Forgejo repo file inconsistency between gpgcheck and gpgkey url #108

New issue

Open

opened 2026-06-16 19:14:14 +02:00 by yestax · 2 comments

yestax commented

2026-06-16 19:14:14 +02:00

Owner

At this time, an user publishing rpm packages can't follow the documentation of the RPM package registry https://forgejo.org/docs/v15.0/user/packages/rpm/ as it results in errors if the packages are not signed.

Since packages are tied to the user, could be great to add his public key url to gpgkey (2 urls separated by a whitespace).

Either add repo_gpgcheck=1 (default to false) and is natively supported.

Remove gpg_check since it defaults to false or specifically say in the documentation that packages must be signed or instruct to disable the gpgcheck.

https://dnf.readthedocs.io/en/latest/conf_ref.html

Forgejo served rpm repo file sets gpgcheck=1 that implies to sign packages at build time. On the other hand it gives as gpgkey the url to the repo signing metadata wich check is managed by repo_gpgcheck. At this time, an user publishing rpm packages can't follow the documentation of the RPM package registry https://forgejo.org/docs/v15.0/user/packages/rpm/ as it results in errors if the packages are not signed. Since packages are tied to the user, could be great to add his public key url to gpgkey (2 urls separated by a whitespace). Either add repo_gpgcheck=1 (default to false) and is natively supported. Remove gpg_check since it defaults to false or specifically say in the documentation that packages must be signed or instruct to disable the gpgcheck. https://dnf.readthedocs.io/en/latest/conf_ref.html

yestax commented

2026-06-17 14:23:43 +02:00

Author

Owner

Tracked under https://codeberg.org/forgejo/forgejo/issues/7780