HTTP URLs for gpgkey don’t work

[fbruetting]

Host system details

State: idle; auto updates disabled
Deployments:
● ostree://fedora-workstation:fedora/28/x86_64/workstation
                   Version: 28.20180707.0 (2018-07-07 21:14:36)
                BaseCommit: 280fbe273785e835d3c2381f8f9ecf3a4a6181fac530be06eb53452894e274d8
              GPGSignature: Valid signature by 128CF232A9371991C8A65695E08E7E629DB62FB1
           LayeredPackages: adapta-gtk-theme adobe-source-code-pro-fonts
                            adobe-source-sans-pro-fonts adobe-source-serif-pro-fonts
                            android-tools chrome-gnome-shell cockpit dconf-editor dnf
                            easytag exa exfat-utils fd-find ffmpeg-libs gcolor2 git glances
                            gnome-tweaks gnome-usage gpick hack-fonts htop iftop julia
                            linux-libertine-biolinum-fonts linux-libertine-fonts mosh
                            mozilla-fira-mono-fonts mozilla-fira-sans-fonts neovim
                            powerline-go pv pygobject3 python3-matplotlib ripgrep
                            setroubleshoot task tilix tilix-nautilus tmux tokei youtube-dl
                            zsh
             LocalPackages: rpmfusion-free-release-28-1.noarch
                            rpmfusion-nonfree-release-28-1.noarch

Expected vs actual behavior

I want to install gnome-encfs-manager. The required steps therefore are:

dnf config-manager --add-repo https://download.opensuse.org/repositories/home:moritzmolch:gencfsm/Fedora_28/home:moritzmolch:gencfsm.repo
dnf install gnome-encfs-manager

In Silverblue this doesn’t work, so I fetched that repo file and moved it into /etc/yum.repos.d/. When I then want to install it, I get:

Resolving dependencies... done
error: package gnome-encfs-manager-1.8.19-300.1.x86_64 cannot be verified and repo home_moritzmolch_gencfsm is GPG enabled: failed to lookup digest in keyring for /var/cache/rpm-ostree/repomd/home_moritzmolch_gencfsm-28-x86_64/packages/gnome-encfs-manager-1.8.19-300.1.x86_64.rpm

According to the repo file, the key lies at:

http://download.opensuse.org/repositories/home:/moritzmolch:/gencfsm/Fedora_26/repodata/repomd.xml.key

miabbott then helped me with copying that file into /etc/pki/rpm-gpg and modifying the repo file accordingly. That worked fine. Could you please fix that?

[dustymabe]

It might be by design (i.e. http is insecure). does https work?

[fbruetting]

Nah, sadly not.

[jlebon]

Can you try again with https:// but cleaning up the metadata first with cleanup -m? It worked fine here. Though we should probably just error out on http:// paths instead of silently ignoring them.

[fbruetting]

Jep, that worked! Then just the issue of the not directly installable .repo file remains. :)

[jlebon]

Nice!

Then just the issue of the not directly installable .repo file remains. :)

I'm inclined to close this as a dupe of #1176 and #405. IOW, it's unlikely we'll be re-implementing dnf features before the discussions in #405 are settled (see also coreos/fedora-coreos-tracker#19).