Docs about dnf5/gpg signature checking

Related: #4544

docs/source/mock_config.rst

@@ -91,6 +91,34 @@ to apply rlimit settings in *both* ``kojid.conf`` and ``site-defaults.cfg`` for
 consistency.
 
 
+.. _mock_gpg_verification:
+
+GPG signature verification
+==========================
+
+Koji generates mock configs with ``gpgcheck=0`` in the yum/dnf configuration,
+because packages in Koji's buildroot repos are unsigned.
+
+Starting with Fedora 45, RPM defaults ``%_pkgverify_level`` to ``all``,
+meaning RPM itself refuses to install unsigned packages regardless of the
+dnf-level ``gpgcheck`` setting. This causes buildroot setup to fail with
+``GPG check FAILED`` when installing packages from the Koji repo.
+
+DNF5 (>= 5.2.14.0, available in Fedora 42+) has built-in support for
+disabling per-package signature verification for repos with ``gpgcheck=0``.
+For Fedora 45+ build tags, set ``mock.package_manager=dnf5`` to use this
+mechanism:
+
+::
+
+    koji edit-tag f45-build -x mock.package_manager=dnf5
+
+Older Fedora versions and RHEL are not affected, as they default
+``%_pkgverify_level`` to ``digest`` (or do not have the macro at all).
+
+See :ref:`tuning-mock-per-tag` for other mock-related tag options.
+
+
 .. _cli_mock_config:
 
 Local mock configs

docs/source/using_the_koji_build_system.rst

@@ -389,7 +389,11 @@ environment follows:
 
 
 * ``mock.package_manager`` - If this is set, it will override mock's default
-  package manager. Typically used with ``yum`` or ``dnf`` values.
+  package manager. Typically used with ``yum``, ``dnf``, or ``dnf5`` values.
+  For Fedora 45+ targets, ``dnf5`` is recommended because it correctly handles
+  unsigned packages from repos with ``gpgcheck=0`` under RPM's enforced
+  signature checking (``%_pkgverify_level all``).
+  See :ref:`mock_gpg_verification` for details.
 
 * ``mock.new_chroot`` - 0/1 value. If it is set, ``--new-chroot`` or
   `--old-chroot` option is appended to any mock call. If it is not set, mock's