Configure DNF GPG Verification and Metadata Expiration in Rocky Linux 8 and 9

Desired Outcome

Ensure that DNF on Rocky Linux 8 or 9 validates GPG signatures for all repository metadata and packages, while controlling how often repository metadata is refreshed. This prevents installation of tampered or unsigned packages and avoids stale metadata causing failed updates or security gaps.

Prerequisites

• Root or sudo access on a Rocky Linux 8 or 9 system
• Active network connectivity to configured repositories
• Familiarity with editing system configuration files (e.g., /etc/dnf/dnf.conf)
• Existing GPG keys for official Rocky repositories (installed by default in /etc/pki/rpm-gpg/)

Understanding the Default Behavior

Rocky Linux ships with GPG keys for its official repositories in /etc/pki/rpm-gpg/. DNF verifies both repository metadata (repodata) and individual RPM packages against these keys before any transaction. If a repository lacks a valid key, DNF prompts to import it or aborts the operation unless --nogpgcheck is used.

Metadata freshness is governed by two settings in /etc/dnf/dnf.conf:

• metadata_expire (default: 6h) — Time after which cached metadata is considered stale and DNF will refresh it on the next operation.
• metadata_timeout (default: 300 seconds) — Maximum time DNF waits for a metadata download before timing out.

These defaults balance network traffic against update currency. Reducing metadata_expire increases freshness but also increases bandwidth usage and load on mirrors.

Procedure: Verify and Adjust GPG Verification and Metadata Expiration

Step 1: Confirm Current GPG Key Trust

Run the following as root or with sudo to list all GPG keys currently trusted by RPM (and therefore DNF):

rpm -qa gpg-pubkey*

Expected output includes keys such as gpg-pubkey-...-rocky for Rocky Linux official repos. If third-party repositories (e.g., EPEL, Docker, Kubernetes) are configured, their keys should also appear here after initial import.

Step 2: Check Repository GPG Enforcement Status

List enabled repositories and their GPG check setting:

dnf repolist enabled -v | grep -E 'Repo-id|gpgcheck'

Each repository should show gpgcheck = 1. A value of 0 means signature verification is disabled for that repo — a security risk unless the repository is intentionally unsigned and you accept the risk.

Step 3: Inspect and Modify Metadata Expiration

View the current global DNF configuration:

dnf config-manager --dump | grep -E 'metadata_expire|metadata_timeout'

Alternatively, inspect /etc/dnf/dnf.conf directly:

grep -E 'metadata_expire|metadata_timeout' /etc/dnf/dnf.conf

To change the expiration to 1 hour (for faster update visibility in CI/CD or staging environments), edit /etc/dnf/dnf.conf and add or modify:

[main]
metadata_expire=1h
metadata_timeout=300

Risk: Setting metadata_expire below 1 hour is not recommended for production systems — it increases mirror load and may trigger rate limiting. Use per-repository overrides in /etc/yum.repos.d/*.repo if only specific repos need faster refresh.

Step 4: Force a Metadata Refresh and Verify GPG Validation

Clear expired metadata and force a fresh download with signature verification:

dnf clean expire-cache
dnf makecache

Watch the output for lines like:

Rocky Linux 9 - BaseOS                    2.1 MB/s | 2.3 MB     00:01    
GPG key verified successfully

If a repository fails GPG verification, DNF will halt and report the error. Do not proceed with --nogpgcheck unless you have manually verified the repository's authenticity through an out-of-band channel.

Step 5: Handle Third-Party Repository Key Import

When adding a new third-party repository (e.g., HashiCorp, Grafana), the vendor typically provides a GPG key URL. Import it before enabling the repo:

rpm --import https://rpm.releases.hashicorp.com/gpg

Then create the repo file in /etc/yum.repos.d/hashicorp.repo with gpgcheck=1 and gpgkey=https://rpm.releases.hashicorp.com/gpg. DNF will use the already-imported key for verification.

Expected Checks After Configuration

1. Run dnf update --dry-run — it should complete without GPG errors and show only packages from repositories with valid signatures.
2. Check the system journal for DNF verification logs:

   journalctl -u dnf-makecache.timer -f

   Look for GPG signature verification passed entries.
3. Verify metadata timestamps in /var/cache/dnf/ — each repo subdirectory contains repodata/ with a repomd.xml file. Its timestamp field should be recent (within your metadata_expire window).

Recovery Options

If GPG Verification Fails Unexpectedly

• Confirm the repository URL hasn't changed (mirror migration, CDN shift).
• Check if the GPG key expired or was rotated — vendor announcements usually precede rotation.
• Re-import the key from a trusted source (vendor website, not a mirror).
• If a repository is permanently unsigned and you must use it, set gpgcheck=0 only for that repo in its .repo file, and document the exception.

If Metadata Refresh Fails Due to Timeout

• Increase metadata_timeout in /etc/dnf/dnf.conf (e.g., to 600 for slow links).
• Test mirror connectivity with curl -I /repodata/repomd.xml.
• Switch to a closer mirror by editing baseurl or enabling fastestmirror=True in /etc/dnf/dnf.conf.

Rollback Configuration Changes

If a change to metadata_expire causes excessive bandwidth or mirror bans, revert /etc/dnf/dnf.conf to defaults and run dnf clean all to reset cache state. No system reboot or service restart is required — DNF reads the config on each invocation.

Limitations and Considerations

• DNF does not enforce GPG verification on local .rpm files installed via dnf install ./package.rpm unless gpgcheck=1 is set in the repo configuration — but local installs bypass repo metadata entirely. Use rpm -K package.rpm manually to verify local packages.
• metadata_expire accepts time units: s, m, h, d. Values without a unit are interpreted as seconds.
• Per-repository metadata_expire in .repo files overrides the global setting. Use this for high-churn repos (e.g., CI artifact repos) without affecting base OS repos.
• Rocky Linux 8 uses DNF 4.x; Rocky Linux 9 uses DNF 5.x (via dnf5 symlink). Configuration syntax is compatible, but dnf5 may log verification details differently. The steps above apply to both.

Practical Verification Checklist

Check	Command	Pass Criteria
All enabled repos enforce GPG	dnf repolist enabled -v | grep gpgcheck	All show gpgcheck = 1
Metadata expiration as intended	dnf config-manager --dump | grep metadata_expire	Matches your configured value (e.g., 1h)
Recent metadata timestamps	find /var/cache/dnf -name repomd.xml -exec grep -H '' {} \;	Timestamps within metadata_expire window
No GPG errors on dry-run	dnf update --dry-run 2>&1 | grep -i gpg	No GPG or signature errors