GPG key when adding Proxmox repo to Foreman

Support
1

Running Foreman/Katello 3.12/4.14 and was trying to give access to Proxmox repos to some Proxmox nodes from Foreman. So to make this happen I imported the Debian repos and GPG keys, no problem there (with help from https://docs.orcharhino.com/or/docs/sources/guides/debian/managing_content/importing_content.html).

Now when I was looking on the Proxmox repos http://download.proxmox.com/debian/ they seem to use another type of signing keys I do not really understand. They are not in “clear” text so not really sure how to handle them.

I can sync the repos without assigning GPG keys to the repos but figured it should be possible to assign one? Any ideas?

2

I can confirm that using the public key at http://download.proxmox.com/debian/key.asc as a content credential, I get the following sync error:

Unable to verify any Release files from 'http://download.proxmox.com/debian/dists/bullseye' using the GPG key provided.

If I manually download the InRelease file, and obtain the key using the method described here, I end up with the same key that did not work during sync, and can use it to verify locally on my laptop. :face_with_diagonal_mouth:

@tedevil Can you open an issue for this? Issues - Katello - Foreman Please link to this thread from the issue, and post the issue in this thread when you are done.

3

Not used to work with Debian distros/repos but I see on the Proxmox nodes the directory /etc/apt/trusted.gpg.d that contains some keys.
ex.
proxmox-release-bookworm.gpg
I assume this key is used by the Proxmox node but looks encrypted or something since it is not in clear text.

key.asc is on the repo and looks like a “normal” key but as you said, does not work to use with Foreman.

Performing “gpg --verify” gives:

# gpg --verify key.asc
gpg: verify signatures failed: Unexpected error
# gpg --verify proxmox-release-bookworm.gpg
gpg: verify signatures failed: Unexpected error

Was hoping maybe someone else uses Foreman with Proxmox nodes/repos that knows how this works…

4

Yes, unfortunately the keys are not ASCII-armoured. But fear not, it is fairly easy to convert them.
You can simply import the key into your local GPG keyring and export it in armored format:

gpg --import proxmox-release-bookworm.gpg
gpg --armor --output proxmox-release-bookworm.asc --export 'Proxmox'
2 Likes
5

Thanks, worked!