On Jul 7, 2023, at 15:58, ToddAndMargo via users <users(a)lists.fedoraproject.org&gt; wrote: As it says in the error, you have an expired GPG RPM signature in your RPM database for the virtmaint-wig’s virt-preview copr repository. This is not part of Fedora, you had to have added it at some point. It has nothing to do with your query, it’s just an error it got while searching the database. In Fedora 38, we got an overhaul to the GPG library in rpm and it is much smarter, but also detects this kind of thing. The solution is to delete that rpm-gpgkey in the database and figure out what to do about the broken repo. -- Jonathan Billings

On Fri, Jul 7, 2023 at 3:58 PM ToddAndMargo via users <users(a)lists.fedoraproject.org&gt; wrote: GnuPG does not handle key management well. I don't know if it is due to the OpenPGP spec or not. The signature is likely good. A signature on something signed in the past is still good even if the key used to apply the signature is now retired. A retired key cannot (should not?) be used to make new signatures once the key expires. That does not look like it is the case here. (See below on timestamp servers). The only time a signature would become invalid is if the private key was compromised. An expired key is not a compromised key. That does not look like it is the case here. And the certificate on the software package would need to include a timestamp from a trusted TS server. Or something like a blockchain that records the signature. I don't believe the key or certificate includes the attestation, so there's no way to tell when the certificate was actually signed. Because there's no timestamp on the package, you get the nonsense above. Jeff

On 7/7/23 12:57, ToddAndMargo via users wrote: # dnf update gives "Error: GPG check FAILED"