http://bugzilla.opensuse.org/show_bug.cgi?id=1093808 Bug ID: 1093808 Summary: gpg2 update to 2.2.7 (or minor rpm update), breaks own-repository signing key Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Factory Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening@forge.provo.novell.com Reporter: patrick.schaaf@yalwa.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Tumbleweed recently updated gpg2 from 2.2.6 to 2.2.7 and rpm from 4.14.1-6.1 to 4.14.1-7.1. With the newer versions, I now experience a weird issue with a self-built repository (in use for quite some years) related to client side signature checking on "zypper ref". Output looks like this: Retrieving repository 'my-own-thing' metadata -------------------------------------------------------[\] Warning: File 'content' from repository 'my-own-thing' is signed with an unknown key '<REDACTED>'. Note: Signing data enables the recipient to verify that no modifications occurred after the data were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system and in extreme cases even to a system compromise. Note: File 'content' is the repositories master index file. It ensures the integrity of the whole repo. Warning: We can't verify that no one meddled with this file, so it might not be trustworthy anymore! You should not continue unless you know it's safe. File 'content' from repository 'my-own-thing' is signed with an unknown key '<REDACTED>'. Continue? [yes/no] (no): -- You are receiving this mail because: You are on the CC list for the bug.