Skip to content

fix(install): resolve GPG key verification failures on RHEL platforms #810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix(install): resolve GPG key verification failures on RHEL platforms #810

wants to merge 5 commits into from
+154 −30

Conversation

damacus
Copy link
Member

@damacus damacus commented Oct 16, 2025

  • Add execute resource to import GPG key into RPM database
  • Set repo_gpgcheck=false to work around metadata signature issues
  • Add KITCHEN_LOCAL_YAML to mise.toml for the Dokken driver
  • Enhance TESTING.md with local development guide
  • Create FAILING_TESTS.md to track test failures and fixes

Root cause: DNF on RHEL 9+ requires GPG keys to be imported into the RPM database, not just present as files. Additionally, repo metadata signatures can cause issues even when package signatures are valid.

This fix enables all RHEL-based platform testing which were previously blocked.

@damacus
fix(install): resolve GPG key verification failures on RHEL platforms
5957d57 
- Add execute resource to import GPG key into RPM database
- Set repo_gpgcheck=false to work around metadata signature issues
- Add KITCHEN_LOCAL_YAML to mise.toml for Dokken driver
- Enhance TESTING.md with comprehensive local development guide
- Create FAILING_TESTS.md to track test failures and fixes

Root cause: DNF on RHEL 9+ requires GPG keys to be imported into the
RPM database, not just present as files. Additionally, repo metadata
signatures can cause issues even when package signatures are valid.

This fix enables all RHEL-based platform testing which were previously blocked.

Signed-off-by: Dan Webb <[email protected]>
@damacus damacus requested a review from a team as a code owner October 16, 2025 13:08
@damacus
fix(install): use architecture-specific GPG keys for RHEL platforms
d56a457 
PostgreSQL uses different GPG keys for signing aarch64 vs x86_64 packages.
The previous fix attempted to import the generic key, but packages were
still failing verification because they were signed with arch-specific keys.

Changes:
- Update default_yum_gpg_key_uri helper to detect architecture
- Use PGDG-RPM-GPG-KEY-AARCH64-RHEL for aarch64 on RHEL 8+
- Use PGDG-RPM-GPG-KEY-AARCH64-RHEL7 for aarch64 on RHEL 7
- Keep generic keys for x86_64 architecture
- Remove not_if guard from rpm import (command is idempotent)

Verified on:
- centos-stream-9 (aarch64): PASSING
- rockylinux-9 (aarch64): PASSING
- debian-12 (aarch64): PASSING

This fully resolves the GPG verification failures on RHEL-based platforms.
@damacus
chore: fix yum dependency version constraint
754b47d 
Use >= 7.2 instead of >= 7.2.0 per Chef metadata best practices.
Version constraints should use major.minor format without patch version.
@damacus damacus force-pushed the fix-up branch 2 times, most recently from 2773db7 to 54508a3 Compare October 20, 2025 21:34
@github-actions GitHub Actions
Copy link

Slowest examples

Top 10 slowest examples (0.01 seconds, 47.99% of total time)
Example Description Time in seconds
spec/libraries/helpers_spec.rb:19 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from repo returns the correct path 0.01242
spec/libraries/helpers_spec.rb:35 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 13 from repo returns the correct path 0.00044
spec/libraries/helpers_spec.rb:81 PostgreSQL::Cookbook::Helpers#conf_dir(version) with debian family and Postgres 12 from os returns the correct path 0.00041
spec/libraries/helpers_spec.rb:65 PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 11 from os returns the correct path 0.0004
spec/libraries/helpers_spec.rb:111 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 15 from repo returns the correct service name 0.00039
spec/libraries/helpers_spec.rb:111 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 11 from repo returns the correct service name 0.00038
spec/libraries/helpers_spec.rb:119 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 12 from os returns the correct service name 0.00038
spec/libraries/helpers_spec.rb:27 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 15 from os returns the correct path 0.00038
spec/libraries/helpers_spec.rb:119 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 14 from os returns the correct service name 0.00038
spec/libraries/helpers_spec.rb:43 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 14 from os returns the correct path 0.00038

@github-actions GitHub Actions
Copy link

Slowest examples

Top 10 slowest examples (0.01 seconds, 47.95% of total time)
Example Description Time in seconds
spec/libraries/helpers_spec.rb:19 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from repo returns the correct path 0.01253
spec/libraries/helpers_spec.rb:111 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 11 from repo returns the correct service name 0.00041
spec/libraries/helpers_spec.rb:119 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 15 from os returns the correct service name 0.00039
spec/libraries/helpers_spec.rb:111 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 12 from repo returns the correct service name 0.00039
spec/libraries/helpers_spec.rb:103 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with rhel family and Postgres 13 from os returns the correct service name 0.00039
spec/libraries/helpers_spec.rb:65 PostgreSQL::Cookbook::Helpers#conf_dir(version) with rhel family and Postgres 11 from os returns the correct path 0.00039
spec/libraries/helpers_spec.rb:43 PostgreSQL::Cookbook::Helpers#data_dir(version) with debian family and Postgres 14 from os returns the correct path 0.00039
spec/libraries/helpers_spec.rb:27 PostgreSQL::Cookbook::Helpers#data_dir(version) with rhel family and Postgres 11 from os returns the correct path 0.00038
spec/libraries/helpers_spec.rb:95 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with rhel family and Postgres 14 from repo returns the correct service name 0.00038
spec/libraries/helpers_spec.rb:119 PostgreSQL::Cookbook::Helpers#default_platform_service_name(version) with debian family and Postgres 12 from os returns the correct service name 0.00038

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@damacus