), you should also post the command you used to add the repo and/or the installed repo as follows(I’m suggesting the general command to list all your repos on the chance that specifying the individual repo might be faulty)
Thanks for the reply. I manually added the repo by creating a file in /etc/zypp/repos.d and pasting the contents I gave above. The output of the command you suggested is
**One thing that caught my eye is the (p) Yes under GPGCheck column. What does that mean? Will that have any effect?
**
Also, trying refresh without specifying any repo name also didn’t work
bash-4.3# zypper --gpg-auto-import-keys ref
Repository 'NON OSS' is up to date.
Repository 'NON OSS Update' is up to date.
Repository 'OSS' is up to date.
Repository 'OSS Update' is up to date.
Retrieving repository 'gitlab_gitlab-ee' metadata ----------------------------------------------------------------------------------------------------------------------------|]
Warning: File 'repomd.xml' from repository 'gitlab_gitlab-ee' is signed with an unknown key '14219A96E15E78F4'.
Note: Signing data enables the recipient to verify that no modifications occurred after the data
were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
and in extreme cases even to a system compromise.
Note: File 'repomd.xml' is the repositories master index file. It ensures the integrity of the
whole repo.
Warning: We can't verify that no one meddled with this file, so it might not be trustworthy
anymore! You should not continue unless you know it's safe.
File 'repomd.xml' from repository 'gitlab_gitlab-ee' is signed with an unknown key '14219A96E15E78F4'. Continue? [yes/no] (no):
On Sat 16 Dec 2017 03:36:01 PM CST, balasankarc wrote:
Hi tsu2,
tsu2;2848193 Wrote:
> Nothing wrong catches my eye although I’d suggest running your refresh
> command without specifying the repo name… The command without
> specifying the repo will automatically accept keys for all repos as
> needed, and removes a possible point of error (specifying the repo
> correctly).
>
> So, as follows(see if the following works)
> >
Code:
> > zypper --gpg-auto-import-keys ref
> >
>
> Also,
> To make your provided info complete (and incidentally possibly
> confirming mis-identifying the repo), you should also post the command
> you used to add the repo and/or the installed repo as follows(I’m
> suggesting the general command to list all your repos on the chance
> that specifying the individual repo might be faulty)
> >
Code:
> > zypper lr -d
> >
>
> TSU
Thanks for the reply. I manually added the repo by creating a file in
/etc/zypp/repos.d and pasting the contents I gave above. The output of
the command you suggested is
Code:
bash-4.3# zypper lr -d
Repository priorities are without effect. All enabled repositories
share the same priority.
*One thing that caught my eye is the (p) Yes under GPGCheck column. What
does that mean? Will that have any effect?
*
Also, trying refresh without specifying any repo name also didn’t work
Code:
bash-4.3# zypper --gpg-auto-import-keys ref
Repository ‘NON OSS’ is up to
date. Repository ‘NON OSS Update’ is up to
date. Repository ‘OSS’ is up to
date. Repository ‘OSS Update’ is up to
date. Retrieving repository ‘gitlab_gitlab-ee’ metadata
----------------------------------------------------------------------------------------------------------------------------|]
Warning: File ‘repomd.xml’ from repository ‘gitlab_gitlab-ee’ is signed
with an unknown key ‘14219A96E15E78F4’. Note: Signing data enables the
recipient to verify that no modifications occurred after the data were
signed. Accepting data with no, wrong or unknown signature can lead to
a corrupted system and in extreme cases even to a system compromise.
Note: File ‘repomd.xml’ is the repositories master index file. It
ensures the integrity of the whole repo.
Warning: We can’t verify that no one meddled with this file, so it
might not be trustworthy anymore! You should not continue unless you
know it’s safe.
File ‘repomd.xml’ from repository ‘gitlab_gitlab-ee’ is signed with
an unknown key ‘14219A96E15E78F4’. Continue? [yes/no] (no):
–
Cheers Malcolm °¿° SUSE Knowledge Partner (Linux Counter #276890)
openSUSE Leap 42.2|GNOME 3.20.2|4.4.92-18.36-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!
The original question was why wasn’t zypper auto-importing the key, as the flag is supposed to make it do. The key is available in public keyservers like pgp.mit.edu. Also, I had already tried out the following method
When I open the URL of your repo in a web browser, I get an empty page when I expect to see various files including a repo definition file.
So,
You’ve got to fix that.
Then,
I’d also recommend adding your repo using the zypper command line because it leaves less possibility for making a mistake. For instance, I can’t check because your path currently leads to an empty page but I would test whether your first entry for the GPG key is necessary or correct.
I’d recommend first deleting (or moving elsewhere) your current repo file (client side) and then when the URL actually points to something running something like the following
zypper ar -f https://packages.gitlab.com/gitlab/gitlab-ee/opensuse/42.2/SRPMS && zypper --gpg-auto-import-keys ref
