Error: GPG check FAILED unable to install on Fedora 38

SYSTEM INFORMATION
OS type and version Fedora 38
Webmin version 2.021-1 and all previous

Having upgraded some Fedora 37 servers to Fedora 38 Webmin will no longer install or update. This is an expected behaviour because F38 introduces stricter signature checking.

For a F38 system with Webmin already installed:

rpm -q webmin
error: rpmdbNextIterator: skipping h# 3476
Header V4 DSA/SHA1 Signature, key ID 11f63c51: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
package webmin is not installed

For a new build:


[root@testbuild ~]# curl -o setup-repos.sh https://raw.githubusercontent.com/webmin/webmin/master/setup-repos.sh
sh setup-repos.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4772  100  4772    0     0  10226      0 --:--:-- --:--:-- --:--:-- 10218
Setup Webmin official repository? (y/N) y
  Downloading Webmin key ..
  .. done
  Installing Webmin key ..
warning: Certificate D97A3AE911F63C51:
  Policy rejects subkey 55A94CAA1B24BE83: Policy rejected asymmetric algorithm
  Certificate does not have any usable signing keys
  .. done
  Setting up Webmin repository ..
  .. done
  Cleaning repository metadata ..
  .. done
Webmin package can now be installed using dnf install webmin command.
[root@testbuild ~]# dnf install webmin
Fedora 38 - x86_64                                                                                                                                                                                                                                                                                                                                                                                                                                          7.7 MB/s |  66 MB     00:08
Fedora 38 openh264 (From Cisco) - x86_64                                                                                                                                                                                                                                                                                                                                                                                                                    1.5 kB/s | 2.5 kB     00:01
Fedora Modular 38 - x86_64                                                                                                                                                                                                                                                                                                                                                                                                                                  2.1 MB/s | 2.3 MB     00:01
Fedora 38 - x86_64 - Updates                                                                                                                                                                                                                                                                                                                                                                                                                                5.0 MB/s | 6.1 MB     00:01
Fedora Modular 38 - x86_64 - Updates                                                                                                                                                                                                                                                                                                                                                                                                                        353  B/s | 257  B     00:00
Webmin - noarch                                                                                                                                                                                                                                                                                                                                                                                                                                             1.4 MB/s |  23 MB     00:16
Dependencies resolved.
============================================================================================================================================================================================================================================================================================================================================================================================================================================================================================
 Package                                                                                                                   Architecture                                                                                                  Version                                                                                                                 Repository                                                                                                            Size
============================================================================================================================================================================================================================================================================================================================================================================================================================================================================================
Installing:
 webmin                                                                                                                    noarch                                                                                                        2.021-1                                                                                                                 webmin-noarch                                                                                                         40 M
Installing dependencies:
 perl-AutoLoader                                                                                                           noarch                                                                                                        5.74-495.fc38                                                                                                           fedora                                                                                                                23 k
 perl-B                                                                                                                    x86_64                                                                                                        1.83-495.fc38                                                                                                           fedora                                                                                                               184 k
 perl-Data-Dumper                                                                                                          x86_64                                                                                                        2.184-491.fc38                                                                                                          fedora                                                                                                                56 k
 perl-Digest                                                                                                               noarch                                                                                                        1.20-490.fc38                                                                                                           fedora                                                                                                                25 k
 perl-Digest-MD5                                                                                                           x86_64                                                                                                        2.58-490.fc38                                                                                                           fedora                                                                                                                36 k
 perl-Digest-SHA                                                                                                           x86_64                                                                                                        1:6.04-1.fc38                                                                                                           fedora                                                                                                                61 k
 perl-Encode-Detect                                                                                                        x86_64                                                                                                        1.01-41.fc38                                                                                                            fedora                                                                                                                87 k
 perl-Filter                                                                                                               x86_64                                                                                                        2:1.64-2.fc38                                                                                                           fedora                                                                                                                87 k
 perl-Net-SSLeay                                                                                                           x86_64                                                                                                        1.92-5.fc38                                                                                                             fedora                                                                                                               361 k
 perl-base                                                                                                                 noarch                                                                                                        2.27-495.fc38                                                                                                           fedora                                                                                                                18 k
 perl-encoding                                                                                                             x86_64                                                                                                        4:3.00-493.fc38                                                                                                         fedora                                                                                                                63 k
 perl-lib                                                                                                                  x86_64                                                                                                        0.65-495.fc38                                                                                                           fedora                                                                                                                17 k
 perl-open                                                                                                                 noarch                                                                                                        1.13-495.fc38                                                                                                           fedora                                                                                                                19 k

Transaction Summary
============================================================================================================================================================================================================================================================================================================================================================================================================================================================================================
Install  14 Packages

Total download size: 41 M
Installed size: 118 M
Is this ok [y/N]: y
Downloading Packages:
(1/14): perl-AutoLoader-5.74-495.fc38.noarch.rpm                                                                                                                                                                                                                                                                                                                                                                                                            454 kB/s |  23 kB     00:00
(2/14): perl-Data-Dumper-2.184-491.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                          872 kB/s |  56 kB     00:00
(3/14): perl-Digest-1.20-490.fc38.noarch.rpm                                                                                                                                                                                                                                                                                                                                                                                                                1.0 MB/s |  25 kB     00:00
(4/14): perl-B-1.83-495.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                                     2.0 MB/s | 184 kB     00:00
(5/14): perl-Digest-MD5-2.58-490.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                            1.3 MB/s |  36 kB     00:00
(6/14): perl-Digest-SHA-6.04-1.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                              1.8 MB/s |  61 kB     00:00
(7/14): perl-Net-SSLeay-1.92-5.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                              6.2 MB/s | 361 kB     00:00
(8/14): perl-base-2.27-495.fc38.noarch.rpm                                                                                                                                                                                                                                                                                                                                                                                                                  1.0 MB/s |  18 kB     00:00
(9/14): perl-encoding-3.00-493.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                              2.6 MB/s |  63 kB     00:00
(10/14): perl-lib-0.65-495.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                                  876 kB/s |  17 kB     00:00
(11/14): perl-open-1.13-495.fc38.noarch.rpm                                                                                                                                                                                                                                                                                                                                                                                                                 977 kB/s |  19 kB     00:00
(12/14): perl-Encode-Detect-1.01-41.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                         353 kB/s |  87 kB     00:00
(13/14): perl-Filter-1.64-2.fc38.x86_64.rpm                                                                                                                                                                                                                                                                                                                                                                                                                 340 kB/s |  87 kB     00:00
(14/14): webmin-2.021-1.noarch.rpm                                                                                                                                                                                                                                                                                                                                                                                                                          1.7 MB/s |  40 MB     00:23
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                                                                                                                                                                                                                                                                                                       1.7 MB/s |  41 MB     00:24
Problem opening package webmin-2.021-1.noarch.rpm
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED
[root@testbuild ~]#

@Jamie, I think it is time to upgrade your GPG key to use newer algo (ECC) and size (4096).

The work-around for anyone seeing this issue is to install Webmin from Virtualmin repos, e.g.

wget https://software.virtualmin.com/gpl/scripts/virtualmin-install.sh
sh virtualmin-install.sh --setup
dnf install webmin

I suggest you take a second look at my post.

The second quoted section is on a fresh build of F38 using your repo.
This fails.

As for the F37 server. I had already set this up to use your repo and had manually deleted the old GPG keys (from 2002 IIRC).
This also fails.

The new F38 features page lists the change to RPM.

RPM now uses the Rust-written Sequoia OpenGPG parser for better security.

To note:

Your Virtualmin method has worked (after removing webmin repo details).

What is documented on Downloading and Installing | Webmin does not.

Yeah, I’ll take a look at this …

I found this workaround for Fedora 38 Server Edition:

  • install the perl dependencies with dnf
  • install webmin with rpm and nosignature flag
dnf install perl-AutoLoader perl-B perl-Data-Dumper perl-Digest perl-Digest-MD5 perl-Digest-SHA perl-Encode-Detect perl-Filter perl-Net-SSLeay perl-base perl-encoding perl-open
rpm -ivh webmin-2.021-1.noarch.rpm --nosignature

Happened to me to, looked at this workaround and

Does not work for me

error: open of webmin-2.021-1.noarch.rpm failed: No such file or directory

also tried the virtualmin workaround and that did indeed get webmin installed, but it does not seem to show up on localhost:10000
Also checked and implemented firewall thing I saw somewhere making sure port 10000 being available

tried all over again

Now. Is this a showstopper and if so why is not mentioned as a thing needing to be fixed on the download page? Downloading and Installing | Webmin

 Installing Webmin key ..
warning: Certificate D97A3AE911F63C51:
  Policy rejects subkey 55A94CAA1B24BE83: Policy rejected asymmetric algorithm
  Certificate does not have any usable signing keys

rpm -q webmin
error: Verifying a signature using certificate 1719003…911F63C51 (Jamie Cameron <jca…ron@we…min.com>):
Key D97A…F63C51 invalid: not signing capable
error: rpmdbNextIterator: skipping h# 13335
Header V4 DSA/SHA1 Signature, Key ID 11f63c51: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
package webmin is not installed

Exactly the same as other reports.
My doubt: Is this a question of generating another form of signing with the new compliant key?
Is there an expected date to fix this?

Tks

Did you download the webmin rpm?

I can’t fix the Webmin repo signing key, but the Virtualmin repository packages are signed with a much newer key. You could install Webmin from there until @Jamie starts signing with a newer key.

Dumped fedora, running ubuntu.

This actually worked now

curl -o setup-repos.sh https://raw.githubusercontent.com/webmin/webmin/master/setup-repos.sh
sh setup-repos.sh

Was mainly after something that could give me an interface to the running OS…cockpit project is in the hands of bad people…

It seems absolutely insane to switch operating systems just to deal with a signing key. (Especially since I suggested another repo that also has a Webmin package that is signed with a new key.)

Jamie says he’ll try to update his signing key soon.

Heh, its all the same *nix to me. I just need it to be relevant and updated in order to host Docker with half a dozen of apps. Your admin interface to the OS is more comprehensive and better for me than Cockpit-Project. It was some time since last I ran Webmin, but I trust and know you guys and your product.

Fedora, Debian, Suse, Ubuntu, Arch; sure I may have my preferences, but most will do the job and all will always have a some nuisance that requires a bit more labour.

1 Like

FYI, the Webmin setup-repos.sh script has been updated to use a new key (for YUM/DNF) that will work on the latest Fedora release.

Work to switch to the new key for APT is still in progress …

And now setup-repos.sh has also been updated to use a new key and repository for APT…

Ok the new Webmin repo is all done, and users will be prompted to switch to it when after Webmin.

@Jamie,

It appears that there is still some issues:
DNF appears to work to install, but:

rpm -qa webmin
error: Verifying a signature using certificate 1719003ACE3E5A41E2DE70DFD97A3AE911F63C51 (Jamie Cameron jcameron@webmin.com):
Key D97A3AE911F63C51 invalid: not signing capable
error: rpmdbNextIterator: skipping h# 13335
Header V4 DSA/SHA1 Signature, key ID 11f63c51: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK

And the same error appears with:
sudo dnf remove webmin
Dependencies resolved.
Removing:
webmin noarch 2.021-1 @ Webmin 116 M
Removing unused dependencies:
perl-Encode-Detect x86_64 1.01-41.fc38 @ fedora 186 k

Running transaction check
error: Verifying a signature using certificate 1719003ACE3E5A41E2DE70DFD97A3AE911F63C51 (Jamie Cameron jcameron@webmin.com):
Key D97A3AE911F63C51 invalid: not signing capable
error: rpmdbNextIterator: skipping h# 13335
Header V4 DSA/SHA1 Signature, key ID 11f63c51: BAD
Header SHA256 digest: OK
Header SHA1 digest: OK
Error: An rpm exception occurred: package not installed

Solution:
sudo rpm -q gpg-pubkey --qf ‘%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n’
rpm -e gpg-pubkey-11f63c51-3c7dc11d

Did you remove Webmin and re-install from the new repository as setup by the latest version of the setup-repo.sh command?

We are discussing it here.

The initial issue is solved. What’s left is to re-generate Webmin Developers key so it won’t throw SHA1 error …

Note that you will have to re-setup the repo over again using updated setup-repos.sh script.