Unable to install 2.4.17.1 on RHEL8 due to GPG key

[amitmun]

When trying to install version 2.4.17.1 on RHEL 8.10 (OS is fully up-to-date) I get the following error message:

# rpm -Uvh mod_auth_openidc-2.4.17.1-1.el8.x86_64.rpm
error: mod_auth_openidc-2.4.17.1-1.el8.x86_64.rpm: Header DSA signature: BAD (package tag 267: invalid OpenPGP signature)
error: mod_auth_openidc-2.4.17.1-1.el8.x86_64.rpm cannot be installed

The GPG key is using ed25519 which is not supported by rpm 4.14 in RHEL 8. Support for EdDSA/Ed25519 keys was only added in rpm 4.16 (RHEL 9).

# gpg --list-packets gpg-key.txt
# off=0 ctb=98 tag=6 hlen=2 plen=51
:public key packet:
	version 4, algo 22, created 1749813312, expires 0
	pkey[0]: [80 bits] ed25519 (1.3.6.1.4.1.11591.15.1)
	pkey[1]: [263 bits]
	keyid: AEE179B2B8F4129A
# off=53 ctb=b4 tag=13 hlen=2 plen=29
:user ID packet: "OpenIDC <support@openidc.com>"
# off=84 ctb=88 tag=2 hlen=2 plen=147
:signature packet: algo 22, keyid AEE179B2B8F4129A
	version 4, created 1749813312, md5len 0, sigclass 0x13
	digest algo 10, begin of digest 02 bf
	hashed subpkt 33 len 21 (issuer fpr v4 F8A07B7DEB68709A02CA241BAEE179B2B8F4129A)
	hashed subpkt 2 len 4 (sig created 2025-06-13)
	hashed subpkt 27 len 1 (key flags: 03)
	hashed subpkt 11 len 4 (pref-sym-algos: 9 8 7 2)
	hashed subpkt 34 len 1 (?)
	hashed subpkt 21 len 5 (pref-hash-algos: 10 9 8 11 2)
	hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
	hashed subpkt 30 len 1 (features: 07)
	hashed subpkt 23 len 1 (keyserver preferences: 80)
	subpkt 16 len 8 (issuer key ID AEE179B2B8F4129A)
	data: [255 bits]
	data: [256 bits]

The workaround is to disable the signature check in rpm:

# rpm -Uvh --nosignature mod_auth_openidc-2.4.17.1-1.el8.x86_64.rpm
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:mod_auth_openidc-2.4.17.1-1.el8  ################################# [100%]

Is it possible to sign the RPM for RHEL 8 with a GPG key that is supported on that OS?

[zandbelt]

we have updated the packages with a -2 variant that is signed with a 2048 bit RSA key that is supported on all platforms