Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1433592 - RFE: Support pkg_gpgcheck config option and rework gpgcheck config option
Summary: RFE: Support pkg_gpgcheck config option and rework gpgcheck config option
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: dnf5
Version: rawhide
Hardware: Unspecified
OS: Unspecified
low
unspecified
Target Milestone: ---
Assignee: rpm-software-management
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: dnf-community
TreeView+ depends on / blocked
 
Reported: 2017-03-18 14:02 UTC by Neal Gompa
Modified: 2023-08-08 07:02 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-03-22 13:13:50 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github rpm-software-management dnf5 issues 727 0 None open Introduce `gpgcheck_policy` to control `gpgcheck` defaults and add support for `pkg_gpgcheck` 2023-07-17 10:38:24 UTC
Red Hat Bugzilla 1373317 0 unspecified CLOSED RFE: Add "type=rpm-md" and "repo_gpgcheck=0" to Fedora repo files 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1452392 0 unspecified CLOSED DNF does not report librepo errors 2021-02-22 00:41:40 UTC

Internal Links: 1373317 1452392

Description Neal Gompa 2017-03-18 14:02:56 UTC
Description of problem:
Currently, DNF supports two flags: gpgcheck and repo_gpgcheck. However, it is not clear what "gpgcheck" actually covers. In DNF, gpgcheck only covers package signature checking, but in Zypper, it covers both package and repository metadata signature checking.

Zypper has three options:
1. gpgcheck, covering repo and packages
2. pkg_gpgcheck, covering packages only (equivalent to current gpgcheck in Yum/DNF)
3. repo_gpgcheck, covering repo only (DNF supports this the same way Zypper does)

Each of these can be set globally or per-repository. By default, Zypper does both repository and package checks, and the other two options can be used to override bits of that behavior in Zypper.

We should implement the same options in DNF. This should not break Fedora 26 and newer because fedora-repos in F26+ has options set to be Zypper compatible (see bug 1373317). To ensure expectations are the same as before, we should globally switch off repo_gpgcheck in dnf.conf, so that third party repositories won't break.


Version-Release number of selected component (if applicable):
2.1.0-1.fc26

Comment 1 Neal Gompa 2017-03-18 14:04:20 UTC
Also, for reference: https://doc.opensuse.org/projects/libzypp/HEAD/group__ZyppConfig.html

Comment 2 Neal Gompa 2017-03-18 14:07:17 UTC
In addition, COPR repos have the same assumptions as fedora-repos since September 2016: https://github.com/fedora-copr/copr/pull/12

Comment 3 Jaroslav Mracek 2017-03-22 13:13:50 UTC
According to my knowledge, DNF use the options:

gpgcheck = covering packages only
repo_gpgcheck = covering repo only

We are sorry, but we cannot rename configuration options according to your request, due to introducing incompatibility with yum.

Comment 4 Neal Gompa 2017-03-23 19:19:23 UTC
@Jaroslav:

DNF currently has the ability to have this behavior changed in code. It currently defaults to not having repo_gpgcheck not inherit from gpgcheck, and it can remain that way for RHEL.

I am saying that it should change for Fedora, and the pkg_gpgcheck config option should be introduced to offer the pkg equivalent of repo_gpgcheck.

And "Yum incompatibility" is not a solid enough justification for allowing dumb behaviors to persist forever. One of the very distinct reasons DNF is not named Yum is so that it would be allowed to fix broken behavior. This is one of those broken behaviors.

If you want to have RHEL support the Yum legacy behavior, that's fine, it's even configurable to do so! The Yum behavior would be easy to do. Just add to dnf.conf the following:

gpgcheck = 1
repo_gpgcheck = 0

But I should be able to have "gpgcheck = 1" and then have package repos that are set up like the following:

gpgcheck = 1
pkg_gpgcheck = 0

That is currently not possible.

"gpgcheck = 0" doesn't work, because it forces "repo_gpgcheck = 0" too. Thus, I can't actually do "no signatures on packages, but signatures on repodata". And yes, this is a valid possibility in Zypper, and I have seen RPM repositories in the wild this way.

Comment 5 Fedora End Of Life 2018-05-03 08:41:01 UTC
This message is a reminder that Fedora 26 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 26. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '26'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 26 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Comment 6 Michal Domonkos 2019-02-20 13:22:53 UTC
Removing the Triaged keyword so that it shows up in our queries for the next triaging meeting.

Comment 7 Neal Gompa 2019-02-20 13:28:11 UTC
I discussed this issue with Michal Domonkos in #yum today, and we agreed the that following proposal makes sense to implement:

In /etc/dnf/dnf.conf, a new option "gpgcheck_policy" would be implemented, with the following options: "legacy", "full", and "all".

* "gpgcheck_policy=legacy" makes "gpgcheck=1" equivalent to setting "pkg_gpgcheck=1", "repo_gpgcheck=0", and "localpkg_gpgcheck=0".

* "gpgcheck_policy=full" makes "gpgcheck=1" equivalent to setting "pkg_gpgcheck=1", "repo_gpgcheck=1", and "localpkg_gpgcheck=0".

* "gpgcheck_policy=all" makes "gpgcheck=1" equivalent to setting "pkg_gpgcheck=1", "repo_gpgcheck=1", and "localpkg_gpgcheck=1".


Regardless of modes, each configuration section ("[main]" or repo sections in dnf.conf or in repo files) can override the policy behavior by setting "pkg_gpgcheck" and "repo_gpgcheck" accordingly. Obviously "localpkg_gpgcheck" has no bearing in repo sections, but could be switched on separately in the main section in dnf.conf.

The upstream default in the code (that is, when the "gpgcheck_policy" option is unset) would be the equivalent of setting "gpgcheck_policy=full". However, for the dnf.conf that will ship in Fedora and RHEL, it would be set to "gpgcheck_policy=legacy" to conform with the existing behavior and not break anything.

This aligns our options and behaviors with other RPM package managers using rpm-md and makes the GPG checking policy coherent.

Comment 8 Michal Domonkos 2019-11-15 09:37:21 UTC
I'm returning this to the backlog (dropping "Triaged") for the DNF team to reconsider.

Comment 9 Neal Gompa 2023-07-17 10:22:35 UTC
Moving to DNF 5.


Note You need to log in before you can comment on or make changes to this bug.