From 583e2fa32113554cf0b601197a3cd3b33a8c5382 Mon Sep 17 00:00:00 2001
From: Markus Hilger <markus.hilger@megware.com>
Date: Mon, 7 Sep 2026 13:19:36 +0200
Subject: [PATCH] Import the signing key SLE 16 media ships

Building a SUSE 16 image from SLE media failed every package with
"key ID fec28eaf09d9ea69: NOKEY". Leap publishes that key as
gpg-pubkey-*.asc, which the existing glob picks up; SLE publishes the
same key only as repodata/repomd.xml.key, so nothing was imported.

15 media carries both spellings, so this changes nothing there.
---
 imgutil/imgutil | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/imgutil/imgutil b/imgutil/imgutil
index e9bd1f5c..fc73e3de 100644
--- a/imgutil/imgutil
+++ b/imgutil/imgutil
@@ -657,6 +657,8 @@ class SuseHandler(OsHandler):
             if source.startswith('file://'):
                 gpgpath = source.replace('file://', '')
                 gpgkeys.extend(glob.glob(os.path.join(gpgpath, '*/gpg-pubkey*.asc')))
+                # SLE media publishes the signing key only as the repo key
+                gpgkeys.extend(glob.glob(os.path.join(gpgpath, '*/repodata/repomd.xml.key')))
             subprocess.check_call(self.zypper_cmd() + ['ar', source, 'source-{}'.format(idx)])
             idx += 1
         if gpgkeys: