Trying to download images using the oc-mirror plugin from quay.io to disk on a RHEL8 and RHEL9 OS with fips enabled generates the error:

error: error retrieving mapping information for quay.io/openshift-release-dev/ocp-release@sha256:dd58c982a2166dcac5ce8f390f8b26b36df27ac765c4e012a670a9c0bac909df: Unable to load configmap verifier: the config map openshift-config-managed/release-verification has an invalid key "verifier-public-key-redhat" that must be a GPG public key: openpgp: invalid data: tag byte does not have MSB set: openpgp: invalid data: tag byte does not have MSB set    

./oc-mirror version --output=yaml
clientVersion:
  buildDate: "2024-09-12T09:59:41Z"
  compiler: gc
  gitCommit: c9123030d5df99847cf3779856d90ff83cf64dcb
  gitTreeState: clean
  gitVersion: 4.17.0-202409120935.p0.gc912303.assembly.stream.el9-c912303
  goVersion: go1.22.5 (Red Hat 1.22.5-1.el9) X:strictfipsruntime
  major: ""
  minor: ""
  platform: linux/amd64    

1. Install oc-mirror 4.17.0-202409120935.p0.gc912303.assembly.stream.el9-c912303
2.  oc-mirror --config=./imageset-config.yaml file://updates     

Found: updates/oc-mirror-workspace/src/publish
Found: updates/oc-mirror-workspace/src/v2
Found: updates/oc-mirror-workspace/src/charts
Found: updates/oc-mirror-workspace/src/release-signatures
No metadata detected, creating new workspace
Using proxy <REDACTED> to request updates from https://api.openshift.com/api/upgrades_info/v1/graph?arch=amd64&channel=stable-4.13&id=2c53cb87-f9dd-43f0-bd28-0a7e217e5bf2&version=4.12.40
error: error retrieving mapping information for quay.io/openshift-release-dev/ocp-release@sha256:dd58c982a2166dcac5ce8f390f8b26b36df27ac765c4e012a670a9c0bac909df: Unable to load configmap verifier: the config map openshift-config-managed/release-verification has an invalid key "verifier-public-key-redhat" that must be a GPG public key: openpgp: invalid data: tag byte does not have MSB set: openpgp: invalid data: tag byte does not have MSB set    

No errors should be seen when performing disk2mirror    

imageset-config.yaml link in the comment.

When testing locally with fips disabled the image download finishes without errors. 

$ sudo sysctl crypto.fips_enabled
crypto.fips_enabled = 0