[BUG] zypperpkg refresh_db does not support skip_verify
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
When installing a package on OpenSUSE while having an invalid signature on a separate repository, the installation fails despite having skip_verify set True.
Setup
Set up an OpenSUSE installation (I enjoy Tumbleweed). Install a repository with a bad signature; the Microsoft Teams repository is a good one. Create a state that installs a package:
Install btop:
pkg.installed:
- pkg: btop
- skip_verify: True
Run the state with debug output. Note that the repositories are first refreshed, but without the --no-gpg-checks switch:
[DEBUG ] Calling Zypper: zypper --non-interactive refresh --force
Running that command fails unless --no-gpg-checks is used, which is what skip_verify should tell it to do.
skip_verify should be passed to refresh_db here; then added to the function signature. If present, prepend "--no-gpg-checks" to refresh_opts before the command is called.
I expect this issue to affect anything that uses it, but for completeness, I've tested only with this environment.
- on-prem machine
- VM (Virtualbox, KVM, etc. please specify)
- VM running on a cloud service, please be explicit and add details
- container (Kubernetes, Docker, containerd, etc. please specify)
- or a combination, please be explicit
- jails if it is FreeBSD
- classic packaging
- used bootstrap to install
Expected behavior
If skip_verify is True on an install state, then verification should also be skipped during package refresh.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in salt/modules/zypperpkg.py at refresh_db around lines 1405 and 1440, then inspect the install call around line 1610. Confirm how skip_verify reaches the refresh operation and verify that an install with skip_verify=True refreshes repositories using the no-GPG-checks behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100