Closed mohd-akram closed 1 year ago
I am afraid we do not control how keys of hosted services such as PackageCloud are generated.
You can opt in for installing using direct download from GitHub
Here is the rabbitmq/erlang
signing key used by PackageCloud. There is one per repo. I do not see any way for us to regenerate it,
and if we did, I'm afraid it would require an action from every user who has provisioned
this RPM from PackageCloud.
In the past we've had a similar transition with the RabbitMQ signing key as well as one key transition with PackageCloud (in October 2018) which was forced upon us by the service.
I haven't seen this issue on CentOS 9 just last month. But if this does have to do with the algorithm used when generating the key, for the time being, direct downloads would be the only option for Oracle Linux 9 users, until PackageCloud introduces a way to regenerate the key.
It seems a solution is to remove the repo_gpgcheck=1
line from the .repo
file. The packages themselves are signed by the RabbitMQ key, which works in RHEL 9. Here's a much simplified rabbitmq.repo
file that works:
[rabbitmq_erlang]
name=rabbitmq_erlang
baseurl=https://packagecloud.io/rabbitmq/erlang/el/8/$basearch
gpgcheck=1
enabled=1
gpgkey=https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc
[rabbitmq_server]
name=rabbitmq_server
baseurl=https://packagecloud.io/rabbitmq/rabbitmq-server/el/8/$basearch
gpgcheck=1
enabled=1
gpgkey=https://github.com/rabbitmq/signing-keys/releases/download/2.0/rabbitmq-release-signing-key.asc
I would recommend updating the documentation to this. The current one is unnecessarily long.
I get this when installing on Oracle Linux 9 (following the guide here):
My guess is that it's because the key uses SHA-1 (verified via
gpg --list-packets
, digest algo is 2 i.e. SHA-1) which is not supported by default on RHEL 9.