Package_signing_fingerprint cannot be nil

Support
1

Problem: Error during publishing CV’s and sync’ing proxies: package_signing_fingerprint cannot be nil

Expected outcome: Successful sync’s and CV publishing

Foreman and Proxy versions: 3.17.1

Foreman and Proxy plugin versions:

Name Description Author Version
foreman-tasks The goal of this plugin is to unify the way of showing task statuses across the Foreman instance. It defines Task model for keeping the information about the tasks and Lock for assigning the tasks to resources. The locking allows dealing with preventing multiple colliding tasks to be run on the same resource. It also optionally provides Dynflow infrastructure for using it for managing the tasks. Ivan Nečas 11.0.6
foreman_ansible Ansible integration with Foreman Daniel Lobato Garcia 17.0.2
foreman_leapp A Foreman plugin to support inplace RHEL upgrades with Leapp utility. Foreman Leapp team 3.1.0
foreman_remote_execution A plugin bringing remote execution to the Foreman, completing the config management functionality with remote management functionality. Foreman Remote Execution team 16.3.1
foreman_virt_who_configure A plugin to make virt-who configuration easy Foreman virt-who-configure team 0.5.27
katello Katello adds Content and Subscription Management to Foreman. For this it relies on Candlepin and Pulp. N/A 4.19.1

Distribution and version: 3.17.1

Other relevant data:

2

Foreman 3.17 uses pulpcore 3.85, which uses pulp_rpm 3.32.5 (up from 3.29.7 in the previous Foreman version). Looking through the pulp_rpm changelog, I found the following pulp_rpm issue that sounds relevant.

The fix was released as part of pulp_rpm 3.32.9.

I suspect upgrading from pulp_rpm 3.32.5 to >= 3.32.9 will fix this issue.

3

That sounds great! Thanks for the info @quba42 Where do we get the upgraded version of pulp_rpm (3.32.9 version)?

4

It is currently available in the nightly build: https://yum.theforeman.org/pulpcore/nightly/el9/x86_64/python3.12-pulp-rpm-3.32.9-1.el9.noarch.rpm

If you install this rpm on your instance and then run foreman-installer to make sure the changes take effect (probably overkill, but I am not sure exactly what changed, so it is the safest way).

You can verify if the new version is running using pulp status, which should include something like:

    {
      "component": "rpm",
      "version": "3.32.9",
      "package": "pulp-rpm",
      "module": "pulp_rpm.app",
      "domain_compatible": true
    },

In the output.

Then you can verify if that fixes the issue.

5

Thanks @quba42

I ran the following command and thought we were running an older version of pulp_rpm, but I misunderstood where pulp_rpm was actually coming from:

# rpm -qa | grep pulp_rpm
rubygem-pulp_rpm_client-3.32.2-1.el9.noarch

Here’s the output from a current “pulp status” on my Foreman DEV server:

{
  "component": "rpm",
  "version": "3.32.9",
  "pac

So it appears we are running the correct version of pulp_rpm.

For giggles I re-ran the foreman-installer and saw the following error:

~# foreman-installer

2026-03-25 13:56:40 [NOTICE] [root] Loading installer configuration. This will take some time.

2026-03-25 13:56:43 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2026-03-25 13:56:43 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
2026-03-25 13:56:45 [NOTICE] [checks] System checks passed
2026-03-25 13:56:49 [NOTICE] [configure] Starting system configuration.
2026-03-25 13:56:55 [NOTICE] [configure] 250 configuration steps out of 1176 steps complete.
2026-03-25 13:56:57 [NOTICE] [configure] 500 configuration steps out of 1179 steps complete.
2026-03-25 13:56:59 [NOTICE] [configure] 750 configuration steps out of 1185 steps complete.
2026-03-25 13:56:59 [NOTICE] [configure] 1000 configuration steps out of 1185 steps complete.
2026-03-25 13:57:28 [NOTICE] [configure] System configuration has finished.
Executing: foreman-rake upgrade:run

Upgrade Step 1/3: katello:correct_repositories. This may take a long while.

Processing Repository 1/265: AppStream x86_64 os (1)
Failed upgrade task: katello:correct_repositories, see logs for more information.

Upgrade Step 2/3: katello:clean_backend_objects. This may take a long while.

0 orphaned consumer id(s) found in candlepin.
Candlepin orphaned consumers: [ ]

Upgrade Step 3/3: katello:upgrades:4.12:update_content_access_modes. Checking Candlepin status

Setting content access modes
Setting content access mode for APS current mode=org_environment current mode list=org_environment
Setting content access mode for Default Organization current mode=org_environment current mode list=org_environment
Setting content access mode for NEWS current mode=org_environment current mode list=org_environment
Setting content access mode for REACH current mode=org_environment current mode list=org_environment
Setting content access mode for SDIT current mode=org_environment current mode list=org_environment

Set content access mode for 0 organizations

Success!

Since I saw that error, I checked the production.log file and found this error:

2026-03-25T13:58:53 [W|app|] Failed upgrade task: katello:correct_repositories
2026-03-25T13:58:53 [I|app|] Backtrace for ‘Failed upgrade task: katello:correct_repositories’ error (NoMethodError): undefined method `code’ for #<ArgumentError: package_signing_fingerprint cannot be nil>

So even though we appear to be running pulp_rpm version 3.32.9, we are still hitting the “*package_signing_fingerprint cannot be nil” error. *:frowning:

6

New theory: This field was not needed at all in some past version of pulp_rpm and you created a DB entry without it. Now some newer version of pulp_rpm expects this field to be not nil.

But that is just a theory. At this point it would really be best to open an issue with the folks at pulp_rpm to have them look into this.

@ian @sajha: Have either of you already come across this and know more?

7

Thanks again for your assistance @quba42

I really have no idea who the folks at pulp_rpm would be. Wondering if anyone else has seen this issue? I get the same error (package_signing_fingerprint cannot be nil) with every repo I have including RHEL, ROCKY, Oracle Linux, etc. I’ve tried to copy a content view and publish the copy, but it fails on each repo in the copied CV also. I even tried to create a new CV and publish it, but it also fails with the same error on every repo in the new CV. I’m kind of stuck at this point. Hoping someone has been down this road before and has a resolution.

8

Hi all,

This is a known issue, it’s because newer pulp RPM was released into the repositories before the client got upgraded due to version pins that needed to be removed. Essentially the core blame is that we’re still using the generated Pulp bindings, but that’s through a long chain of unfortunate events.

Please take a look at Unable to add new repository

Katello 4.19.2 should take care of your issue - we removed the pins, so you’ll get an updated pulp-rpm client that is compatible with newer pulp-rpm.

I just saw a user report that the 4.19.2 RPM is not published for some reason, but I’m asking about why. There was a release announcement already even.

In the meantime, please downgrade pulp-rpm to python3.12-pulp-rpm-3.32.5-1.el9.noarch.rpm and run

systemctl restart pulpcore* --all

When you are on Katello 4.19.2 you can re-upgrade to latest pulp-rpm.

Tip: after you’re on 4.19.2 and latest pulp-rpm, run the following to clean up any potentially problematic fingerprint data:

sudo -u pulp PULP_SETTINGS='/etc/pulp/settings.py' DJANGO_SETTINGS_MODULE='pulpcore.app.settings' pulpcore-manager rpm-datarepair 4073
2 Likes
9

Thanks @iballou !!! That’s great information. I went ahead and downgraded pulp-rpm with the following command: # dnf downgrade python3.12-pulp-rpm.noarch.

Downgrading:
python3.12-pulp-rpm noarch 3.32.5-1.el9 pulpcore 597 k

Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Downgrading : python3.12-pulp-rpm-3.32.5-1.el9.noarch 1/2
Cleanup : python3.12-pulp-rpm-3.32.9-1.el9.noarch 2/2
Running scriptlet: python3.12-pulp-rpm-3.32.9-1.el9.noarch 2/2
Verifying : python3.12-pulp-rpm-3.32.5-1.el9.noarch 1/2
Verifying : python3.12-pulp-rpm-3.32.9-1.el9.noarch 2/2
Installed products updated.*

Downgraded:
python3.12-pulp-rpm-3.32.5-1.el9.noarch

Complete!

Then I restarted pulpcore with # systemctl restart pulpcore* --all.

Then I successfully published the ROCKY9 content view. I was excited!

Then I attempted to sync the proxy server and it got to 97% complete and I thought we were good, until it failed right at the end of the proxy sync task:
ERROR: Last sync failed: package_signing_fingerprint cannot be nil Plus 2 more errors

So CV publishes work, but proxy syncs still fail with the same error. Thoughts?

10

Are you already upgraded to Katello 4.19.2?

11

No. 4.19.1:

rpm -qa | grep -i katello

katello-client-bootstrap-1.7.9-2.el9.noarch
katello-certs-tools-2.10.0-1.el9.noarch
katello-selinux-5.2.0-1.el9.noarch
rubygem-hammer_cli_katello-1.19.0-1.el9.noarch
katello-common-4.19.1-1.el9.noarch
rubygem-katello-4.19.1-1.el9.noarch
foreman-installer-katello-3.17.1-1.el9.noarch
katello-4.19.1-1.el9.noarch
katello-repos-4.19.1-1.el9.noarch

But I just checked “dnf update” and as of today I have the ability to update Katello to 4.19.2. We can perform that update today.

12

@quba42 Thanks!!!

We’ve upgraded our DEV environment to Foreman 3.17.2 and Foreman to 4.19.2. Proxy sync’s work now, as well as publishing content views. Thanks so much for your help!