STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must check the GPG signature of repository metadata before package installation.

DISA Rule

SV-269166r1050048_rule

Vulnerability Number

V-269166

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

ALMA-09-009920

Severity

CAT I

CCI(s)

CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

Fix Recommendation

Configure dnf to always check the GPG signature of repository metadata.

Add or update the following line in the [main] section of the /etc/dnf/dnf.conf file:

repo_gpgcheck=1

Remove any instances of "repo_gpgcheck=0" from any "/etc/yum.repos.d/*.repo" files.

Check Contents

Verify that dnf always checks the GPG signature of repository metadata:

$ grep repo_gpgcheck /etc/dnf/dnf.conf /etc/yum.repos.d/*.repo

repo_gpgcheck=1

If "repo_gpgcheck" is not set to "1" in the global "/etc/dnf/dnf.conf" file, or if the option is missing or commented out, this is a finding.

If "repo_gpgcheck" is set to "0" in any of the "/etc/yum.repos.d/*.repo" files and the information system security officer (ISSO) lacks a documented requirement, this is a finding.

Note: Not all repositories support this feature.

Vulnerability Number

V-269166

Documentable

False

Rule Version

ALMA-09-009920

Severity Override Guidance

Check Content Reference

Target Key

5664