From 386068a40f765f9fbae14bd73732b5cd9dc8a7c7 Mon Sep 17 00:00:00 2001 From: Tomas Kopecek Date: Fri, 31 Jul 2026 11:00:02 +0200 Subject: [PATCH] Docs about dnf5/gpg signature checking Related: https://forge.fedoraproject.org/koji/koji/issues/4544 --- docs/source/mock_config.rst | 28 +++++++++++++++++++++ docs/source/using_the_koji_build_system.rst | 6 ++++- 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/docs/source/mock_config.rst b/docs/source/mock_config.rst index 471a5125..73cbb7c8 100644 --- a/docs/source/mock_config.rst +++ b/docs/source/mock_config.rst @@ -91,6 +91,34 @@ to apply rlimit settings in *both* ``kojid.conf`` and ``site-defaults.cfg`` for consistency. +.. _mock_gpg_verification: + +GPG signature verification +========================== + +Koji generates mock configs with ``gpgcheck=0`` in the yum/dnf configuration, +because packages in Koji's buildroot repos are unsigned. + +Starting with Fedora 45, RPM defaults ``%_pkgverify_level`` to ``all``, +meaning RPM itself refuses to install unsigned packages regardless of the +dnf-level ``gpgcheck`` setting. This causes buildroot setup to fail with +``GPG check FAILED`` when installing packages from the Koji repo. + +DNF5 (>= 5.2.14.0, available in Fedora 42+) has built-in support for +disabling per-package signature verification for repos with ``gpgcheck=0``. +For Fedora 45+ build tags, set ``mock.package_manager=dnf5`` to use this +mechanism: + +:: + + koji edit-tag f45-build -x mock.package_manager=dnf5 + +Older Fedora versions and RHEL are not affected, as they default +``%_pkgverify_level`` to ``digest`` (or do not have the macro at all). + +See :ref:`tuning-mock-per-tag` for other mock-related tag options. + + .. _cli_mock_config: Local mock configs diff --git a/docs/source/using_the_koji_build_system.rst b/docs/source/using_the_koji_build_system.rst index 7f9c00c7..5ca43f19 100644 --- a/docs/source/using_the_koji_build_system.rst +++ b/docs/source/using_the_koji_build_system.rst @@ -389,7 +389,11 @@ environment follows: * ``mock.package_manager`` - If this is set, it will override mock's default - package manager. Typically used with ``yum`` or ``dnf`` values. + package manager. Typically used with ``yum``, ``dnf``, or ``dnf5`` values. + For Fedora 45+ targets, ``dnf5`` is recommended because it correctly handles + unsigned packages from repos with ``gpgcheck=0`` under RPM's enforced + signature checking (``%_pkgverify_level all``). + See :ref:`mock_gpg_verification` for details. * ``mock.new_chroot`` - 0/1 value. If it is set, ``--new-chroot`` or `--old-chroot` option is appended to any mock call. If it is not set, mock's