noninteractive gpg

[cgwalters]

RPM and GPG. Always a fun topic!

For the case of upgrading inside an existing system, e.g. you're doing yum update inside a Fedora system with fedora-release installed which references the GPG key by file:/// URIs that were already retrieved in a trusted way (ideally), things are fine.

Where things start to break down is when one is operating on a root outside of the running system, which happens with things like installers (Anaconda) and containers (rpm-ostree container).

Notes

• It's common for 3rd party repository files to reference GPG keys by http(s):// URL
• At least yum will auto-download and then either prompt, or auto-import if -y is provided (and it's very common to use -y in deployment scripts, Dockerfiles, etc.)
• In Fedora at least, the LiveCD kickstart imports the gpg keys for the main repos, so users don't see the prompt on the first update

Also specifically, I think using yum -y with gpgkey=http://blah.com/ is completely broken - anyone on the internets can MITM the key and the packages.

libhif noninteractivity vs GPG

Now libhif has a policy of noninteractivity (AFAICS). Which...flips around some of the tradeoffs. We actually currently don't even import gpgkey URL references at all if gpgcheck=1 but gpgcheck_md=0 (which is the default for Fedora/CentOS at least).

Fixes

1. Add a new gpg_fingerprint to repository files. That way we can auto-download them even over un-authenticated http without (too much) fear (doing HTTP as root still sucks).

2. For the use case of constructing fresh install roots, I would like to support retrieving keys from locations relative to the .repo file. Something like: gpgkey=file://./RPM-GPG-KEY-CentOS-7

3. Make more well defined which keyring is used for installroots (do we use the real /etc/rpm/pki-gpg even if doing an installroot?)

[cgwalters]

Worth noting the way mock handles this now is: https://lists.fedoraproject.org/pipermail/devel/2015-October/215841.html

[copumpkin]

The /etc/rpm/pki-gpg thing has been getting in my way too, since my host system doesn't have that folder (I'm using libhif for rpm-ostree).

[copumpkin]

Err, for /etc/pki/rpm-gpg 😄

[Conan-Kudo]

Related Red Hat bugs:

• https://bugzilla.redhat.com/show_bug.cgi?id=1448164
• https://bugzilla.redhat.com/show_bug.cgi?id=1433592