10308 2016-09-20 07:59:49 +0000 rpm installs bad signature package with option --nodigest --nosignature failed 2026-10-29 15:03:21 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.4 x86 Multiple NEW Medium normal 6.2 1 hongxu.jia unassigned ccasciato liezhi.yang mark.hatle meta.mr.watcher meta.watcher paul randy.macleod --- --- No (bug/feature does not impact docs) oldest_to_newest 66348 0 3428 hongxu.jia 2016-09-20 07:59:49 +0000 Created attachment 3428 Package with bad signature 1. Problem Boot a target environment with rpm: 1). With option '--nodigest --nosignature', installing package with bad signature failed ====== root@localhost:~# rpm -ivh --nodigest --nosignature hello-bogus.rpm error: hello-bogus.rpm: Header V4 DSA signature: BAD, key ID 09753bc ====== 2). Without option '--nodigest --nosignature', installing package with bad signature is successful ====== root@localhost:~# rpm -ivh hello-bogus.rpm Preparing... ########################################### [100%] 1:hello ########################################### [100%] root@localhost:~# rpm -q hello hello-1.0-r1.1.x86_64 ====== 2. Expected: ====== root@localhost:~# rpm -ivh hello-bogus.rpm error: hello-bogus.rpm: Header V4 DSA signature: BAD, key ID 09753bca root@localhost:~# rpm -ivh --nodigest --nosignature hello-bogus.rpm Preparing... ########################################### [100%] 1:hello ########################################### [100%] ====== 66349 1 liezhi.yang 2016-09-20 08:05:16 +0000 I've fixed --query, I think that we also need fix --install/--upgrade: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=51b08835b64421669e018481e344effe4727183b 66351 2 hongxu.jia 2016-09-20 09:06:12 +0000 (In reply to comment #1) > I've fixed --query, I think that we also need fix --install/--upgrade: > > http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/ > ?id=51b08835b64421669e018481e344effe4727183b We should make sure rpm upgrade should work: Preprae two version hello with bad signature 1. Install hello with version 1.0-r1.0 root@localhost:~# rpm -ivh --nodigest --nosignature hello-1.0-r1.0.corei7_64.rpm Preparing... ########################################### [100%] 1:hello ########################################### [100%] root@localhost:~# rpm -F --verbose hello-1.0-r2.0.corei7_64.rpm error: hello-1.0-r2.0.corei7_64.rpm: Header V4 DSA signature: BAD, key ID 8a0274fa 2. Upgrade hello with version 1.0-r2.0 root@localhost:~# rpm -F --verbose --nodigest --nosignature hello-1.0-r2.0.corei7_64.rpm Preparing packages for installation... hello-1.0-r2.0.corei7_64 root@localhost:~# rpm -q hello hello-1.0-r2.0.corei7_64 //Hongxu 66352 3 hongxu.jia 2016-09-20 09:08:42 +0000 BTW: How to prepare rpm package with bad singnature vim rpm pacakge(such as hello-1.0-r1.0.corei7_64.rpm) Tweak any single character before -----END PGP PUBLIC KEY BLOCK----- //Hongxu 66492 4 mark.hatle 2016-09-22 14:50:54 +0000 As noted in the mailing list. The problem is that apparently a previous change activated some normally deactivated code to allow signature by-pass. The previous code was implemented in reverse, i.e. signature/digest validation was always deactivated instead of always activated. This permits a corrupted package to avoid validation and install. As noted on the mailing list by Hongxu, the fix for this issue would be to correct the validation arguments, so the default is enabled, and the --no* options disable the default. Alternatively we disable the previous patch and go back to the community setting avoiding this chunk of code. 91533 5 randy.macleod 2021-09-23 15:21:51 +0000 Hongxu, Does WR care about this bug? 97141 6 randy.macleod 2023-10-30 15:37:30 +0000 Build move to 5.0 -- ../Randy 98810 7 randy.macleod 2024-04-25 01:13:51 +0000 Bulk move of 5.0 medium importance issues to 5.99. Move to 5.1 if you want to actively work on an issue. 98897 8 randy.macleod 2024-04-25 01:23:53 +0000 Build move to 5.1 101822 9 randy.macleod 2025-05-01 14:07:09 +0000 Bulk move of all unassigned 5.2 medium importance bugs to 5.3. 104433 10 randy.macleod 2026-02-26 19:54:18 +0000 Robert, Is this still a problem with rpm6 ? 105607 11 randy.macleod 2026-05-28 13:16:29 +0000 Bulk move of 6.0 Medium bugs to 6.1. 3428 2016-09-20 07:59:49 +0000 2016-09-20 07:59:49 +0000 Package with bad signature hello-bogus.rpm application/x-rpm 2936 hongxu.jia 7avu2wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUAAAAAAAAAAAAAAAAAAAAAjq3oAQAAAAAAAAAHAAAA5AAA AD4AAAAHAAAA1AAAABAAAAELAAAABwAAAAAAAABIAAABDQAAAAYAAABIAAAAAQAAA+gAAAAEAAAA dAAAAAEAAAPsAAAABwAAAHgAAAAQAAAD7QAAAAcAAACIAAAASAAAA+8AAAAEAAAA0AAAAAGIRgQA EQIABgUCU3W53wAKCRAysOS/CXU7ypn0AKCWIFuF4HCcTvZQqUC5Cq48u26UIACgidqlqK6NHDwP 7E5jKE/11XtzrZExMDJmMWQzNjVkNjZjNzRjMzlhNDExOTE0Y2E3MDc4ZTlmOTNjNjVkAAAAAAAA Ca8SGefXlbgAeOvIOO6iVnw9iEYEABECAAYFAlN1ud8ACgkQMrDkvwl1O8paywCdHcIAcPFz02lx YRPnfnVeax97q7MAnRgAuukBghkNELV2mXBP3XPCPYShAAAB3AAAAD4AAAAH////kAAAABAAAAAA jq3oAQAAAAAAAAA4AAAFPAAAAD8AAAAHAAAFLAAAABAAAABkAAAACAAAAAAAAAABAAABCgAAAAgA AAACAAAAAQAAA+gAAAAGAAACrAAAAAEAAAPpAAAABgAAArIAAAABAAAD6gAAAAYAAAK2AAAAAQAA A+wAAAAJAAACuwAAAAEAAAPtAAAACQAAAtAAAAABAAAD7gAAAAQAAAMIAAAAAQAAA+8AAAAGAAAD DAAAAAEAAAPxAAAABAAAAyAAAAABAAAD9gAAAAYAAAMkAAAAAQAAA/cAAAAGAAADLgAAAAEAAAP4 AAAACQAAA04AAAABAAAD/AAAAAYAAANVAAAAAQAAA/0AAAAGAAADXQAAAAEAAAP+AAAABgAAA2MA AAABAAAEBAAAAAQAAANsAAAAAgAABAYAAAADAAADdAAAAAIAAAQJAAAAAwAAA3gAAAACAAAECgAA AAQAAAN8AAAAAgAABAsAAAAIAAADhAAAAAIAAAQMAAAACAAAA8YAAAACAAAEDQAAAAQAAAPIAAAA AgAABA8AAAAIAAAD0AAAAAIAAAQQAAAACAAAA9oAAAACAAAEFAAAAAYAAAPkAAAAAQAABBUAAAAE AAAD/AAAAAIAAAQXAAAACAAABAQAAAABAAAEGAAAAAQAAAQMAAAAAgAABBkAAAAIAAAEFAAAAAIA AAQaAAAACAAABEgAAAACAAAEKAAAAAYAAARYAAAAAQAABEcAAAAEAAAEYAAAAAIAAARIAAAABAAA BGgAAAACAAAESQAAAAgAAARwAAAAAgAABFgAAAAEAAAEdAAAAAEAAARZAAAACAAABHgAAAABAAAE XAAAAAQAAASEAAAAAgAABF0AAAAIAAAEjAAAAAIAAAReAAAACAAABJcAAAACAAAEYgAAAAYAAASg AAAAAQAABGQAAAAGAAAEpAAAAAEAAARlAAAABgAABKkAAAABAAAEZgAAAAYAAASuAAAAAQAABGwA AAAGAAAEsAAAAAEAAAR0AAAABAAABMgAAAACAAAEdQAAAAQAAATQAAAAAgAABHYAAAAIAAAE2AAA AAQAAAR3AAAABAAABQQAAAACAAAEeAAAAAQAAAUMAAAAAgAABJkAAAAEAAAFFAAAAAIAAASvAAAA BAAABRwAAAABAAAEsAAAAAQAAAUgAAAAAQAABLEAAAAEAAAFJAAAAAEAABOTAAAABAAABSgAAAAB QwAtLS0tLUJFR0lOIFBHUCBQVUJMSUMgS0VZIEJMT0NLLS0tLS0KVmVyc2lvbjogUlBNIDUuNC45 IChCZWVDcnlwdCkKCm1RR2lCRk4wZmtvUkJBRDNwVzd3WWR4c2JBN2VQMlVJK25IL0x0dXhJeGtE N2VFTndyOTlSMTJ0cGQrS3dMZFlPNjBYUG9GQQpLUU5JSWFzVEpYdHZveHFpUWNJMmFKY0ZUUE9u U1ZkWHhNMFBrbVYwVUNOOFB1RzBjTE8xYVBFZHNNbnVaUHdGSW5DazBnOS8KN09jcTJhU0tBN1hY NlB6TXpaTVlWOVB3bzkvcjNjRTZybWlQYUdsbGZ3Q2c3YXVYZ1l5eXpHQ0EyZ3NzU0w0Sk9Vc0RE SDhFCkFMUWhrSk93ZVlPcVJxOEdUQWp1M2xiZkJCdW1VRk1udXpTSnFhbnBHTWFURDVrcWRFMlVz SnphQk5EUGxXMWpCWnNmdFM2QgplOCs0T0JwRjhCa1NHTjhWYk80d0VzNDJ6NCtSbkJ1aFF5Qy94 NytNZ2FwZWtFdVRrRHdualp2SDZSQVRYNDExU1dRTDFrd1oKUlN0SnVrVklxSUV5S1FPWDVFdnQy RS80T3JVQ0JBRFh4QmVSYXloZW1CMXpSOWRjQWc4OHloMHhTdGNQdTdaYjFjNjVDTGpZCmRhaTlS MFZuOUViaEtydjhvVTU2MG1OYU5OV0h3NGtrWmJjb0RqTEtuZElmUDhaUHY4QXJBeEhpZDhxdVlr eFUrK3ZnRVFKSwptdm5jY3lmNkhDZkF4anJUUVE0WUVtOU5MUHdMeGZwNm91SzJlNndRTXQ3S1hN NTVPRThDRUtLWTBBPT0KPW43L2UKLS0tLS1FTkQgUEdQIFBVQkxJQyBLRVkgQkxPQ0stLS0tLQoA aGVsbG8AMS4wAHIxLjEAaGVsbG8gdmVyc2lvbiAxLjAtcjEAdGhpcyBwYWNrYWdlIGNvbnRhaW5z IHRoZSBzaW1wbGUgSGVsbG8gV29ybGQgcHJvZ3JhbS4AAABTdH5Kd3J0LU9wdGlQbGV4LTkwMTAA AAAAAABsd2luZHJpdmVyAFdpbmQgUml2ZXIgPGluZm9Ad2luZHJpdmVyLmNvbT4Ac2FtcGxlAHVu a25vd24AbGludXgAeDg2XzY0AAAAAAAQAAAAAGxB7YHtAAAAAFN0fTRTdH00ADE2ZDcxMTY4MTE5 NzczY2RmY2VjNWY3MGRiMjA5MDYzOTQ5NmM4ZDliYjc2YzVhMGM0MTA2ZmZkOTFiYjJmMjgAAAAA AAAAAAAAAHJvb3QAcm9vdAByb290AHJvb3QAaGVsbG8tMS4wLXIxLjEuc3JjLnJwbQAA//////// //9oZWxsbwAAAAEAAAoBAAAKcnBtbGliKEZpbGVEaWdlc3RzKQBycG1saWIoRmlsZURpZ2VzdFBh cmFtZXRlcml6ZWQpADQuNi4wLTEANC40LjYtMQA1LjQuOQAAAIDOWHKAzlhysgkkxv8ZlYwAAAAA AAAACDEuMC1yMS4xAAAAAAAAAAAAAAABcm9vdABoZWxsbwAvAC9yb290LwAtTzIAY3BpbwBnemlw ADkAeDg2XzY0LXdycy1saW51eC1nbnUAAAAAAAAAAAAAAAAAAAADAAAAAQBDIHNvdXJjZSwgQVND SUkgdGV4dABkaXJlY3RvcnkAZGlyZWN0b3J5IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAIKJAk AH3EEABSUE01AAAACAAAAD8AAAAH///8gAAAABAfiwgAAAAAAAIDjZDNCsIwDIB3tU+R6UVFtrZO KyiCiKDgaQpevOjausJspauCiO/u/DsoCvsuCSHJR4IZZphgSqQkXYkLIiI4/g3ttFnEeDv6qvde sfNnjr2TILTGOK8AP71E9gSlyWPJfy/59HaTkl7+6Q1TkWXG88ImgiaMzeFs1S51QDGhsFKaQ6xO wsLinDuxz1sw00lQtIYI1ZROsiMXMMgdVyZIhwjtN0rXG3BBlYNV2sl6dXrfDytjM77W1UYfXdHr znKU7ftm+06W8Wg2n8S+799/fAPSe+iS3AEAAAo=