From 416af4bec47b04e0acc95619f84bde5c7042a344 Mon Sep 17 00:00:00 2001 From: Hampus Date: Sun, 20 Sep 2026 16:42:33 +0200 Subject: [PATCH] fix(docs): correct the flatpak and dnf signing instructions (#2865) --- fluxer_docs/src/content/docs/downloads/linux-repositories.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fluxer_docs/src/content/docs/downloads/linux-repositories.md b/fluxer_docs/src/content/docs/downloads/linux-repositories.md index 6c64c9589..6f0076724 100644 --- a/fluxer_docs/src/content/docs/downloads/linux-repositories.md +++ b/fluxer_docs/src/content/docs/downloads/linux-repositories.md @@ -28,9 +28,12 @@ One repository serves Fedora and the RHEL family, split by channel and architect ``` sudo curl -fsSL -o /etc/yum.repos.d/fluxer.repo \ https://pkgs.fluxer.com/rpm/fluxer.repo +sudo rpm --import https://pkgs.fluxer.com/keys/fluxer-archive-keyring.asc sudo dnf install fluxer ``` +The `.repo` file names the signing key by URL, so dnf fetches it rather than needing the keyring step the apt entry has. Without the `rpm --import` line dnf asks to import twice on a first install, once for the repository metadata and once for the package. With it dnf asks once, for the metadata, which dnf keeps in its own key store. Both prompts print the fingerprint, which reads `09D01339EE128925F75E675C855C5BDE34D205D2`. + Metadata expires after six hours, so a freshly published build becomes visible within that window, or immediately with `dnf --refresh upgrade`. :::caution[RHEL, Rocky, Alma and CentOS Stream need EPEL] @@ -89,4 +92,4 @@ Once the remote exists, either application installs by id: flatpak install fluxer app.fluxer.FluxerCanary ``` -The reference file names no signing key, so flatpak configures the remote unverified and no flag is required. Adding the remote by URL instead of by reference file does need `--no-gpg-verify`. +The reference file names the signing key, so flatpak configures the remote verified and imports the key. `fluxer.flatpakrepo` does the same, so `flatpak remote-add` from that URL needs no flag either. Adding the bare repository URL skips both files: flatpak still turns verification on but has no key to check against, so that route needs `--gpg-import` or `--no-gpg-verify`.