A vendor repo that has no Fedora 45 tree does not stop dnf. It prints “Usable URL not found”, loads every other repo and carries on. The failure shows up one command later as “No match for argument: terraform”, or worse, as dnf swapping your PostgreSQL server for a different build in the middle of an unrelated install. Find the broken repo before you install anything from it.
Most third-party repo files build their URL from $releasever, so on Fedora 45 they ask for a /45/ directory that Docker, Oracle, HashiCorp, NVIDIA and the PostgreSQL project publish on their own schedule. This guide checks each of those repos on Fedora 45, shows the exact 404 errors, and gives a fix per vendor: a dnf5 override that pins one repo to the Fedora 44 tree, a scoped extra repo, the RPM Fusion package or the testing tree the vendor publishes. Pinning is not always safe. Two of the five repos break on library versions when pinned, and the lab output below shows which.
Tested on 4 October 2026 against Fedora 45, with SELinux enforcing and Secure Boot on.
Which third-party repos work on Fedora 45 right now
Every row comes from one Fedora 45 VM, and we installed real packages from each repo rather than trusting a curl of the metadata:
| Repo | Fedora 45 tree | What breaks | Fix that worked |
|---|---|---|---|
| Docker CE | Present, but carries only 5 packages (no buildx) | No match for argument: docker-buildx-plugin | Core packages from the 45 tree, buildx from a scoped 44 repo |
| HashiCorp | 404 | No match for argument: terraform | Pin the repo to the 44 tree with a dnf5 override |
| Oracle VirtualBox | 404 | Pinned to 44: nothing provides libvpx.so.9()(64bit) | RPM Fusion VirtualBox with a signed akmod |
| NVIDIA CUDA | No fedora45 repo | Nothing, if you use the fedora44 repo file | Install from the fedora44 repo |
| PGDG PostgreSQL | Stable 404, repo RPM 404, testing tree present | Pinned to 44: nothing provides libperl.so.5.42()(64bit) | Repo RPM from F-44, then the PGDG testing tree for 45 |
| RPM Fusion | releases/45 returned 404 on our run | Nothing; on our run the metalink resolved to the development/45 tree, and rpmfusion-free-updates-testing was enabled | None needed |
| VS Code, GitHub CLI, Tailscale | One tree for all Fedora releases | Nothing | None needed |
The release-agnostic repos at the bottom use one URL for every Fedora release, which is why they never 404. Anything with $releasever in the base URL is at the mercy of the build calendar each vendor keeps. This table is a snapshot. We will re-check it when Fedora 45 goes final and again two weeks later.
Step 1: Find the repo that is failing
Fedora ships skip_if_unavailable=True in /usr/share/dnf5/libdnf.conf.d/20-fedora-defaults.conf. That’s why a dead repo is a warning and not an error. Confirm the setting on your machine:
dnf --dump-main-config | grep -E "^skip_if_unavailable"
Fedora 45 reports it enabled:
skip_if_unavailable = 1
Refresh the metadata and keep only the repo name that sits above each failure. The grep -v drops the raw “Status code: 404” lines, which repeat once per mirror attempt:
sudo dnf makecache --refresh 2>&1 | grep -vE "Status code" | grep -B1 "Usable URL not found" | grep -v -- "--"
Three repos had no Fedora 45 tree on our test box:
Fedora 45 - x86_64 - VirtualBox 100% | 6.8 KiB/s | 27.6 KiB | 00m04s
>>> Usable URL not found
PostgreSQL 18 for Fedora 45 - x86_64 100% | 137.0 B/s | 584.0 B | 00m04s
>>> Usable URL not found
Hashicorp Stable - x86_64 ???% | 71.0 B/s | 314.0 B | 00m04s
>>> Usable URL not found
The same check rendered in the terminal:

Those are display names. You need the repo ID for every fix below, so map them:
dnf repo list --enabled | grep -iE "virtualbox|hashicorp|pgdg18 "
The first column is the ID:
hashicorp Hashicorp Stable - x86_64
pgdg18 PostgreSQL 18 for Fedora 45 - x86_64
virtualbox Fedora 45 - x86_64 - VirtualBox
Before pinning anything, ask the vendor which release directories exist. This loop probes the HashiCorp tree for 45, 44 and 43:
for v in 45 44 43; do printf "%s %s\n" $v $(curl -s -o /dev/null -w "%{http_code}" https://rpm.releases.hashicorp.com/fedora/$v/x86_64/stable/repodata/repomd.xml); done
A 200 means that tree has metadata. Fedora 44 is the newest one HashiCorp publishes:
45 404
44 200
43 200
Swap the URL for any other vendor. The repodata/repomd.xml path at the end stays the same for every yum-style repo.
Step 2: Fix Docker CE on Fedora 45 (missing buildx)
The Docker Fedora 45 tree exists, so the repo loads without a 404. The trap is what is inside it. Add the repo the way Docker documents it:
sudo dnf config-manager addrepo --from-repofile https://download.docker.com/linux/fedora/docker-ce.repo
The documented install command then fails on one package:
sudo dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin 2>&1 | tail -25
The 45 tree has no buildx plugin:
Updating and loading repositories:
Docker CE Stable - x86_64 100% | 23.9 KiB/s | 4.5 KiB | 00m00s
Repositories loaded.
Failed to resolve the transaction:
No match for argument: docker-buildx-plugin
You can try to add to command line:
--skip-unavailable to skip unavailable packages
List what Docker actually ships for Fedora 45:
dnf repoquery --repo=docker-ce-stable --latest-limit=1 --qf "%{name} %{version}-%{release}\n" 2>/dev/null | sort
That is five packages, while the 44 tree carries ten, including docker-buildx-plugin and docker-model-plugin:
containerd.io 2.3.6-1.fc45
docker-ce 29.8.2-1.fc45
docker-ce-cli 29.8.2-1.fc45
docker-ce-rootless-extras 29.8.2-1.fc45
docker-compose-plugin 5.6.0-1.fc45
The split that worked takes two repos. Install the core packages first, straight from the 45 tree:
sudo dnf -y install docker-ce docker-ce-cli containerd.io docker-compose-plugin
With Docker CE in place, the Fedora docker-buildx package is no way out. Try it:
sudo dnf -y install docker-buildx 2>&1 | tail -8
It requires the Fedora docker-cli, which conflicts with docker-ce-cli. dnf refuses unless you let it remove the Docker CE CLI with --allowerasing:
- package docker-buildx-0.37.1-1.fc45.x86_64 from fedora requires docker-cli, but none of the providers can be installed
- package docker-buildx-0.37.2-1.fc45.x86_64 from updates-testing requires docker-cli, but none of the providers can be installed
- problem with installed package
- installed package docker-ce-cli-1:29.8.2-1.fc45.x86_64 conflicts with docker-ce-cli provided by docker-cli-29.7.2-1.fc45.x86_64 from fedora
- package docker-cli-29.7.2-1.fc45.x86_64 from fedora conflicts with docker-ce-cli provided by docker-ce-cli-1:29.8.2-1.fc45.x86_64 from docker-ce-stable
You can try to add to command line:
--allowerasing to allow removing of installed packages to resolve problems
--skip-broken to skip uninstallable packages
Order matters here. On a box without Docker CE, nothing blocks that command: it would pull in the Fedora docker-cli, and the Docker CE install would then be the one that conflicts.
Instead, add a second Docker repo that points at the 44 tree and is allowed to offer exactly one package. The includepkgs line is the safety catch: nothing else can come from Fedora 44.
sudo dnf config-manager addrepo --id=docker-ce-f44-plugins --set=name="Docker CE plugins (Fedora 44 tree)" --set=baseurl=https://download.docker.com/linux/fedora/44/\$basearch/stable --set=gpgcheck=1 --set=gpgkey=https://download.docker.com/linux/fedora/gpg --set=includepkgs=docker-buildx-plugin
dnf writes this file to /etc/yum.repos.d/docker-ce-f44-plugins.repo:
[docker-ce-f44-plugins]
name=Docker CE plugins (Fedora 44 tree)
enabled=1
baseurl=https://download.docker.com/linux/fedora/44/$basearch/stable
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
includepkgs=docker-buildx-plugin
Install buildx:
sudo dnf -y install docker-buildx-plugin
Check which build it pulled:
rpm -q docker-buildx-plugin; sudo docker buildx version
The fc44 release tag shows where it came from:
docker-buildx-plugin-0.37.1-1.fc44.x86_64
github.com/docker/buildx v0.37.1 0b265a9f62db554fa9aba6dd19e1bd5704bc7d8a
The Fedora packages next to Docker CE, side by side:

Don’t stop at a version string. We built an image with docker buildx build from a fedora-minimal:45 base, ran it (it printed built-on-45), and brought up an nginx container with docker compose up -d that answered HTTP/1.1 200 OK on port 8080. Non-root access, SELinux bind mounts and firewall rules are covered in the Docker on Fedora guide.
Step 3: Fix the HashiCorp repo (Terraform, Packer) on Fedora 45
HashiCorp has no Fedora 45 tree at all. Add the repo the way HashiCorp documents it:
sudo dnf config-manager addrepo --from-repofile=https://rpm.releases.hashicorp.com/fedora/hashicorp.repo
The install then fails with nothing more than a missing package:
sudo dnf -y install terraform 2>&1 | grep -vE "Status code: 404" | tail -6
The repo loaded empty:
>>> Usable URL not found
Repositories loaded.
Failed to resolve the transaction:
No match for argument: terraform
You can try to add to command line:
--skip-unavailable to skip unavailable packages
Do not edit /etc/yum.repos.d/hashicorp.repo by hand. dnf5 can override a single key of one repo, and it records the change in its own file where you can see it and undo it later:
sudo dnf config-manager setopt hashicorp.baseurl=https://rpm.releases.hashicorp.com/fedora/44/\$basearch/stable
The override lands in /etc/dnf/repos.override.d/99-config_manager.repo. The [virtualbox] entry in our capture comes from the VirtualBox step below, where we disabled the Oracle repo:
# Generated by libdnf5.
# Do not modify this file manually, use dnf5 config-manager instead.
[virtualbox]
enabled=0
[hashicorp]
baseurl=https://rpm.releases.hashicorp.com/fedora/44/$basearch/stable
Install from the pinned tree:
sudo dnf -y install terraform packer
Confirm both binaries run:
terraform version | head -1; packer version | head -1; rpm -q terraform packer
Both work on Fedora 45:
Terraform v1.16.5
Packer v1.16.1
terraform-1.16.5-1.x86_64
packer-1.16.1-1.x86_64
The override file and the install, captured on the lab box:

The pin is safe here for a specific reason. file /usr/bin/terraform reports a statically linked Go binary, and ldd says “not a dynamic executable”. Nothing in it depends on a Fedora 45 library. That is the question to ask before every pin, and Step 4 shows what happens when the answer is no.
Step 4: Fix VirtualBox on Fedora 45 (use RPM Fusion, not a pin)
The Oracle repo 404s on Fedora 45 in the same way as the HashiCorp one. If you followed the Oracle instructions, the repo is already on the box:
sudo dnf config-manager addrepo --from-repofile https://download.virtualbox.org/virtualbox/rpm/fedora/virtualbox.repo
The obvious fix fails here, so watch what happens when you pin the virtualbox repo to the 44 tree and ask dnf what it would install:
sudo dnf config-manager setopt virtualbox.enabled=1 virtualbox.baseurl=http://download.virtualbox.org/virtualbox/rpm/fedora/44/\$basearch
sudo dnf install --assumeno VirtualBox-7.2 2>&1 | tail -6
Every build in the Oracle tree needs a library Fedora 45 no longer ships:
- nothing provides libvpx.so.9()(64bit) needed by VirtualBox-7.2-7.2.2_170484_fedora40-1.x86_64 from virtualbox
- nothing provides libvpx.so.9()(64bit) needed by VirtualBox-7.2-7.2.4_170995_fedora40-1.x86_64 from virtualbox
- nothing provides libvpx.so.9()(64bit) needed by VirtualBox-7.2-7.2.6_172322_fedora40-1.x86_64 from virtualbox
- nothing provides libvpx.so.9()(64bit) needed by VirtualBox-7.2-7.2.8_173730_fedora40-1.x86_64 from virtualbox
You can try to add to command line:
--skip-broken to skip uninstallable packages
Note the fedora40 in every package name: the builds Oracle serves from its 44 directory were made on Fedora 40. Fedora 44 still ships libvpx 1.15 with libvpx.so.9. Fedora 45 moved to libvpx 1.17, which provides libvpx.so.12 only. No pin can fix a missing soname.

Undo that pin and switch the Oracle repo off. Pinned, it loads fine and only produces these dependency errors. Unpinned, it 404s on every dnf run:
sudo dnf config-manager unsetopt virtualbox.baseurl
sudo dnf config-manager setopt virtualbox.enabled=0
RPM Fusion builds VirtualBox against Fedora 45 itself. Enable the free repo (the RPM Fusion setup explains the free and nonfree split):
sudo dnf -y install https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm
The akmod builds against kernel-devel for the running kernel, and the Fedora repos keep only the release build and the newest update of kernel-devel. On our box the running kernel was one update behind and kernel-devel-$(uname -r) failed with “No match for argument”. Update and boot the new kernel first:
sudo dnf upgrade --refresh
sudo systemctl reboot
Install VirtualBox, its akmod, and headers for the running kernel:
sudo dnf -y install VirtualBox akmod-VirtualBox kernel-devel-$(uname -r)
The akmod package starts the module build in the background when the install finishes. Run akmods in the foreground so you know the build is done before you load anything:
sudo akmods --kernels $(uname -r)
It reports Checking kmods exist for 7.2.8-300.fc45.x86_64 [ OK ]. On a Secure Boot machine, loading the module still fails:
sudo modprobe vboxdrv
The kernel rejects it:
modprobe: ERROR: could not insert 'vboxdrv': Key was rejected by service
The module was unsigned because the akmods signing key didn’t exist yet. Key creation hangs off akmods.service, which pulls in akmods-keygen.target at boot and runs kmodgenca -a when /etc/pki/akmods/certs/public_key.der is missing. The build that ran right after the install found no key and left the module unsigned. Starting from scratch? RPM Fusion’s Secure Boot howto runs kmodgenca -a and the mokutil --import below before any akmod is installed, which avoids the unsigned first build. Already installed? Create the key now and rebuild:
sudo kmodgenca -a
sudo akmods --force --rebuild --kernels $(uname -r)
modinfo -F signer vboxdrv should now print the key name, which on our box was repo-lab01_1791106457_0a95b74e. The kernel still rejects that key until the firmware trusts it. Queue it for MOK enrollment. You set a one-time password here and type it again in the blue MokManager screen on the next boot:
sudo mokutil --import /etc/pki/akmods/certs/public_key.der
Reboot and press a key during the short countdown when shim offers MOK management. Choose Enroll MOK, Continue and Yes, enter that password, then pick Reboot. The NVIDIA driver guide has screenshots of each MokManager screen. Back in Fedora, confirm the modules load with Secure Boot still on:
mokutil --sb-state; lsmod | grep -E "^vbox"; systemctl is-active vboxdrv; VBoxManage --version
All three VirtualBox modules loaded, and a test VM registered and deleted cleanly:
SecureBoot enabled
vboxnetadp 32768 0
vboxnetflt 49152 0
vboxdrv 774144 2 vboxnetadp,vboxnetflt
active
7.2.18_RPMFUSIONr175117
Do not switch Secure Boot off to make the error go away, because one enrollment covers every later akmod rebuild signed with this key. If a kernel module is not a hard requirement for you, KVM needs none of this: see the KVM and virt-manager guide. The VirtualBox install guide covers the vboxusers group and the Oracle Extension Pack.
Step 5: Install CUDA on Fedora 45 from the fedora44 repo
NVIDIA doesn’t use $releasever. Its repo file names the release outright, and there is no fedora45 directory. Use the fedora44 one:
sudo dnf config-manager addrepo --from-repofile=https://developer.download.nvidia.com/compute/cuda/repos/fedora44/x86_64/cuda-fedora44.repo
That repo also carries NVIDIA’s own driver packages. If your GPU driver comes from RPM Fusion, which is the path we tested, hide them from this repo the way RPM Fusion’s CUDA howto does. The quotes keep your shell from expanding the globs:
sudo dnf config-manager setopt "cuda-fedora44-$(uname -m).exclude=nvidia-driver*,cuda-drivers*,nvidia-modprobe,nvidia-persistenced,nvidia-settings,nvidia-libXNVCtrl*,nvidia-xconfig,nvidia-open,nvidia-imex,nvidia-kmod-common,libnvidia-fbc,kmod-nvidia-*-dkms,nvidia-fs*,nvidia-gds*,xorg-x11-nvidia*"
Before the exclude, dnf repoquery --repo=cuda-fedora44-x86_64 listed nvidia-driver, cuda-drivers and nvidia-open. After it, the same query returned only the toolkit package we asked about.
The real question is the compiler. Fedora 45 ships GCC 16, and nvcc refuses host compilers newer than it knows about. We installed only the compiler and runtime headers:
sudo dnf -y install cuda-nvcc-13-4 cuda-cudart-devel-13-4
CUDA 13.4 accepts GCC 16. Its host_config.h only errors out on __GNUC__ > 16. Prove it with a minimal kernel:
nano hello.cu
Paste a kernel that does nothing and a host function that prints one line:
#include <cstdio>
__global__ void k(){}
int main(){k<<<1,1>>>(); printf("compiled\n");}
Compile it with the default host compiler, no -allow-unsupported-compiler:
export PATH=/usr/local/cuda-13.4/bin:$PATH
nvcc hello.cu -o hello; echo nvcc_rc=$?; ls -l hello
The compiler exited cleanly and wrote the binary:
nvcc_rc=0
-rwxr-xr-x. 1 mercy mercy 1079528 Oct 4 09:40 hello
Older toolkits in the same repo carry their own GCC limit, so check the __GNUC__ limit in /usr/local/cuda-*/targets/x86_64-linux/include/crt/host_config.h before you pin a CUDA version below 13.4. Our lab VM has no GPU, so we did not install the driver packages from this repo and cannot vouch for them on Fedora 45. The RPM Fusion driver path in the Fedora NVIDIA guide is the one we tested on this release. Keep the exclude in place for that setup.
Step 6: Install PGDG PostgreSQL on Fedora 45 without losing your server
The install command from the PostgreSQL project uses rpm -E %fedora, and the F-45 repo RPM does not exist yet:
sudo dnf -y install https://download.postgresql.org/pub/repos/yum/reporpms/F-$(rpm -E %fedora)-x86_64/pgdg-fedora-repo-latest.noarch.rpm
dnf stops at “Failed to download files” with a Librepo “Status code: 404” error for the F-45-x86_64 path. The F-44 repo RPM installs fine, because it only drops .repo files that use $releasever:
sudo dnf -y install https://download.postgresql.org/pub/repos/yum/reporpms/F-44-x86_64/pgdg-fedora-repo-latest.noarch.rpm
The stable repos (pgdg18 down to pgdg14, plus pgdg-common) then 404 on Fedora 45. The testing tree has Fedora 45 builds. Pinning pgdg18 to the fedora-44 tree instead fails on Perl: dnf reports “nothing provides libperl.so.5.42()(64bit) needed by postgresql18-contrib-18.6-4PGDG.f44.x86_64”. Fedora 45 moved to a newer Perl, the same soname problem VirtualBox hit with libvpx.
Switch to the testing repos and turn the dead stable ones off, all in one override:
sudo dnf config-manager setopt pgdg-common-testing.enabled=1 pgdg18-updates-testing.enabled=1 pgdg-common.enabled=0 pgdg18.enabled=0 pgdg17.enabled=0 pgdg16.enabled=0 pgdg15.enabled=0 pgdg14.enabled=0
Install the server and contrib modules, initialise the cluster, and start it:
sudo dnf -y install postgresql18-server postgresql18-contrib
sudo /usr/pgsql-18/bin/postgresql-18-setup initdb
sudo systemctl enable --now postgresql-18
List what landed:
rpm -qa "postgresql*" | sort
Every package is a PGDG build for Fedora 45 (the f45 tag):
postgresql18-18.6-4PGDG.f45.x86_64
postgresql18-contrib-18.6-4PGDG.f45.x86_64
postgresql18-libs-18.6-4PGDG.f45.x86_64
postgresql18-server-18.6-4PGDG.f45.x86_64
A contrib extension proves the server and contrib builds match:
sudo -u postgres psql -c "CREATE EXTENSION pg_trgm;" -c "SELECT extname, extversion FROM pg_extension WHERE extname = 'pg_trgm';"
The extension is created and reports its version:
CREATE EXTENSION
extname | extversion
---------+------------
pg_trgm | 1.6
(1 row)
The failure mode: dnf replaces the PGDG server with Fedora’s
Keep those testing repos enabled for as long as the server is installed. We turned them off with PGDG 18 running and asked for one more extension package:
sudo dnf install --assumeno postgresql18-plpython3
dnf found no PGDG build of it. The Fedora postgresql-plpython3 package provides that name, and Fedora’s postgresql-server both provides and obsoletes postgresql18-server. dnf took them:

Read the “replacing” lines. One -y would have swapped the PGDG 18.6 server, client and contrib packages for the Fedora 18.3 builds. The damage is immediate. The PGDG server package has a %preun scriptlet (rpm -q --scripts postgresql18-server shows it) that runs systemctl disable and systemctl stop postgresql-18.service when the package is removed, so your database goes down inside that same transaction, and the PGDG server and client binaries are removed with it. The Fedora server ships postgresql.service with PGDATA=/var/lib/pgsql/data, while your cluster lives in /var/lib/pgsql/18/data. Read the transaction summary on every PostgreSQL install. The PostgreSQL on Fedora guide covers the Fedora-packaged route if you would rather not depend on the PGDG testing tree.
With the testing repos enabled, a full sudo dnf upgrade --assumeno on the same box proposed no PostgreSQL changes at all. The trap only opens when the PGDG repos that hold your installed builds go away.
These are testing builds. They carry the same 18.6 version as PGDG’s stable Fedora 44 builds, but the PostgreSQL project has not promoted them yet. Put this on a dev box now and on production once the stable Fedora 45 tree exists.
Undo each workaround when the vendor catches up
Every fix above is temporary. Leave a pin in place after the vendor ships Fedora 45 builds and you keep installing packages built for an older release. The signal to undo differs per vendor, because Docker never had a 404 in the first place:
| Vendor | Undo when | Undo |
|---|---|---|
| HashiCorp | The Step 1 probe loop returns 200 for 45 | sudo dnf config-manager unsetopt hashicorp.baseurl |
| Docker CE | dnf repoquery --repo=docker-ce-stable docker-buildx-plugin prints a .fc45 build | sudo rm /etc/yum.repos.d/docker-ce-f44-plugins.repo |
| PGDG | The probe returns 200 for both download.postgresql.org/pub/repos/yum/18/fedora/fedora-45-x86_64/ and .../yum/common/fedora/fedora-45-x86_64/ (append repodata/repomd.xml) | sudo dnf config-manager setopt pgdg-common.enabled=1 pgdg18.enabled=1 pgdg-common-testing.enabled=0 pgdg18-updates-testing.enabled=0 |
| Oracle VirtualBox | Oracle publishes a 45 tree built against libvpx 1.17 | Remove the RPM Fusion VirtualBox and akmod-VirtualBox packages first, then sudo dnf config-manager unsetopt virtualbox.enabled |
| NVIDIA CUDA | A fedora45 repo appears | Remove cuda-fedora44.repo, run sudo dnf config-manager unsetopt cuda-fedora44-x86_64.exclude, then add the fedora45 repo file and set the same exclude on its repo ID (dnf repo list shows it) |
We ran the HashiCorp undo on the lab box. dnf repo info hashicorp went straight back to the $releasever URL, https://rpm.releases.hashicorp.com/fedora/45/x86_64/stable. Do not run the PGDG undo before PGDG publishes the stable 45 tree, or you’re back in the replacement trap above.
Today that Docker query prints nothing, so leave the extra repo alone. We deleted it on the lab box anyway to see what happens: docker-buildx-plugin-0.37.1-1.fc44 stayed installed, docker buildx version still answered, and dnf upgrade proposed no change to it. You only lose buildx updates. dnf replaces the package on a normal upgrade once the 45 tree carries a build with a higher version-release. The .fc45 release tag sorts above .fc44, so the same upstream version is enough.
Upgrading from Fedora 44 rather than installing fresh? Check the 45 tree of each vendor with the probe loop from Step 1 before you start the Fedora 44 to 45 upgrade. Every repo that builds its URL from $releasever starts asking for the 45 directory as soon as the upgrade runs. Vendor .rpm files you download and install by hand are a separate problem from repo 404s, covered in the NOKEY fix.