Bug 1036659

PackageKit is not a KDE Application, it's maintained by the GNOME team.

@Jonathan: I suspect the latest patch addition to be responsible here.

especially
+               // keys no longer stored in the rpmdb need to be removed from the zypp keyring!
+               for (const PublicKeyData &el : zypp->keyRing ()->trustedPublicKeyData ())

(In reply to Dominique Leuenberger from comment #2)
> @Jonathan: I suspect the latest patch addition to be responsible here.
> 
> especially
> +               // keys no longer stored in the rpmdb need to be removed
> from the zypp keyring!
> +               for (const PublicKeyData &el : zypp->keyRing
> ()->trustedPublicKeyData ())

Those codes are written based on the demo provided in bug#899755 by
Michael Andres. I didn't understand every piece of those codes.

@Michael
Could you please help take a look at this?

Thanks.

This will need some more investigation, and I need to get the build key (0D210A40).

Authority for the trusted gpg keys is the rpm database, so the zypp trusted keyring must be in sync with the keys stored in the rpm database (the gpg-pubkey pseudo packages).

> [zypp] RpmDb.cc(syncTrustedKeys):966 Going to sync trusted keys...
> [zypp++] RpmDb.cc(computeKeyRingSync):946 gpg-pubkey-0d210a40-581257c6 R_
>                                                      ^^^^^^^^^^^^^^^^^
> [zypp++] RpmDb.cc(computeKeyRingSync):946 gpg-pubkey-307e3d54-4be01a65 R_
> [zypp++] RpmDb.cc(computeKeyRingSync):946 gpg-pubkey-3dbdc284-53674dd4 R_
> [zypp] RpmDb.cc(syncTrustedKeys):970 Rpm keys to export into zypp trusted keyring: 3
> [zypp] RpmDb.cc(syncTrustedKeys):971 Zypp trusted keys to import into rpm database: 0
> [zypp] RpmDb.cc(syncTrustedKeys):977 Exporting rpm keyring into zypp trusted keyring

The initial sync finds key 0d210a40 (creation time -581257c6) int the rpm database. After import into the gpg keyring, the creation time changed to '-581257c7':

> Found keys: {
>    [20F8C4F40D210A40-581257c7] [KDE:Extra OBS Project <KDE:Extra@build.opensuse.org>]
>                            ^^
>    [B88B2FD43DBDC284-53674dd4] [openSUSE Project Signing Key <opensuse@opensuse.org>]
>    [E3A5C360307E3D54-4be01a65] [SuSE Package Signing Key <build@suse.de>]
> }

It almost looks like the key in PKs trusted zypp keyring (from a previous sync) is 1 second newer than the one now in the rpm database. This is where the trouble starts. 

> [zypp++] RpmDb.cc(updateIf):909 Old key in Z: gpg-pubkey-0d210a40-581257c6
> [zypp++] RpmDb.cc(computeKeyRingSync):946 gpg-pubkey-0d210a40-581257c7 _Z
>                                             in Zypp but not in Rpm: ^^ ^^
> [zypp++] RpmDb.cc(computeKeyRingSync):946 gpg-pubkey-307e3d54-4be01a65 RZ
> [zypp++] RpmDb.cc(computeKeyRingSync):946 gpg-pubkey-3dbdc284-53674dd4 RZ

PKs attempt to remove ....c7 from the keyring is correct.
But it also leads to removal of the older ....c6 in the rpm database, which is a zypp issue (no matter if the 1 second difference is real (2 keys) or due to rpm/zypp/gpg compute the creation time differently).


Anyway, these key handling details are nothing PK should care about. I'll add some method to target->rpmDb(), which will load the rpmdb trusted keys in manner sufficient for this usecase. Then you will just have to call this methods and the details go into libzypp.

Ping.

This seems to happen for other repos as well.

*** Bug 1047285 has been marked as a duplicate of this bug. ***

*** Bug 1047285 IS NO DUPLICATE of this bug. ***

I'm taking the bug. It's definitely a zypp problem and nothing Pk can work around.

Libzypp and rpm disagreed on the keys creation time. Fixed in libzypp-16.15.2.

(In reply to Michael Andres from comment #9)
> Libzypp and rpm disagreed on the keys creation time. Fixed in
> libzypp-16.15.2.

Can't find this version in _current_ Tumbleweed (openSUSE-release-20170810-1.4).
When will this arrive?

Thanks,
Dieter

Friday I submitted 16.15.3, maybe this superseded the pending update.

Finally upstream. --- Thank you!
Could be CLOSED.

Dieter

SUSE-SU-2017:2264-1: An update that solves three vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1009745,1036659,1038984,1043218,1045735,1046417,1047785,1048315
CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    libzypp-16.15.3-2.3.1, yast2-pkg-bindings-devel-doc-3.2.4-2.3.1
SUSE Linux Enterprise Server 12-SP3 (src):    libzypp-16.15.3-2.3.1, yast2-pkg-bindings-3.2.4-2.3.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    libzypp-16.15.3-2.3.1, yast2-pkg-bindings-3.2.4-2.3.1

openSUSE-SU-2017:2335-1: An update that solves three vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1009745,1036659,1038984,1043218,1045735,1046417,1047785,1048315
CVE References: CVE-2017-7435,CVE-2017-7436,CVE-2017-9269
Sources used:
openSUSE Leap 42.3 (src):    libzypp-16.15.3-9.1, yast2-pkg-bindings-3.2.4-4.1, yast2-pkg-bindings-devel-doc-3.2.4-4.1

SUSE-SU-2017:2470-1: An update that solves 18 vulnerabilities and has 46 fixes is now available.

Category: security (important)
Bug References: 1004995,1009745,1014471,1017420,1019637,1026825,1027079,1027688,1027908,1028281,1028723,1029523,1031756,1032706,1033236,1035062,1036659,1038132,1038444,1038984,1042392,1043218,1043333,1044095,1044107,1044175,1044840,1045384,1045735,1045987,1046268,1046417,1046659,1046853,1046858,1047008,1047236,1047240,1047310,1047379,1047785,1047964,1047965,1048315,1048483,1048605,1048679,1048715,1049344,1050396,1050484,1051626,1051643,1051644,1052030,1052759,1053409,874665,902364,938657,944903,954661,960820,963041
CVE References: CVE-2013-7459,CVE-2016-9063,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-10684,CVE-2017-10685,CVE-2017-11112,CVE-2017-11113,CVE-2017-3308,CVE-2017-3309,CVE-2017-3453,CVE-2017-3456,CVE-2017-3464,CVE-2017-7435,CVE-2017-7436,CVE-2017-8872,CVE-2017-9233,CVE-2017-9269
Sources used:
SUSE Container as a Service Platform ALL (src):    caasp-container-manifests-0.0.0+git_r155_93e40ab-2.3.3, container-feeder-0.0.0+20170901.git_r55_17ecbd3-2.3.3, sles12-mariadb-docker-image-1.1.0-2.3.10, sles12-pause-docker-image-1.1.0-2.3.11, sles12-pv-recycler-node-docker-image-1.1.0-2.3.10, sles12-salt-api-docker-image-1.1.0-2.3.9, sles12-salt-master-docker-image-1.1.0-4.3.10, sles12-salt-minion-docker-image-1.1.0-2.3.8, sles12-velum-docker-image-1.1.0-4.3.9

SUSE-SU-2017:2861-1: An update that solves three vulnerabilities and has 22 fixes is now available.

Category: security (moderate)
Bug References: 1005063,1008325,1009269,1012523,1025176,1028485,1032680,1036659,1042781,1045628,1045735,1050767,1050943,1054028,1054088,1054671,1055920,1056995,1060653,1061876,1063824,903543,978055,998893,999878
CVE References: CVE-2017-1000254,CVE-2017-1000257,CVE-2017-11462
Sources used:
SUSE Container as a Service Platform ALL (src):    sles12-mariadb-docker-image-1.1.0-2.5.19, sles12-pause-docker-image-1.1.0-2.5.21, sles12-pv-recycler-node-docker-image-1.1.0-2.5.19, sles12-salt-api-docker-image-1.1.0-2.5.19, sles12-salt-master-docker-image-1.1.0-4.5.18, sles12-salt-minion-docker-image-1.1.0-2.5.18, sles12-velum-docker-image-1.1.0-4.5.18

SUSE-RU-2018:0138-1: An update that has 7 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 1008325,1036659,1043218,1064999,1068708,1071466,969569
CVE References: 
Sources used:
SUSE OpenStack Cloud 6 (src):    libzypp-15.25.6-46.9.1
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    libzypp-15.25.6-46.9.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    libzypp-15.25.6-46.9.1

SUSE-RU-2018:1307-1: An update that has 10 recommended fixes can now be installed.

Category: recommended (moderate)
Bug References: 1008325,1033236,1036659,1038132,1043218,1068708,1074687,1076415,1079334,637791
CVE References: 
Sources used:
SUSE Linux Enterprise Server 12-LTSS (src):    libzypp-14.45.10-2.73.1, zypper-1.11.66-2.64.1