Certificate 1CCB9CBF0B5C3D64 invalid

[keestux]

Installing lxc-libs fails because the certificate is not valid anymore.

$ rpm -ql /var/cache/libdnf5/copr:copr.fedorainfracloud.org:ganto:lxc4-5adceaa4b33214a3/packages/lxc-libs-6.0.4-0.1.fc41.x86_64.rpm
fout: Verifying a signature using certificate 29FDD5F72A4029C31E2846451CCB9CBF0B5C3D64 (ganto_lxc4 (None) <ganto#lxc4@copr.fedorahosted.org>):
  1. Certificate 1CCB9CBF0B5C3D64 invalid: certificate is not alive
      because: The primary key is not live
      because: Expired on 2025-04-04T20:51:20Z
  2. Key 1CCB9CBF0B5C3D64 invalid: key is not alive
      because: The primary key is not live
      because: Expired on 2025-04-04T20:51:20Z
waarschuwing: /var/cache/libdnf5/copr:copr.fedorainfracloud.org:ganto:lxc4-5adceaa4b33214a3/packages/lxc-libs-6.0.4-0.1.fc41.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 0b5c3d64: NOTTRUSTED
/etc/lxc
/etc/lxc/default.conf
/etc/sysconfig/lxc
...

[ps-gill]

I encountered this issue myself. Here's how I resolved it:

• rpmkeys --list to find the key ID for ganto_lxc4 (None) <ganto#lxc4@copr.fedorahosted.org>. In my case, the key ID was 0b5c3d64-5e8a44c8, but yours might be different.
• rpmkeys --delete 0b5c3d64-5e8a44c8 to remove the expired key.

During the next dnf update/install, the PGP key was re-downloaded, and everything worked smoothly without any issues.

[keestux]

Thanks, that helped for me.

BTW. It was the same key 0b5c3d64-5e8a44c8. For the record, after deleting and renewing dnf upgrade I got:

Importing OpenPGP key 0x0B5C3D64:
 UserID     : "ganto_lxc4 (None) <ganto#lxc4@copr.fedorahosted.org>"
 Fingerprint: 29FDD5F72A4029C31E2846451CCB9CBF0B5C3D64
 From       : https://download.copr.fedorainfracloud.org/results/ganto/lxc4/pubkey.gpg
Is this ok [y/N]: y
The key was successfully imported.

[ganto]

Yes, the COPR repository is already so old that the GPG key expired. So if you're getting the error about the expired key you can delete and re-import it as described by @ps-gill.

Alternatively you can also run:

dnf update --enableplugin=expired-pgp-keys