Bad GPG signature found when using KDE Discover

tailscale / tailscale

The easiest, most secure way to use WireGuard and 2FA.

https://tailscale.com

BSD 3-Clause "New" or "Revised" License

19.33k stars 1.51k forks source link

Bad GPG signature found when using KDE Discover #6246

Closed t3kg33k closed 1 year ago

t3kg33k commented 2 years ago

What is the issue?

When attempting to complete updates in Fedora 36 KDE via Discover I get the following message and the updates fail:

Bad GPG signature found:<br/><br/>/var/cache/PackageKit/36/metadata/tailscale-stable-36-x86_64/packages/tailscale_1.32.2_x86_64.rpm could not be verified.
/var/cache/PackageKit/36/metadata/tailscale-stable-36-x86_64/packages/tailscale_1.32.2_x86_64.rpm:  digest:  SIGNATURE:  NOT OK

In order to complete updates I have to uninstall Tailscale, run updates to completion, and then reinstall Tailscale. This is a consistent error seen and practice on my laptop and desktop.

Steps to reproduce

Run updates in KDE Discover

Are there any recent changes that introduced the issue?

OS

Linux

OS version

Fedora 36 KDE Plasma

Tailscale version

1.32.1-1

Bug report

BUG-223a942f89a47ae5f793015e80673d8ffb9d2f3fc0d97df07e6b42b0992f386c-20221109111706Z-7794eeac66a60538

t3kg33k commented 2 years ago

Follow up:

I just attempted a sudo dnf update from CLI and did NOT get the error. Updates were successful. So, I am assuming there is an issue with the update process in KDE Discover Software Center. If so, is that a KDE issue or a Tailscale issue?

DentonGentry commented 2 years ago

There appear to be other packages which KDE Discover flags as having a bad signature: https://www.reddit.com/r/Fedora/comments/847jic/cant_install_bluej_on_fedora_kde_bad_gpg/

ejnshtein commented 1 year ago

Currently, I have version 1.34.1-1 and trying to update it to 1.34.2-1. Same Distro, its version and solution as reported earlier.

danderson commented 1 year ago

It sounds like KDE discover might not be implementing the full rpm spec. In particular, it may be insisting on having signatures on the individual package files, whereas our package server signs the index root file, which transitively verifies the packages by virtue of the hashes in the index.

The .repo file we provide (https://pkgs.tailscale.com/stable/fedora/36/tailscale.repo) specifies to enforce signature checking on the repo index, and not on individual packages. So, I think this is a KDE Discover upstream bug?

DentonGentry commented 1 year ago

I believe this will be resolved by signing the packages then. Duplicate of https://github.com/tailscale/tailscale/issues/1882