<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Hello,</div><div><br></div><div>Am Montag, den 13.03.2017, 09:29 -0500 schrieb Dan Nicholson:</div><blockquote type="cite"><pre>On Mon, Mar 13, 2017 at 2:27 AM, Alexander Larsson <<a href="mailto:alexl@redhat.com">alexl@redhat.com</a>> wrote:
<blockquote type="cite">
On Sat, 2017-03-11 at 11:18 +0100, Sascha Manns wrote:
<blockquote type="cite">
Hello list,
i used
sascha@sascha-desktop:~/Downloads$ flatpak remote-add gnome <a href="https://s">https://s</a>
dk.gnome.org/gnome.flatpakrepo
for adding a flatpak repo. Then i used:
sascha@sascha-desktop:~/Downloads$ flatpak install gnome
org.gnome.Platform//3.22
for installing a Platform. Sadly i'm getting:
Error: GPG verification enabled, but no summary signatures found (use
gpg-verify-summary=false in remote config to disable)
But how to fix this?
</blockquote>
That is very strange. I just tried exactly these commands, and it
worked fine here. What version are you using?
You can get some remote configuration info with:
$ flatpak remote-list -d
Otherwise there remote configuration is in
/var/lib/flatpak/repo/config, and additionally you should have a gpg
keyring in /var/lib/flatpak/repo/gnome.trustedkeys.gpg
My config snippet is:
[remote "gnome"]
gpg-verify=true
gpg-verify-summary=true
url=<a href="http://sdk.gnome.org/repo/">http://sdk.gnome.org/repo/</a>
xa.title=Gnome Stable Runtimes
And the gpg keys:
$ ls -l /var/lib/flatpak/repo/gnome.trustedkeys.gpg
-rw-r--r--. 1 root root 633 13 mar 08.21 /var/lib/flatpak/repo/gnome.trustedkeys.gpg
$ sha256sum /var/lib/flatpak/repo/gnome.trustedkeys.gpg
2d7ca0276c5bbc08e1ef762e39a3a88757fe93b02bc7286ddaf08c6847047a9d /var/lib/flatpak/repo/gnome.trustedkeys.gpg
Does anyone else see this?
</blockquote>
We sometimes hit this at Endless in our builder. I've never debugged
it fully, but I suspect it's the race between downloading the summary
and the signature. One thing I do know is that all the ostree GPG
errors end up with the same message no matter the error. So, my guess
is that the cached signature is not the correct one and the
verification is failing. The failure is not because there's no
appropriate keyring, but rather because the signature does not match
the file it's intended to sign.
I'd try "sudo rm -rf /var/lib/flatpak/repo/tmp/cache/summaries" and
then "flatpak remote-list -d" again.
</pre></blockquote><div>I tried this out too. </div><div>Then a "flatpak install gnome-nightly org.gnome.Platform//master" gives out the same issue. After adding a "<span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff;">gpg-verify-summary=false" </span></span><div>to the config i'm getting "<span style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: monospace;">sascha@sascha-desktop:/var/lib/flatpak/repo$ flatpak install gnome-nightly org.gnome.Platform//master</span></div><span style="font-family:monospace"><br><span style="font-weight:bold;color:#ff5454;background-color:#ffffff;">Fehler: </span><span style="color:#000000;background-color:#ffffff;">Remote listing not available; server has no summary file</span><br></span></div><div><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff;"><br></span></span></div><div><span style="font-family:monospace"><span style="color:#000000;background-color:#ffffff;">Mysterious...</span></span></div></body></html>