Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Skipped PGP checks - but not sure which package or repo #1311

Closed
praiskup opened this issue Mar 14, 2024 · 3 comments · Fixed by #1459
Closed

Skipped PGP checks - but not sure which package or repo #1311

praiskup opened this issue Mar 14, 2024 · 3 comments · Fixed by #1459
Assignees
@j-mracek
Labels
Priority: LOW RFE Request For Enhancement (as opposed to a bug) Triaged Someone on the DNF 5 team has read the issue and determined the next steps to take

Comments

@praiskup
Copy link
Member 

$ sudo dnf5 update --refresh
..
Total size of inbound packages is 408 MiB. Need to download 408 MiB.
After this operation 2 MiB will be used (install 963 MiB, remove 961 MiB).
Is this ok [y/N]: y
...
Warning: skipped PGP checks for 1 package(s).

It would be nice if DNF5 admitted what packages are guilty.
@jan-kolarik jan-kolarik added Priority: LOW Triaged Someone on the DNF 5 team has read the issue and determined the next steps to take RFE Request For Enhancement (as opposed to a bug) labels Mar 15, 2024
@ppisar
Copy link
Contributor

ppisar commented Mar 15, 2024

I believe that it simply pertains repositories which have signature verification disabled. (Either specifically in the repository configuration, or globally for all of them.) Otherwise, RPM would reject installing that package.

If somebody will ever implement listing the packages, bear in mind the list can amount hundreds of packages, typically when installing packages directly from Koji repositories. In that case the output would be pretty annoying. Especially when the user consented to no verification before invoking DNF.

If the current message indeed corresponds to repository configuration, it would be better to list the affected repositories, preferably before the user confirms the transaction, instead of listing packaged after the sin^Wtransaction was committed.

@j-mracek
Copy link
Member

What about to only extend message and include IDs of repositories, because as it was mentioned skipping is not per package property, but per repository including commandline repository.

What about something like Warning: skipped PGP checks for 1 package(s) from 'fedora' repository.

@praiskup
Copy link
Member Author

I believe that it simply pertains repositories which have signature verification disabled. (Either specifically in the repository configuration, or globally for all of them.) Otherwise, RPM would reject installing that package.

Don't we want to drop the warning, then? I mean, if I (intentionally) use gpgcheck=0, the warning seems to raise eyebrows unnecessarily.

@j-mracek j-mracek self-assigned this Apr 26, 2024
j-mracek added a commit to j-mracek/dnf5 that referenced this issue Apr 29, 2024
@j-mracek
Enhance warning about RPMs that were not validate by RPM
0efcfd9 
DNF5 informs about number of packages that signature was not
verified, but without any additional detail. The ID of repository
provides a good hint for user why the check was skipped.

Closes: rpm-software-management#1311
@j-mracek j-mracek mentioned this issue Apr 29, 2024
Merged
j-mracek added a commit to j-mracek/dnf5 that referenced this issue May 21, 2024
@j-mracek
Enhance warning about RPMs that were not validate by RPM
2ddb0b3 
DNF5 informs about number of packages that signature was not
verified, but without any additional detail. The ID of repository
provides a good hint for user why the check was skipped.

Closes: rpm-software-management#1311
j-mracek added a commit to j-mracek/dnf5 that referenced this issue May 27, 2024
@j-mracek
Enhance warning about RPMs that were not validate by RPM
13672b6 
DNF5 informs about number of packages that signature was not
verified, but without any additional detail. The ID of repository
provides a good hint for user why the check was skipped. The behavior
is related to configuration options which some of them  are repo
specific or specific for commandline repository. If user wants to verify
everything, the hint provides sufficient information which configuration
of repository should be modified.

Closes: rpm-software-management#1311
j-mracek added a commit to j-mracek/dnf5 that referenced this issue May 28, 2024
@j-mracek
Enhance warning about RPMs that were not validate by RPM
0f31437 
DNF5 informs about number of packages that signature was not
verified, but without any additional detail. The ID of repository
provides a good hint for user why the check was skipped. The behavior
is related to configuration options which some of them  are repo
specific or specific for commandline repository. If user wants to verify
everything, the hint provides sufficient information which configuration
of repository should be modified.

Closes: rpm-software-management#1311
github-merge-queue bot pushed a commit that referenced this issue May 28, 2024
@j-mracek @pkratoch
Enhance warning about RPMs that were not validate by RPM
a889d09 
DNF5 informs about number of packages that signature was not
verified, but without any additional detail. The ID of repository
provides a good hint for user why the check was skipped. The behavior
is related to configuration options which some of them  are repo
specific or specific for commandline repository. If user wants to verify
everything, the hint provides sufficient information which configuration
of repository should be modified.

Closes: #1311
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@j-mracek j-mracek

Labels
Priority: LOW RFE Request For Enhancement (as opposed to a bug) Triaged Someone on the DNF 5 team has read the issue and determined the next steps to take
Projects
DNF team
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Enhance warning about RPMs that were not validate by RPM j-mracek/dnf5
4 participants
@ppisar @praiskup @j-mracek @jan-kolarik