Cannot install rpm-fusion packages due to missing gpg key

[sstendahl]

Hey,

I was trying to get VirtualBox to work on my install (universal blue base image with nvidia), however it seems like I'm running into issues with anything that has to do with rpm-fusion. I need VirtualBox specifically as part of a course I'm following through my employer (there's set-up images available in the course which we ought to use), so going with some KVM tool is not an option.

In short, when I try to install virtualbox, I'm getting:

sstendahl@zenobia:~$ rpm-ostree install virtualbox
Checking out tree e3e5932... done
Enabled rpm-md repositories: copr:copr.fedorainfracloud.org:ublue-os:akmods updates fedora fedora-multimedia copr:copr.fedorainfracloud.org:phracek:PyCharm google-chrome rpmfusion-nonfree-nvidia-driver rpmfusion-nonfree-steam updates-testing rpmfusion-free-updates-testing rpmfusion-nonfree-updates-testing updates-archive
Updating metadata for 'rpmfusion-nonfree-steam'... done
Updating metadata for 'updates-testing'... done
Updating metadata for 'rpmfusion-free-updates-testing'... done
error: Updating rpm-md repo 'rpmfusion-free-updates-testing': Failed to download gpg key for repo 'rpmfusion-free-updates-testing': Curl error (37): Could not read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-41 [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-41]

As far as I understood (and these logs seem to kinda confirm this), rpmfusion is enabled by default in ublue. But after this error, I wanted to check what happens if I try to add them manually, maybe that would shake things into place and go through the proper procedues with regard to signing these keys:

sstendahl@zenobia:~$  sudo rpm-ostree install https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
[sudo] password for sstendahl: 
Sorry, try again.
[sudo] password for sstendahl: 
Downloading https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-41.noarch.rpm...done
Downloading https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-41.noarch.rpm...done
Checking out tree e3e5932... done
Enabled rpm-md repositories: copr:copr.fedorainfracloud.org:ublue-os:akmods updates fedora fedora-multimedia copr:copr.fedorainfracloud.org:phracek:PyCharm google-chrome rpmfusion-nonfree-nvidia-driver rpmfusion-nonfree-steam updates-testing rpmfusion-free-updates-testing rpmfusion-nonfree-updates-testing updates-archive
Updating metadata for 'rpmfusion-free-updates-testing'... done
error: Updating rpm-md repo 'rpmfusion-free-updates-testing': Failed to download gpg key for repo 'rpmfusion-free-updates-testing': Curl error (37): Could not read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-41 [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-41]

But the same issue occurs. As this seems to be coupled to the repo setup, and this is an immutable distro, I think this is the proper place to file this issue as it looks like a misconfiguration. However, I don't rule out this being an upstream issue at rpm-fusion or even just Fedora Silverblue, so feel free to close this issue if that is the case.

Edit: Seems like VirtualBox might be somewhat problematic due to requiring out-of-tree kernel modules, but that seems to be unrelated to the issue here. I'm getting the same result with rpm-ostree install google-chrome for instance.

[sstendahl]

Almost forgot to add explictly, but I'm running the silverblue-nvidia:latest images:

sstendahl@zenobia:~$ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-nvidia:latest
                   Digest: sha256:737348c1a71df938fc3d5cae6ed3b7a1e94be4adb04f237b3cda60de61e9445f
                  Version: 41.20250115.0 (2025-01-16T04:08:54Z)

  ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-nvidia:latest
                   Digest: sha256:9365ee285c9887e5256658a0a5fe866cab19dfb3169bfcd7f902ec607aab856c
                  Version: 41.20250114.0 (2025-01-15T04:09:58Z)

I know the base images are strictly not recommended, but I am really uninterested in the other tweaks that are done in Bluefin and the likes (even though they are fantastic projects, not discounting that!).

[KyleGospo]

You'll want to use qemu instead, virtualbox modules won't work here.

For other things you need from rpmfusion, use distrobox.

[m2Giles]

We strongly recommend qemu over virtualbox.

That said if it is absolutely a requirement, you can install the kmod as part of a custom image.

Since you are using a base image, I'm assuming that you have quite a few things layered already. Moving to a custom image would allow you to have those be apart of the image directly.

[sstendahl]

Since you are using a base image, I'm assuming that you have quite a few things layered already. Moving to a custom image would allow you to have those be apart of the image directly.

That would be wrong, I didn't have anything layered. I actually have the output of rpm-ostree status in my second message :)

One of the biggest reasons I went to Fedora in the first place is because I honestly prefer to run stock GNOME, I like the out of the box experience from Fedora and I would not know what I'd need to layer at this point. As IDE I develop in GNOME Builder, and have a Pycharm install in a container for non-GNOME projects (the Flatpak is too unreliable for me). Otherwise I've got everything as Flatpak actually, with CLI tools in distrobox.

You'll want to use qemu instead, virtualbox modules won't work here.

We strongly recommend qemu over virtualbox.

I strongly prefer qemu over VirtualBox myself as well, apart from being more reliable if it was only to avoid Oracle this would be a plus. In this particular case however, I've got a course that explictly uses VirtualBox images as containers for some reasons, where we then should ssh into. I tried to get away with converting the image to qcow2 and work from there, but I also have a job to do and would just like to be able to follow the instructions as is.

As far as I understood, VirtualBox relies on dkms modules, which don't work with Silverblue (and by extension ublue) in the first place. Otherwise I'm happy layering them if needed. For now, I simply installed Workstation on my work computer instead, as it's not out of the question there'll be other tools where I run into issues. My home machines are all still running ublue variants though (since 2022 if I recall correctly).

Now I'm kinda drifting off-topic with regard to the main point though, which was about the missing gpg keys. As I said in the initial post the same error popped up when trying to layer Google Chrome. As I'm at my work PC at the moment running Workstation, I can't test right now. But I can give it a shot this evening when I'm at my laptop (running the UBlue Base image, no layers).

[sstendahl]

Just to re-iterate, the report was not about VirtualBox (which I know is unsupported), but the error popped up at any RPM-Fusion package (see google chrome). Honestly I'm assuming it has been resolved by now, if not purely due to the lack of more reports. But I can double check this evening.

[sstendahl]

Just checked on my private work laptop, and still getting the same issue with e.g. chrome as well:

sstendahl@lennart:~$ rpm-ostree install google-chrome
Checking out tree d7775c8... done
Enabled rpm-md repositories: copr:copr.fedorainfracloud.org:ublue-os:akmods updates fedora fedora-multimedia copr:copr.fedorainfracloud.org:phracek:PyCharm google-chrome rpmfusion-nonfree-steam rpmfusion-nonfree-nvidia-driver rpmfusion-free-updates-testing rpmfusion-nonfree-updates-testing updates-archive
Updating metadata for 'copr:copr.fedorainfracloud.org:ublue-os:akmods'... done
Updating metadata for 'updates'... done
Updating metadata for 'fedora'... done
Updating metadata for 'fedora-multimedia'... done
Updating metadata for 'copr:copr.fedorainfracloud.org:phracek:PyCharm'... done
Updating metadata for 'google-chrome'... done
Updating metadata for 'rpmfusion-nonfree-steam'... done
Updating metadata for 'rpmfusion-nonfree-nvidia-driver'... done
Updating metadata for 'rpmfusion-free-updates-testing'... done
error: Updating rpm-md repo 'rpmfusion-free-updates-testing': Failed to download gpg key for repo 'rpmfusion-free-updates-testing': Curl error (37): Could not read a file:// file for file:///etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-41 [Couldn't open file /etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-free-fedora-41]

Here's the image I've got, base image no layers on this machine either:

sstendahl@lennart:~/Projects/Graphs$ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: last run 40min ago
Deployments:
  ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-nvidia:latest
                   Digest: sha256:4688c06eb1662072025dfeb65b44855b7e566ad99fdef6e47ffb4710c4f38e6b
                  Version: 41.20250215.0 (2025-02-16T04:09:04Z)
                     Diff: 6 upgraded

● ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-nvidia:latest
                   Digest: sha256:afbf89858a91674528c89e8f2d5bf8e26c3e1e06b8ba55e81c5324378c1d7713
                  Version: 41.20250214.0 (2025-02-15T04:10:04Z)

  ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-nvidia:latest
                   Digest: sha256:f020d769971fb783c9eb1126b83a1a3030e39f7b5bb62974ab6a70e02d527b9f
                  Version: 41.20250205.0 (2025-02-06T04:09:14Z)