How to Fix EXPKEYSIG Error on Fedora

If you're using Fedora and have come across the EXPKEYSIG error, it means that a repository's GPG key has expired. This guide will help you update the key to keep your system running smoothly.

Understanding the EXPKEYSIG Error

The EXPKEYSIG error indicates that the GPG key used to verify the packages from a repository has expired. This key ensures that the packages are authentic and haven't been tampered with.

Example Error Message

GPG key at http://example.com/fedora/RPM-GPG-KEY-example (0x0123456789ABCDEF) is expired

Step-by-Step Guide to Fix EXPKEYSIG Error on Fedora

1. Identify the Expired Key

First, identify the key ID from the error message. In the example above, the key ID is 0123456789ABCDEF.

2. Fetch the Updated Key

Use the following command to fetch the updated key from a key server. Note that Fedora doesn't use apt-key, so we'll use rpm and curl instead.

gpg --keyserver keyserver.ubuntu.com --recv-keys 0123456789ABCDEF

3. Export the Key to a File

Export the key to a file in the /etc/pki/rpm-gpg directory.

gpg --export --armor 0123456789ABCDEF | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-example

4. Update the Repository Configuration

Make sure your repository configuration points to the updated key file. Edit the repository configuration file (e.g., /etc/yum.repos.d/example.repo) and update the gpgkey line if necessary:

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-example

5. Clean the YUM Cache

Clear the YUM cache to ensure it recognizes the updated key.

sudo dnf clean all

6. Update Your System

Finally, update your system to apply the changes.

sudo dnf update

Handling Specific Keyring Files

Some repositories might specify their GPG keys directly in their configuration files. Here’s how to handle these cases.

Example: Updating the Docker Key

Identify the Key ID

Find the key ID in the error message. For example, 9DC858229FC7DD38854AE2D88D81803C0EBFCD88.

Fetch the Updated Key

gpg --keyserver keyserver.ubuntu.com --recv-keys 9DC858229FC7DD38854AE2D88D81803C0EBFCD88

Export the Key to the Keyring File

Export the key to the specific keyring file, such as /etc/pki/rpm-gpg/docker-archive-keyring.gpg.
```
gpg --export --armor 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 | sudo tee /etc/pki/rpm-gpg/docker-archive-keyring.gpg
```
Update the Repository Configuration

Ensure your repository configuration file points to the updated keyring file.
```
gpgkey=file:///etc/pki/rpm-gpg/docker-archive-keyring.gpg
```
Clean the YUM Cache and Update
```
sudo dnf clean all
sudo dnf update
```

General Steps for Any Repository with Pinned Keys

For repositories that specify their keys, follow these steps:

Identify the Key ID

Find the key ID in the error message or repository documentation.

Fetch the Updated Key

gpg --keyserver keyserver.ubuntu.com --recv-keys <KEY_ID>

Export the Key to the Keyring File

gpg --export --armor <KEY_ID> | sudo tee /etc/pki/rpm-gpg/<repository-keyring-file>.gpg

Update the Repository Configuration

Ensure the repository configuration file points to the updated keyring file.
```
gpgkey=file:///etc/pki/rpm-gpg/<repository-keyring-file>.gpg
```
Clean the YUM Cache and Update
```
sudo dnf clean all
sudo dnf update
```

Complete Example: Updating a Custom Repository Key

Suppose you have a custom repository configured like this:

[custom-repo]
name=Custom Repository
baseurl=https://example.com/fedora
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-custom

Identify the Key ID

Assume the key ID is 1234567890ABCDEF.

Fetch the Updated Key

gpg --keyserver keyserver.ubuntu.com --recv-keys 1234567890ABCDEF

Export the Key to the Keyring File

gpg --export --armor 1234567890ABCDEF | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-custom

Clean the YUM Cache and Update
```
sudo dnf clean all
sudo dnf update
```

By following these steps, you can resolve the EXPKEYSIG error on your Fedora system, ensuring your repositories remain functional and secure.

Conclusion

The EXPKEYSIG error can be a bit frustrating, but it's essential for maintaining the security and integrity of your package management on Fedora. Regularly updating your GPG keys and following the latest methods will keep your system safe and up-to-date. If you encounter this issue, refer back to this guide for a straightforward solution.