Approximately all RPM packages are signed by GPG keys (or maybe they're supposed to be called PGP keys), which your system stores in the RPM database as pseudo-packages (because why not). If your Fedora install has been around long enough, as mine have, you will have accumulated a drift of old keys and sometimes you either want to clean them up or something unfortunate will happen to one of those keys (I'll get to one case for it).
One basic command to see your collection of GPG keys in the RPM database is (taken from this gist ):
rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
On some systems this will give you a nice short list of keys. On others, your list may be very long.
Since Fedora 42 ( cf ), DNF has functionality (I believe more or less built in) that should offer to remove old GPG keys that have actually expired. This is in the ' expired PGP keys plugin ' which comes from the 'libdnf5-plugin-expired-pgp-keys' if you don't have it installed (with a brief manpage that's called 'libdnf5-expired-pgp-keys'). I believe there was a similar DNF4 plugin. However, there are two situations where this seems to not work correctly.
The first situation is now-obsolete GPG keys that haven't expired yet, for various reasons; these may be for past versions of Fedora, for example. These days, the metadata for every DNF repository you use should list a URL for its GPG keys (see the various .repo files in
/etc/yum.repos.d/
and look for the 'gpgkey=' lines). So one way to clean up obsolete keys is to fetch all of the current keys for all of your current repositories (or at least the enabled ones), and then remove anything you have that isn't among the list. This process is automated for you by the '
clean-rpm-gpg-pubkey
' command and package, which is mentioned in some Fedora upgrade instructions . This will generally clean out most of your obsolete keys, although rare people will have keys that are so old that it chokes on them .
The second situation is apparently a repository operator who is sufficiently clever to have re-issued an expired key using the same key ID and fingerprint but a new expiry date in the future; this fools RPM and related tools and everything chokes. This is unfortunate, since it will often stall all DNF updates unless you disable the repo. One repository operator who has done this is Google, for their Fedora Chrome repository. To fix this you'll have to manually remove the relevant GPG key or keys. Once you've used
clean-rpm-gpg-pubkey
to reduce your list of GPG keys to a reasonable level, you can use the RPM command I showed above to list all your remaining keys, spot the likely key or keys (based on who owns it, for example), and then use '
rpm -e --allmatches
gpg-pubkey-d38b4796-570c8cd3
' (or some other appropriate gpg-pubkey name) to manually scrub out the GPG key. Doing a DNF operation such as installing or upgrading a package from the repository should then re-import the current key.
(This also means that it's theoretically harmless to overshoot and remove the wrong key, because it will be fetched back the next time you need it.)
(When I wrote my Fediverse post about discovering clean-rpm-gpg-pubkey , I apparently thought I would remember it without further prompting. This was wrong, and in fact I didn't even remember to use it when I upgraded my home desktop. This time it will hopefully stick, and if not, I have it written down here where it will probably be easier to find.)