[SOLVED] RPM waptagent fails to install on Fedora 43

[bastien30]

Good morning,

The RPM package waptagent cannot be installed on a Fedora 43 machine.

The RPM package does not contain a signature:

Code: Select all

# rpm -qi tis-waptagent-2.6.1.17576-407e255f.x86_64.rpm
Name        : tis-waptagent
Version     : 2.6.1.17576
Release     : 407e255f
Architecture: x86_64
Install Date: (not installed)
Group       : Development/Tools
Size        : 199338202
License     : Proprietary license
Signature   : (none)
Source RPM  : tis-waptagent-2.6.1.17576-407e255f.src.rpm
Build Date  : Fri Nov 14 12:07:28 2025
Build Host  : bbot-rhel7-amd64.ad.tranquil.it
Relocations : /opt
URL         : https://wapt.fr
Summary     : WAPT Agent
Description :

Since Fedora 43 and especially RPM 6.0, This is no longer accepted by default (see attached image).

The installation can be forced by bypassing the signature verification:

Code: Select all

sudo rpm -Uvh --nodigest --nofiledigest ./tis-waptagent-2.6.1.17647-8649fa77.x86_64.rpm

Would it be possible to add a signature or correct the waptupgrade package so that it installs the package despite its absence, please?

Thanks in advance.

[TartareFR]

Good morning,

Checksums are absent from the RPM metadata

Code: Select all

rpm -K tis-waptagent-2.6.1.17647-8649fa77.x86_64.rpm
tis-waptagent-2.6.1.17647-8649fa77.x86_64.rpm: DIGESTS NOT OK

When installing a local package, dnf does not check the gpg signature, but only if the digests match

[dcardon]

Hello Bastien and TartareFR,

actually, we do sign the RPMs individually... but only in the Red Hat RPM repository, and not in the "release" directory, where the agent creation GUI looks for them.

I'll look into fixing the repository uploads; the RPM should also be signed in the https://wapt.tranquil.it/releases... When we download it in the console, we verify its SHA2 hash, so there's no security issue, but it would be better if we downloaded the signed version (with the corresponding SHA2 hash).

Anyway, thank you very much for bringing this to our attention.

Best regards,

Denis

[bastien30]

Hello Denis,

Thank you very much

[dcardon]

Good evening Bastien,

in the meantime you can copy the RPM from the Red Hat repository (https://wapt.tranquil.it/redhat10/wapt- ... x86_64.rpm), it is properly signed. You can retrieve the GPG key fingerprint from the server installation documentation if needed (see https://www.wapt.fr/fr/doc/wapt-server- ... r-packages).

Have a good weekend,

Denis

[bastien30]

Good evening,

So there's only one affected machine and it installed the package manually using the command I posted above, so there's no rush, we'll see at the next agent update.

Thank you and have a good weekend too!

[dcardon]

Good evening again Bastien,

FYI :

Code: Select all

[root@srv-wapt-rhel ~]# wget -q -O /tmp/tranquil_it.gpg "https://wapt.tranquil.it/redhat9/RPM-GPG-KEY-TISWAPT-9"; rpm --import /tmp/tranquil_it.gpg
[root@srv-wapt-rhel ~]# wget https://wapt.tranquil.it/redhat10/wapt-2.6.1.17576/tis-waptagent-2.6.1.17576-407e255f.x86_64.rpm
--2026-01-16 16:45:03--  https://wapt.tranquil.it/redhat10/wapt-2.6.1.17576/tis-waptagent-2.6.1.17576-407e255f.x86_64.rpm
Resolving wapt.tranquil.it (wapt.tranquil.it)... 195.154.18.22, 2001:bc8:392f:300::22
Connecting to wapt.tranquil.it (wapt.tranquil.it)|195.154.18.22|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 48418936 (46M) [application/x-redhat-package-manager]
Saving to: ‘tis-waptagent-2.6.1.17576-407e255f.x86_64.rpm’

tis-waptagent-2.6.1.17576-407e 100%[=================================================>]  46.18M  29.9MB/s    in 1.5s    

2026-01-16 16:45:05 (29.9 MB/s) - ‘tis-waptagent-2.6.1.17576-407e255f.x86_64.rpm’ saved [48418936/48418936]

[root@srv-wapt-rhel ~]# rpm -K tis-waptagent-2.6.1.17576-407e255f.x86_64.rpm 
tis-waptagent-2.6.1.17576-407e255f.x86_64.rpm: digests signatures OK

Have a good weekend too. I'm submitting an internal ticket for the signature issue and marking the topic as resolved

Denis