vmupdate: answer "yes" to the import key question #194
Conversation
When fetching repository metadata for the first time, dnf will ask for confirmation on importing metadata signing key. Since the key is imported from the local filesystem, it's safe to do, so do it automatically. QubesOS/qubes-issues#9807
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025062603-4.3&flavor=pull-requests Test run included the following:
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025061004-4.3&flavor=update
Failed tests13 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/142375#dependencies 10 fixed
Unstable testsPerformance TestsPerformance degradation:6 performance degradations
Remaining performance tests:66 tests
|
|
Also, Wouldn't it be more safe and robust to explicitly import the key from local filesystem when/if necessary? |
|
All good questions.
Key location is specified in the repo file, all repos we include use file:// location. The same applies to all other popular repositories. If you modify the repo configuration to use remote location, then yes, it may import that key - you asked for it... But also, see the answer below.
Not really, there aren't any other prompts during refresh operation. In fact, this prompt is only about metadata signatures (not package signatures), which most repositories don't use anyway...
If there would be a proper method for that, maybe (but also, it would require duplicating quite some part already done by dnf - for example to properly get repo config, including any drop-ins, check for enabled/disabled repos etc). But there isn't any API for importing metadata signing key - it's stored by dnf internally, keys imported to rpmdb via |
Well, I may be happy with the location but still want to manually monitor the effective fingerprint or other changes. We should also be prompted on any unexpected key changes in any case IMO.
Hmm. Would you like me to take a shot at opening an upstream issue? |
Actually, I don't think so. The only way to get a different key in a local filesystem is that something (already authenticated) put it there. And making key rotation harder than it should be is a bad thing.
It's an issue known for a long time: https://bugzilla.redhat.com/show_bug.cgi?id=1768206 |
When fetching repository metadata for the first time, dnf will ask for
confirmation on importing metadata signing key. Since the key is
imported from the local filesystem, it's safe to do, so do it
automatically.
QubesOS/qubes-issues#9807