Baike.dev
Log in
Back to tool/Back to issues
#10722·gocd

GoCD RPMs cannot be verified/installed with default RHEL 9 / CentOS Stream 9 configuration

Author: chadlwilsonCreated Aug 21, 2022Updated Jul 26, 2026
Labelsinstallersno stalebot
Issue Type
  • Bug Report
Summary

Currently it is not possible to install the GoCD RPMs on RHEL 9 and Centos Stream 9 - and other derived repos such as Rocky, Alma, Fedora.

  • RHEL 9/10 ❌
  • CentOS Stream 9/10 ❌
  • Rocky Linux 9/10 ❌
  • AlmaLinux 9/10 ❌
  • Fedora 36 + 37 ✅

Fedora 39+ will break also according to their plans - it should be OK on Fedora 36-38 at the moment as they haven't yet changed policies to match the upstream RHEL/CentOS.

This appears to be because the GoCD GPG key includes at least one signature on a SHA-1 hash which are deprecated on RHEL 9 and friends. and removed in the default crypto policies.

We'd need to ensure all signatures are based on SHA256 digests to resolve this.

Environment

Tested with CentOS Stream 9

Steps to Reproduce
  1. docker run -it quay.io/centos/centos:stream9
  2. Follow instructions at https://docs.gocd.org/current/installation/install/server/linux.html#rpm-based-distributions-ie-redhatcentosfedora
  3. curl https://download.gocd.org/gocd.repo -o /etc/yum.repos.d/gocd.repo
  4. dnf install -y go-agent
Importing GPG key 0x8816C449:
 Userid     : "ThoughtWorks GoCD (GoCD Code signing keys) <[email protected]>"
 Fingerprint: 3222 59C8 2D30 82B3 E32A EC2E D884 3F28 8816 C449
 From       : https://download.gocd.org/GOCD-GPG-KEY.asc
warning: Signature not supported. Hash algorithm SHA1 not available.
Key import failed (code 2). Failing package is: go-agent-22.2.0-14697.noarch
 GPG Keys are configured as: https://download.gocd.org/GOCD-GPG-KEY.asc

This is also the same error when trying to build GoCD itself during attempt to sign on CentOS Stream 9 (example here)

Expected Results

It should be possible to install GoCD on CentOS Stream 9 without weakening ones local policy.

Actual Results
warning: Signature not supported. Hash algorithm SHA1 not available.
Key import failed (code 2). Failing package is: go-agent-22.2.0-14697.noarch
Possible Fix

Based on some local wrangling, it's possible to edit the key and force it to remove SHA-1 signatures.

This guide was somewhat helpful, however the defaults on Mac gpg-suite seemed to still include SHA-1 so I setpref manually in the below.

  1. Import the key (requires keyring and passphrase in gpg-passphrase) gpg --quiet --batch --passphrase-file gpg-passphrase --output - gpg-keys.pem.gpg | gpg --import --batch --quiet
  2. See the problem (algo 2 = SHA1): gpg -a --export 322259C82D3082B3E32AEC2ED8843F288816C449 | gpg --list-packets | grep -B2 "digest algo 2"
bash
:signature packet: algo 1, keyid D8843F288816C449
version 4, created 1418667531, md5len 0, sigclass 0x13
digest algo 2, begin of digest 24 5c
```	
3. Edit the key `gpg --edit-key 322259C82D3082B3E32AEC2ED8843F288816C449`
4. Set preferences to roughly the same as before, but removing SHA1 `setpref SHA512,SHA384,SHA256,SHA224,AES256,AES192,AES,CAST5,3DES,ZLIB,BZIP2,ZIP`
5. `quit` and save the key.
6. You can see it is gone now, as well as produce a diffable output with `gpg -a --export 322259C82D3082B3E32AEC2ED8843F288816C449 | gpg --list-packets | grep -B2 "digest algo 2"`

Then
1. Export the edited key's public element `gpg --armor --output GPG-KEY-GOCD.pem.gpg --export 0xD8843F288816C449`
2. Manually import the key `rpm --import GOCD-GPG-KEY.pem.gpg`
3. Try installing again `dnf -y install go-agent` --> WORKS

We'd have to validate this doesn't cause weird regressions and then re-publish the key, including to `download.gocd.org`.

##### Workaround

Create a new crypto policy locally that explicitly allow signatures on top of SHA1 hashes inside keys. This will allow the old key to be imported and RPMs validated with minimal required weakening of the default RHEL 9/10 policies.
`sudo bash -c '(echo "hash = +SHA1" >/etc/crypto-policies/policies/modules/SHA1-HASH.pmod) && update-crypto-policies --set DEFAULT:SHA1-HASH'`

If using certain minimal RHEL variants you may need to do the below beforehand:
```shell
sudo microdnf -y install crypto-policies-scripts

Now add the key

bash
sudo curl https://download.gocd.org/gocd.repo -o /etc/yum.repos.d/gocd.repo
#... etc other steps

Source: gocd/gocd

View original on GitHubView discussion on GitHub