Reposync and GPG key issue

[sigveo]

Hello.
I have an internal reposerver where I sync the zabbix repo to host internally to other servers that don't have internet access. But when I try to sync the zabbix repo, I get a GPG signature check error. The servers we use are Rocky Linux 9. The steps I have done so far, is:


dnf install https://repo.zabbix.com/zabbix/6.4/r...el9.noarch.rpm
--> This installs the repo on the internal repo server

The /etc/yum.repos.d/zabbix.repo then looks like this

[zabbix]
name=Zabbix Official Repository - $basearch
baseurl=https://repo.zabbix.com/zabbix/6.4/rhel/9/$basearch/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-08EFA7DD

[zabbix-non-supported]
name=Zabbix Official Repository non-supported - $basearch
baseurl=https://repo.zabbix.com/non-supported/rhel/9/$basearch/
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-08EFA7DD
gpgcheck=1

And the key is placed here: /etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-08EFA7DD

I then do reposync to host the repo to other servers:
dnf reposync -g --delete -p /path/to/folder/for/web/server/ --repoid=zabbix --newest-only --download-metadata

But I get an error: GPG signature check failed

What am I missing? It works when setting gpgcheck=0, but that's not really an alternative.

[sigveo]

I solved this using rsync. I thought rsync didn't work, since i used https://mirror.rackspace.com/zabbix/ and rsync didn't work from there. But it turns out that rsync from repo.zabbix.com/mirror works.

So now I rsync the zabbix repository to my repository server, and then install the gpg key and zabbix on my servers from my local repository server. I use Ansible for this, but the manual sync command should be:

rsync -aSHogp --chown=root:root --chmod=D755,F644 --delete --partial --exclude-from=/path/to/exludes/file.txt rsync://repo.zabbix.com/mirror /path/to/local/folder --delete-excluded

My exclude file looks like this, since we don't want older versions and use RedHat distros. This saves time on initial sync and saves disk space on your repository server:

1.8
2.0
2.2
2.4
3.0
3.2
3.4
4.0
4.2
4.4
4.5
5.0
5.1
5.2
5.3
5.4
5.5
*/debian*
*/raspbian*
*/sles*

As I said, I use Ansible, but the command to import the key should be something like
rpm --import path.to.your.local.repository.server/RPM-GPG-KEY-ZABBIX-08EFA7DD

Then, create the repo under /etc/yum.repos.d/local_zabbix.repo

Should look something like this (We still use version 6, so maybe replace 6.0 with 7.0 in your case):

[local-zabbix]
name=Internal Repo Zabbix
baseurl=path.to.zabbix.dir.on.you.local.repo.serve r/6.0/rhel/$releasever/$basearch/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-08EFA7DD

Then you should be able to install zabbix:
dnf install zabbix-agent2 zabbix-agent2-plugin-*

And restart zabbix
# systemctl restart zabbix-agent2
# systemctl enable zabbix-agent2

[adminjerry]

I have the same type of issue. I have not been able to sync a version 7 Linux 9 rpm since 7 came out. The key you have in your post is the same one I have trouble with.
Does anyone have an answer to this?

[sigveo]

I solved this using rsync. I thought rsync didn't work, since i used https://mirror.rackspace.com/zabbix/ and rsync didn't work from there. But it turns out that rsync from repo.zabbix.com/mirror works.

So now I rsync the zabbix repository to my repository server, and then install the gpg key and zabbix on my servers from my local repository server. I use Ansible for this, but the manual sync command should be:

rsync -aSHogp --chown=root:root --chmod=D755,F644 --delete --partial --exclude-from=/path/to/exludes/file.txt rsync://repo.zabbix.com/mirror /path/to/local/folder --delete-excluded

My exclude file looks like this, since we don't want older versions and use RedHat distros. This saves time on initial sync and saves disk space on your repository server:

1.8
2.0
2.2
2.4
3.0
3.2
3.4
4.0
4.2
4.4
4.5
5.0
5.1
5.2
5.3
5.4
5.5
*/debian*
*/raspbian*
*/sles*

As I said, I use Ansible, but the command to import the key should be something like
rpm --import path.to.your.local.repository.server/RPM-GPG-KEY-ZABBIX-08EFA7DD

Then, create the repo under /etc/yum.repos.d/local_zabbix.repo

Should look something like this (We still use version 6, so maybe replace 6.0 with 7.0 in your case):

[local-zabbix]
name=Internal Repo Zabbix
baseurl=path.to.zabbix.dir.on.you.local.repo.serve r/6.0/rhel/$releasever/$basearch/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-08EFA7DD

Then you should be able to install zabbix:
dnf install zabbix-agent2 zabbix-agent2-plugin-*

And restart zabbix
# systemctl restart zabbix-agent2
# systemctl enable zabbix-agent2