Starting with v6.14.0, the Agent RPM packages are signed with a different GPG key. As a common best practice, Datadog periodically updates the GPG key.

Hosts using RPM packages located in the Datadog Yum repository are affected by this change and need to trust the key by importing the associated public key in their hosts’ keyrings.

Trying to install or upgrade the Agent package without trusting the key results in NOKEY errors when installing the package.

The fingerprint of the associated public key is: A4C0B90D7443CF6E4E8AA341F1068E14E09422B3.

If you’re using the latest version for one of the following officially supported install methods, your hosts trust the key automatically and no further action is needed.

• Agent installation page
• Chef cookbook
• Ansible role
• Puppet module
• SaltStack formula

Check if a host trusts the GPG key

To check if a particular host trusts the key, run this command on the host:

rpm -q gpg-pubkey-e09422b3

If the key is trusted, the command has a 0 exit code and outputs:

gpg-pubkey-e09422b3-57744e9e

Otherwise, the command returns a non-0 exit code and the following output:

package gpg-pubkey-e09422b3 is not installed

Trust the GPG keys

This step is not required if hosts already trust the keys or if a recent version of an official installation method is used.

Import command

Run the following commands on the host:

$ curl -o /tmp/DATADOG_RPM_KEY_CURRENT.public https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public
$ curl -o /tmp/DATADOG_RPM_KEY_B01082D3.public https://keys.datadoghq.com/DATADOG_RPM_KEY_B01082D3.public
$ curl -o /tmp/DATADOG_RPM_KEY_FD4BF915.public https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public
$ curl -o /tmp/DATADOG_RPM_KEY_E09422B3.public https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public

$ rpm --import /tmp/DATADOG_RPM_KEY_CURRENT.public
$ rpm --import /tmp/DATADOG_RPM_KEY_B01082D3.public
$ rpm --import /tmp/DATADOG_RPM_KEY_FD4BF915.public
$ rpm --import /tmp/DATADOG_RPM_KEY_E09422B3.public

Then check if the keys are trusted by following the steps in Check if a host trusts the GPG key.

Yum repository file update

On CentOS, RHEL, and Amazon Linux, if your Yum repository file is used to define the Datadog repository (datadog.repo), update it to add the key as a trusted key:

[datadog]
name = Datadog, Inc.
baseurl = https://yum.datadoghq.com/stable/7/x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public
       https://keys.datadoghq.com/DATADOG_RPM_KEY_B01082D3.public
       https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public
       https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public

[datadog]
name = Datadog, Inc.
baseurl = https://yum.datadoghq.com/stable/6/x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public
       https://keys.datadoghq.com/DATADOG_RPM_KEY_B01082D3.public
       https://keys.datadoghq.com/DATADOG_RPM_KEY_FD4BF915.public
       https://keys.datadoghq.com/DATADOG_RPM_KEY_E09422B3.public

Note: due to a bug in dnf, use repo_gpgcheck=0 instead of repo_gpgcheck=1 on RHEL/CentOS 8.1.

Note: This method doesn’t work on SUSE-based systems. Use the import command instead.