Skip to content

Update the Real-Time Forwarder Signing Key on Linux

This article explains a change to how the Linux packages for the Cloudhouse Guardian (Guardian) real-time forwarder are signed, the errors you may see on a node after the change, and how to fix them.

What Changed

In November 2026, the apt and yum repositories that deliver the real-time forwarder (upguard-rtfd and its kernel module) moved to a single Cloudhouse signing key. This key replaces the older ScriptRock and UpGuard keys.

Name Cloudhouse Technologies Ltd security@cloudhouse.com
Fingerprint 0817 A68F F173 8267 2A20 7161 1A35 02F0 34C2 BE9A
Type RSA 4096
Expires 5 November 2031

Nodes set up before the change still trust only the old key, so package updates from the repository will fail until the node trusts the new key. You only need to do this once per node.

The yum repository definition also now turns on signature checks for both the packages and the repository index (gpgcheck=1 and repo_gpgcheck=1).

Errors You May See

Package tool Error Cause Fix
apt NO_PUBKEY 1A3502F034C2BE9A, The following signatures couldn't be verified because the public key is not available, or The repository ... is not signed The node does not trust the new key yet. Update the key on Debian or Ubuntu.
yum or dnf Public key for upguard-rtfd-... is not installed The node does not trust the new key yet. Update the key on Red Hat, CentOS, Oracle Linux or Amazon Linux.
yum or dnf repomd.xml GPG signature verification error: Bad GPG signature (dnf), or Gpg Keys not imported, cannot verify repomd.xml (yum on version 6 and 7 systems) yum needs permission to trust the key for the repository index, and was run without -y (for example, from a script). Run the makecache command in step 4 once, then retry.
yum Package does not match intended download or No more mirrors to try yum is reusing repository data or a part-downloaded package from before the change. Run the clean command in step 3, then retry.
apt, yum or dnf Hash Sum mismatch, File has unexpected size, or a size or checksum error straight after the change Download servers can briefly serve a mix of old and new files after the repository is republished. Wait a while and retry. If it persists, run the clean command for your package tool and retry, or contact Support.

Update the Key on Debian or Ubuntu

Run these commands as root, replacing <repo> with your release: ubuntu1404, ubuntu1604, ubuntu1804 or ubuntu2004.

  1. Download the new key:

    curl -fsS https://download.cloudhouse.com/realtime/repo/master/deb/cloudhouse-linux.gpg -o /usr/share/keyrings/cloudhouse-linux.gpg
chmod 644 /usr/share/keyrings/cloudhouse-linux.gpg

  2. Point the repository definition at the new key:

    echo "deb [signed-by=/usr/share/keyrings/cloudhouse-linux.gpg] http://download.cloudhouse.com/realtime/repo/master/deb <repo> main" > /etc/apt/sources.list.d/upguard-rtf.list

    Note: Ubuntu 14.04 uses apt 1.0, which does not support signed-by. On Ubuntu 14.04, save the key to /etc/apt/trusted.gpg.d/cloudhouse-linux.gpg in step 1 instead, and leave out [signed-by=...] in step 2.

  3. Check that apt accepts the repository:

    apt-get update

Update the Key on Red Hat, CentOS, Oracle Linux or Amazon Linux

Run these commands as root, replacing <repo> with your release: centos6, centos7, centos8, rhel6, rhel7, rhel8, oraclelinux6, oraclelinux7, oraclelinux8 or amazonlinux2.

  1. Import the new key:

    rpm --import https://download.cloudhouse.com/realtime/repo/master/<repo>/RPM-GPG-KEY-cloudhouse

  2. Replace the repository definition, which now turns on signature checks:

    curl -fsSL -o /etc/yum.repos.d/UpGuard-RTF-<repo>.repo https://download.cloudhouse.com/realtime/repo/master/UpGuard-RTF-<repo>.repo

  3. Clear the cached repository data and part-downloaded packages for this repository only:

    yum clean metadata packages --disablerepo='*' --enablerepo='UpGuard-RTF-<repo>'

  4. Let yum trust the key for the repository index, and check that it accepts the repository:

    yum -y makecache --disablerepo='*' --enablerepo='UpGuard-RTF-<repo>'

  5. Optionally, remove the old UpGuard key, which no longer signs anything in this repository:

    rpm -e gpg-pubkey-af4da192

Check the Key

To confirm you downloaded the genuine key, compare its fingerprint with the one in What Changed:

curl -fsS -o /tmp/cloudhouse-linux.gpg https://download.cloudhouse.com/realtime/repo/master/deb/cloudhouse-linux.gpg
gpg --no-default-keyring --keyring /tmp/cloudhouse-linux.gpg --fingerprint

The output should include 0817 A68F F173 8267 2A20 7161 1A35 02F0 34C2 BE9A.