Science Repository keys not FIPS mode compatible

Hi openSUSE community,

I tried to setup a project within my homelab and recogniced an issue with the science repo when fips is enabled.
Correct me if I'm wrong, but I asume since the science repo uses DSA 1024, the setup of the science repo will be blocked when fips mode is enabled on the system.

I tried to sum up everything and if something is missing I will try to reproduce it again.
Happy to test if something is adapted.

Thank you for your help, all the work and the systems created by the community.

How to reproduce

OS version and FIPS enabled

Fresh installation with fips enabled and rebooted

node1:~ # cat /etc/os-release
NAME="openSUSE Leap"
VERSION="16.0"
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="16.0"
PRETTY_NAME="openSUSE Leap 16.0"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:16.0"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Leap"
LOGO="distributor-logo-Leap"
node1:~ # sysctl -a | grep fips
crypto.fips_enabled = 1
crypto.fips_name = Linux Kernel Cryptographic API
crypto.fips_version = 6.12.0-160000.35-default

Add science repo

node1:~ # zypper ar -f https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/ science
Adding repository 'science' ...........................................................................................................................................................[done]
Repository 'science' successfully added

URI         : https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/
Enabled     : Yes
GPG Check   : Yes
Autorefresh : Yes
Priority    : 99 (default priority)

Repository priorities are without effect. All enabled repositories share the same priority.
node1:~ # zypper refresh
Looking for gpg keys in repository repo-openh264 (16.0).
  gpgkey=https://codecs.opensuse.org/openh264/openSUSE_Leap_16/repodata/repomd.xml.key
Retrieving repository 'repo-openh264 (16.0)' metadata .................................................................................................................................[done]
Building repository 'repo-openh264 (16.0)' cache ......................................................................................................................................[done]
Looking for gpg keys in repository repo-oss (16.0).
  gpgkey=http://cdn.opensuse.org/distribution/leap/16.0/repo/oss/x86_64/repodata/repomd.xml.key
Retrieving repository 'repo-oss (16.0)' metadata ......................................................................................................................................[done]
Building repository 'repo-oss (16.0)' cache ...........................................................................................................................................[done]
Looking for gpg keys in repository OpenNebula Community Edition.
  gpgkey=https://downloads.opennebula.io/repo/repo2.key
Retrieving repository 'OpenNebula Community Edition' metadata .........................................................................................................................[done]
Building repository 'OpenNebula Community Edition' cache ..............................................................................................................................[done]
Looking for gpg keys in repository science.
  gpgkey=https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/repodata/repomd.xml.key
Retrieving repository 'science' metadata .............................................................................................................................................[error]
Repository 'science' is invalid.
[science|https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/] Failed to retrieve new repository metadata.
History:
 **- File /var/tmp/zypp.tmp/TmpFile.gJptb0 doesn't contain public key data**
Please check if the URIs defined for this repository are pointing to a valid repository.
Skipping repository 'science' because of the above error.
Some of the repositories have not been refreshed because of an error.
node1:~ # cat /etc/zypp/repos.d/science.repo
[science]
enabled=1
autorefresh=1
baseurl=https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/

Tried to import the key

node1:~ # wget https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/repodata/repomd.xml.key
--2026-06-25 16:21:07--  https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/repodata/repomd.xml.key
Resolving download.opensuse.org (download.opensuse.org)... 195.135.223.226, 2a07:de40:b250:131:10:151:131:30
Connecting to download.opensuse.org (download.opensuse.org)|195.135.223.226|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 991 [application/x-download]
Saving to: ‘repomd.xml.key’

repomd.xml.key                                  100%[====================================================================================================>]     991  --.-KB/s    in 0s

2026-06-25 16:21:07 (68.6 MB/s) - ‘repomd.xml.key’ saved [991/991]

node1:~ # rpm --import repomd.xml.key
error: Pubkey self-signature verification failure
error: repomd.xml.key: key 1 import failed.

Disabled FIPS and reboot

node1:~ # fips-mode-setup --disable
*****************************************************************
* PRESS CONTROL-C WITHIN 15 SECONDS TO ABORT...                 *
*                                                               *
* DISABLING FIPS MODE AFTER THE INSTALLATION IS NOT RECOMMENDED.*
* THIS OPERATION CANNOT BE UNDONE.                              *
*****************************************************************
15... 14... 13... 12... 11... 10... 9... 8... 7... 6... 5... 4... 3... 2... 1...
Setting system policy to DEFAULT
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies to fully take place.
FIPS mode will be disabled.
node1:~ # reboot

Refresh the repo and autoimport the key

node1:~ # cat /etc/zypp/repos.d/science.repo
[science]
enabled=1
autorefresh=1
baseurl=https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/
gpgcheck=1
node1:~ # zypper refresh --force science
Forcing raw metadata refresh
Looking for gpg keys in repository science.
  gpgkey=https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/repodata/repomd.xml.key

New repository or package signing key received:

  Repository:       science
  Key Fingerprint:  D1DD 7ACD 6D68 A0B4 3081 B158 01DB 7302 943D 8BB8
  Key Name:         science OBS Project <science@build.opensuse.org>
  Key Algorithm:    DSA 1024
  Key Created:      Tue 17 Feb 2026 10:31:56 AM CET
  Key Expires:      Thu 27 Apr 2028 11:31:56 AM CEST
  Rpm Name:         gpg-pubkey-943d8bb8-6994358c



    Note: Signing data enables the recipient to verify that no modifications occurred after the data
    were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system
    and in extreme cases even to a system compromise.

    Note: A GPG pubkey is clearly identified by its fingerprint. Do not rely on the key's name. If
    you are not sure whether the presented key is authentic, ask the repository provider or check
    their web site. Many providers maintain a web page showing the fingerprints of the GPG keys they
    are using.

Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r): a
Retrieving repository 'science' metadata ..............................................................................................................................................[done]
Forcing building of repository cache
Building repository 'science' cache ...................................................................................................................................................[done]
Specified repositories have been refreshed.

Check keys and algorithms

node1:~ # wget https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/repodata/repomd.xml.key
--2026-06-25 16:55:25--  https://download.opensuse.org/repositories/science/openSUSE_Leap_16.0/repodata/repomd.xml.key
Resolving download.opensuse.org (download.opensuse.org)... 195.135.223.226, 2a07:de40:b250:131:10:151:131:30
Connecting to download.opensuse.org (download.opensuse.org)|195.135.223.226|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 991 [application/x-download]
Saving to: ‘repomd.xml.key’

repomd.xml.key                                  100%[====================================================================================================>]     991  --.-KB/s    in 0s

2026-06-25 16:55:25 (365 MB/s) - ‘repomd.xml.key’ saved [991/991]

node1:~ # gpg --show-keys --verbose repomd.xml.key
gpg: enabled compatibility flags:
gpg: armor header: Version: GnuPG v2.4.4 (GNU/Linux)
gpg: using pgp trust model
pub   dsa1024 2008-01-22 [SC] [expires: 2028-04-27]
      D1DD7ACD6D68A0B43081B15801DB7302943D8BB8
uid                      science OBS Project <science@build.opensuse.org>

Start by reproducing the failure on an openSUSE Leap 16.0 system with FIPS enabled, using the science repository URL and its repomd.xml.key. Compare the key import and zypper refresh behavior with FIPS disabled. Done means the science repository metadata key can be imported and refreshed successfully while FIPS remains enabled.