How to Fix “GPG check FAILED” on AlmaLinux

Every AlmaLinux package is signed with a digital key, so your server can check that it really came from AlmaLinux and was not tampered with. If the server does not have the right key, dnf (or yum) refuses to install anything and stops with GPG check FAILED. This guide explains why that happens and how to fix it safely.

Quick answer

Import the current AlmaLinux signing key, then run the update again:

rpm --import https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux
dnf clean all
dnf update

That command is for AlmaLinux 8, where this error is most common. For AlmaLinux 9, use RPM-GPG-KEY-AlmaLinux-9 at the end of the address instead; for AlmaLinux 10, RPM-GPG-KEY-AlmaLinux-10.

What you need: root access. The import is safe: it only adds AlmaLinux's official key, and does nothing if the key is already there.

What the error looks like

Importing GPG key 0xC21AD6EA:
 Userid     : "AlmaLinux <packager@almalinux.org>"
 Fingerprint: E53C F5EF 91CE B0AD 1812 ECB8 51D6 647E C21A D6EA
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
Is this ok [y/N]: y
Key imported successfully
Import of key(s) didn't help, wrong key(s)?
...
Error: GPG check FAILED

The giveaway is Import of key(s) didn't help, wrong key(s)?. dnf imported a key, but it was the wrong one, so the packages still could not be verified.

Why it happens

AlmaLinux 8's original signing key (ID C21AD6EA) expired in January 2024. AlmaLinux could not extend it, so from 12 January 2024 it started signing all AlmaLinux 8 packages with a new key (ID CED7258B). AlmaLinux announcement

The new key arrives with the almalinux-release package, version 8.8-3 or newer (October 2023). Servers that update regularly got it automatically and never see this error. A server that had not been updated for a long time still only has the old key file. When dnf tries to fix things, it imports that old key from /etc/pki/rpm-gpg/, which cannot verify the new packages. That is exactly the "didn't help, wrong key" message above.

1. Check whether the new key is installed

rpm -q gpg-pubkey-ced7258b-6525146f

• gpg-pubkey-ced7258b-6525146f means the new key is already trusted. Your error has a different cause; see the last section.
• package gpg-pubkey-ced7258b-6525146f is not installed means it is missing. Continue with step 2.

2. Import the new key

rpm --import https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux

This downloads the key over HTTPS directly from AlmaLinux's official repository. Run the check from step 1 again; it should now print the key name.

No internet access on the server? If almalinux-release is already version 8.8-3 or newer, the key is on disk and you can import it from there:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux

3. Clear the cache and update

dnf clean all
dnf update

dnf clean all removes the packages that were downloaded before the failure, so they are checked again with the new key. The update should now run normally, and it will also bring almalinux-release up to date so this does not happen again.

Still failing?

• Wrong AlmaLinux version. Check yours with cat /etc/almalinux-release and use the key that matches (-9 or -10 for those versions).
• Third-party repositories. If the failing package comes from another repository (for example EPEL, MariaDB or cPanel), it is signed with that vendor's key, not AlmaLinux's. The error output names the repository: import that vendor's key from their official site.
• Corrupt downloads. A broken mirror or proxy can also cause GPG errors. Run dnf clean all and try again later.

Never work around the error by turning off signature checks (--nogpgcheck or gpgcheck=0). That removes the protection against tampered packages.