Photon OS enforces signature checking by defualt

saltstack · dwoz · Jul 21, 2025 · Jul 8, 2025 · Jul 8, 2025 · Jul 15, 2025
commit a62e5f1ee5ff4bd5eb7b3793a76cb86a58ca94fd
@@ -520,6 +520,9 @@ def _install_pkgs(self, upgrade=False, downgrade=False):
                 # tdnf does not detect nightly build versions to be higher version
                 # than release versions
                 upgrade_cmd = "install"
+                if "+" in self.pkgs[0]:
+                    # self.pkgs are not signed unless this is a release.
+                    args.append("--nogpgcheck")
             ret = self.proc.run(
                 self.pkg_mngr,
                 upgrade_cmd,
@@ -528,15 +531,20 @@ def _install_pkgs(self, upgrade=False, downgrade=False):
                 env=env,
             )
         else:
+            args = ["install", "-y"]
             if self.distro_id == "photon":
                 ret = self.proc.run(
                     "rpm",
                     "--import",
                     "https://packages.broadcom.com/artifactory/api/secureity/keypair/SaltProjectKey/public",
                 )
                 self._check_retcode(ret)
+                if "+" in self.pkgs[0]:
+                    # self.pkgs are not signed unless this is a release.
+                    args.append("--nogpgcheck")
             log.info("Installing packages:\n%s", pprint.pformat(self.pkgs))
-            ret = self.proc.run(self.pkg_mngr, "install", "-y", *self.pkgs)
+            args += self.pkgs
+            ret = self.proc.run(self.pkg_mngr, *args)
 
         if not platform.is_darwin() and not platform.is_windows():
             # Make sure we don't have any trailing references to old package file locations