[GH-ISSUE #3140] Bad GPG signature found: /var/cache/PackageKit/41/metadata/NetBird-41-x86_64/packages/netbird_0.35.2_linux_amd64.rpm could not be verified. /var/cache/PackageKit/41/metadata/NetBird-41-x86_64/packages/netbird_0.35.2_linux_amd64.rpm: d… #6708

New Issue

Originally created by @VinterSolen on GitHub (Jan 2, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3140

Originally assigned to: @nazarewk on GitHub.

Fedora linux update:

Bad GPG signature found:

/var/cache/PackageKit/41/metadata/NetBird-41-x86_64/packages/netbird_0.35.2_linux_amd64.rpm could not be verified. /var/cache/PackageKit/41/metadata/NetBird-41-x86_64/packages/netbird_0.35.2_linux_amd64.rpm: digest: SIGNATURE: NOT OK

Originally created by @VinterSolen on GitHub (Jan 2, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3140 Originally assigned to: @nazarewk on GitHub. Fedora linux update: ``` Bad GPG signature found: /var/cache/PackageKit/41/metadata/NetBird-41-x86_64/packages/netbird_0.35.2_linux_amd64.rpm could not be verified. /var/cache/PackageKit/41/metadata/NetBird-41-x86_64/packages/netbird_0.35.2_linux_amd64.rpm: digest: SIGNATURE: NOT OK ```

saavagebueno added the system-compatibility-issue label 2026-08-05 01:09:43 -04:00

saavagebueno closed this issue

saavagebueno commented

@13pk13 commented on GitHub (Feb 16, 2025):

I have the same issue

@13pk13 commented on GitHub (Feb 16, 2025): I have the same issue

saavagebueno commented

@support1 commented on GitHub (Feb 23, 2025):

Also have the same problem. This prevents system updates on Fedora.
Used the guide on "RPM/Red hat/Amazon Linux 2" in install docs to install NetBird.

Temporary solution:
If you stop the service --> uninstall service --> uninstall NetBird client, you will be able to install the Fedora updates. You are then able to reinstall the NetBird service and client.

@support1 commented on GitHub (Feb 23, 2025): Also have the same problem. This prevents system updates on Fedora. Used the guide on "RPM/Red hat/Amazon Linux 2" in install docs to install NetBird. Temporary solution: If you stop the service --> uninstall service --> uninstall NetBird client, you will be able to install the Fedora updates. You are then able to reinstall the NetBird service and client.

saavagebueno commented

@BoboceaOctavian commented on GitHub (Mar 16, 2025):

This happens for me when updating through Fedora's Discover software centre.

Bad GPG signature found:

/var/cache/PackageKit/41/metadata/netbird-41-x86_64/packages/netbird-ui_0.38.2_linux_amd64.rpm could not be verified.
/var/cache/PackageKit/41/metadata/netbird-41-x86_64/packages/netbird-ui_0.38.2_linux_amd64.rpm:  digest:  SIGNATURE:  NOT OK

I have found that using the console and sudo dnf update directly will perform the upgrade successfully, so there is no need to uninstall/reinstall each time, at least for me. Still it would be better to have a proper fix.

@BoboceaOctavian commented on GitHub (Mar 16, 2025): This happens for me when updating through Fedora's Discover software centre. ``` Bad GPG signature found: /var/cache/PackageKit/41/metadata/netbird-41-x86_64/packages/netbird-ui_0.38.2_linux_amd64.rpm could not be verified. /var/cache/PackageKit/41/metadata/netbird-41-x86_64/packages/netbird-ui_0.38.2_linux_amd64.rpm: digest: SIGNATURE: NOT OK ``` I have found that using the console and `sudo dnf update` directly will perform the upgrade successfully, so there is no need to uninstall/reinstall each time, at least for me. Still it would be better to have a proper fix.

saavagebueno commented

@mlsmaycon commented on GitHub (Mar 16, 2025):

Can you confirm if there is any custom setting for our repository in your system? The RPMs aren't signed yet, which causes the check to fail as expected, but our examples shouldn't have the check enabled either.

@mlsmaycon commented on GitHub (Mar 16, 2025): Can you confirm if there is any custom setting for our repository in your system? The RPMs aren't signed yet, which causes the check to fail as expected, but our examples shouldn't have the check enabled either.

saavagebueno commented

@BoboceaOctavian commented on GitHub (Mar 18, 2025):

My /etc/yum.repos.d/netbird.repo looks like this:

[netbird]
name=netbird
baseurl=https://pkgs.netbird.io/yum/
enabled=1
gpgcheck=0
gpgkey=https://pkgs.netbird.io/yum/repodata/repomd.xml.key
repo_gpgcheck=1

and it has been created with curl -fsSL https://pkgs.netbird.io/install.sh | sh.

I have however found tailscale/tailscale#6246 which suggests this might be a problem with Discover. There are some other reports about this, but it doesn't seem to go anywhere as far as I could find (for example).

@BoboceaOctavian commented on GitHub (Mar 18, 2025): My `/etc/yum.repos.d/netbird.repo` looks like this: ``` [netbird] name=netbird baseurl=https://pkgs.netbird.io/yum/ enabled=1 gpgcheck=0 gpgkey=https://pkgs.netbird.io/yum/repodata/repomd.xml.key repo_gpgcheck=1 ``` and it has been created with `curl -fsSL https://pkgs.netbird.io/install.sh | sh`. I have however found tailscale/tailscale#6246 which suggests this might be a problem with Discover. There are some other reports about this, but it doesn't seem to go anywhere as far as I could find ([for example](https://bugs.kde.org/show_bug.cgi?id=448646)).

saavagebueno commented

@Ivan-753 commented on GitHub (Apr 14, 2025):

Same problem on Fedora 41.
Discover can't update packages, but Gnome Software can (it shows dialog, asking what to do with this packages).

@Ivan-753 commented on GitHub (Apr 14, 2025): Same problem on Fedora 41. Discover can't update packages, but Gnome Software can (it shows dialog, asking what to do with this packages).

saavagebueno commented

@Ivan-753 commented on GitHub (May 5, 2025):

@Ivan-753 commented on GitHub (May 5, 2025): ![Image](https://github.com/user-attachments/assets/e0e6c657-1c8b-47cb-8b0a-d521d88cfc09) ![Image](https://github.com/user-attachments/assets/bdd7476a-c8d7-4b32-ae44-ef57458ce9b2) ![Image](https://github.com/user-attachments/assets/dd249ac5-ad21-46e2-ad5c-2e404a78b708)

saavagebueno commented

@kbkozlev commented on GitHub (Jun 18, 2025):

Any news on how to resolve this?

Through Discover I receive this error, but when I do dnf update, it says that there are no new files to update?
The NetBird icon, however, shows that there is a new update - its very confusing.

@kbkozlev commented on GitHub (Jun 18, 2025): Any news on how to resolve this? Through Discover I receive this error, but when I do dnf update, it says that there are no new files to update? The NetBird icon, however, shows that there is a new update - its very confusing.

saavagebueno commented

@mlsmaycon commented on GitHub (Jun 18, 2025):

This should be fine for most cases, but maybe something fails on different systems using DNF, see the example below with a fedora container; see highlighted text with a similar error, but dnf handles it:

@mlsmaycon commented on GitHub (Jun 18, 2025): This should be fine for most cases, but maybe something fails on different systems using DNF, see the example below with a fedora container; see highlighted text with a similar error, but dnf handles it: <img width="1632" alt="Image" src="https://github.com/user-attachments/assets/d36b3fe7-db2c-4c34-a147-a2da97a109ce" />

saavagebueno commented

@feldim2425 commented on GitHub (Jun 26, 2025):

DNF in the terminal handles it but PackageKit via Discover won't.
That means the updates on desktop systems are broken when the GPG key needs to be imported. Ideally it shouldn't need to be imported every update.

@feldim2425 commented on GitHub (Jun 26, 2025): DNF in the terminal handles it but PackageKit via Discover won't. That means the updates on desktop systems are broken when the GPG key needs to be imported. Ideally it shouldn't need to be imported every update.

saavagebueno commented

@masterjuggler commented on GitHub (Jul 20, 2025):

I have this same issue on fedora, has there been any change to this?

@masterjuggler commented on GitHub (Jul 20, 2025): I have this same issue on fedora, has there been any change to this?

saavagebueno commented

@niklaas commented on GitHub (Aug 21, 2025):

I have however found tailscale/tailscale#6246 which suggests this might be a problem with Discover.

It looks like they fixed the issue by signing the packages, see tailscale/tailscale#1882.

@niklaas commented on GitHub (Aug 21, 2025): > I have however found [tailscale/tailscale#6246](https://github.com/tailscale/tailscale/issues/6246) which suggests this might be a problem with Discover. It looks like they fixed the issue by signing the packages, see tailscale/tailscale#1882.

saavagebueno commented

@4Robato commented on GitHub (Oct 19, 2025):

I still have this issue. Seems doing:

sudo dnf update

works fine but it uninstalls and reinstalls netbird to update it.

@4Robato commented on GitHub (Oct 19, 2025): I still have this issue. Seems doing: `sudo dnf update` works fine but it uninstalls and reinstalls netbird to update it.

saavagebueno commented

@FriskyFennecFox commented on GitHub (Jan 16, 2026):

This issue still exists on Fedora 43 while attempting to update from 0.62.3-1 to 0.63.0-1.

sudo dnf update returns Nothing to do despite Discover reporting 2 system updates. However, sudo dnf update --refresh allowed dnf to catch these two (netbird and netbird-ui) packages and update normally, although not without a warning:

Warning: skipped OpenPGP checks for 2 packages from repository: NetBird

@FriskyFennecFox commented on GitHub (Jan 16, 2026): This issue still exists on Fedora 43 while attempting to update from `0.62.3-1` to `0.63.0-1`. `sudo dnf update` returns `Nothing to do` despite Discover reporting 2 system updates. However, `sudo dnf update --refresh` allowed `dnf` to catch these two (`netbird` and `netbird-ui`) packages and update normally, although not without a warning: ``` Warning: skipped OpenPGP checks for 2 packages from repository: NetBird ```

saavagebueno commented

@sandroshu commented on GitHub (Mar 12, 2026):

Still bad on Fedora 43 at 66.4:

Bad GPG signature found:

/var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm could not be verified. /var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm:: Header OpenPGP DSA signature: NOTFOUND: Header OpenPGP RSA signature: NOTFOUND: Header OpenPGP signature: NOTFOUND: Header SHA256 digest: OK: Payload SHA256 digest: OK: Legacy OpenPGP DSA signature: NOTFOUND: Legacy OpenPGP RSA signature: NOTFOUND

After nuking packagekit cache:

Bad GPG signature found:

/var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm could not be verified. /var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm: digest: SIGNATURE: NOT OK

@sandroshu commented on GitHub (Mar 12, 2026): Still bad on Fedora 43 at 66.4: ``` Bad GPG signature found: /var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm could not be verified. /var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm:: Header OpenPGP DSA signature: NOTFOUND: Header OpenPGP RSA signature: NOTFOUND: Header OpenPGP signature: NOTFOUND: Header SHA256 digest: OK: Payload SHA256 digest: OK: Legacy OpenPGP DSA signature: NOTFOUND: Legacy OpenPGP RSA signature: NOTFOUND ``` After nuking packagekit cache: ``` Bad GPG signature found: /var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm could not be verified. /var/cache/PackageKit/43/metadata/NetBird-43-x86_64/packages/netbird-ui_0.66.4_linux_amd64.rpm: digest: SIGNATURE: NOT OK ```

saavagebueno commented