rpm output

[Patrick Dupre]

Hello,

If I make a rpm -qa, I got

xconsole-1.0.7-2.fc34.x86_64
nautilus-sendto-3.8.6-8.fc32.x86_64
--More--error: rpmdbNextIterator: skipping h#     132 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
(28))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     134 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  1111100
(7c))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     137 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in    10011
(13))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     138 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101101
(2d))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     140 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet



Can I void these errors?
===========================================================================
 Patrick DUPRÉ                                 | | email: pdupre(a)gmx.com
===========================================================================

[Barry]

>  On 17 Oct 2023, at 21:16, Patrick Dupre via users
> <users(a)lists.fedoraproject.org&gt; wrote:
>  
>  Hello,
>  
>  If I make a rpm -qa, I got
>  
>  xconsole-1.0.7-2.fc34.x86_64
>  nautilus-sendto-3.8.6-8.fc32.x86_64 
These are very old packages that are, I think, signed by keys that are
no longer supported because they are not secure.

>  --More--error: rpmdbNextIterator: skipping h#     132
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>   Failed to parse Signature Packet
>       because: Signature appears to be created by a non-conformant OpenPGP implementation,
> see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>       because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
> (28))
>  Header SHA1 digest: OK
>  error: rpmdbNextIterator: skipping h#     134
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>   Failed to parse Signature Packet
>       because: Signature appears to be created by a non-conformant OpenPGP implementation,
> see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>       because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  1111100
> (7c))
>  Header SHA1 digest: OK
>  error: rpmdbNextIterator: skipping h#     137
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>   Failed to parse Signature Packet
>       because: Signature appears to be created by a non-conformant OpenPGP implementation,
> see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>       because: Malformed MPI: leading bit is not set: expected bit 8 to be set in    10011
> (13))
>  Header SHA1 digest: OK
>  error: rpmdbNextIterator: skipping h#     138
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>   Failed to parse Signature Packet
>       because: Signature appears to be created by a non-conformant OpenPGP implementation,
> see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>       because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101101
> (2d))
>  Header SHA1 digest: OK
>  error: rpmdbNextIterator: skipping h#     140
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>   Failed to parse Signature Packet
>  
>  
>  
>  Can I void these errors? 
Yes remove the very old packages. Can you install f38 versions of them?

Barry

> ===========================================================================
>  Patrick DUPRÉ                                 | | email: pdupre(a)gmx.com
>  ===========================================================================
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Patrick Dupre]

>  
>  > On 17 Oct 2023, at 21:16, Patrick Dupre via users
> <users(a)lists.fedoraproject.org&gt; wrote:
>  > 
>  > Hello,
>  > 
>  > If I make a rpm -qa, I got
>  > 
>  > xconsole-1.0.7-2.fc34.x86_64
>  > nautilus-sendto-3.8.6-8.fc32.x86_64
>  
>  These are very old packages that are, I think, signed by keys that are
>  no longer supported because they are not secure.
>   
I do not think so, I removed nautilus-sendto-3.8.6-8.fc32.x86_64
and same thing appears.
On one machine
rpm -qa xpr 
xpr-1.0.5-2.fc34.x86_64
One the other machine, the same command

xpr-1.0.5-2.fc34.x86_64
--More--error: rpmdbNextIterator: skipping h#     132
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
Failed to parse Signature Packet
    because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
    because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
(28))
 Header SHA1 digest: OK

> > error: rpmdbNextIterator: skipping h#     134
> > Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an
OpenPGP packet:
> >  Failed to parse Signature Packet
> >      because: Signature appears to be created by a non-conformant OpenPGP
implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
> >      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in
 1111100 (7c))
> > Header SHA1 digest: OK
> > error: rpmdbNextIterator: skipping h#     137
> > Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an
OpenPGP packet:
> >  Failed to parse Signature Packet
> >      because: Signature appears to be created by a non-conformant OpenPGP
implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
> >      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in
   10011 (13))
> > Header SHA1 digest: OK
> > error: rpmdbNextIterator: skipping h#     138
> > Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an
OpenPGP packet:
> >  Failed to parse Signature Packet
> >      because: Signature appears to be created by a non-conformant OpenPGP
implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
> >      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in
  101101 (2d))
> > Header SHA1 digest: OK
> > error: rpmdbNextIterator: skipping h#     140
> > Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an
OpenPGP packet:
> >  Failed to parse Signature Packet
> > 
> > 
> > 
> > Can I void these errors?
> 
> Yes remove the very old packages. Can you install f38 versions of them?
> 
> Barry
> 
> > ===========================================================================
> > Patrick DUPRÉ                                 | | email: pdupre(a)gmx.com
> > ===========================================================================
> > _______________________________________________
> > users mailing list -- users(a)lists.fedoraproject.org
> > To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]
> > Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
> 
>

[Barry]

>  On 17 Oct 2023, at 22:28, Patrick Dupre <pdupre(a)gmx.com&gt;
> wrote:
>  
>  I do not think so, I removed nautilus-sendto-3.8.6-8.fc32.x86_64
>  and same thing appears.
>  On one machine
>  rpm -qa xpr
>  xpr-1.0.5-2.fc34.x86_64
>  One the other machine, the same command
>  
>  xpr-1.0.5-2.fc34.x86_64
>  --More--error: rpmdbNextIterator: skipping h#     132
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>  Failed to parse Signature Packet
>     because: Signature appears to be created by a non-conformant OpenPGP implementation,
> see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>     because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
> (28))
>  Header SHA1 digest: OK 
In that case it maybe that you have gpg keys installed on the working machine that are
missing from the failing one. There is a folder that holds all the gog keys that rpm
uses.
(I dont have the detail in front of me)

Are you still using these old x11 apps? Are there not newer, supported, apps as
replacements you could use?

Barry

[Patrick Dupre]

>  > On 17 Oct 2023, at 22:28, Patrick Dupre <pdupre(a)gmx.com&gt; wrote:
>  >
>  > I do not think so, I removed nautilus-sendto-3.8.6-8.fc32.x86_64
>  > and same thing appears.
>  > On one machine
>  > rpm -qa xpr
>  > xpr-1.0.5-2.fc34.x86_64
>  > One the other machine, the same command
>  >
>  > xpr-1.0.5-2.fc34.x86_64
>  > --More--error: rpmdbNextIterator: skipping h#     132
>  > Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an
> OpenPGP packet:
>  > Failed to parse Signature Packet
>  >    because: Signature appears to be created by a non-conformant OpenPGP
> implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>  >    because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  
> 101000 (28))
>  > Header SHA1 digest: OK
>
>  In that case it maybe that you have gpg keys installed on the working machine that are
> missing from the failing one. There is a folder that holds all the gog keys that rpm
> uses.
>  (I dont have the detail in front of me)
>
>  Are you still using these old x11 apps? Are there not newer, supported, apps as
> replacements you could use?
>
>  Barry
>  
The glitches are not due to xpr,
nautilus-sendto-3.8.6-8.fc32.x86_64
--More--error: rpmdbNextIterator: skipping h#     132
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
(28))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     134
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  1111100
(7c))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     137
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in    10011
(13))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     138
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101101
(2d))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     140
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
......................

[Barry Scott]

>  On 18 Oct 2023, at 21:45, Patrick Dupre via users
> <users(a)lists.fedoraproject.org&gt; wrote:
>  
>   Failed to parse Signature Packet
>       because: Signature appears to be created by a non-conformant OpenPGP implementation,
> see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>       because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
> (28)) 
I read the issue 2351 and it is saying that there are RPMs that where signed by a buggy
gpg implementation.

Apart from dnf remove of the old RPMs you have installed I'm not sure what to suggest
you do to fix this.

It is odd that your other system is fine. Are there any RPMs that only the problem system
has installed?

Barry

[Samuel Sieb]

On 10/18/23 15:31, Barry Scott wrote:
>  
>  
> > On 18 Oct 2023, at 21:45, Patrick Dupre via users 
> > <users(a)lists.fedoraproject.org&gt; wrote:
> >
> >  Failed to parse Signature Packet
> >      because: Signature appears to be created by a non-conformant 
> > OpenPGP implementation, see 
> > <https://github.com/rpm-software-management/rpm/issues/2351 
> > <https://github.com/rpm-software-management/rpm/issues/2351>>;.
> >      because: Malformed MPI: leading bit is not set: expected bit 8 to 
> > be set in   101000 (28))
>  
>  I read the issue 2351 and it is saying that there are RPMs that where 
>  signed by a buggy gpg implementation.
>  
>  Apart from dnf remove of the old RPMs you have installed I'm not sure 
>  what to suggest you do to fix this.
>  
>  It is odd that your other system is fine. Are there any RPMs that only 
>  the problem system has installed? 
It might be a bad key in the database.
Try running "rpm -qa | grep pubkey" to see the list of keys.
Run "rpm -qi $(rpm -qa | grep pubkey)" to get info on all the keys which 
might indicate which one is bad.

[Patrick Dupre]

This what I get:

 rpm -qa | grep pubkey
gpg-pubkey-d651ff2e-5dadbbc1
gpg-pubkey-94843c65-5dadbc64
gpg-pubkey-6dc1be18-5ca9b41f
gpg-pubkey-c0aeda6e-5ad45327
gpg-pubkey-100bcd92-5ca9b382
gpg-pubkey-9db62fb1-59920156
gpg-pubkey-cfc659b9-5b6eac67
gpg-pubkey-be1229cf-5631588c
gpg-pubkey-7f858107-595fbac5
gpg-pubkey-12c944d0-5d5156ab
gpg-pubkey-7bb74681-5548d874
gpg-pubkey-45719a39-5f2c0192
gpg-pubkey-1d14a795-5ad4532e
gpg-pubkey-09eab3f2-595fbba3
gpg-pubkey-f6777c67-45e5b1b9
gpg-pubkey-e9e25bc4-5e46a4cb
gpg-pubkey-1911e097-57eb894d
gpg-pubkey-7e6c5dbe-5d91bb57
error: rpmdbNextIterator: skipping h#     132 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
(28))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     134 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  1111100
(7c))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     137 
........................
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     186 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  1111100
(7c))
Header SHA1 digest: OK
gpg-pubkey-4218647e-61f7b089
gpg-pubkey-38ab71f4-60242b08
gpg-pubkey-33eaab8e-63bd672b
gpg-pubkey-eb10b464-6202d9c6
gpg-pubkey-df7587c3-576a5c23
gpg-pubkey-645f044f-626fcd87
gpg-pubkey-19940e11-5f99778b

and

rpm -qi $(rpm -qa | grep pubkey)
error: rpmdbNextIterator: skipping h#     132 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in   101000
(28))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     134 
Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation,
see <https://github.com/rpm-software-management/rpm/issues/2351>;.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  1111100
(7c))
Header SHA1 digest: OK
error: rpmdbNextIterator: skipping h#     137 



How can I associate the pubkeys with the package?

Should I rebuild the rpm databasis?




> On 10/18/23 15:31, Barry Scott wrote:
> > 
> > 
> >> On 18 Oct 2023, at 21:45, Patrick Dupre via users 
> >> <users(a)lists.fedoraproject.org&gt; wrote:
> >>
> >>  Failed to parse Signature Packet
> >>      because: Signature appears to be created by a non-conformant 
> >> OpenPGP implementation, see 
> >> <https://github.com/rpm-software-management/rpm/issues/2351 
> >> <https://github.com/rpm-software-management/rpm/issues/2351>>;.
> >>      because: Malformed MPI: leading bit is not set: expected bit 8 to 
> >> be set in   101000 (28))
> > 
> > I read the issue 2351 and it is saying that there are RPMs that where 
> > signed by a buggy gpg implementation.
> > 
> > Apart from dnf remove of the old RPMs you have installed I'm not sure 
> > what to suggest you do to fix this.
> > 
> > It is odd that your other system is fine. Are there any RPMs that only 
> > the problem system has installed?
> 
> It might be a bad key in the database.
> Try running "rpm -qa | grep pubkey" to see the list of keys.
> Run "rpm -qi $(rpm -qa | grep pubkey)" to get info on all the keys which 
> might indicate which one is bad.
> _______________________________________________
> users mailing list -- users(a)lists.fedoraproject.org
> To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>

[Samuel Sieb]

On 10/25/23 13:35, Patrick Dupre via users wrote:
>  rpm -qi $(rpm -qa | grep pubkey)
>  error: rpmdbNextIterator: skipping h#     132
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>     Failed to parse Signature Packet
>         because: Signature appears to be created by a non-conformant OpenPGP
> implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>         because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  
> 101000 (28))
>  Header SHA1 digest: OK
>  error: rpmdbNextIterator: skipping h#     134
>  Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an OpenPGP
> packet:
>     Failed to parse Signature Packet
>         because: Signature appears to be created by a non-conformant OpenPGP
> implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
>         because: Malformed MPI: leading bit is not set: expected bit 8 to be set in 
> 1111100 (7c))
>  Header SHA1 digest: OK
>  error: rpmdbNextIterator: skipping h#     137
>  
>  
>  
>  How can I associate the pubkeys with the package? 
They aren't part of a package.  They are independent data items.  I'm 
not sure if it's a pubkey or a package.

>  Should I rebuild the rpm databasis? 
That won't do anything.  The database is fine, it's the signature of 
something in it that isn't.

Try running "rpm -qa --nosignature | grep pubkey" and see if that runs 
without the error.  That option isn't documented for querying, so I 
don't know if it will have any effect.

[Todd Zullinger]

Samuel Sieb wrote:
>  On 10/25/23 13:35, Patrick Dupre via users wrote:
> > rpm -qi $(rpm -qa | grep pubkey)
> > error: rpmdbNextIterator: skipping h#     132
> > Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an
> OpenPGP packet:
> >    Failed to parse Signature Packet
> >        because: Signature appears to be created by a non-conformant OpenPGP
> implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
> >        because: Malformed MPI: leading bit is not set: expected bit 8 to be set in  
> 101000 (28))
> > Header SHA1 digest: OK
> > error: rpmdbNextIterator: skipping h#     134
> > Header RSA signature: BAD (header tag 268: invalid OpenPGP signature: Parsing an
> OpenPGP packet:
> >    Failed to parse Signature Packet
> >        because: Signature appears to be created by a non-conformant OpenPGP
> implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>;.
> >        because: Malformed MPI: leading bit is not set: expected bit 8 to be set in 
> 1111100 (7c))
> > Header SHA1 digest: OK
> > error: rpmdbNextIterator: skipping h#     137
> > 
> > 
> > 
> > How can I associate the pubkeys with the package?
>  
>  They aren't part of a package.  They are independent data items.  I'm not
>  sure if it's a pubkey or a package.
>  
> > Should I rebuild the rpm databasis?
>  
>  That won't do anything.  The database is fine, it's the signature of
>  something in it that isn't.
>  
>  Try running "rpm -qa --nosignature | grep pubkey" and see if that runs
>  without the error.  That option isn't documented for querying, so I don't
>  know if it will have any effect. 
There is some guidance for how to handle this in Common
Issues:

https://discussion.fedoraproject.org/t/third-party-rpms-with-an-invalid-s...

As a brief example (I'd recommend reading the article in
full):

    $ rpm -q --nosignature --querybynumber 132

should report the first affected package.  Repeat for the
other numbers in the errors and then remove the packages via

    $ sudo rpm -e --nosignature <packages>

-- 
Todd

[Samuel Sieb]

On 10/25/23 17:47, Todd Zullinger wrote:
>  There is some guidance for how to handle this in Common
>  Issues:
>  
>
> https://discussion.fedoraproject.org/t/third-party-rpms-with-an-invalid-s...
Oh, it's on "discussion".  No wonder I couldn't find it.  That
wasn't 
linked from anywhere I looked.