# Signature Verification DISABLED for RPM Packages

**URL:** <https://community.grafana.com/t/signature-verification-disabled-for-rpm-packages/96447>\
**Category:** OSS Support\
**Created:** [November 14, 2019, 8:33pm UTC](https://community.grafana.com/t/signature-verification-disabled-for-rpm-packages/96447 "2019-11-14T20:33:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![srg](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@srg](https://community.grafana.com/u/srg)\
**Post date:** [November 14, 2019, 8:33pm UTC](https://community.grafana.com/t/signature-verification-disabled-for-rpm-packages/96447/1 "2019-11-14T20:33:02Z")

</div>

Hello,

I am trying to setup a RHEL server with k6. Looking at [the instructions to install the rpm repo](https://docs.k6.io/docs/installation), the file it instructs users to install under `/etc/yum.repos.d/` contains two lines:

> gpgcheck=0  
> repo\_gpgcheck=0

This **disables** signature verification of the RPM files and the yum repository metadata.

If I remove the lines (or change the value to `1`), running `yum install k6` fails with the error:

> Package k6-v0.25.1-amd64.rpm is not signed

Is this not a security issue, especially when using a 3rd party service (Bintray) to distribute the packages? If Bintray is compromised, an attacker can upload a malicious k6 package and all the systems using the repo would install it without question.

Am I misunderstanding something here?

Thanks,  
Steve

---

<div class="post-metadata">

**Author:** ![nedyalko](https://avatars.discourse-cdn.com/v4/letter/n/d26b3c/32.png) [@nedyalko](https://community.grafana.com/u/nedyalko)\
**Post date:** [November 15, 2019, 2:20pm UTC](https://community.grafana.com/t/signature-verification-disabled-for-rpm-packages/96447/2 "2019-11-15T14:20:34Z")

</div>

Ah, thanks for pointing this out! You are totally right, we should guard against that attack vector by signing our releases 😞 I’ve created a new GitHub issue for this task: [Improve security and automation of official binary releases · Issue #1247 · grafana/k6 · GitHub](https://github.com/loadimpact/k6/issues/1247)

---

<div class="post-metadata">

**Author:** ![srg](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@srg](https://community.grafana.com/u/srg)\
**Post date:** [November 15, 2019, 2:58pm UTC](https://community.grafana.com/t/signature-verification-disabled-for-rpm-packages/96447/3 "2019-11-15T14:58:51Z")

</div>

Thank you for the positive response! I’ll subscribe to that GitHub issue.

(I was expecting some pushback as I’ve gotten in the past with other various open-source projects).

---

<div class="post-metadata">

**Author:** ![imiric](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/imiric/32/36245_2.png) [@imiric](https://community.grafana.com/u/imiric)\
**Post date:** [April 22, 2021, 12:11pm UTC](https://community.grafana.com/t/signature-verification-disabled-for-rpm-packages/96447/4 "2021-04-22T12:11:34Z")

</div>

Hi there, this is a bit of an old thread, but just to let you know that RPM packages are now signed with our own GPG key, and `gpgcheck` is enabled for the repo. See the [updated installation instructions](https://k6.io/docs/getting-started/installation/#fedora-centos).

We missed signing of the repo metadata, so `repo_gpgcheck` is still disabled, but we’ll make that happen soon as well. Now that we have control over the repositories it shouldn’t take us a year. 🙂

Slight correction: we decided to not sign repo metadata and leave `repo_gpgcheck` disabled since it’s known to [cause](https://bugzilla.redhat.com/show_bug.cgi?id=1768206) [issues](https://bugzilla.redhat.com/show_bug.cgi?id=1636743), and is not enabled even on main Fedora repositories.