diff --git a/xCAT-test/unit/buildrpms_openeuler.t b/xCAT-test/unit/buildrpms_openeuler.t
index 5781bdc2a..78d79bbcc 100644
--- a/xCAT-test/unit/buildrpms_openeuler.t
+++ b/xCAT-test/unit/buildrpms_openeuler.t
@@ -35,7 +35,9 @@ my $driver = "$root/driver.pl";
 write_file($driver, <<'PERL');
 BEGIN {
     require File::Slurper;
+    require Parallel::ForkManager;
     no warnings 'redefine';
+    *Parallel::ForkManager::new = sub { die "BUILD_BOUNDARY\n" } if $ENV{BUILD_STOP};
     my $write = \&File::Slurper::write_text;
     *File::Slurper::write_text = sub {
         my ($path, @rest) = @_;
@@ -74,6 +76,27 @@ my $el = run_builder('rocky', '9.6', '9.6', 'x86_64', '--setup_local_repos');
 is($el->{status}, 0, 'existing EL local repository setup completes');
 like($el->{core}, qr{/dist/rocky\+epel-10-x86_64/rpms$}m, 'existing EL default target is unchanged');
 like($el->{dep}, qr{/el9/x86_64$}m, 'existing EL dependency path is unchanged');
+for my $missing (qw(core dep)) {
+    local $ENV{BUILD_MISSING_KEY} = $missing;
+    my $result = run_builder('openEuler', '24.03 (LTS-SP3)', '24.03', 'x86_64', '--setup_local_repos');
+    isnt($result->{status}, 0, "setup rejects the missing $missing exported key");
+    like($result->{stderr}, qr/Missing openEuler repository signing key/, 'setup identifies the absent trust input');
+    is($result->{core} . $result->{dep}, '', 'setup fails before writing either repository configuration');
+}
+{
+    local $ENV{BUILD_STOP} = 1;
+    my $unsigned = run_builder('openEuler', '24.03 (LTS-SP3)', '24.03', 'x86_64', '--package', 'xCAT-client');
+    isnt($unsigned->{status}, 0, 'unsigned native binary builds are rejected');
+    like($unsigned->{stderr}, qr/openEuler binary repository builds require --gpg-sign/, 'the CLI reports the signing requirement');
+    unlike($unsigned->{stderr}, qr/BUILD_BOUNDARY/, 'unsigned native builds stop before the build scheduler');
+    for my $case (['native signed', 'openEuler', '--gpg-sign'], ['native source only', 'openEuler', '--source-only'],
+                  ['legacy unsigned', 'rocky']) {
+        my ($label, $id, @args) = @$case;
+        my $result = run_builder($id, '24.03 (LTS-SP3)', '24.03', 'x86_64', '--package', 'xCAT-client', @args);
+        like($result->{stderr}, qr/BUILD_BOUNDARY/, "$label reaches the existing build scheduler");
+        unlike($result->{stderr}, qr/repository builds require --gpg-sign/, "$label preserves its signing policy");
+    }
+}
 my $install = run_builder('openEuler', '24.03 (LTS-SP3)', '24.03', 'x86_64', '--install_deps');
 is($install->{status}, 0, 'full native prerequisite entry point completes through process boundaries');
 unlike($install->{commands}, qr/epel|crb|codeready/i, 'native prerequisites do not enable EL repositories');
@@ -100,10 +123,11 @@ done_testing();
 sub run_builder {
     my ($id, $version, $version_id, $arch, @args) = @_;
     my $fixture = tempdir(DIR => $root, CLEANUP => 1);
-    make_path("$fixture/build-utils/lib/XCAT", "$fixture/bin", "$fixture/repos", "$fixture/native-input",
+    make_path("$fixture/build-utils/lib/XCAT", "$fixture/bin", "$fixture/repos", "$fixture/native-input", "$fixture/locks", "$fixture/home",
         "$fixture/dep/openeuler24.03sp3/x86_64", "$fixture/dep/openeuler24.03/ppc64le", "$fixture/dep/el9/x86_64");
-    my $body = slurp_repo_file('buildrpms.pl');
+    my $body = read_file($ENV{XCAT_TEST_BUILDRPMS} || repo_path('buildrpms.pl'));
     $body =~ s{'/etc/os-release'}{'$fixture/os-release'}g;
+    $body =~ s{/var/lock/}{$fixture/locks/}g;
     write_file("$fixture/buildrpms.pl", $body);
     copy(repo_path('build-utils/lib/XCAT/BuildUtils.pm'), "$fixture/build-utils/lib/XCAT/BuildUtils.pm") or die $!;
     copy($driver, "$fixture/driver.pl") or die $!;
@@ -111,11 +135,19 @@ sub run_builder {
     write_file("$fixture/Gitepoch", "1756000000\n");
     write_file("$fixture/native-input/buildinfo.txt", "BUILD_TARGET=openeuler-24.03sp3-x86_64\n");
     write_file("$fixture/os-release", "ID=$id\nVERSION=\"$version\"\nVERSION_ID=$version_id\n");
+    for my $target ('openeuler-24.03sp3-x86_64', 'openeuler-24.03-ppc64le') {
+        my $subdir = openeuler_repo_subdir($target);
+        for my $key (['core', "$fixture/dist/$target/rpms"], ['dep', "$fixture/dep/$subdir"]) {
+            make_path("$key->[1]/repodata");
+            write_file("$key->[1]/repodata/repomd.xml.key", 'existing exported key')
+                unless ($ENV{BUILD_MISSING_KEY} || '') eq $key->[0];
+        }
+    }
     write_file("$fixture/bin/dnf", "#!/bin/sh\nprintf '%s\\n' \"\$*\" >> \"\$BUILD_FIXTURE/commands\"\nexit \"\${BUILD_DNF_FAILURE:-0}\"\n");
     write_file("$fixture/bin/systemctl", "#!/bin/sh\nexit 0\n");
     write_file("$fixture/bin/rpmdev-setuptree", "#!/bin/sh\nexit 0\n");
     chmod 0755, map {"$fixture/bin/$_"} qw(dnf systemctl rpmdev-setuptree);
-    local %ENV = (%ENV, BUILD_FIXTURE => $fixture, BUILD_ARCH => $arch, PATH => "$fixture/bin:$ENV{PATH}");
+    local %ENV = (%ENV, HOME => "$fixture/home", BUILD_FIXTURE => $fixture, BUILD_ARCH => $arch, PATH => "$fixture/bin:$ENV{PATH}");
     my $pid = fork();
     die $! unless defined $pid;
     if (!$pid) {
@@ -128,7 +160,8 @@ sub run_builder {
     my $status = $? >> 8;
     my $result = {status => $status, core => read_file("$fixture/repos/xcat-core-local.repo"),
         dep => read_file("$fixture/repos/xcat-dep.repo"), commands => read_file("$fixture/commands"), stderr => read_file("$fixture/stderr")};
-    diag(read_file("$fixture/stderr")) if $status && !$ENV{BUILD_DNF_FAILURE} && !grep {$_ eq '--merge-core-repos'} @args;
+    diag(read_file("$fixture/stderr")) if $status && !$ENV{BUILD_DNF_FAILURE} && !$ENV{BUILD_MISSING_KEY}
+        && !$ENV{BUILD_STOP} && !grep {$_ eq '--merge-core-repos'} @args;
     return $result;
 }
 sub write_file {
diff --git a/xCAT-test/unit/buildrpms_release_openeuler.t b/xCAT-test/unit/buildrpms_release_openeuler.t
index 443658c60..980335b99 100644
--- a/xCAT-test/unit/buildrpms_release_openeuler.t
+++ b/xCAT-test/unit/buildrpms_release_openeuler.t
@@ -127,6 +127,8 @@ sub run_builder {
         : "ID=rocky\nVERSION=9.6\nVERSION_ID=9.6\n");
     write_file("$fixture/mock/$target.cfg", "config_opts['root'] = '$target'\n");
     write_file("$fixture/bin/createrepo_c", "#!/bin/sh\nexit 0\n");
+    write_file("$fixture/bin/rpmsign", "#!/bin/sh\nexit 0\n");
+    write_file("$fixture/bin/gpg", "#!/bin/sh\nexit 0\n");
     write_file("$fixture/bin/cp", "#!/bin/sh\n[ \"\$XCAT_RELEASE_TEST_FAILURE\" != cp ] || exit 41\nexec /usr/bin/cp \"\$@\"\n");
     write_file("$fixture/bin/tar", <<'SH');
 #!/bin/sh
@@ -142,7 +144,7 @@ fi
 exec /usr/bin/tar "$@"
 SH
     write_file("$fixture/bin/mock", mock_command());
-    chmod 0755, map {"$fixture/bin/$_"} qw(mock createrepo_c cp tar);
+    chmod 0755, map {"$fixture/bin/$_"} qw(mock createrepo_c rpmsign gpg cp tar);
     if ($failure) {
         write_file("$fixture/home/rpmbuild/SOURCES/xCAT-release-2.19.0.tar.gz", 'prior archive');
         unlink "$fixture/xCAT-release/xcat-core.repo" if $failure eq 'missing-core';
@@ -156,6 +158,7 @@ SH
         XCAT_RELEASE_TEST_FAILURE => ($failure && $failure eq 'copy' ? 'cp' : $failure || ''));
     my @target = $default ? () : ('--target', $target);
     my ($status, $output) = run($fixture, $^X, 'buildrpms.pl', '--package', 'xCAT-release', @target,
+        (defined($subdir) ? '--gpg-sign' : ()),
         '--release', 'releasecontract', '--mock-uniqueext', 'release-contract', '--nproc', '1');
     write_file("$fixture/builder-output", $output);
     return {fixture => $fixture, status => $status, output => $output};