Tigervnc-icons-1.15.0-6.el9_7.1.noarch has invalid GPG signature

Rocky Linux Help & Support
1

The package tigervnc-icons-1.15.0-6.el9_7.1.noarch.rpm from the AppStream repository fails GPG verification on Rocky Linux 9.7. The key is present and trusted in the local keyring, all digests are OK, but the RSA signature itself is BAD.

$ rpm -Kv tigervnc-icons-1.15.0-6.el9_7.1.noarch.rpm
    Header V4 RSA/SHA256 Signature, key ID 350d275d: BAD
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK

Key 350d275d is present in the keyring (Release: 6279464b). All other packages in the same transaction, including the other tigervnc-* subpackages, pass GPG verification without issue.

2

Looking into this. We’ve been having some intermittent signing issues, and thought we’d sorted it out and added validation, but have obviously missed something.

3

The fixed package has been pushed out to dl.rockylinux.org and the mirrors should pick it up within the next few hours.