[MDEV-30591] GPG key issue when updating MariaDB on CentOS 7 and AlmaLinux 8 Created: 2023-02-07  Updated: 2023-02-08

Status: Open
Project: MariaDB Server
Component/s: None
Fix Version/s: None

Type: Task Priority: Major
Reporter: Nuno Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: None


 Description   

If I run "yum update", today I'm getting this issue:

Resolving Dependencies
--> Running transaction check
---> Package MariaDB-common.x86_64 0:10.4.27-1.el7.centos will be updated
---> Package MariaDB-common.x86_64 0:10.4.28-1.el7.centos will be an update
---> Package MariaDB-compat.x86_64 0:10.4.27-1.el7.centos will be updated
---> Package MariaDB-compat.x86_64 0:10.4.28-1.el7.centos will be an update
---> Package MariaDB-shared.x86_64 0:10.4.27-1.el7.centos will be updated
---> Package MariaDB-shared.x86_64 0:10.4.28-1.el7.centos will be an update
---> Package galera-4.x86_64 0:26.4.13-1.el7.centos will be updated
---> Package galera-4.x86_64 0:26.4.14-1.el7.centos will be an update
--> Finished Dependency Resolution
 
Dependencies Resolved
 
========================================================================================================================================================
 Package                              Arch                         Version                                     Repository                          Size
========================================================================================================================================================
Updating:
 MariaDB-common                       x86_64                       10.4.28-1.el7.centos                        mariadb-main                        82 k
 MariaDB-compat                       x86_64                       10.4.28-1.el7.centos                        mariadb-main                       2.2 M
 MariaDB-shared                       x86_64                       10.4.28-1.el7.centos                        mariadb-main                       113 k
 galera-4                             x86_64                       26.4.14-1.el7.centos                        mariadb-main                       9.9 M
 
Transaction Summary
========================================================================================================================================================
Upgrade  4 Packages
 
Total size: 12 M
Total download size: 2.3 M
Downloading packages:
Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
warning: /var/cache/yum/x86_64/7/mariadb-main/packages/MariaDB-common-10.4.28-1.el7.centos.x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID c74cd1d8: NOKEY
Public key for MariaDB-common-10.4.28-1.el7.centos.x86_64.rpm is not installed
(1/3): MariaDB-common-10.4.28-1.el7.centos.x86_64.rpm                                                                            |  82 kB  00:00:01
(2/3): MariaDB-shared-10.4.28-1.el7.centos.x86_64.rpm                                                                            | 113 kB  00:00:00
(3/3): MariaDB-compat-10.4.28-1.el7.centos.x86_64.rpm                                                                            | 2.2 MB  00:00:01
--------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                   1.2 MB/s | 2.3 MB  00:00:02
Retrieving key from file:///etc/pki/rpm-gpg/MariaDB-Server-GPG-KEY
 
 
GPG key retrieval failed: [Errno 14] curl#37 - "Couldn't open file /etc/pki/rpm-gpg/MariaDB-Server-GPG-KEY"

Same on AlmaLinux:

Last metadata expiration check: 1:56:36 ago on Tue 07 Feb 2023 03:03:28 AM UTC.
Dependencies resolved.
================================================================================
 Package         Architecture  Version                Repository           Size
================================================================================
Upgrading:
 galera-4        x86_64        26.4.14-1.el8          mariadb-main         13 M
 
Transaction Summary
================================================================================
Upgrade  1 Package
 
Total download size: 13 M
Downloading Packages:
galera-4-26.4.14-1.el8.x86_64.rpm               8.0 MB/s |  13 MB     00:01
--------------------------------------------------------------------------------
Total                                           8.0 MB/s |  13 MB     00:01
MariaDB Server                                  8.0 MB/s | 8.2 kB     00:00
GPG key at file:///etc/pki/rpm-gpg/MariaDB-Server-GPG-KEY (0x1BB943DB) is already installed
The GPG keys listed for the "MariaDB Server" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: galera-4-26.4.14-1.el8.x86_64
 GPG Keys are configured as: file:///etc/pki/rpm-gpg/MariaDB-Server-GPG-KEY
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'yum clean packages'.
Error: GPG check FAILED


This is the repo file:

# cat mariadb.repo
[mariadb-main]
name = MariaDB Server
baseurl = https://downloads.mariadb.com/MariaDB/mariadb-10.4/yum/rhel/$releasever/$basearch
gpgkey = file:///etc/pki/rpm-gpg/MariaDB-Server-GPG-KEY
gpgcheck = 1
enabled = 1
 
 
[mariadb-maxscale]
# To use the latest stable release of MaxScale, use "latest" as the version
# To use the latest beta (or stable if no current beta) release of MaxScale, use "beta" as the version
name = MariaDB MaxScale
baseurl = https://downloads.mariadb.com/MaxScale/2.4/centos/$releasever/$basearch
gpgkey = file:///etc/pki/rpm-gpg/MariaDB-MaxScale-GPG-KEY
gpgcheck = 1
enabled = 1
 
[mariadb-tools]
name = MariaDB Tools
baseurl = https://downloads.mariadb.com/Tools/rhel/$releasever/$basearch
gpgkey = file:///etc/pki/rpm-gpg/MariaDB-Enterprise-GPG-KEY
gpgcheck = 1
enabled = 1

Disabling "gpgcheck" will likely make it work, but I'd like to keep it updated

Thank you!



 Comments   
Comment by Daniel Black [ 2023-02-07 ]

The key got changed.

https://mariadb.org/new-gpg-release-key-rpms/

changing gpgkey = https://supplychain.mariadb.com/MariaDB-Server-GPG-KEY is probably the easiest fix and accept new key matching the blog fingerprint.

Comment by Nuno [ 2023-02-08 ]

Thank you very much! That seems to have resolved it.

I see now also in the Release Notes, that the yum repo changed.

Have a great day!

Generated at Thu Feb 08 10:17:24 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.