Problem

GIM69276S ** RECEIVE PROCESSING FAILED. THE GIMZIP PACKAGE IS NOT DIGITALLY SIGNED. USER <USERID> IS NOT AUTHORIZED TO DOWNLOAD OR USE GIMZIP PACKAGES THAT ARE NOT DIGITALLY SIGNED

With the maintenance delivered under APAR IO29474 (applicable to z/OS 3.2 / SMP/E V3R7 for z/OSMF Software Management updates), SMP/E now disables SHA-1 verification by default.

Mandatory Verification: For digitally signed GIMZIP packages, SMP/E now strictly performs digital signature verification using SHA-256.

• Deprecation of SHA-1: The following commands and utilities no longer support SHA-1 verification
  • RECEIVE ORDER
  • RECEIVE FROMNETWORK
  • RECEIVE FROMNTS
  • GIMGTPKG program

Resolution

To bypass the new default SMP/E restrictions introduced by APAR IO29474 and continue receiving or installing legacy, unsigned packages, system administrators must provision an explicit SAF authorization specifically permitting unsigned GIMZIP packages.

Example under RACF:

RDEFINE FACILITY GIM.ACTION.ALLOW_UNSIGNED_GIMZIP UACC(NONE)

PERMIT GIM.ACTION.ALLOW_UNSIGNED_GIMZIP CLASS(FACILITY) ID(<USERID>) ACCESS(UPDATE)

SETROPTS RACLIST(FACILITY) REFRESH