Leapp fails with "Could not check for valid GPG keys"

Solution Verified - Updated

Environment

  • Red Hat Enterprise Linux 7.9
  • Leapp IPU 7>8
  • Red Hat Satellite

Issue

The Leapp report shows the following error and inhibitor:

Following errors occurred and the upgrade cannot continue:
    1. Actor: missing_gpg_keys_inhibitor
       Message: Could not check for valid GPG keys
Upgrade has been inhibited due to the following problems:
    1. Cannot find required basic RHEL target repositories.

Resolution

  • Check at first if you can reach your RHEL 8 repositories, and properly download the repo metadata, especially if the machine to upgrade uses Satellite repositories: Leapp In-Place Upgrade: how to check DNF is working with the Satellite repositories from the client side?

  • Please perform the steps below to enable the RHEL 8 repositories if the affected server is registered with Satellite server.

    Navigate to Satellite Web UI > Hosts > All Hosts > Search and Open the Host > Click on tab 'Content' > Click on the sub tab 'Repository Sets' > Select on the check boxes for the RHEL 8 BaseOS <target_version> repository and RHEL 8 AppStream <target_version> repository > Click on the 3 dots at the end of rows > Choose 'Override to Enabled' for both the repositories.

  • Also check whether you use the correct channel ('ga', 'eus', 'e4s') depending on your subscription and the target release. In the leapp logs, you can see the repositories available through RHSM, and the repos Leapp expects to be enabled (see the lines with '--enablerepo' in the logs):

    # grep -- --enablerepo /var/log/leapp/leapp-upgrade.log | tail -1 | grep -o rhel-.*-rpms | awk -F"'" '{print $1,$NF}'

    For example, if it returns 'rhel-8-for-x86_64-baseos-e4s-rpms' whereas RHSM provides only GA or EUS repos, try to force the EUS channel with: leapp preupgrade --channel eus.

  • If the issue persists, export the below environement variable and retry the Leapp process:

    # export LEAPP_OVL_IMG_FS_EXT4=1

Root Cause

The GPG keys that cannot be checked is a side effect of the repositories that are not seen. The repositories that are not seen is a side effect of an issue with OverlayFS + XFS which appears in "some circumstances".
The issue is tracked by the below Jira: This content is not included.Leapp fails with "Could not check for valid GPG keys"

Note: we cannot exclude it also affects 8>9 upgrades.

Diagnostic Steps

  • Check whether your issue strictly matches the description. Also check whether this string is present in the log files:

    # grep No.UsedTargetRepositories.facts /var/log/leapp/*.{txt,log}

  • Check whether the RHEL 8 repositories are successfully fetched or not using the below command.

    # grep "rhel-8" /var/lib/rhsm/cache/*
SBR
Product(s)
Components
Category
Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.