CentOS 7 - 1708 ISO's missing repomd.xml.asc file

[FluxxTwr]

Hello,

Just wanted to let you know that someone didn't finish building the base package correctly and did not do a createrepo on the disk as repomd.xml.asc is not there. This breaks using the distro ISO as a local repo. You can not mount the disk at /media/CentOS and point to it as a local repo to do local yum installs via the C7-media directive. Total bummer, this used to work. Please correct on next release.

Thanks,

Fluxx

[avij]

While it's true that the DVD image does not seem to have repomd.xml.asc, the Everything image does.

[TrevorH]

Sounds like you have edited the supplied /etc/yum.repos.d/CentOS-Media.repo and added repo_gpgcheck=1 to it. That would make it look for signed metadata and thus the .asc file.

I've also checked the 1611 DVD iso and that doesn't have signed repodata either.

[FluxxTwr]

Actually, the CentOS-Media.repo is set that way by default. I should have tried changing that to 0. However, it would be nice to validate with the signatures. I have to setup machines offline, which is my I stumbled across this. The DVD and basic CD images are both affected, but apparently the everything one is not on 1708. Unfortunately I do not have a dual-sided writer, so I didn't suck down the everything one.

Just wanted to notify you that something changed in your release procedure at some point. Would be great to install from media and check signatures on the packages on the CD and DVD iso's. Should be a quick fix you can stick into the release scripts.

Thanks for all you do...

Fluxx

[TrevorH]

Not here it isn't. I've checked on 2 different machines and neither has repo_gpgcheck=1 out of the box - it's something that has to be turned on manually.

I also checked the 1611 and 1511 media and neither has signed repodata - nothing has changed.

[axus]

Hello,
repo_gpgcheck=1 seems to be the default, when repo_gpgcheck is undefined in the .repo file (which it is).

By adding "repo_gpgcheck=0" to CentOS-Media.repo, I was able to use "yum install" with the CentOS-DVD media without an Internet connection. This wasn't something I needed on RHEL 6, though I don't know the story on RHEL 7.

[TrevorH]

The repo_gpgcheck= thing is added by one of the more stringent security profiles - it's not "normal" for a newly installed CentOS system if the default security profile is selected. For repos that don't have signed repo data it's necessary to override and disable that check. The CentOS iso images do not contain signed repo data.