[Fedora 44] 'Warning: skipped OpenPGP checks for 1 package from repository: @commandline' when installing rpm

[huang-jy]

Noticed that when installing the rpm, it complains about skipping OpenPGP checks

Can't see any other issues reported about this.

$ sudo dnf install https://github.com/httptoolkit/httptoolkit-desktop/releases/download/v1.26.1/HttpToolkit-1.26.1-x64.rpm 
Updating and loading repositories:
Repositories loaded.
 https://github.com/httptoolkit/httptoolkit-desktop/releases/download/v1.26.1/HttpToolkit-1.26.1-x64.rpm              100% |  36.0 MiB/s | 123.9 MiB |  00m03s
Package                                              Arch         Version                                               Repository                        Size
Upgrading:
 httptoolkit                                         x86_64       0:1.26.1-1                                            @commandline                 497.5 MiB
   replacing httptoolkit                             x86_64       0:1.26.0-1                                            @commandline                 497.5 MiB

Transaction Summary:
 Upgrading:          1 package
 Replacing:          1 package

Total size of inbound packages is 124 MiB. Need to download 0 B.
After this operation, 16 KiB extra will be used (install 497 MiB, remove 497 MiB).
Is this ok [y/N]: y
Running transaction
[1/4] Verify package files                                                                                            100% |   2.0   B/s |   1.0   B |  00m00s
[2/4] Prepare transaction                                                                                             100% |   1.0   B/s |   2.0   B |  00m01s
[3/4] Upgrading httptoolkit-0:1.26.1-1.x86_64                                                                         100% |  55.5 MiB/s | 498.5 MiB |  00m09s
[4/4] Removing httptoolkit-0:1.26.0-1.x86_64                                                                          100% |   3.0 KiB/s |   5.0 KiB |  00m02s
Warning: skipped OpenPGP checks for 1 package from repository: @commandline
Complete!

[pimterry]

This isn't really a concern I think.

The package isn't signed, but that's OK - you don't have a signature to verify it against anyway, and it's a direct download over HTTPS from the repo.

We could add signatures to this, but there's little value in reality without a full RPM package repo (since you won't have a signature to verify against, and you'll always be downloading manually). Setting up a full RPM repo is a lot more effort than it's worth in practice, I'm happy to have an RPM package but it's not an especially popular option compared to deb, AppImage & simple zip downloads. From what I can see, most other similar packages do the same.

I'll leave this open in case anybody else has feedback on this or suggestions of best approaches.