RHEL/Rocky 9 not working out-of-the-box

[ziller-hqs]

This is a follow-up from #712

The new key for signing the packages is using Ed25519/Curve25519 as algorithm. This will make sure that no Linux admin has to enable the insecure SHA1 algorithm that was used with the old signing key.

The problem here is that RHEL/Rocky 9 do not suppot this algorithm for their package manager at all.

So while the new packages are signed with a key that is newer, it still does not allow me to install patchman without modifications on RHEL/Rocky 9 servers.

The only alternative is to update to Rocky 10, but an in-place upgrade is not supported by Rocky Linux. I would have to reinstall the machines. This is not an option, of course.

Would it be possible to also use a RSA key for signing in the future?

[furlongm]

I made some changes to the keys. Could you check again?

[ziller-hqs]

I have attempted to "rpm --import" the following modifiied files:

https://repo.openbytes.ie/openbytes-1.gpg
https://repo.openbytes.ie/openbytes.gpg

on both keys, I get a warning from the rpm tool:

~#: rpm --import openbytes-1.gpg
warning: Signature not supported. Hash algorithm SHA1 not available.
error: openbytes-1.gpg: key 1 import failed.
error: openbytes-1.gpg: key 1 import failed.

I am unfamiliar with the whole signing concept, but I believe the key needs to be re-signed with a newer algorithm?

EDIT: Done on Rocky Linux 9.7

EDIT2: I believe the whole GPG key and all its subkeys need to be resigned. Not just a new one added to it.