Diagnosing and Fixing GPG Key Errors in zypper on openSUSE

Recognizable Condition

When installing packages with zypper on openSUSE Leap or Tumbleweed, the operation halts with one of these messages:

• The GPG key is not trusted
• GPG error: key <ID> is not available

The key ID (a 8- or 16-character hex string) appears in the error. This means zypper cannot verify the repository's metadata signature because the corresponding public key is missing, expired, or rejected by the local RPM keyring.

Quick Cause & Diagnostic Table

Symptom	Likely Cause	First Check
Key ID reported as missing	Repository's GPG key not imported into local keyring	rpm -qa gpg-pubkey* | grep -i <key-id>
Key exists but validation fails	Key expired or system clock incorrect	date and rpm -qi gpg-pubkey-<id>
Error on specific repo only	Repo file has gpgcheck=1 but no gpgkey directive	cat /etc/zypp/repos.d/<repo>.repo
All repos fail	System clock far off; NTP disabled	timedatectl status

Ordered Diagnostic Checks

1. Capture the Key ID

Run the failing command again and note the exact key ID from the error output. Example:

zypper install vim
# ... GPG error: key 1234ABCD is not available

Run this in a regular user shell; no elevated privileges needed for diagnosis.

2. Verify Repository Configuration

Inspect the repository file that triggered the error:

cat /etc/zypp/repos.d/<repository-name>.repo

Look for:

• gpgcheck=1 (enabled)
• gpgkey= directive pointing to a key file or URL
• enabled=1

If gpgkey is missing, zypper cannot auto-import the key.

3. Check Local Keyring

List all imported GPG public keys in the RPM database:

rpm -qa gpg-pubkey*

Output shows packages named like gpg-pubkey-1234abcd-5a1b2c3d. The middle segment (8 hex chars) is the key ID. Confirm whether the missing key ID appears.

4. Validate System Clock

GPG signatures embed timestamps. A clock skew of more than a few minutes causes validation to fail:

date
# Compare with a reliable time source

If off by minutes or more, enable NTP:

sudo timedatectl set-ntp true

Requires root. Verify with timedatectl status.

5. Inspect Key Expiry (if key exists)

If the key ID appears in rpm -qa, query its details:

rpm -qi gpg-pubkey-<key-id>

Check the Valid Until field. An expired key must be replaced.

Targeted Fixes

Missing Key: Import from Official Location

openSUSE stores official repository keys under /etc/pki/rpm-gpg/. Import the matching key:

sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-openSUSE

For third-party repos, download the key from the repository's website (verify fingerprint first), then import:

sudo rpm --import https://example.com/repo.key

Risk: Importing an unverified key allows malicious packages. Always compare the key fingerprint with the publisher's published fingerprint before importing.

Expired Key: Update the Key Package

Official keys are distributed as RPM packages. Refresh and reinstall:

sudo zypper refresh
sudo zypper install --force gpg-pubkey-<key-id>

If the key package isn't available, the repository maintainer must publish an updated key.

Clock Skew: Synchronize Time

sudo timedatectl set-ntp true
# Wait a few seconds, then verify
date

On VMs without a hardware clock, ensure the hypervisor provides time sync.

Repository Missing gpgkey Directive

Edit the repo file as root and add the key location:

[repo-name]
name=Example Repo
baseurl=https://example.com/repo/
enabled=1
gpgcheck=1
gpgkey=https://example.com/repo/repo.key

Then run sudo zypper refresh to trigger auto-import.

Temporary Workaround (Not for Production)

To install a single package while diagnosing:

sudo zypper install --no-gpg-checks <package>

This bypasses signature verification. Do not add gpgcheck=0 to the repo file permanently.

Verification After Fix

1. Refresh repository metadata: sudo zypper ref
2. Retry the original install: sudo zypper install <package>
3. Confirm no GPG errors appear and the package installs.

If the install succeeds, the key is now trusted. Run rpm -qa gpg-pubkey* | grep <key-id> to confirm the key persists in the keyring.

Escalation Criteria

Contact the repository maintainer or openSUSE support when:

• The key ID from the error does not match any key published by the repository owner.
• The repository provides no gpgkey URL and no key file in /etc/pki/rpm-gpg/.
• System clock cannot be corrected (e.g., no NTP access, hypervisor blocks time sync).
• Key fingerprint verification fails against the publisher's published fingerprint.

Provide the exact error message, key ID, repository URL, and output of rpm -qa gpg-pubkey* and date when filing a bug or support request.

Limitations

• This guide covers RPM-level GPG verification. It does not address zypper metadata signature errors (repomd.xml.key) which follow a similar but separate code path.
• Third-party repositories may use custom key management; consult their documentation.
• On openSUSE MicroOS or transactional-update systems, key imports may require a reboot to take effect in the active snapshot.