GPG verification enabled, but no summary signatures found

[Alexander Larsson]

On Sat, 2017-03-11 at 11:18 +0100, Sascha Manns wrote:
> Hello list,
> 
> i used
> 
> sascha at sascha-desktop:~/Downloads$ flatpak remote-add gnome https://s
> dk.gnome.org/gnome.flatpakrepo
> 
> for adding a flatpak repo. Then i used:
> 
> sascha at sascha-desktop:~/Downloads$ flatpak install gnome
> org.gnome.Platform//3.22
> 
> for installing a Platform. Sadly i'm getting:
> 
> Error: GPG verification enabled, but no summary signatures found (use
> gpg-verify-summary=false in remote config to disable) 
> But how to fix this?

That is very strange. I just tried exactly these commands, and it
worked fine here. What version are you using?

You can get some remote configuration info with:

$ flatpak remote-list -d

Otherwise there remote configuration is in 
/var/lib/flatpak/repo/config, and additionally you should have a gpg
keyring in /var/lib/flatpak/repo/gnome.trustedkeys.gpg

My config snippet is:

[remote "gnome"]
gpg-verify=true
gpg-verify-summary=true
url=http://sdk.gnome.org/repo/
xa.title=Gnome Stable Runtimes

And the gpg keys:

$ ls -l /var/lib/flatpak/repo/gnome.trustedkeys.gpg 
-rw-r--r--. 1 root root 633 13 mar 08.21 /var/lib/flatpak/repo/gnome.trustedkeys.gpg
$ sha256sum /var/lib/flatpak/repo/gnome.trustedkeys.gpg 
2d7ca0276c5bbc08e1ef762e39a3a88757fe93b02bc7286ddaf08c6847047a9d  /var/lib/flatpak/repo/gnome.trustedkeys.gpg


Does anyone else see this?

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Alexander Larsson                                            Red Hat, Inc 
       alexl at redhat.com            alexander.larsson at gmail.com 
He's a war-weary arachnophobic senator haunted by an iconic dead American 
confidante She's a mistrustful mute schoolgirl who believes she is the 
reincarnation of an ancient Egyptian queen. They fight crime!