Questions about signing key for upgrades

Support
1

Problem:

I’m following Foreman :: Manual to upgrade 3.17.1 to 3.18 on Almalinux 9.7. When trying to install the new release, I get:

[root@foreman ~]# dnf upgrade https://yum.theforeman.org/releases/3.18/el9/x86_64/foreman-release.rpm
Last metadata expiration check: 1:53:30 ago on Sun 15 Mar 2026 01:06:39 PM EDT.
foreman-release.rpm                                                                     171 kB/s | 9.5 kB     00:00
Dependencies resolved.
========================================================================================================================
 Package                         Architecture           Version                      Repository                    Size
========================================================================================================================
Upgrading:
 foreman-release                 noarch                 3.18.0-1.el9                 @commandline                 9.5 k

Transaction Summary
========================================================================================================================
Upgrade  1 Package

Total size: 9.5 k
Is this ok [y/N]: y
Downloading Packages:
Public key for foreman-release.rpm is not installed
Error: GPG check FAILED

Running rpm -import ``https://yum.theforeman.org/releases/3.18/RPM-GPG-KEY-foreman allowed me to continue.

So my question is, should rpm -import be added to the instructions, should foreman-release.rpm be signed with the previous version’s key (and install the new key), or is there something screwy on my machine?
Semi-related: RPM GPG key on yum.theforeman.org seems to be incorrect

Thanks.

2

As I have mentioned in the other thread you have linked to, that installation does not check the gpg key unless you specifically enable it. I can only suggest again to run

# dnf config-manager --dump | grep gpg

and show what you have set there. By default, packages installed not via a repository won’t be checked for the gpg signature.