Skip to content

fix(install): resolve GPG key verification failures on RHEL platforms #810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix(install): resolve GPG key verification failures on RHEL platforms #810

wants to merge 4 commits into from

Conversation

damacus
Copy link
Member

@damacus damacus commented Oct 16, 2025

  • Add execute resource to import GPG key into RPM database
  • Set repo_gpgcheck=false to work around metadata signature issues
  • Add KITCHEN_LOCAL_YAML to mise.toml for the Dokken driver
  • Enhance TESTING.md with local development guide
  • Create FAILING_TESTS.md to track test failures and fixes

Root cause: DNF on RHEL 9+ requires GPG keys to be imported into the RPM database, not just present as files. Additionally, repo metadata signatures can cause issues even when package signatures are valid.

This fix enables all RHEL-based platform testing which were previously blocked.

@damacus
fix(install): resolve GPG key verification failures on RHEL platforms
5957d57 
- Add execute resource to import GPG key into RPM database
- Set repo_gpgcheck=false to work around metadata signature issues
- Add KITCHEN_LOCAL_YAML to mise.toml for Dokken driver
- Enhance TESTING.md with comprehensive local development guide
- Create FAILING_TESTS.md to track test failures and fixes

Root cause: DNF on RHEL 9+ requires GPG keys to be imported into the
RPM database, not just present as files. Additionally, repo metadata
signatures can cause issues even when package signatures are valid.

This fix enables all RHEL-based platform testing which were previously blocked.

Signed-off-by: Dan Webb <[email protected]>
@damacus damacus requested a review from a team as a code owner October 16, 2025 13:08
@damacus
fix(install): use architecture-specific GPG keys for RHEL platforms
d56a457 
PostgreSQL uses different GPG keys for signing aarch64 vs x86_64 packages.
The previous fix attempted to import the generic key, but packages were
still failing verification because they were signed with arch-specific keys.

Changes:
- Update default_yum_gpg_key_uri helper to detect architecture
- Use PGDG-RPM-GPG-KEY-AARCH64-RHEL for aarch64 on RHEL 8+
- Use PGDG-RPM-GPG-KEY-AARCH64-RHEL7 for aarch64 on RHEL 7
- Keep generic keys for x86_64 architecture
- Remove not_if guard from rpm import (command is idempotent)

Verified on:
- centos-stream-9 (aarch64): PASSING
- rockylinux-9 (aarch64): PASSING
- debian-12 (aarch64): PASSING

This fully resolves the GPG verification failures on RHEL-based platforms.
@damacus
chore: fix yum dependency version constraint
754b47d 
Use >= 7.2 instead of >= 7.2.0 per Chef metadata best practices.
Version constraints should use major.minor format without patch version.
@damacus
chore: add gpg cookbook dependency
a4302c0
@github-actions GitHub Actions
Copy link

Slowest examples

Top 10 slowest examples (0.01 seconds, 52.87% of total time)
Example Description Time in seconds
spec/libraries/helpers_spec.rb:19 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from repo returns the correct path 0.01414
spec/libraries/helpers_spec.rb:27 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from os returns the correct path 0.00059
spec/libraries/helpers_spec.rb:35 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 11 from repo returns the correct path 0.00047
spec/libraries/helpers_spec.rb:65 PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 11 from os returns the correct path 0.00041
spec/libraries/helpers_spec.rb:43 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 11 from os returns the correct path 0.0004
spec/libraries/helpers_spec.rb:111 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 15 from repo returns the correct service name 0.00037
spec/libraries/helpers_spec.rb:57 PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 11 from repo returns the correct path 0.00037
spec/libraries/helpers_spec.rb:73 PostgreSQL::Cookbook::Helpers#conf_dir(version) with debian family and Postgres 15 from repo returns the correct path 0.00037
spec/libraries/helpers_spec.rb:57 PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 12 from repo returns the correct path 0.00036
spec/libraries/helpers_spec.rb:43 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 13 from os returns the correct path 0.00035

@github-actions GitHub Actions
Copy link

Slowest examples

Top 10 slowest examples (0.01 seconds, 51.17% of total time)
Example Description Time in seconds
spec/libraries/helpers_spec.rb:19 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from repo returns the correct path 0.01327
spec/libraries/helpers_spec.rb:27 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from os returns the correct path 0.0005
spec/libraries/helpers_spec.rb:35 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 11 from repo returns the correct path 0.00042
spec/libraries/helpers_spec.rb:57 PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 11 from repo returns the correct path 0.00036
spec/libraries/helpers_spec.rb:103 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with rhel family and Postgres 14 from os returns the correct service name 0.00036
spec/libraries/helpers_spec.rb:111 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 11 from repo returns the correct service name 0.00036
spec/libraries/helpers_spec.rb:73 PostgreSQL::Cookbook::Helpers#conf_dir(version) with debian family and Postgres 11 from repo returns the correct path 0.00035
spec/libraries/helpers_spec.rb:43 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 11 from os returns the correct path 0.00035
spec/libraries/helpers_spec.rb:95 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with rhel family and Postgres 11 from repo returns the correct service name 0.00035
spec/libraries/helpers_spec.rb:111 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 13 from repo returns the correct service name 0.00035

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@damacus