On Thu, 2003-06-12 at 12:06, Charles A Edwards wrote: > On 12 Jun 2003 11:53:00 -0700 > James Sparenberg <[EMAIL PROTECTED]> wrote: > > > You're right, but my understanding from Warly during the various > > beta > > and rc cycles was that anything in release contrib is resigned with > > MDK's sig before release. (at least there where a lot of people > > checking this point for him.) with cooker contrib yes... this is a > > problem. (and people are always noting bad sigs there.) However > > nothing new gets added to release contrib does it? It would seem that > > updates would go into update not straight into contrib. But maybe I'm > > mistaken. > > > Many/most contrib rpms Do Not contain the builders signature Only the > Mandrake sig. > These will all install without error. > It is Only the contrib rpms which Have been signed by the builder that > give the sig error during installation. > > You have 2 choice you can import the sigs from a key.server for you root > keyring or you can disregard the sig error. > > Disregarding the error will in no way compromise security as all contrib > rpms are Still verified to contain the Mandrake sig. > > > Charles
But if I'm reading correctly doesn't re-sign say that if you sign a package and I sign a package then if the end user has either key it will show up correctly? Either way it seems rather silly to me to have items on the contribs disk which don't have a key sig that the end user can use. Hardly user friendly. James
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
