Why do some repos fail the RPM package import with GPG errors? (Chrome, ProtonVPN)

[Repowave]

For example, using ProtonVPN's provided .repo:

[protonvpn-fedora-stable]
name = ProtonVPN Fedora Stable repository
baseurl = https://repo.protonvpn.com/fedora-$releasever-stable
enabled = 1
gpgcheck = 1
repo_gpgcheck=1
gpgkey = https://repo.protonvpn.com/fedora-$releasever-stable/public_key.asc

This doesn't look out of the ordinary from other repos that are working fine, but when trying to rpm-ostree install a package from the repo, it outputs the following error:

Importing packages... done
error: importing RPMs: package proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch cannot be verified and repo protonvpn-fedora-stable is GPG enabled: /var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm could not be verified.
/var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm:  digest:  SIGNATURE:  NOT OK

Is there a misconfiguration in the repo, or the rpm trying to be acquired, or is this a bug in rpm-ostree?

No prompts to accept/import GPG keys occurs in Silverblue, for instance, as it does on Fedora Workstation.

[miabbott]

This kind of looks like an issue that was reported a while ago about how rpm-ostree handles GPG keys with subkeys (#1094 (comment))

$ gpg /etc/pki/rpm-gpg/protonvpn.asc 
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa3072 2020-10-28 [SC] [expires: 2024-12-15]
      A88441BD4864F95BEE08E63A71EB474019940E11
uid           Proton Technologies AG <[email protected]>
sub   rsa3072 2020-10-28 [E] [expires: 2024-12-15]
pub   rsa3072 2024-03-20 [SC] [expires: 2025-03-20]
      9E72DFDF2AF019F0CCFC68F38DD48989F43719CA
uid           Proton Technologies AG <[email protected]>
sub   rsa3072 2024-03-20 [E] [expires: 2025-03-20]
pub   rsa3072 2024-10-25 [SC] [expires: 2026-10-25]
      F20018AD1914638BC3B485F7413E4BA367FCBBBB
uid           Proton Technologies AG <[email protected]>

$ rpm -qip /var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm | grep Signature
warning: /var/cache/rpm-ostree/repomd/protonvpn-fedora-stable-41-x86_64/packages/proton-vpn-gnome-desktop-0.8.0-1.fc41.noarch.rpm: Header V4 RSA/SHA256 Signature, key ID 67fcbbbb: NOKEY
Signature   : RSA/SHA256, Tue 05 Nov 2024 05:49:12 AM EST, Key ID 413e4ba367fcbbbb

But that was supposed to be fixed with rpm-software-management/libdnf#711 and #1819

@jlebon any ideas here?

[Repowave]

Ahh interesting! If would be nice if it was just an old bug that cropped back up and could be fixed again. Looking at those old ones, it looks like this was happening with Brave - which I use coincidentally. At the moment it doesn't seem to be having the same problem.