Unable to check for software updates in Cockpit

[phil-harmoniq]

Hello,

I've been testing AlmaLinux on a Raspberry Pi but ran into an issue while using Cockpit. When trying to check for updates Cockpit gives the following error:

Loading available updates failed
Failed to download gpg key for repo 'raspberrypi': Curl error (37): Couldn't read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux]

Please reload the page after resolving the issue.

Sure enough, the rpm-gpg folder doesn't have that file available, but there are files for CentOS and RedHat:

[ devops@rpi-2 ~ ]$ ls -lhaF /etc/pki/rpm-gpg
total 32K
drwxr-xr-x. 2 root root 4.0K Feb 16 17:25 ./
drwxr-xr-x. 8 root root 4.0K Feb 13 20:41 ../
-rw-r--r--. 1 root root 1.7K Feb 14 13:43 RPM-GPG-KEY-centosofficial
-rw-r--r--. 1 root root 2.2K Feb 14 13:43 RPM-GPG-KEY-CentOS-SIG-Extras
-rw-r--r--. 1 root root 2.2K Feb 14 13:43 RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
-rw-r--r--. 1 root root 1.7K Aug 10  2022 RPM-GPG-KEY-EPEL-9
-rw-r--r--. 1 root root 1.7K Feb  1 06:25 RPM-GPG-KEY-redhat-beta
-rw-r--r--. 1 root root 1.9K Feb  1 06:25 RPM-GPG-KEY-redhat-release

I am not super familiar with how the GPG keys are supposed to work. Is this a bug in Cockpit or with the AlmaLinux image?

[AlexBaranowski]

Hi @phil-harmoniq could you specify which image you used? I can blindly blame the almalinux-release-raspberrypi package but I would love to confirm the version before further investigation.

Edit: Grammarly

[phil-harmoniq]

Of course, I'm using the AlmaLinux-9-RaspberryPi-9.1-20221116.aarch64.raw.xz from the repo and version 276.1 of Cockpit.

[AlexBaranowski]

Hi @phil-harmoniq, for fix there is TLDR with soulution. If you want the steps to reproduce and investigate then:

I just checked and there is a problem. Not only with the cockpit, but also with the bash and command not found wrapper:

[alex@localhost ~]$ sadfafdsafasfsa
bash: sadfafdsafasfsa: command not found...
Failed to search for file: Failed to download gpg key for repo 'raspberrypi': Curl error (37): Couldn't read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux]

Firstly I checked the installed packages that are AlmaLinux branding/repositories related:

[alex@localhost ~]$ rpm -qa | grep '^alma'
almalinux-backgrounds-90.5.1-1.1.el9.noarch
almalinux-release-9.1-1.9.el9.aarch64
almalinux-release-raspberrypi-9-1.el9.aarch64
almalinux-indexhtml-9-1.el9.noarch
almalinux-gpg-keys-9.1-1.9.el9.aarch64
almalinux-repos-9.1-1.9.el9.aarch64
almalinux-logos-90.5.1-1.1.el9.aarch64

There is almalinux-gpg-keys-9.1-1.9.el9.aarch64 package that should contain the AlmaLinux gpg keys. I listed the keys and then use rpm --verify to prove that the key was not changed.

[alex@localhost ~]$ rpm -ql almalinux-gpg-keys-9.1-1.9.el9.aarch64
/etc/pki/rpm-gpg
/etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
[alex@localhost ~]$ rpm --verify almalinux-gpg-keys-9.1-1.9.el9.aarch64

That means that the problem for 99% is the .repo file that is in the /etc/yum.repos.d. I confirmed it with the:

[alex@localhost ~]$ grep -h  'gpgkey' /etc/yum.repos.d/almalinux-* | sort -u
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9

So some repo file uses the wrong gpgkey and as You can imagine they are RPI one :)

TLDR

To fix you can run the sed (as root or with sudo):

sed -i 's#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9#' /etc/yum.repos.d/almalinux-raspberrypi.repo 

or create the symlink for the key

cd /etc/pki/rpm-gpg/ && sudo ln -s RPM-GPG-KEY-AlmaLinux-9 RPM-GPG-KEY-AlmaLinux

@srbala could you fix the almalinux-release-raspberrypi package?

[phil-harmoniq]

Thanks @AlexBaranowski that fix works on my Raspberry Pi 👍

[AlexBaranowski]

@andrewlukoshko @srbala the almalinux-release-raspberrypi requires the fix in the /etc/yum.repos.d/almalinux-raspberrypi.repo

Best, Alex

[andrewlukoshko]

Update for almalinux-release-raspberrypi is released

It's also possible to fix this by importing GPG key manually:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9

I'll close this issue when we have updated image.

[metalefty]

The root cause is the same with #19 and almalinux-package-raspberrypi package is already fixed.

[metalefty]

Now the issue is solved at 20230615 image. https://repo.almalinux.org/development/almalinux/9/raspberrypi/