2

I am having an issue with a lab server I am running using CentOS 9, when I'm trying to install Grafana, the GPG check fails. This is the output I get:

     Importing GPG key 0x24098CB6:
     Userid     : "Grafana <info@grafana.com>"
     Fingerprint: 4E40 DDF6 D76E 284A 4A67 80E4 8C8C 34C5 2409 8CB6
     From       : https://packages.grafana.com/gpg.key
    Is this ok [y/N]: y
    Key import failed (code 2). Failing package is: grafana-8.5.5-1.x86_64
     GPG Keys are configured as: https://packages.grafana.com/gpg.key
    The downloaded packages were saved in cache until the next successful transaction.
    You can remove cached packages by executing 'dnf clean packages'.
    Error: GPG check FAILED

When I try the same on my local Fedora 35 machine, I get this:

    Importing GPG key 0x24098CB6:
     Userid     : "Grafana <info@grafana.com>"
     Fingerprint: 4E40 DDF6 D76E 284A 4A67 80E4 8C8C 34C5 2409 8CB6
     From       : https://packages.grafana.com/gpg.key
    Is this ok [y/N]: y
    Key imported successfully
    Running transaction check

The packages being downloaded are the same grafana-8.5.5-1.x86_64.rpm, I am using dnf for both installations, and the grafana.repo files are both the same:

[grafana]
name=grafana
baseurl=https://packages.grafana.com/oss/rpm
repo_gpgcheck=1
enabled=1
gpgcheck=1
gpgkey=https://packages.grafana.com/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt

I know I could just turn off the gpg checking, but I am not comfortable with a solution like that.

Any help resolving this would be greatly appreciated! Let me know if I should supply any more information.

I've quite recently swapped over to CentOS and Fedora, so I apologize if this has been resolved before, but I was unable to find it.

nidor
  • 21
  • 3

2 Answers2

2

There has been some change with the default crypto policies in CentOS streams 9.

update-crypto-policies --set DEFAULT:SHA1

The packages need to be re-signed with a SHA256 or SHA521 key instead of SHA1.

Ref: https://access.redhat.com/articles/6846411

askb
  • 6,501
  • 30
  • 43
  • Thank you, worked on AlmaLinux 9. After executing, does the system revert to SHA256 on reboot if system wide encryption policies are set ? – Orsiris de Jong Aug 18 '22 at 10:53
0

Just in case someone finds this thread with the same problem installing Plex Media Server on Rocky / RHEL / CentOS Stream 9 the information from @askb solved my issue.

balter
  • 25
  • 1
  • 9
  • As it’s currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Aug 16 '23 at 05:13