I’m currently using Katello to synchronize Rocky Linux dnf repositories locally. Since August 15, 2026 the Rocky Linux 10 AppStream, BaseOS, CRB, Extras, and DEVEL repositories have all failed to synchronize due to incorrect checksum information in extra_files.json for the RPM-GPG-KEY-Rocky-10 GPG key.
For instance, today 2026/08/20, https://dl.rockylinux.org/pub/rocky/10.2/metadata/extra_files.json states the sha256sum of AppStream/x86_64/os/RPM-GPG-KEY-Rocky-10 is be8c4f070b696e64d8ce40e59a95a57e8b5c776f0015c2fd64e14b896622bdb4. However, if you download https://dl.rockylinux.org/pub/rocky/10.2/AppStream/x86_64/os/RPM-GPG-KEY-Rocky-10 manually and run sha256sum on the file, its checksum is actually:
$ sha256sum RPM-GPG-KEY-Rocky-10
7f517e9ca329b042228e9a35e74e1b260513ed9c786d5ebcc459e623855f2831 RPM-GPG-KEY-Rocky-10
Is this a Rocky Linux Infrastructure issue that needs to be fixed?
Yes, and I’ll get on it right now. This is due to a new PQC key that was added to Rocky 10 in preparation for doing RPM signing with it in a later point release. I missed updating extra_files.json.
This should be sorted now. Can you please verify that it’s correct?
No dice. Looks like there’s another extra_files.json that needs to be updated as well (and maybe that’s the one causing my issues 
):
https://download.rockylinux.org/pub/rocky/10.2/AppStream/x86_64/os/extra_files.json
Checksum of the GPG key in that file is listed as the incorrect value: be8c4f070b696e64d8ce40e59a95a57e8b5c776f0015c2fd64e14b896622bdb4
Well, crap. Give me a moment. There’s a whole lot more of those files.
Ok, try that. All of the extra_files.json have been updated in the os directories in 10.2. I didn’t touch kickstart, since those still have the original GPG key files.
Thanks, that did the trick. All the repositories mentioned in the OP synchronized successfully. Appreciate the quick turnaround!
No problem! Sorry for the trouble.