Issue during installation on Fedora 43

[ThatMan644]

During the installation process I keep getting the following error:

Transaction failed: Rpm transaction failed.
Warning: skipped OpenPGP checks for 1 package from repository: @commandline
  - package metasploit-framework-6.4.109~20260117055925~1rapid7-1.el6.x86_64 does not verify: no digest

I got this error from both the methods explained in the installation guide (msfinstall and manual install via rpm).
The only thing i have found around the net was someone talking about having FIPS enabled on the machine which was the thing causing the same issue, but i've checked and cat /proc/sys/crypto/fips_enabled returns 0.
Does anyone know how to fix this problem?

[AtlasLost]

I've been having this issue for several weeks.

[AtlasLost]

This seems to be the solution you'll need to download the .rpm file from rapid7 then it should work. You also might need to version lock it for now so you can keep updating it manually. @ThatMan644

[Winjp99]

Transaction failed: Rpm transaction failed.
Warning: skipped OpenPGP checks for 1 package from repository: @commandline

• package metasploit-framework-6.4.109202601170559251rapid7-1.el6.x86_64 does not verify: no digest

[AtlasLost]

do

sudo rpm -i ~/path/to/downloads/file --nodigest

[straa-code]

会不会是没有安装依赖文件

[l1ve709]

Hi! It feels like it's been a while, but I hope this helps!

Root cause: This isn't FIPS-related — it's Fedora 43 shipping RPM 6.0, which by default hard-fails installation of any package missing a modern payload digest (SHA256) in its header, instead of just warning like older rpm versions did.

You can confirm this yourself:

rpm -K -v /path/to/metasploit-framework-*.rpm

If you see Payload SHA256 digest: NOTFOUND (or similar), that confirms it — the RPM was built with a toolchain that never wrote that header, likely Rapid7's nightly build pipeline running an older rpmbuild. This is the same issue that's been hitting other third-party repos (Collabora Online, SoftMaker, etc.) since Fedora 43 shipped.

Workarounds, safest first:

1. Only if you already trust the source (download it yourself over HTTPS from the official nightly installer page, and verify any published checksum manually first):

   sudo rpm -i --nodigest /path/to/downloaded.rpm

This disables payload digest verification for this install only — it does not disable GPG signature verification of the package header itself, so it's less bad than it looks. You're mainly trusting the download path rather than skipping all integrity checks.

2. Consider the Docker-based install method instead:

   ./docker/bin/msfconsole

This sidesteps RPM packaging entirely and stays current with upstream.

3. This is fundamentally a packaging pipeline issue on Rapid7's side, not something users can permanently fix locally. Worth filing against the nightly-installers repo so the RPM build gets a proper SHA256 payload digest added — otherwise every Fedora 43+ user will keep hitting this.