search

keybase / keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.
902 stars 37 forks source link

Keybase upgrade to 6.0.2 using installed yum repository fails #4140

Open pemensik opened 2 years ago

pemensik commented 2 years ago

I am running Fedora 35 with keybase installed. But I started having failures on keybase upgrade, because GPG signature is incorrect.

$ LC_ALL=C.UTF-8 sudo dnf upgrade keybase
keybase                                                                                                                                                         49 kB/s | 3.3 kB     00:00    
Dependencies resolved.
===============================================================================================================================================================================================
 Package                                Architecture                          Version                                                             Repository                              Size
===============================================================================================================================================================================================
Upgrading:
 keybase                                x86_64                                6.0.2.20220610191041.a459abf326-1                                   keybase                                191 M

Transaction Summary
===============================================================================================================================================================================================
Upgrade  1 Package

Total size: 191 M
Is this ok [y/N]: y
Downloading Packages:
[SKIPPED] keybase-6.0.2.20220610191041.a459abf326-1.x86_64.rpm: Already downloaded                                                                                                            
keybase                                                                                                                                                        7.2 kB/s | 3.0 kB     00:00    
GPG key at https://keybase.io/docs/server_security/code_signing_key.asc (0x656D16C7) is already installed
The GPG keys listed for the "keybase" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.. Failing package is: keybase-6.0.2.20220610191041.a459abf326-1.x86_64
 GPG Keys are configured as: https://keybase.io/docs/server_security/code_signing_key.asc
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

It seems it were signed by different key than repository expects.

warning: keybase-6.0.2.20220610191041.a459abf326-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 656d16c7: NOKEY
Name        : keybase
Version     : 6.0.2.20220610191041.a459abf326
Release     : 1
Architecture: x86_64
Install Date: (not installed)
Group       : Unspecified
Size        : 558258324
License     : BSD
Signature   : RSA/SHA256, Fri Jun 10 21:26:54 2022, Key ID 47484e50656d16c7
Source RPM  : keybase-6.0.2.20220610191041.a459abf326-1.src.rpm
Build Date  : Fri Jun 10 21:25:12 2022
Build Host  : 18598b8abc38
Summary     : The Keybase Go client, filesystem, and GUI
Description :
The Keybase Go client, filesystem, and GUI
LC_ALL=C curl -L https://keybase.io/docs/server_security/code_signing_key.asc | LC_ALL=C gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3106  100  3106    0     0   7396      0 --:--:-- --:--:-- --:--:--  7412
gpg: key 47484E50656D16C7: "Keybase.io Code Signing (v1) <code@keybase.io>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
pemensik commented 2 years ago

It seems I fixed it with a help from page https://www.redhat.com/sysadmin/rpm-gpg-verify-packages:

sudo rpm --import https://keybase.io/docs/server_security/code_signing_key.asc

Then again sudo dnf upgrade keybase passed without turning off GPG verification. I think there should have been something done different on repository side to avoid this being necessary. Not sure what exactly.