add GPG key references in repo files #674

fkooman commented 2025年11月24日 10:33:13 +01:00

remove the rpm --import command, and reference the GPG key
directly in the repo file. This prevents the key from being
deleted on OS upgrade.

remove the `rpm --import` command, and reference the GPG key directly in the `repo` file. This prevents the key from being deleted on OS upgrade.

fkooman commented 2025年11月24日 13:45:39 +01:00

enabled=1

Explicitly enable the repository, it is not strictly necessary as that is the default.

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-python-eduvpn-client_v4

Reference the public key on disk so the manual importing using rpm --import is no longer needed, dnf/yum takes care of it just in time.

The reason for wanting this (in one form or another) is that the upgrade process reference a tool to clean up the GPG keys that are no longer referenced anywhere, so it avoids them being deleted when the user runs that script (as recommended by upgrade process):

https://docs.fedoraproject.org/en-US/quick-docs/upgrading-fedora-offline/#sect-clean-up-old-keys

> `enabled=1` Explicitly enable the repository, it is not strictly necessary as that is the default. > `gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-python-eduvpn-client_v4` Reference the public key on disk so the manual importing using `rpm --import` is no longer needed, `dnf`/`yum` takes care of it just in time. The reason for wanting this (in one form or another) is that the upgrade process reference a tool to clean up the GPG keys that are no longer referenced anywhere, so it avoids them being deleted when the user runs that script (as recommended by upgrade process): https://docs.fedoraproject.org/en-US/quick-docs/upgrading-fedora-offline/#sect-clean-up-old-keys

fkooman commented 2025年11月24日 13:46:33 +01:00

You could probably also directly reference the URL in the gpgkey line. I just don't know what happens when that key updates at that URL. Hopefully dnf/yum will refuse to function?

You could probably also directly reference the URL in the `gpgkey` line. I just don't know what happens when that key updates at that URL. Hopefully `dnf`/`yum` will refuse to function?

jwijenbergh commented 2025年11月24日 14:20:22 +01:00

Thanks!

Thanks!

jwijenbergh commented 2025年11月24日 14:25:14 +01:00

Also updated here a65f1e956e

Also updated here https://codeberg.org/eduVPN/linux-app/commit/a65f1e956ed1e5c3261942e040d3500ae1e6874e