Third-party Channels

Uyuni includes the ability to synchronize the content of optional third-party repositories with some of the products that can be managed by it.

Some third-party GPG keys are included by default in the Uyuni database, and some are not. For third-party keys that are not included, the relevant keys need to be imported when choosing to synchronize such third-party repositories.

GPG key management is performed through the Uyuni XML-RPC API. The mgrctl gpg subcommands read a key from a local file or remote URL and upload it to the server, so they can be run from any host that has mgrctl installed and network access to the server’s API; they no longer require shell access into the server container.

Because the commands call the API, valid administrator credentials must be supplied. They can be provided on the command line with the --api-server, --api-user, and --api-password flags, through environment variables, or in the mgrctl configuration file.

To import a GPG key, use the following command syntax:

mgrctl gpg upload <path-to-gpg-key-file-or-URL>

The argument can be either a path to a local file containing an ASCII-armored GPG key, or an URL from which mgrctl can download the key from.

  1. Example: Uploading a GPG key from a local file

    mgrctl gpg upload repomd.xml.key

  2. Example: Uploading a GPG key from a remote repository using a URL

    mgrctl gpg upload https://<3rd-party-domain>/path/to/repository/repodata/repomd.xml.key

To list the keys currently held in the Uyuni GPG keyring, run:

mgrctl gpg list

The output includes, for each key, its fingerprint, key type and size, and the associated user IDs. The fingerprint can be used to remove a key from the keyring:

mgrctl gpg remove <fingerprint>

When installing a package on the client, you may also need to trust the GPG key on the client itself. This requires that the GPG key is also available there.

For more information, see: GPG Keys.