JFrog RPM-Repo - rpm not signed

[MattLParker]

Describe the bug

Installation of the jfrog-cli-v2-jf package from the configured RPM repository fails due to a GPG signature verification error. The RPM package appears to be unsigned, causing the transaction to abort when GPG checking is enabled.
Environment

Package Manager: yum (RPM-based system)
Repository: jfrog-cli
Package Name: jfrog-cli-v2-jf
Package Version: 2.110.0-1
Architecture: x86_64

Issue Description
When attempting to install the JFrog CLI package from the official RPM repository, the installation fails with a GPG verification error. The output explicitly indicates that the RPM is not signed.

Current behavior

Package jfrog-cli-2.110.0.x86_64.rpm is not signed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'yum clean packages'.
Error: GPG check FAILED

Reproduction steps

yum install jfrog-cli-v2-jf -y

Expected behavior

No response

JFrog CLI version

2.110.0-1

Operating system type and version

Amazon Linux 2023

JFrog Artifactory version

No response

JFrog Xray version

No response

[bensonthomas124]

Command: in RHEL

  - echo "[jfrog-cli]" > jfrog-cli.repo
  - echo "name=jfrog-cli" >> jfrog-cli.repo
  - echo "baseurl=https://releases.jfrog.io/artifactory/jfrog-rpms" >> jfrog-cli.repo
  - echo "enabled=1" >> jfrog-cli.repo
  - echo "gpgcheck=0" >> jfrog-cli.repo
  - yum install -y wget
  - wget https://releases.jfrog.io/artifactory/jfrog-gpg-public/jfrog_public_gpg.key
  - sed -i -e '$a\' jfrog_public_gpg.key
  - rpm --import jfrog_public_gpg.key
  - mv jfrog-cli.repo /etc/yum.repos.d/
  - yum install -y jfrog-cli-v2-jf
  - 

---

Current message

Package jfrog-cli-2.110.0.x86_64.rpm is not signed

The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'yum clean packages'.
Error: GPG check FAILED

Conclusion

Seems like jfrog-cli-2.110.0.x86_64.rpm which was released on "25-Jun-2026 09:19" with " 21.36 MB" may Not be Signed
Location is https://releases.jfrog.io/artifactory/jfrog-rpms/jfrog-cli-v2-jf/

No issues with release of jfrog-cli-2.109.0.x86_64.rpm which was released on "17-Jun-2026 10:16"

Reference:
https://docs.jfrog.com/integrations/docs/download-and-install-the-jfrog-cli

[MattLParker]

Given the current state of supply chain attacks, it is crucial to consider the tool’s primary purpose: safe artifact management.

Disabling signature checks is not a viable solution. I would not recommend to anyone disabling signature verification.

Nothing like advise from an LLM :/

[bensonthomas124]

Yes, Agreed.
To add the gpgcheck=1, the latest artifact - "jfrog-cli-2.110.0.x86_64.rpm" should be signed. Let us know the next steps.

[bensonthomas124]

AI LLM check:
- yum install -y curl
- curl -fL https://getcli.jfrog.io/v2-jf | sh
- mv jf /usr/local/bin/jf
- chmod +x /usr/local/bin/jf

[MattLParker]

Also don't pipe curl to shell. For the humans reading.

[connconn]

pin the version for now until they fix their stuff

cat <<REPO >/etc/yum.repos.d/jfrog.repo
[jfrog-cli]
name=JFrog CLI
baseurl=https://releases.jfrog.io/artifactory/jfrog-rpms
enabled=1
gpgcheck=1
gpgkey=https://releases.jfrog.io/artifactory/api/v2/repositories/jfrog-rpms/keyPairs/primary/public
       https://releases.jfrog.io/artifactory/api/v2/repositories/jfrog-rpms/keyPairs/secondary/public
REPO

dnf --assumeyes jfrog-cli-v2-jf-2.109.0

[ehl-jf]

@MattLParker thanks for noticing.
We have just released the version 2.111.0 with a fix.
Fill free to reach out if there are other issues.