Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 2149762

Summary: Signature failures on 3rd party packages
Product: [Fedora] Fedora Reporter: Mikhail <mikhail.v.gavrilov>
Component: rpmAssignee: Packaging Maintenance Team <packaging-team-maint>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: dhill, igor.raits, jaltman, lionking_1996-redhatbugzilla, lnie, mdomonko, packaging-team-maint, pmatilai, robatino, vmukhame, zkabelac
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-12-07 12:48:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2083912    

Description Mikhail 2022-11-30 20:13:38 UTC
Description of problem:
I observed rpmdbNextIterator error when rpm list all packages.

# rpm -qa > /dev/null
error: rpmdbNextIterator: skipping h#    1736 
Header V4 RSA/SHA256 Signature, key ID 222d23d0: BAD
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#    1869 
Header V4 RSA/SHA256 Signature, key ID 222d23d0: BAD
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#    2135 
Header V4 DSA/SHA1 Signature, key ID 7f8840ce: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#    2604 
Header V4 DSA/SHA1 Signature, key ID 7fac5991: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK


And
# rpm --rebuilddb
did not solve this issue.


Version-Release number of selected component (if applicable):
$ rpm -q rpm
rpm-4.18.0-7.fc38.x86_64

Comment 1 Mikhail 2022-12-02 00:52:07 UTC
# rpm -Uvh /home/mikhail/Downloads/google-chrome-unstable_current_x86_64.rpm 
error: /home/mikhail/Downloads/google-chrome-unstable_current_x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 7fac5991: BAD
error: /home/mikhail/Downloads/google-chrome-unstable_current_x86_64.rpm cannot be installed

# rpm -Uvh --nosignature /home/mikhail/Downloads/google-chrome-unstable_current_x86_64.rpm 
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:google-chrome-unstable-110.0.5449################################# [ 50%]
Cleaning up / removing...
   2:google-chrome-unstable-109.0.5414################################# [100%]

Comment 2 Mikhail 2022-12-06 14:20:37 UTC
Looks like all 3rd party packages couldn't update.

$ dnf upgrade --refresh
local repo                                      208 kB/s | 3.0 kB     00:00    
Copr repo for openvpn3 owned by dsommers        4.7 kB/s | 3.3 kB     00:00    
Copr repo for gnome-info-collect owned by vstan 5.1 kB/s | 3.3 kB     00:00    
Fedora rawhide openh264 (From Cisco) - x86_64   2.6 kB/s | 989  B     00:00    
Fedora - Rawhide - Developmental packages for t  17 kB/s |  10 kB     00:00    
Fedora - Rawhide - Developmental packages for t 913 kB/s | 1.7 MB     00:01    
Fedora - Rawhide - Debug                         15 kB/s | 9.9 kB     00:00    
Fedora - Rawhide - Debug                        4.6 kB/s | 4.9 kB     00:01    
Fedora - Modular Rawhide - Developmental packag  43 kB/s |  13 kB     00:00    
Fedora - Modular Rawhide - Developmental packag  86 kB/s | 171 kB     00:01    
Fedora - Modular Rawhide - Debug                 14 kB/s |  13 kB     00:00    
Fedora - Modular Rawhide - Debug                9.6 kB/s | 4.8 kB     00:00    
google-chrome-unstable                          6.5 kB/s | 1.3 kB     00:00    
RPM Fusion for Fedora Rawhide - Free             15 kB/s | 8.0 kB     00:00    
RPM Fusion for Fedora Rawhide - Free - Debug     16 kB/s | 8.1 kB     00:00    
RPM Fusion for Fedora Rawhide - Nonfree          28 kB/s | 8.1 kB     00:00    
RPM Fusion for Fedora Rawhide - Nonfree - Debug  30 kB/s | 8.2 kB     00:00    
Scooter Software                                3.3 kB/s | 2.9 kB     00:00    
Sublime Text - x86_64 - Dev                     4.3 kB/s | 2.9 kB     00:00    
Dependencies resolved.
================================================================================
 Package               Architecture   Version        Repository            Size
================================================================================
Upgrading:
 sublime-merge         x86_64         2080-1         sublime-text         6.3 M

Transaction Summary
================================================================================
Upgrade  1 Package

Total size: 6.3 M
Is this ok [y/N]: y
Downloading Packages:
[SKIPPED] sublime-merge-2080-1.x86_64.rpm: Already downloaded                  
Problem opening package sublime-merge-2080-1.x86_64.rpm
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

Comment 3 Panu Matilainen 2022-12-07 07:41:06 UTC
There seem to be (at least) two separate issues: 

> error: rpmdbNextIterator: skipping h#    2604 
> Header V4 DSA/SHA1 Signature, key ID 7fac5991: BAD

DSA/SHA1 signatures are considered dangerously weak by the new sequoia crypto (this is not a bug)

> error: rpmdbNextIterator: skipping h#    1736 
> Header V4 RSA/SHA256 Signature, key ID 222d23d0: BAD
> error: rpmdbNextIterator: skipping h#    1869 
> Header V4 RSA/SHA256 Signature, key ID 222d23d0: BAD

...but there's no obvious reason for these, they're V4 signatures and using strong hashes. And, chasing down the above sublime-merge package which appears to be one of the failing packages here, it checks out ok for me:

[root@localhost ~]# rpmkeys --import https://download.sublimetext.com/sublimehq-rpm-pub.gpg
[root@localhost ~]# rpmkeys -Kv sublime-merge-2080-1.x86_64.rpm 
sublime-merge-2080-1.x86_64.rpm:
    Header V4 RSA/SHA256 Signature, key ID 222d23d0: OK
    Header SHA1 digest: OK
    V4 RSA/SHA256 Signature, key ID 222d23d0: OK
    MD5 digest: OK

What does 'rpm -q rpm-sequoia' say on this system? Make sure to update that to the latest version (1.2.0-1) and recheck.

Comment 4 Panu Matilainen 2022-12-07 08:02:57 UTC
Okay the difference is rawhide vs older system without the sequoia crypto policy. On rawhide, attempting to import the key I get:

# rpmkeys --import /tmp/sublimehq-rpm-pub.gpg 
error: Certificate CA464A9A222D23D0:
  Policy rejects CA464A9A222D23D0: No binding signature at time 2022-12-07T07:51:32Z

And then it hangs, which is probably an unrelated issue somewhere (but needs investigating + fixing of course).

Anyway, the import message explains why it fails the verification. It's just that in your case, the key was already imported, it's just that the verify API lacks the means to report that sort of a message.

Here's what sq says about the key (https://download.sublimetext.com/sublimehq-rpm-pub.gpg):

$ sq packet dump /tmp/sublimehq-rpm-pub.gpg 
Public-Key Packet, old CTB, 525 bytes
    Version: 4
    Creation time: 2017-05-08 17:54:56 UTC
    Pk algo: RSA
    Pk size: 4096 bits
    Fingerprint: 1B64279675A4299DCFC70858CA464A9A222D23D0
    KeyID: CA464A9A222D23D0
  
User ID Packet, old CTB, 44 bytes
    Value: Sublime HQ Pty Ltd <support>
  
Signature Packet, old CTB, 564 bytes
    Version: 4
    Type: PositiveCertification
    Pk algo: RSA
    Hash algo: SHA1
    Hashed area:
      Signature creation time: 2017-05-08 17:54:56 UTC
      Key flags: CSEtErA
      Symmetric algo preferences: AES256, AES128
      Hash preferences: SHA512, SHA384, SHA256
      Compression preferences: Zlib, BZip2, Zip, Uncompressed
      Features: MDC
      Keyserver preferences: no modify
    Unhashed area:
      Issuer: CA464A9A222D23D0
    Digest prefix: B42C
    Level: 0 (signature over data)

Comment 5 Panu Matilainen 2022-12-07 10:50:43 UTC
Doh, of course, this is the actual reason for the failed signature check in the non-chrome case:

Signature Packet, old CTB, 564 bytes
    Version: 4
    Type: PositiveCertification
    Pk algo: RSA
    Hash algo: SHA1
               ^^^^

While the *signature* made by this key uses SHA256 (ie "Header V4 RSA/SHA256 Signature, key ID 222d23d0"), the binding signature of the *key* uses the weak SHA1 hash.

These SHA1 usages should be reported to the vendors in question, they can't be fixed in Fedora. In the meanwhile, as a workaround you can do 

    # update-crypto-policies --set DEFAULT:SHA1

So the rpmdbNextIterator errors are not a bug, these are just insecure signatures/keys from 3rd parties that are only now getting caught out. Of course, ideally rpm would output something comprehensible in these situations, there's an upstream ticket for that. The one concrete bug here is hanging on import, and that seems to be a bug in 4.18 as it doesn't happen in upstream development codebase. I'll look into it.

Comment 6 Panu Matilainen 2022-12-07 12:48:57 UTC
The related hang on failed key import fixed in rpm-4.18.0-8. While that's not what this report was about, that issue was found thanks to this report so thanks!

Other than that, no bugs here. The fix is getting vendors to update their crypto.

Comment 7 Mikhail 2022-12-07 13:10:44 UTC
> Other than that, no bugs here. The fix is getting vendors to update their crypto.

So maybe more human readable message expected here? I would prefer to see in message which rpm package has outdated crypto.

Comment 8 Mikhail 2022-12-07 13:15:58 UTC
# dnf upgrade --refresh
local repo                                                     3.0 MB/s | 3.0 kB     00:00    
Copr repo for gnome-info-collect owned by vstanek              5.2 kB/s | 3.3 kB     00:00    
Fedora rawhide openh264 (From Cisco) - x86_64                  4.1 kB/s | 989  B     00:00    
Fedora - Rawhide - Developmental packages for the next Fedora   47 kB/s |  13 kB     00:00    
Fedora - Modular Rawhide - Developmental packages for the next  19 kB/s |  13 kB     00:00    
google-chrome-unstable                                         7.6 kB/s | 1.3 kB     00:00    
RPM Fusion for Fedora Rawhide - Free                            17 kB/s | 8.6 kB     00:00    
RPM Fusion for Fedora Rawhide - Nonfree                         34 kB/s | 8.7 kB     00:00    
Sublime Text - x86_64 - Dev                                    5.1 kB/s | 2.9 kB     00:00    
Dependencies resolved.
===============================================================================================
 Package                                    Arch   Version                  Repository    Size
===============================================================================================
Installing:
 kernel                                     x86_64 6.1.0-0.rc8.58.fc38      rawhide      116 k
 kernel-core                                x86_64 6.1.0-0.rc8.58.fc38      rawhide       49 M
 kernel-debug                               x86_64 6.1.0-0.rc8.58.fc38      rawhide      116 k
 kernel-debug-core                          x86_64 6.1.0-0.rc8.58.fc38      rawhide       51 M
 kernel-debug-modules                       x86_64 6.1.0-0.rc8.58.fc38      rawhide       59 M
 kernel-modules                             x86_64 6.1.0-0.rc8.58.fc38      rawhide       58 M
 kernel-modules-extra                       x86_64 6.1.0-0.rc8.58.fc38      rawhide      3.4 M
Upgrading:
 edk2-ovmf                                  noarch 20221117gitfff6d81270b5-5.fc38
                                                                            rawhide       10 M
 evolution-data-server                      x86_64 3.46.2-1.fc38            rawhide      2.5 M
 evolution-data-server-langpacks            noarch 3.46.2-1.fc38            rawhide      1.2 M
 grub2-common                               noarch 1:2.06-68.fc38           rawhide      926 k
 grub2-efi-ia32                             x86_64 1:2.06-68.fc38           rawhide      2.1 M
 grub2-efi-ia32-cdboot                      x86_64 1:2.06-68.fc38           rawhide      2.1 M
 grub2-efi-x64                              x86_64 1:2.06-68.fc38           rawhide      2.1 M
 grub2-efi-x64-cdboot                       x86_64 1:2.06-68.fc38           rawhide      2.1 M
 grub2-pc                                   x86_64 1:2.06-68.fc38           rawhide       18 k
 grub2-pc-modules                           noarch 1:2.06-68.fc38           rawhide      958 k
 grub2-tools                                x86_64 1:2.06-68.fc38           rawhide      1.8 M
 grub2-tools-efi                            x86_64 1:2.06-68.fc38           rawhide      544 k
 grub2-tools-extra                          x86_64 1:2.06-68.fc38           rawhide      843 k
 grub2-tools-minimal                        x86_64 1:2.06-68.fc38           rawhide      607 k
 kernel-headers                             x86_64 6.1.0-0.rc8.git0.1.fc38  rawhide      1.5 M
 libbsd                                     x86_64 0.11.7-2.fc38            rawhide      112 k
 libphonenumber                             x86_64 8.12.57-2.fc38           rawhide      2.3 M
 libvirt-daemon                             x86_64 8.10.0-1.fc38            rawhide      384 k
 libvirt-daemon-config-network              x86_64 8.10.0-1.fc38            rawhide       13 k
 libvirt-daemon-driver-interface            x86_64 8.10.0-1.fc38            rawhide      163 k
 libvirt-daemon-driver-network              x86_64 8.10.0-1.fc38            rawhide      203 k
 libvirt-daemon-driver-nodedev              x86_64 8.10.0-1.fc38            rawhide      184 k
 libvirt-daemon-driver-nwfilter             x86_64 8.10.0-1.fc38            rawhide      199 k
 libvirt-daemon-driver-qemu                 x86_64 8.10.0-1.fc38            rawhide      910 k
 libvirt-daemon-driver-secret               x86_64 8.10.0-1.fc38            rawhide      160 k
 libvirt-daemon-driver-storage              x86_64 8.10.0-1.fc38            rawhide       11 k
 libvirt-daemon-driver-storage-core         x86_64 8.10.0-1.fc38            rawhide      218 k
 libvirt-daemon-driver-storage-disk         x86_64 8.10.0-1.fc38            rawhide       22 k
 libvirt-daemon-driver-storage-gluster      x86_64 8.10.0-1.fc38            rawhide       24 k
 libvirt-daemon-driver-storage-iscsi        x86_64 8.10.0-1.fc38            rawhide       19 k
 libvirt-daemon-driver-storage-iscsi-direct x86_64 8.10.0-1.fc38            rawhide       21 k
 libvirt-daemon-driver-storage-logical      x86_64 8.10.0-1.fc38            rawhide       23 k
 libvirt-daemon-driver-storage-mpath        x86_64 8.10.0-1.fc38            rawhide       17 k
 libvirt-daemon-driver-storage-rbd          x86_64 8.10.0-1.fc38            rawhide       28 k
 libvirt-daemon-driver-storage-scsi         x86_64 8.10.0-1.fc38            rawhide       19 k
 libvirt-daemon-driver-storage-zfs          x86_64 8.10.0-1.fc38            rawhide       19 k
 libvirt-daemon-kvm                         x86_64 8.10.0-1.fc38            rawhide       11 k
 libvirt-libs                               x86_64 8.10.0-1.fc38            rawhide      4.7 M
 paps                                       x86_64 0.7.1-6.fc38             rawhide       34 k
 perl-srpm-macros                           noarch 1-47.fc38                rawhide      8.2 k
 sublime-merge                              x86_64 2080-1                   sublime-text 6.3 M
 vim-data                                   noarch 2:9.0.1006-1.fc38        rawhide       24 k
 vim-minimal                                x86_64 2:9.0.1006-1.fc38        rawhide      783 k
Installing weak dependencies:
 libvirt-client                             x86_64 8.10.0-1.fc38            rawhide      429 k
Removing:
 kernel                                     x86_64 6.1.0-0.rc7.20221130git01f856ae6d0c.53.fc38
                                                                            @local-repo    0  
 kernel-core                                x86_64 6.1.0-0.rc7.20221130git01f856ae6d0c.53.fc38
                                                                            @local-repo   94 M
 kernel-debug                               x86_64 6.1.0-0.rc7.20221130git01f856ae6d0c.53.fc38
                                                                            @local-repo    0  
 kernel-debug-core                          x86_64 6.1.0-0.rc7.20221130git01f856ae6d0c.53.fc38
                                                                            @local-repo    0  
 kernel-debug-modules                       x86_64 6.1.0-0.rc7.20221130git01f856ae6d0c.53.fc38
                                                                            @local-repo    0  
 kernel-modules                             x86_64 6.1.0-0.rc7.20221130git01f856ae6d0c.53.fc38
                                                                            @local-repo   58 M
 kernel-modules-extra                       x86_64 6.1.0-0.rc7.20221130git01f856ae6d0c.53.fc38
                                                                            @local-repo  3.3 M

Transaction Summary
===============================================================================================
Install   8 Packages
Upgrade  43 Packages
Remove    7 Packages

Total download size: 268 M
Is this ok [y/N]: y
Downloading Packages:
(1/51): kernel-6.1.0-0.rc8.58.fc38.x86_64.rpm                  205 kB/s | 116 kB     00:00    
(2/51): kernel-debug-6.1.0-0.rc8.58.fc38.x86_64.rpm            196 kB/s | 116 kB     00:00    
(3/51): kernel-core-6.1.0-0.rc8.58.fc38.x86_64.rpm              14 MB/s |  49 MB     00:03    
(4/51): kernel-debug-core-6.1.0-0.rc8.58.fc38.x86_64.rpm        16 MB/s |  51 MB     00:03    
(5/51): kernel-modules-extra-6.1.0-0.rc8.58.fc38.x86_64.rpm    7.1 MB/s | 3.4 MB     00:00    
(6/51): libvirt-client-8.10.0-1.fc38.x86_64.rpm                3.2 MB/s | 429 kB     00:00    
(7/51): kernel-debug-modules-6.1.0-0.rc8.58.fc38.x86_64.rpm     13 MB/s |  59 MB     00:04    
(8/51): evolution-data-server-3.46.2-1.fc38.x86_64.rpm         6.5 MB/s | 2.5 MB     00:00    
(9/51): edk2-ovmf-20221117gitfff6d81270b5-5.fc38.noarch.rpm    7.7 MB/s |  10 MB     00:01    
(10/51): evolution-data-server-langpacks-3.46.2-1.fc38.noarch. 4.9 MB/s | 1.2 MB     00:00    
(11/51): grub2-common-2.06-68.fc38.noarch.rpm                  4.8 MB/s | 926 kB     00:00    
(12/51): grub2-efi-ia32-2.06-68.fc38.x86_64.rpm                7.1 MB/s | 2.1 MB     00:00    
(13/51): grub2-efi-ia32-cdboot-2.06-68.fc38.x86_64.rpm         5.3 MB/s | 2.1 MB     00:00    
(14/51): grub2-efi-x64-2.06-68.fc38.x86_64.rpm                 6.7 MB/s | 2.1 MB     00:00    
(15/51): grub2-pc-2.06-68.fc38.x86_64.rpm                      141 kB/s |  18 kB     00:00    
(16/51): grub2-efi-x64-cdboot-2.06-68.fc38.x86_64.rpm          5.5 MB/s | 2.1 MB     00:00    
(17/51): grub2-pc-modules-2.06-68.fc38.noarch.rpm              5.2 MB/s | 958 kB     00:00    
(18/51): kernel-modules-6.1.0-0.rc8.58.fc38.x86_64.rpm          17 MB/s |  58 MB     00:03    
(19/51): grub2-tools-efi-2.06-68.fc38.x86_64.rpm               3.0 MB/s | 544 kB     00:00    
(20/51): grub2-tools-2.06-68.fc38.x86_64.rpm                   4.8 MB/s | 1.8 MB     00:00    
(21/51): grub2-tools-minimal-2.06-68.fc38.x86_64.rpm           2.4 MB/s | 607 kB     00:00    
(22/51): grub2-tools-extra-2.06-68.fc38.x86_64.rpm             2.0 MB/s | 843 kB     00:00    
(23/51): libbsd-0.11.7-2.fc38.x86_64.rpm                       583 kB/s | 112 kB     00:00    
(24/51): kernel-headers-6.1.0-0.rc8.git0.1.fc38.x86_64.rpm     4.2 MB/s | 1.5 MB     00:00    
(25/51): libvirt-daemon-8.10.0-1.fc38.x86_64.rpm               3.5 MB/s | 384 kB     00:00    
(26/51): libvirt-daemon-config-network-8.10.0-1.fc38.x86_64.rp 147 kB/s |  13 kB     00:00    
(27/51): libphonenumber-8.12.57-2.fc38.x86_64.rpm              9.2 MB/s | 2.3 MB     00:00    
(28/51): libvirt-daemon-driver-interface-8.10.0-1.fc38.x86_64. 1.1 MB/s | 163 kB     00:00    
(29/51): libvirt-daemon-driver-network-8.10.0-1.fc38.x86_64.rp 1.8 MB/s | 203 kB     00:00    
(30/51): libvirt-daemon-driver-nodedev-8.10.0-1.fc38.x86_64.rp 1.7 MB/s | 184 kB     00:00    
(31/51): libvirt-daemon-driver-nwfilter-8.10.0-1.fc38.x86_64.r 2.0 MB/s | 199 kB     00:00    
(32/51): libvirt-daemon-driver-secret-8.10.0-1.fc38.x86_64.rpm 1.6 MB/s | 160 kB     00:00    
(33/51): libvirt-daemon-driver-storage-8.10.0-1.fc38.x86_64.rp 117 kB/s |  11 kB     00:00    
(34/51): libvirt-daemon-driver-storage-core-8.10.0-1.fc38.x86_ 2.3 MB/s | 218 kB     00:00    
(35/51): libvirt-daemon-driver-storage-disk-8.10.0-1.fc38.x86_ 239 kB/s |  22 kB     00:00    
(36/51): libvirt-daemon-driver-qemu-8.10.0-1.fc38.x86_64.rpm   3.1 MB/s | 910 kB     00:00    
(37/51): libvirt-daemon-driver-storage-iscsi-direct-8.10.0-1.f 243 kB/s |  21 kB     00:00    
(38/51): libvirt-daemon-driver-storage-gluster-8.10.0-1.fc38.x 193 kB/s |  24 kB     00:00    
(39/51): libvirt-daemon-driver-storage-iscsi-8.10.0-1.fc38.x86 168 kB/s |  19 kB     00:00    
(40/51): libvirt-daemon-driver-storage-mpath-8.10.0-1.fc38.x86 202 kB/s |  17 kB     00:00    
(41/51): libvirt-daemon-driver-storage-logical-8.10.0-1.fc38.x 215 kB/s |  23 kB     00:00    
(42/51): libvirt-daemon-driver-storage-rbd-8.10.0-1.fc38.x86_6 258 kB/s |  28 kB     00:00    
(43/51): libvirt-daemon-driver-storage-scsi-8.10.0-1.fc38.x86_ 232 kB/s |  19 kB     00:00    
(44/51): libvirt-daemon-driver-storage-zfs-8.10.0-1.fc38.x86_6 203 kB/s |  19 kB     00:00    
(45/51): libvirt-daemon-kvm-8.10.0-1.fc38.x86_64.rpm           127 kB/s |  11 kB     00:00    
(46/51): paps-0.7.1-6.fc38.x86_64.rpm                          364 kB/s |  34 kB     00:00    
(47/51): perl-srpm-macros-1-47.fc38.noarch.rpm                  85 kB/s | 8.2 kB     00:00    
(48/51): vim-data-9.0.1006-1.fc38.noarch.rpm                   214 kB/s |  24 kB     00:00    
(49/51): vim-minimal-9.0.1006-1.fc38.x86_64.rpm                6.1 MB/s | 783 kB     00:00    
(50/51): libvirt-libs-8.10.0-1.fc38.x86_64.rpm                  11 MB/s | 4.7 MB     00:00    
(51/51): sublime-merge-2080-1.x86_64.rpm                       2.9 MB/s | 6.3 MB     00:02    
-----------------------------------------------------------------------------------------------
Total                                                           24 MB/s | 268 MB     00:11     
Problem opening package sublime-merge-2080-1.x86_64.rpm
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED


# dnf remove sublime-merge
Dependencies resolved.
===============================================================================================
 Package                  Architecture      Version             Repository                Size
===============================================================================================
Removing:
 sublime-merge            x86_64            2078-1              @sublime-text             21 M

Transaction Summary
===============================================================================================
Remove  1 Package

Freed space: 21 M
Is this ok [y/N]: y
Running transaction check
error: rpmdbNextIterator: skipping h#    7669 
Header V4 RSA/SHA256 Signature, key ID 222d23d0: BAD
Header SHA1 digest: OK
Error: An rpm exception occurred: package not installed



And another stalemate is that it is problematic for the user to even remove the problematic package.

Comment 9 Panu Matilainen 2022-12-07 13:57:22 UTC
> So maybe more human readable message expected here? I would prefer to see in message which rpm package has outdated crypto.
>
> And another stalemate is that it is problematic for the user to even remove the problematic package.

Yes, a nicer message would be nice, but this is an API issue that's not so easy to resolve.
Rpm by default does not access headers whose signature check failed for security reasons, so it can't tell because it actually doesn't know. You can bypass that with --nosignature, and you can pinpoint the package with --querybynumber, eg:

> error: rpmdbNextIterator: skipping h#    7669 
> Header V4 RSA/SHA256 Signature, key ID 222d23d0: BAD

To find out what that is:
rpm -q --nosignature --querybynumber 7669 

And then erase with the help of --nosignature. But like noted above, update-crypto-policies can be used to work around the issue more generally that doesn't require mucking with low-level rpm switches.

Comment 10 Mikhail 2022-12-14 06:19:49 UTC
Yet another affected rpm:

# dnf upgrade --refresh
Waiting for process with pid 149966 to finish.
local repo                                                                3.0 MB/s | 3.0 kB     00:00    
Copr repo for gnome-info-collect owned by vstanek                         5.3 kB/s | 3.3 kB     00:00    
created by dnf config-manager from https://brave-browser-rpm-nightly.s3.b  17 kB/s | 3.3 kB     00:00    
Fedora rawhide openh264 (From Cisco) - x86_64                             4.0 kB/s | 989  B     00:00    
Fedora - Rawhide - Developmental packages for the next Fedora release      12 kB/s | 6.6 kB     00:00    
Fedora - Rawhide - Debug                                                   23 kB/s | 5.7 kB     00:00    
Fedora - Modular Rawhide - Developmental packages for the next Fedora rel  25 kB/s |  16 kB     00:00    
Fedora - Modular Rawhide - Debug                                           49 kB/s |  15 kB     00:00    
google-chrome-unstable                                                    6.9 kB/s | 1.3 kB     00:00    
microsoft-edge-dev                                                        9.8 kB/s | 3.0 kB     00:00    
Opera packages                                                             12 kB/s | 3.0 kB     00:00    
pgadmin4                                                                  1.0 kB/s | 833  B     00:00    
RPM Fusion for Fedora Rawhide - Free                                       32 kB/s | 7.8 kB     00:00    
RPM Fusion for Fedora Rawhide - Free - Debug                               38 kB/s | 7.9 kB     00:00    
RPM Fusion for Fedora Rawhide - Nonfree                                    17 kB/s | 8.5 kB     00:00    
RPM Fusion for Fedora Rawhide - Nonfree - Debug                            16 kB/s | 8.6 kB     00:00    
Scooter Software                                                          3.8 kB/s | 2.9 kB     00:00    
Sublime Text - x86_64 - Dev                                               4.3 kB/s | 2.9 kB     00:00    
Dependencies resolved.
==========================================================================================================
 Package                     Architecture    Version                    Repository                   Size
==========================================================================================================
Upgrading:
 microsoft-edge-dev          x86_64          110.0.1556.0-1             microsoft-edge-dev          135 M

Transaction Summary
==========================================================================================================
Upgrade  1 Package

Total size: 135 M
Is this ok [y/N]: y
Downloading Packages:
[SKIPPED] microsoft-edge-dev-110.0.1556.0-1.x86_64.rpm: Already downloaded                               
microsoft-edge-dev                                                        3.1 kB/s | 983  B     00:00    
Importing GPG key 0xBE1229CF:
 Userid     : "Microsoft (Release signing) <gpgsecurity>"
 Fingerprint: BC52 8686 B50D 79E3 39D3 721C EB3E 94AD BE12 29CF
 From       : https://packages.microsoft.com/keys/microsoft.asc
Is this ok [y/N]: y
error: Certificate EB3E94ADBE1229CF:
  Policy rejects EB3E94ADBE1229CF: No binding signature at time 2022-12-14T00:02:09Z
Key import failed (code 2). Failing package is: microsoft-edge-dev-110.0.1556.0-1.x86_64
 GPG Keys are configured as: https://packages.microsoft.com/keys/microsoft.asc
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

Comment 11 Panu Matilainen 2022-12-14 08:43:57 UTC
Oh, another rather high profile case... It's also an issue of the key, not the signature:

[pmatilai🎩︎localhost tmp]$ sq packet dump microsoft.asc 
Public-Key Packet, old CTB, 269 bytes
    Version: 4
    Creation time: 2015-10-28 23:21:48 UTC
    Pk algo: RSA
    Pk size: 2048 bits
    Fingerprint: BC528686B50D79E339D3721CEB3E94ADBE1229CF
    KeyID: EB3E94ADBE1229CF
  
User ID Packet, old CTB, 55 bytes
    Value: Microsoft (Release signing) <gpgsecurity>
  
Signature Packet, old CTB, 309 bytes
    Version: 4
    Type: PositiveCertification
    Pk algo: RSA
    Hash algo: SHA1
    ^^^^^^^^^^^^^^^
    Hashed area:
      Signature creation time: 2015-10-28 23:21:48 UTC
      Key flags: CS
      Symmetric algo preferences: AES256, AES192, AES128, CAST5, TripleDES
      Hash preferences: SHA1, SHA256, RipeMD
      Compression preferences: Zlib, Zip
      Features: MDC
      Keyserver preferences: no modify
    Unhashed area:
      Issuer: EB3E94ADBE1229CF
    Digest prefix: 1A9B
    Level: 0 (signature over data)

Comment 12 Panu Matilainen 2022-12-16 13:24:14 UTC
*** Bug 2154270 has been marked as a duplicate of this bug. ***

Comment 13 Adam Williamson 2023-01-11 00:38:45 UTC
*** Bug 2159281 has been marked as a duplicate of this bug. ***

Comment 14 Panu Matilainen 2023-01-11 12:05:39 UTC
*** Bug 2160044 has been marked as a duplicate of this bug. ***

Comment 15 Mikhail 2023-02-05 08:09:56 UTC
The Beyond Compare package also affected by this issue.

❯ dnf upgrade --refresh --nogpgcheck
local repo                                      3.0 MB/s | 3.0 kB     00:00    
Copr repo for openvpn3 owned by dsommers        4.8 kB/s | 3.3 kB     00:00    
Copr repo for gnome-info-collect owned by vstan 5.1 kB/s | 3.3 kB     00:00    
created by dnf config-manager from https://brav 748  B/s | 3.3 kB     00:04    
Fedora rawhide openh264 (From Cisco) - x86_64   2.5 kB/s | 989  B     00:00    
Fedora - Rawhide - Developmental packages for t  29 kB/s |  12 kB     00:00    
Fedora - Rawhide - Debug                         30 kB/s |  12 kB     00:00    
Fedora - Modular Rawhide - Developmental packag  22 kB/s |  15 kB     00:00    
Fedora - Modular Rawhide - Debug                 19 kB/s |  14 kB     00:00    
google-chrome-unstable                          3.9 kB/s | 1.3 kB     00:00    
microsoft-edge-dev                              3.9 kB/s | 2.0 kB     00:00    
RPM Fusion for Fedora Rawhide - Free             13 kB/s | 7.4 kB     00:00    
RPM Fusion for Fedora Rawhide - Free - Debug     19 kB/s | 7.5 kB     00:00    
RPM Fusion for Fedora Rawhide - Nonfree          13 kB/s | 7.5 kB     00:00    
RPM Fusion for Fedora Rawhide - Nonfree - Debug  14 kB/s | 7.7 kB     00:00    
Scooter Software                                3.9 kB/s | 2.9 kB     00:00    
Sublime Text - x86_64 - Dev                     4.5 kB/s | 2.9 kB     00:00    
Dependencies resolved.
================================================================================
 Package         Architecture  Version             Repository              Size
================================================================================
Upgrading:
 bcompare        x86_64        4.4.5-27371         scootersoftware         18 M

Transaction Summary
================================================================================
Upgrade  1 Package

Total size: 18 M
Is this ok [y/N]: y
Downloading Packages:
[SKIPPED] bcompare-4.4.5.27371.x86_64.rpm: Already downloaded                  
Running transaction check
error: rpmdbNextIterator: skipping h#    2135 
Header V4 DSA/SHA1 Signature, key ID 7f8840ce: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#    2135 
Header V4 DSA/SHA1 Signature, key ID 7f8840ce: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: An rpm exception occurred: package not installed

Comment 16 Mikhail 2023-02-08 23:11:08 UTC
What if gpg key contains two signature packets?
One with hash algo SHA256 and another with hash algo SHA1?

❯ sq packet dump RPM-GPG-KEY-scootersoftware
Public-Key Packet, old CTB, 418 bytes
    Version: 4
    Creation time: 2010-03-30 16:12:05 UTC
    Pk algo: DSA
    Pk size: 1024 bits
    Fingerprint: C9467A8216C570CDFBAC3AFD331D6DDE7F8840CE
    KeyID: 331D6DDE7F8840CE
  
User ID Packet, old CTB, 46 bytes
    Value: Scooter Software <support>
  
Signature Packet, old CTB, 97 bytes
    Version: 4
    Type: PositiveCertification
    Pk algo: DSA
    Hash algo: SHA256
    ^^^^^^^^^^^^^^^^^
    Hashed area:
      Key flags: CS
      Features: MDC
      Keyserver preferences: no modify
      Signature creation time: 2016-08-23 21:59:52 UTC
      Symmetric algo preferences: AES256, AES192, AES128, CAST5
      Hash preferences: SHA512, SHA384, SHA256, SHA224
      Compression preferences: Zlib, BZip2, Zip, Uncompressed
    Unhashed area:
      Issuer: 331D6DDE7F8840CE
    Digest prefix: 9577
    Level: 0 (signature over data)
  
Public-Subkey Packet, old CTB, 525 bytes
    Version: 4
    Creation time: 2010-03-30 16:12:14 UTC
    Pk algo: ElGamal
    Pk size: 2048 bits
    Fingerprint: 927FE44F49099955FE39EC655DC979E13CAF4617
    KeyID: 5DC979E13CAF4617
  
Signature Packet, old CTB, 73 bytes
    Version: 4
    Type: SubkeyBinding
    Pk algo: DSA
    Hash algo: SHA1
    ^^^^^^^^^^^^^^^
    Hashed area:
      Signature creation time: 2010-03-30 16:12:14 UTC
      Key flags: EtEr
    Unhashed area:
      Issuer: 331D6DDE7F8840CE
    Digest prefix: C821
    Level: 0 (signature over data)