GPG check FAILED Error

[mliljedahl]

Describe the issue
The installation of gcsfuse fails to install on Rocky 10 when the GPG check is done.

System & Version (please complete the following information):

• OS: Rocky Linux 10
• Platform GCE VM (image: rocky-linux-10-optimized-gcp-v20250926)

Steps to reproduce the behavior with following information:

1. Follow the steps in the official guide

Additional context

# dnf install gcsfuse
...
gcsfuse (packages.cloud.google.com)                                                                              
GPG key at https://packages.cloud.google.com/yum/doc/yum-key.gpg (0xDC6315A3) is already installed
gcsfuse (packages.cloud.google.com)                                                                              
Importing GPG key 0x3E1BA8D5:
 Userid     : ""
 Fingerprint: 3749 E1BA 95A8 6CE0 5454 6ED2 F09C 394C 3E1B A8D5
 From       : https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
Is this ok [y/N]: y
error: Certificate F09C394C3E1BA8D5:
  Policy rejects F09C394C3E1BA8D5: No binding signature at time 2025-10-09T06:41:47Z
Key import failed (code 2). Failing package is: gcsfuse-3.4.0-1.x86_64
 GPG Keys are configured as: https://packages.cloud.google.com/yum/doc/yum-key.gpg, https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

SLO:
We strive to respond to all bug reports within 24 business hours provided the information mentioned above is included.

[vipnydav]

Thanks for reporting this issue. This is a known problem that our team is actively working on.

Here’s a summary of what's happening and our plan to fix it:

• The Problem: We are currently using a legacy GPG key to sign our RPM packages. The signing algorithm of this key is outdated and is being rejected by the stricter cryptographic policies of modern Enterprise Linux operating systems like Rocky Linux 10.

• The Solution: We are in the process of modernizing our release signing process. The plan is to migrate to the official, centrally-managed Google signing certificate. This certificate uses modern, secure algorithms that are compliant with the latest security standards and are trusted by all current operating systems.

We are working to get this permanent fix rolled out as soon as possible. Thanks for your patience.