# Installation on Fedora 38 fails **URL:** \ **Category:** Help & Support\ **Created:** [June 26, 2023, 2:30pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793 "2023-06-26T14:30:17Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![chaostheory88](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/chaostheory88/32/2050_2.png) [@chaostheory88](https://forum.crystal-lang.org/u/chaostheory88)\ **Post date:** [June 26, 2023, 2:30pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/1 "2023-06-26T14:30:17Z")
Hi, while trying to install Crystal on Fedora 38 I got the following error: ```sh Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): RPM: Certificate E456AE72856D1476 invalid: policy violation RPM: because: No binding signature at time 2023-06-23T17:13:28Z RPM: error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): RPM: Certificate E456AE72856D1476 invalid: policy violation RPM: because: No binding signature at time 2023-06-23T17:13:28Z The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: Transaction test error: package crystal-1.8.2-5.1.x86_64 does not verify: Header V3 RSA/SHA256 Signature, key ID 856d1476: BAD ``` Kind Regards ---
**Author:** ![straight-shoota](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/straight-shoota/32/36_2.png) [@straight-shoota](https://forum.crystal-lang.org/u/straight-shoota)\ **Post date:** [June 26, 2023, 3:50pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/2 "2023-06-26T15:50:44Z")
I’m assuming you’re using the installer ([https://crystal-lang.org/install.sh](https://crystal-lang.org/install.sh))? Because following the [manual steps](https://crystal-lang.org/install/on_fedora/#manual-setup) seems to work for me. Maybe you can try that? I can reproduce the error with the installer. But only with Fedora 38. It works fine on Fedora 37 and Rawhide. So it must be an error specific to 38. Any idea what that error message means or how to fix it? I’m not familiar with the Fedory ecosystem. The packages are built on OBS ([Show devel:languages:crystal / crystal - openSUSE Build Service](https://build.opensuse.org/package/show/devel:languages:crystal/crystal)) which also hosts the repositories. Usually that works well. ---
**Author:** ![Fulgurance](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/fulgurance/32/1463_2.png) [@Fulgurance](https://forum.crystal-lang.org/u/Fulgurance)\ **Post date:** [June 27, 2023, 7:14am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/3 "2023-06-27T07:14:30Z")
Hi ! Can we see your /etc/yum.repos.d/crystal.repo file please? ---
**Author:** ![straight-shoota](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/straight-shoota/32/36_2.png) [@straight-shoota](https://forum.crystal-lang.org/u/straight-shoota)\ **Post date:** [June 27, 2023, 7:45am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/4 "2023-06-27T07:45:58Z")
The issue is easily reproducible by running the installer script in a clean Fedora 38 environment. ```plaintext docker run --rm -it fedora:38 curl -fsSL https://crystal-lang.org/install.sh | bash ``` This is the content of the repo config file: ```auto [crystal] name=Crystal (Fedora_38) type=rpm-md baseurl=https://download.opensuse.org/repositories/devel:/languages:/crystal/Fedora_38/ gpgcheck=1 gpgkey=https://download.opensuse.org/repositories/devel:/languages:/crystal/Fedora_38/repodata/repomd.xml.key enabled=1 ``` ---
**Author:** ![Fulgurance](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/fulgurance/32/1463_2.png) [@Fulgurance](https://forum.crystal-lang.org/u/Fulgurance)\ **Post date:** [June 27, 2023, 8:00am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/5 "2023-06-27T08:00:54Z")
Maybe needed to import new key, stuff like that ? ---
**Author:** ![chaostheory88](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/chaostheory88/32/2050_2.png) [@chaostheory88](https://forum.crystal-lang.org/u/chaostheory88)\ **Post date:** [June 27, 2023, 9:19am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/6 "2023-06-27T09:19:29Z")
Hi! I tried all the methods described in the installation. It seems that the problem it is related to the key crypto algorithms used for signing, current Fedora crypto-policies are probably very strict. At the end I managed to install Crystal lowering the default policies, specifically: ```sh sudo update-crypto-policies --set LEGACY # after updating the policies it is necessary to reboot sudo rpm --erase gpg-pubkey-856d1476-608aaf94 # I don't know why I'd to also remove the key which gets anyway imported again after running dnf install crystal sudo dnf install crystal sudo update-crypto-policies --set DEFAULT # restrict policies again ``` References: - [Popular third-party RPMs fail to install/update/remove due to security policies verification - Fedora Discussion](https://discussion.fedoraproject.org/t/popular-third-party-rpms-fail-to-install-update-remove-due-to-security-policies-verification/70498) - [GPG key issue with Crowdsec repository - Fedora Discussion](https://discussion.fedoraproject.org/t/gpg-key-issue-with-crowdsec-repository/83689) Note: what I did is very empirical and had not much time to dig deeper, so I could be totally wrong, nevertheless I was finally able to install Crystal. ---
**Author:** ![straight-shoota](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/straight-shoota/32/36_2.png) [@straight-shoota](https://forum.crystal-lang.org/u/straight-shoota)\ **Post date:** [June 27, 2023, 9:40am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/7 "2023-06-27T09:40:30Z")
I tested the install instructions provided by OBS for the package [Install package devel:languages:crystal / crystal](https://software.opensuse.org//download.html?project=devel%3Alanguages%3Acrystal&package=crystal#manualFedora) This works: ```sh dnf config-manager --add-repo https://download.opensuse.org/repositories/devel:languages:crystal/Fedora_38/devel:languages:crystal.repo dnf install crystal ``` So probably we’ll just need to update the installer script to use `dnf` instead of `yum` (which is currently shared between all RPM-based distros). ---
**Author:** ![chaostheory88](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/chaostheory88/32/2050_2.png) [@chaostheory88](https://forum.crystal-lang.org/u/chaostheory88)\ **Post date:** [June 27, 2023, 9:50am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/8 "2023-06-27T09:50:46Z")
Hi, this is the second one I tried, and did not worked for me, but probably mi first attempt with the installer script created some problem and made the second method also failing. I’m going to test this in a new env. Thanks! ---
**Author:** ![straight-shoota](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/straight-shoota/32/36_2.png) [@straight-shoota](https://forum.crystal-lang.org/u/straight-shoota)\ **Post date:** [June 27, 2023, 9:51am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/9 "2023-06-27T09:51:29Z")
I made a patch to fix the installer: [Use dnf on fedora by straight-shoota · Pull Request #251 · crystal-lang/distribution-scripts · GitHub](https://github.com/crystal-lang/distribution-scripts/pull/251) Confirmed to work on Fedora 38, 37 and Rawhide. You can try it: [https://raw.githubusercontent.com/crystal-lang/distribution-scripts/7dd5ba51c1c21c02e51c07ac945999569a8e21a0/packages/scripts/install.sh](https://raw.githubusercontent.com/crystal-lang/distribution-scripts/7dd5ba51c1c21c02e51c07ac945999569a8e21a0/packages/scripts/install.sh) ---
**Author:** ![chaostheory88](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/chaostheory88/32/2050_2.png) [@chaostheory88](https://forum.crystal-lang.org/u/chaostheory88)\ **Post date:** [June 27, 2023, 10:02am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/10 "2023-06-27T10:02:50Z")
It works! Thanks! ---
**Author:** ![kefahi](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/kefahi/32/598_2.png) [@kefahi](https://forum.crystal-lang.org/u/kefahi)\ **Post date:** [July 21, 2023, 9:44am UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/11 "2023-07-21T09:44:29Z")
Hello, I’m getting exactly the same problem. I tried the two things … 1. ```auto zenbook [~]# dnf config-manager --add-repo https://download.opensuse.org/repositories/devel:languages:crystal/Fedora_38/devel:languages:crystal.repo Adding repo from: https://download.opensuse.org/repositories/devel:languages:crystal/Fedora_38/devel:languages:crystal.repo zenbook [~]# rm /etc/yum.repos.d/devel\:languages\:crystal.repo ^C zenbook [~]# dnf install crystal Crystal (Fedora_38) 955 B/s | 1.7 kB 00:01 keybase 1.8 kB/s | 3.3 kB 00:01 Dependencies resolved. ======================================================================================================================================================= Package Architecture Version Repository Size ======================================================================================================================================================= Installing: crystal x86_64 1.9.2-2.1 devel_languages_crystal 33 M Installing dependencies: pcre-cpp x86_64 8.45-1.fc38.3 fedora 26 k pcre-devel x86_64 8.45-1.fc38.3 fedora 490 k pcre-utf16 x86_64 8.45-1.fc38.3 fedora 186 k pcre-utf32 x86_64 8.45-1.fc38.3 fedora 175 k Installing weak dependencies: libyaml-devel x86_64 0.2.5-9.fc38 fedora 168 k Transaction Summary ======================================================================================================================================================= Install 6 Packages Total size: 34 M Total download size: 1.0 M Installed size: 130 M Is this ok [y/N]: y Downloading Packages: [SKIPPED] crystal-1.9.2-2.1.x86_64.rpm: Already downloaded (2/6): pcre-cpp-8.45-1.fc38.3.x86_64.rpm 15 kB/s | 26 kB 00:01 (3/6): libyaml-devel-0.2.5-9.fc38.x86_64.rpm 85 kB/s | 168 kB 00:01 (4/6): pcre-utf32-8.45-1.fc38.3.x86_64.rpm 82 kB/s | 175 kB 00:02 (5/6): pcre-utf16-8.45-1.fc38.3.x86_64.rpm 75 kB/s | 186 kB 00:02 (6/6): pcre-devel-8.45-1.fc38.3.x86_64.rpm 66 kB/s | 490 kB 00:07 ------------------------------------------------------------------------------------------------------------------------------------------------------- Total 121 kB/s | 1.0 MB 00:08 error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): 1. Certificiate E456AE72856D1476 invalid: certificate is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z 2. Key E456AE72856D1476 invalid: key is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): 1. Certificiate E456AE72856D1476 invalid: certificate is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z 2. Key E456AE72856D1476 invalid: key is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z Crystal (Fedora_38) 1.7 kB/s | 1.1 kB 00:00 GPG key at https://download.opensuse.org/repositories/devel:/languages:/crystal/Fedora_38/repodata/repomd.xml.key (0x856D1476) is already installed The GPG keys listed for the "Crystal (Fedora_38)" repository are already installed but they are not correct for this package. Check that the correct key URLs are configured for this repository.. Failing package is: crystal-1.9.2-2.1.x86_64 GPG Keys are configured as: https://download.opensuse.org/repositories/devel:/languages:/crystal/Fedora_38/repodata/repomd.xml.key The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED ``` 1. ```auto zenbook [~]# wget 'https://raw.githubusercontent.com/crystal-lang/distribution-scripts/7dd5ba51c1c21c02e51c07ac945999569a8e21a0/packages/scripts/install.sh' --2023-07-21 12:42:27-- https://raw.githubusercontent.com/crystal-lang/distribution-scripts/7dd5ba51c1c21c02e51c07ac945999569a8e21a0/packages/scripts/install.sh Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.109.133, 185.199.111.133, ... Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 6929 (6.8K) [text/plain] Saving to: ‘install.sh’ install.sh 100%[========================================================================>] 6.77K --.-KB/s in 0s 2023-07-21 12:42:28 (30.6 MB/s) - ‘install.sh’ saved [6929/6929] zenbook [~]# bash install.sh keybase 12 kB/s | 3.3 kB 00:00 Package dnf-plugins-core-4.4.1-1.fc38.noarch is already installed. Dependencies resolved. Nothing to do. Complete! Adding repo from: https://download.opensuse.org/repositories/devel:languages:crystal/Fedora_38/devel:languages:crystal.repo Crystal (Fedora_38) 3.0 kB/s | 1.7 kB 00:00 Dependencies resolved. ======================================================================================================================================================= Package Architecture Version Repository Size ======================================================================================================================================================= Installing: crystal x86_64 1.9.2-2.1 devel_languages_crystal 33 M Installing dependencies: pcre-cpp x86_64 8.45-1.fc38.3 fedora 26 k pcre-devel x86_64 8.45-1.fc38.3 fedora 490 k pcre-utf16 x86_64 8.45-1.fc38.3 fedora 186 k pcre-utf32 x86_64 8.45-1.fc38.3 fedora 175 k Installing weak dependencies: libyaml-devel x86_64 0.2.5-9.fc38 fedora 168 k Transaction Summary ======================================================================================================================================================= Install 6 Packages Total size: 34 M Installed size: 130 M Downloading Packages: [SKIPPED] crystal-1.9.2-2.1.x86_64.rpm: Already downloaded [SKIPPED] libyaml-devel-0.2.5-9.fc38.x86_64.rpm: Already downloaded [SKIPPED] pcre-cpp-8.45-1.fc38.3.x86_64.rpm: Already downloaded [SKIPPED] pcre-devel-8.45-1.fc38.3.x86_64.rpm: Already downloaded [SKIPPED] pcre-utf16-8.45-1.fc38.3.x86_64.rpm: Already downloaded [SKIPPED] pcre-utf32-8.45-1.fc38.3.x86_64.rpm: Already downloaded error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): 1. Certificiate E456AE72856D1476 invalid: certificate is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z 2. Key E456AE72856D1476 invalid: key is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): 1. Certificiate E456AE72856D1476 invalid: certificate is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z 2. Key E456AE72856D1476 invalid: key is not alive because: The primary key is not live because: Expired on 2023-07-08T13:07:32Z Crystal (Fedora_38) 3.6 kB/s | 1.1 kB 00:00 GPG key at https://download.opensuse.org/repositories/devel:/languages:/crystal/Fedora_38/repodata/repomd.xml.key (0x856D1476) is already installed The GPG keys listed for the "Crystal (Fedora_38)" repository are already installed but they are not correct for this package. Check that the correct key URLs are configured for this repository.. Failing package is: crystal-1.9.2-2.1.x86_64 GPG Keys are configured as: https://download.opensuse.org/repositories/devel:/languages:/crystal/Fedora_38/repodata/repomd.xml.key The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED ``` ---
**Author:** ![beta-ziliani](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/beta-ziliani/32/1821_2.png) [@beta-ziliani](https://forum.crystal-lang.org/u/beta-ziliani)\ **Post date:** [July 21, 2023, 2:14pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/12 "2023-07-21T14:14:35Z")
A clean install works, so the problem is on `dnf` not cleaning the key. I don’t know how to do that, but I would try either cleaning the cache, or see if someone knows a better solution than to [skip the gpg test](https://forums.fedoraforum.org/showthread.php?313483-Import-of-key(s)-didn-t-help-wrong-key(s)). ---
**Author:** ![kefahi](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/kefahi/32/598_2.png) [@kefahi](https://forum.crystal-lang.org/u/kefahi)\ **Post date:** [July 21, 2023, 2:55pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/13 "2023-07-21T14:55:48Z")
Thank you, Disabiling gpg check doesn’t fix it. ```auto dnf install crystal --nogpgcheck Last metadata expiration check: 0:00:17 ago on Fri 21 Jul 2023 05:51:58 PM +03. Dependencies resolved. ======================================================================================================================================================= Package Architecture Version Repository Size ======================================================================================================================================================= Installing: crystal x86_64 1.9.2-2.1 devel_languages_crystal 33 M Installing dependencies: pcre-cpp x86_64 8.45-1.fc38.3 fedora 26 k pcre-devel x86_64 8.45-1.fc38.3 fedora 490 k pcre-utf16 x86_64 8.45-1.fc38.3 fedora 186 k pcre-utf32 x86_64 8.45-1.fc38.3 fedora 175 k Installing weak dependencies: libyaml-devel x86_64 0.2.5-9.fc38 fedora 168 k Transaction Summary ======================================================================================================================================================= Install 6 Packages Total size: 34 M Installed size: 130 M Is this ok [y/N]: y Downloading Packages: [SKIPPED] crystal-1.9.2-2.1.x86_64.rpm: Already downloaded [SKIPPED] libyaml-devel-0.2.5-9.fc38.x86_64.rpm: Already downloaded [SKIPPED] pcre-cpp-8.45-1.fc38.3.x86_64.rpm: Already downloaded [SKIPPED] pcre-devel-8.45-1.fc38.3.x86_64.rpm: Already downloaded [SKIPPED] pcre-utf16-8.45-1.fc38.3.x86_64.rpm: Already downloaded [SKIPPED] pcre-utf32-8.45-1.fc38.3.x86_64.rpm: Already downloaded Running transaction check Transaction check succeeded. Running transaction test RPM: error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): RPM: 1. Certificiate E456AE72856D1476 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2023-07-08T13:07:32Z RPM: 2. Key E456AE72856D1476 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2023-07-08T13:07:32Z RPM: error: Verifying a signature using certificate 321DC2EA7F0A4F06714516B8E456AE72856D1476 (devel:languages:crystal OBS Project ): RPM: 1. Certificiate E456AE72856D1476 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2023-07-08T13:07:32Z RPM: 2. Key E456AE72856D1476 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2023-07-08T13:07:32Z The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: Transaction test error: package crystal-1.9.2-2.1.x86_64 does not verify: Header V3 RSA/SHA256 Signature, key ID 856d1476: NOTTRUSTED ``` Trying to disable gpg check from the yum repo file gpgcheck=0 Also doesn’t work. ---
**Author:** ![kefahi](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/kefahi/32/598_2.png) [@kefahi](https://forum.crystal-lang.org/u/kefahi)\ **Post date:** [July 21, 2023, 3:25pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/14 "2023-07-21T15:25:34Z")
I think there is something wrong with the crystal signature … it seems to be expired. ```auto RPM: because: Expired on 2023-07-08T13:07:32Z ``` Is there a way to check Crystal rpm’s signature expiration date? According to the above error I get from fedora it says it expired ~ 13 days ago. ---
**Author:** ![straight-shoota](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/straight-shoota/32/36_2.png) [@straight-shoota](https://forum.crystal-lang.org/u/straight-shoota)\ **Post date:** [July 21, 2023, 3:31pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/15 "2023-07-21T15:31:17Z")
Yes, the GPG key you have installed is expired. But there’s a new one available which just doesn’t get used because the old one is still cached. I believe you can list the installed keys with `rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'` and then remove the expired one with `rpm -e --`. ---
**Author:** ![kefahi](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/kefahi/32/598_2.png) [@kefahi](https://forum.crystal-lang.org/u/kefahi)\ **Post date:** [July 21, 2023, 3:38pm UTC](https://forum.crystal-lang.org/t/installation-on-fedora-38-fails/5793/16 "2023-07-21T15:38:05Z")
> [@straight-shoota](#): > > rpm -e That was the culprit! It works now. Thank you for your patience and support.