Recover from a broken package state

applied · 40 min · Objective 2.4

Task

Break a package installation in the two ways that happen in real life -- a missing GPG key and an unmet dependency from a manually installed file -- then repair each properly rather than by disabling the protection that reported it.

Steps

  1. Add a repository definition pointing at a real repository but with gpgcheck=1 and no key imported. Attempt an install and read the error.
  2. Resolve it the wrong way first, to see what it looks like: set gpgcheck=0, install successfully, then state plainly what protection you just removed.
  3. Undo that, import the correct key with rpm --import, and confirm the install now succeeds with checking enabled.
  4. Now break dependencies. Download a package file without installing it (dnf download or dnf install --downloadonly), then install it with rpm -i so that dependency resolution does not happen.
  5. Observe the failure, then observe the worse option: rpm -i --nodeps installs it anyway. Verify with rpm -V and by running the program that it is broken at runtime rather than at install time.
  6. Repair properly: remove the forced package and install it through the package manager so dependencies resolve.
  7. Finally, pin a package against updates with dnf versionlock or the exclude= directive, and prove the pin holds by attempting an upgrade.

Verify

grep -r 'gpgcheck' /etc/yum.repos.d/ | grep -c 'gpgcheck=0'   # must be 0
rpm -q gpg-pubkey --qf '%{summary}\n' | head                    # key imported
rpm -Va --nofiles --nodigest 2>/dev/null | head                 # no broken deps
dnf check 2>&1 | tail -3                                        # reports consistency

The first must print 0 -- no repository left with checking disabled. dnf check is the summary command: it reports dependency problems in the installed set, and after step 6 it must find none.

Notes

Step 2 exists because "set gpgcheck=0" is the top answer to this error on the internet, and it works. Doing it deliberately, seeing that it works, and then undoing it is a better inoculation than being told not to.