Tecnical issue with System upgrade - Bad GPG signature

1

Hello There,

I cannot make the last System Upgrade due to a Bad GPG Signature :

Bad GPG signature found:

/var/cache/PackageKit/10.2/metadata/slack-10-x86_64/packages/slack-4.52.155-0.1.el8.x86_64.rpm could not be verified. /var/cache/PackageKit/10.2/metadata/slack-10-x86_64/packages/slack-4.52.155-0.1.el8.x86_64.rpm: digest: SIGNATURE: NOT OK

Any idea to solve the matter?

Yhanks for your help,

Marc.

2

This is probably related to Slack’s GPG signing key rather than AlmaLinux.

Slack changed its Linux package signing key starting with Slack 4.47.

Official Slack documentation:

Please try importing the current Slack key and retrying the update:

wget https://slack.com/gpg/slack_pubkey_20251016.gpg
sudo rpm --import slack_pubkey_20251016.gpg
sudo dnf clean all
sudo dnf upgrade --refresh
3

Hi,

On a more generic level regarding GPG keys you can use the following commands to spot existing key in your configuration and remove offending ones.

List current key
root> rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
Remove a key
root> rpm --erase --allmatches gpg-pubkey-XYZ...

This helped me many times when dnf was stuck on bad keys.

4

The purpose of the GPG signature is to verify that the new packages are intact from the same source as the signature of that source (as seen initially). That is, to prevent corrupted packages getting in.

Occasionally even reputable package repos do replace their signature (as those expire) in a way that is not seamless.

Things to check:

  • Is there an issue in file transfer?
  • Has Slack changed their signature?
  • Is the package really from Slack?