R4.3.1 with qubes-contrib-repo issue

User Support
1

It is specific to this template. With other fedora templates I haven’t had such an issue so I have no idea how to start to debug. Any thought highly appreciated.

First, it was:

[45/45] Total 100% | 0.0 B/s | 0.0 B | 00m01s
Running transaction
Transaction failed: Signature verification failed.
Public key “file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-contrib-fedora” is already present, not importing.
OpenPGP check for package “qubes-split-browser-disp-0.17.5-1.fc43.noarch” (/var/cache/libdnf5/qubes-contrib-vm-r4.3-current-30ef4d10d2e227c4/packages/qubes-split-browser-disp-0.17.5-1.fc43.noarch.rpm) from repo “qubes-contrib-vm-r4.3-current” has failed: Public key is not installed.

Then I tried

$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-contrib-fedora

only now to get:

[45/45] Total 100% | 0.0 B/s | 0.0 B | 00m00s
Running transaction
Importing OpenPGP key 0xD0941E87:
UserID : “Qubes OS Contrib Release 4 Signing Key”
Fingerprint: 04A8F986B97FBCB838F08C305FE4986AD0941E87
From : file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-contrib-fedora
Is this ok [y/N]: y
The key was successfully imported.
Transaction failed: Signature verification failed.
OpenPGP check for package “qubes-split-browser-disp-0.17.5-1.fc43.noarch” (/var/cache/libdnf5/qubes-contrib-vm-r4.3-current-30ef4d10d2e227c4/packages/qubes-split-browser-disp-0.17.5-1.fc43.noarch.rpm) from repo “qubes-contrib-vm-r4.3-current” has failed: Import of the key didn’t help, wrong key?

EDIT: I’m getting the same for split-browse template:

[37/37] Total 100% | 2.6 MiB/s | 15.5 MiB | 00m06s
Running transaction
Transaction failed: Signature verification failed.
Public key “file:///etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-4-contrib-fedora” is already present, not importing.
OpenPGP check for package “qubes-split-browser-0.17.5-1.fc43.noarch” (/var/cache/libdnf5/qubes-contrib-vm-r4.3-current-30ef4d10d2e227c4/packages/qubes-split-browser-0.17.5-1.fc43.noarch.rpm) from repo “qubes-contrib-vm-r4.3-current” has failed: Public key is not installed.

Actually, wherever I have some split-browse package installed, now I am realizing

Actually duplicate of https://forum.qubes-os.org/t/r4-3-1-with-qubes-contrib-repo-issue/42249
2

Is the Fedora 43 template a fresh installation or an in-place upgrade? If it’s the latter unfortunately I have no experience with that - maybe try the former, which would also be an opportunity to skip ahead to Fedora 44.

3

Yes, it was in-place upgrade. Why that could be a problem…

4

Not sure how the upgrade affects key management.

Actually I just noticed that none of the contrib packages have been built for Fedora 44 yet. :\ I’ve pinged fepitre (the contrib repo maintainer) about that.

1 Like
5

By no mean I’d want to put excessive effort on you, but shouldn’t in-place upgrade process be unified across all the repos and their content, including split-browser, when we already are offered with it? What are the terms of being included in the (qubes-contrib) repo?

I am not sure on whose side the issue is at all: yours, or Qubes’?

6

:100:, please file a bug (and mention that you also had to update the contrib repo’s URL manually):

https://doc.qubes-os.org/en/latest/introduction/issue-tracking.html

https://doc.qubes-os.org/en/latest/developer/general/package-contributions.html#inclusion-criteria

On the side of Qubes OS. Which specific contrib package wouldn’t make a difference.

2 Likes
7

Thanks for a quick reply. My choice was not have a Github account, so I hope someone else with the same issue and a Github account will do it at some point, because it looks it’d be reproduced in future versions as well.

Cheers

1 Like
8

Put the content of the issue here and I will try to open it on Github.

1 Like
9

Thanks. Do you want me to prepare it in a full Github form like

Qubes OS release

Brief summary

Steps to reproduce

Expected behavior

Actual behavior

Additional information

Or in a free form?

1 Like
10

@unman’s 3isec repo is also not automatically upgraded to fc41 when in-place upgrade.

11

Yes, formatted with the Markdown template, because I don’t understand your issue. Maybe mention that you manually edited the source file if relevant?

1 Like
12

Thanks. Please leave me some time to properly prepare it. I admit I am a bit lazy now, since I already resolved it manually for myself.

13

Eventually I just copied key from the other template, deleted current one and imported the other one and everything resolved.

Thanks for your offer and a good will.