Diagnosing dnf GPG Key Errors on AlmaLinux 9 and 10

Problem: dnf fails with GPG key errors on AlmaLinux

When dnf or yum cannot find the repository signing key in the local trust store, the package transaction aborts before any packages are installed or upgraded.

Diagnostic snapshot

Symptom	Likely cause	First check
GPG key error: NO_PUBKEY	Signing key missing from /etc/pki/rpm-gpg	List /etc/yum.repos.d/ and inspect the failing repo
Failed to import metalink	Repo URL altered by proxy or stale mirror list	Run dnf repolist and confirm the repo is enabled
Signature verification failed	System clock out of sync with key validity period	Run timedatectl and compare with upstream key dates

Ordered verification steps

1. Inspect repository files. Run ls -l /etc/yum.repos.d/ as a user with read access to that directory, typically root or via sudo. Confirm each enabled .repo file points to an official AlmaLinux mirror.

2. Check enabled repositories. Run sudo dnf repolist (AlmaLinux 9/10) or sudo yum repolist (AlmaLinux 8). Look for the repository mentioned in the error and verify its status is enabled.

3. Import the missing key. If the error names a key, run sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9, replacing the file name with the one shown in the error message. Only import keys published by AlmaLinux or the upstream Red Hat repository.

4. Verify system time. Run timedatectl. Expired or not-yet-valid keys are rejected when the system clock is incorrect. Correct drift with chronyd or NTP before retrying.

Fixes tied to findings

• Missing GPG key: import the correct key from the AlmaLinux release package, then rerun the original dnf command.

• Outdated repo file: back up /etc/yum.repos.d/, remove the stale .repo file, download the current version from the official AlmaLinux repository, then run sudo dnf clean all && sudo dnf makecache.

• Clock skew: synchronize time with sudo chronyc makestep if chronyd is running, then refresh repository metadata.

Concrete example

Assume dnf install httpd fails with GPG key error: NO_PUBKEY 3FA5C6E0 for the AlmaLinux 9 BaseOS repository.

# Run as root or with sudo
sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9
sudo dnf clean all
sudo dnf makecache
sudo dnf install httpd

If the import succeeds, the cache rebuild completes without GPG warnings and the install transaction proceeds.

After installation, verify a downloaded package signature:

rpm -K /var/cache/dnf/httpd-*.rpm

Expected output includes OK for the GPG signature.

Escalation criteria

• GPG errors persist after key import and dnf makecache: test network reachability to the repo URL with curl -I https://repo.almalinux.org/. A proxy or firewall may be substituting metadata.

• Time remains incorrect: verify chronyd or systemd-timesyncd is active and synchronized.

• Custom or third-party repositories: confirm the imported key matches the key published by that repository maintainer.

• No resolution after the above: open a support ticket with AlmaLinux or the repository maintainer, including the exact error text and output from dnf repolist and timedatectl.

Verification checklist

1. Run sudo dnf clean all followed by sudo dnf makecache. No GPG key warnings should appear.
2. Run rpm -K <package>.rpm on a freshly downloaded package; the signature line must show OK.
3. Check /var/log/yum.log or journalctl -u dnf.log for remaining GPG warnings.

Limitations and cautions

• AlmaLinux 8 uses yum; AlmaLinux 9 and 10 use dnf. Command syntax and repository paths differ between versions.
• Importing an untrusted GPG key can allow malicious packages. Only import keys from official AlmaLinux or upstream Red Hat sources.
• Editing repository files can break future updates. Always back up /etc/yum.repos.d/ before making changes.

When to roll back

Rolling back applies only if a repository replacement or key import changes system state and causes new failures. Restore the repository directory from the backup made before editing, then run sudo dnf clean all and retry the original operation.