The dnf Signature Check That Is Off By Default

dnf-security

dnf checks the signature on a package it downloads, and not on one you hand it. gpgcheck=1 is in the shipped configuration; localpkg_gpgcheck is not in it at all and defaults to off, so dnf install ./something.rpm installs an unsigned package without a word. repo_gpgcheck is missing the same way, which leaves a repository's metadata unverified. This role sets all three and proves each by the thing it is supposed to prevent.

No download, and no version to pin. dnf is the distribution. What the role owns is four lines in /etc/dnf/dnf.conf - dnf 4, which is what EL 10 carries, has no drop-in directory for them - and the proof that the host now refuses what it used to accept.

A repository file can opt itself out, and that beats dnf.conf. Measured both ways: a repository asking for repo_gpgcheck=1 was honoured against a [main] that said 0, and a repository setting gpgcheck=0 keeps its own answer. The role does not rewrite anybody else's repository file - it names the ones that opt out and stops, which is dnf_security_fail_on_unchecked_repos.

rpm -K exits 0 on a completely unsigned package. On the fixture this role's test builds, rpm -Kv lists four digests, no signature, and returns success; rpm -qpi says Signature : (none). Anything that treats rpm -K as a signature check is reading a digest as a provenance claim, which is why the live test asserts the fixture is unsigned through the signature header before it draws any conclusion from dnf's refusal.

dnf config-manager --dump is dnf's sshd -T. It prints the configuration dnf will use, defaults included, which is what the test reads. The obvious alternative does not work: python3 -c "import dnf; dnf.Base().conf.localpkg_gpgcheck" answered False for all three booleans against a dnf.conf that said 1, and answered gpgcheck=False against a shipped gpgcheck=1, because dnf.Base() builds a configuration of library defaults and never reads the file. A test built on it would have been asserting the library's defaults back at itself.

Turning repo_gpgcheck on does not break the host. This is not an afterthought: the crypto-policy role in this catalogue found that DEFAULT:OSPP, a policy a Protection Profile asks for, stops dnf working entirely, and nothing warns you at the moment you set it. So this role's live test cleans dnf's metadata and reads the distribution's own repositories again with the policy in force, and fails if they no longer verify. Rocky's metadata is signed; makecache imports the release key and succeeds.

The unsigned repository the test refuses is a local one. createrepo_c over a directory, a file:// baseurl, gpgcheck=0 on that repository so only repo_gpgcheck can object - and dnf refuses it with "GPG verification is enabled, but GPG signature is not available", naming the repomd.xml.asc it could not find. No network, no third party, and the same refusal an attacker's mirror would meet.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.