Problem: While registering an AlmaLinux 8 client into Foreman 3.17 server, the /pub/bootstrap.py script raises an error during the installation of katello-host-tools-4.5.0-2.el8.noarch package. The root cause of the error is the inability to import into the RPM database the GPG key that has signed Foreman 3.17 release (reference).
Expected outcome: The registration process of AlmaLinux 8 client into Foreman 3.17 succeeds. Currently, registration of AlmaLinux 9 and AlmaLinux 10 clients succeed.
Foreman and Proxy versions: A standalone Foreman 3.17.0 deployment.
Foreman and Proxy plugin versions:(unsure)
Distribution and version: The Foreman 3.17 server is running on CentOS Stream 9
Other relevant data:
The /pub/bootstrap.py script raises the below error during the installation of katello-host-tools-4.5.0-2.el8.noarch package:
To register the AlmaLinux 8 client into my Foreman 3.17 server, I configured a different PGP public key block on my repository that mirrors Foreman 3.17 client packages.
[root@almalinux8-a ~]# curl https://theforeman.org/static/keys/2C219CE8AC0A3BA2EDE8B652509E3BD3D6AB9AD1.pub | gpg --import
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1859 100 1859 0 0 7436 0 --:--:-- --:--:-- --:--:-- 7436
gpg: key 509E3BD3D6AB9AD1: 1 signature not checked due to a missing key
gpg: key 509E3BD3D6AB9AD1: public key "Foreman Automatic Signing Key (3.17) <packages@theforeman.org>" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: no ultimately trusted keys found
[root@almalinux8-a ~]# gpg --list-keys --keyid-format long
/root/.gnupg/pubring.kbx
------------------------
pub rsa4096/509E3BD3D6AB9AD1 2025-11-10 [SCEA] [expires: 2026-11-10]
2C219CE8AC0A3BA2EDE8B652509E3BD3D6AB9AD1
uid [ unknown] Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
[root@almalinux8-a ~]# gpg --list-sigs
/root/.gnupg/pubring.kbx
------------------------
pub rsa4096 2025-11-10 [SCEA] [expires: 2026-11-10]
2C219CE8AC0A3BA2EDE8B652509E3BD3D6AB9AD1
uid [ unknown] Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
sig 3 509E3BD3D6AB9AD1 2025-11-10 Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
sig C75C383DEACBF894 2025-11-10 [User ID not found]
Apparently, the key that has signed Foreman 3.17 release can only be imported into the RPM database of RHEL8 systems if the third-party signature is removed from the PGP public key block.
The removal of the third-party signature can be performed by modifying the signing key via an interactive GPG session:
Invoke the gpg --edit-key 509E3BD3D6AB9AD1 command line
Pass the clean and save commands to GPG.
[root@almalinux8-a ~]# gpg --edit-key 509E3BD3D6AB9AD1
gpg (GnuPG) 2.2.20; Copyright (C) 2020 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
pub rsa4096/509E3BD3D6AB9AD1
created: 2025-11-10 expires: 2026-11-10 usage: SCEA
trust: unknown validity: unknown
[ unknown] (1). Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
gpg> clean
User ID "Foreman Automatic Signing Key (3.17) <packages@theforeman.org>": 1 signature removed
pub rsa4096/509E3BD3D6AB9AD1
created: 2025-11-10 expires: 2026-11-10 usage: SCEA
trust: unknown validity: unknown
[ unknown] (1). Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
gpg> save
[root@almalinux8-a ~]# gpg --list-sigs
/root/.gnupg/pubring.kbx
------------------------
pub rsa4096 2025-11-10 [SCEA] [expires: 2026-11-10]
2C219CE8AC0A3BA2EDE8B652509E3BD3D6AB9AD1
uid [ unknown] Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
sig 3 509E3BD3D6AB9AD1 2025-11-10 Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
Without the third-party signature, the PGP public key block can be imported into the RPM database.
Nice! Thank you for the info. I was about to create a topic concerning this, but you preempted!
Only other thing I had done to investigate this further was utilize Sequoia GPG’s “sq” (https://book.sequoia-pgp.org/) utility to inspect the Foreman 3.17 vs the Foreman 3.16 GPG keys. I came up with the same determination stumbling around….pretty much.
bhill$ sq inspect --certifications --cert-file 2C219CE8AC0A3BA2EDE8B652509E3BD3D6AB9AD1.pub
OpenPGP Certificate.
Fingerprint: 2C219CE8AC0A3BA2EDE8B652509E3BD3D6AB9AD1
Public-key algo: RSA
Public-key size: 4096 bits
Creation time: 2025-11-10 21:43:29 UTC
Expiration time: 2026-11-10 21:43:29 UTC (creation time + 11months 30days 3h 50m 24s)
Key flags: certification, signing, authentication, transport encryption, data-at-rest encryption
UserID: Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
Certification: Creation time: 2025-11-10 23:27:50 UTC
Alleged certifier: signer's cert not found
BAE35EA68216E1569DD5DC5CC75C383DEACBF894
(signature subkey)
Hash algorithm: SHA512
Note: Certifications have NOT been verified!
bhill$ sq inspect --certifications --cert-file 4EF094BBD6C43ADA8E4190BD18357B59AD173208.pub
OpenPGP Certificate.
Fingerprint: 4EF094BBD6C43ADA8E4190BD18357B59AD173208
Public-key algo: RSA
Public-key size: 4096 bits
Creation time: 2025-08-07 12:15:56 UTC
Expiration time: 2026-08-07 12:15:56 UTC (creation time + 11months 30days 3h 50m 24s)
Key flags: certification, signing, authentication, transport encryption, data-at-rest encryption
UserID: Foreman Automatic Signing Key (3.16) <packages@theforeman.org>
bhill$
The Foreman 3.17 cert perhaps showing showing that third-party identifier?
UserID: Foreman Automatic Signing Key (3.17) <packages@theforeman.org>
Certification: Creation time: 2025-11-10 23:27:50 UTC
Alleged certifier: signer's cert not found
BAE35EA68216E1569DD5DC5CC75C383DEACBF894
(signature subkey)
Hash algorithm: SHA512
Note: Certifications have NOT been verified!
