zabbix-agent-3.2.4-2.el7.x86_64. GPG incorrect

[misho]

Hi,

When i try to update zabbix-agent-3.2.4-2.el7.x86_64 i see:

The GPG keys listed for the "Zabbix Official Repository - x86_64" repository are already installed but they are not correct for this package.
Check that the correct key URLs are configured for this repository.

Thanks!

[jan.garaj]

https://www.zabbix.com/forum/showthread.php?p=196585#post196585

[misho]

OK,

But is not good idea to mix 2 keys.. Can we trust the old key? Because we using automatic updates for servers.

[jan.garaj]

OK, there is no old key. There are 2 keys (actually more):
1st one is used to sign 3.2- packages.
2nd one is used to sign 3.2+ packages.

There is no info that any private key has been compromised. So from the security point both keys are valid and you can trust them.
Only package maintainer has used 3.2- key to sign 3.2+ packages, (hopefully he will republish packages signed with correct 3.2+ key soon). I don't see any security problem. It's only administration problem - you need to import additional 3.2- key, to be able to verify 3.2+packages.

[neonardo1]

The RPMs should be updated and signed with the correct key. Signing with the wrong key and then not fixing it only contributes to speculation of something potentially malicious.

Waiting until the next release to fix the packages isn't acceptable.

[vic]

I just uninstalled the old RPM and then installed the new one.

Can't do this for CE6 unfortunately since there is no 3.2.4 release RPM for CE6 some reason. So I just disabled the gpg check and changed the version number on those.