Question

You added a third-party YUM repository to a RHEL 9 server by creating /etc/yum.repos.d/vendor.repo. When you run 'dnf install vendorapp', the transaction aborts with an error indicating the package is not signed by a trusted key or that GPG signature verification failed. The vendor's documentation confirms the package is legitimately signed with their public key, which is published at https://vendor.example/RPM-GPG-KEY. What is the correct way to resolve this so the package installs and future updates remain verified?

Accepted Answer

Import the vendor's public key with 'rpm --import https://vendor.example/RPM-GPG-KEY' and ensure gpgcheck=1 with the correct gpgkey line in the repo file

Answer

Set gpgcheck=0 in the vendor.repo file so dnf skips signature verification for that repository

Answer

Run 'dnf install vendorapp --nogpgcheck' and add that flag permanently to /etc/dnf/dnf.conf

Answer

Delete /var/cache/dnf and run 'dnf clean all' to force dnf to rebuild the trusted key database from the repo metadata