On Mon, Oct 2, 2017 at 11:25 AM, Alexander Kanavin <[email protected]> wrote: > On 10/02/2017 05:18 PM, Otavio Salvador wrote: >> >> When we wish to use the package feed for local development, it does >> not uses GPG signed feeds by default but dnf uses package signature >> check. We need to configure the GPG signature check out so it works >> out of box. >> >> With this patch, installing non-signed packages works: >> >> $: dnf install <package> > > > This patch is still wrong, and for exact same reasons. You didn't change it > at all compared to v1! I already spelled the reasons out, so I can repeat > them quickly: > > The patch adds 'gpgcheck=0' when repo feed signing is disabled, which will > also disable package verification at runtime, ignoring the altogether > different build setting controlling that. As I've already explained to you, > package signing and feed signing are two different things, with their own > sets of options. > > Test case: > > - enable package signing, disable package feed signing, check that the > resulting dnf.conf file has package verification enabled (it won't).
It does not work as you are explaining. Without this patch I /need/ to use: dnf install --nogpgcheck nano to install nano. dnf has it enabled. root@qemux86-64:~# grep gpg /etc/dnf/dnf.conf gpgcheck=1 -- Otavio Salvador O.S. Systems http://www.ossystems.com.br http://code.ossystems.com.br Mobile: +55 (53) 9981-7854 Mobile: +1 (347) 903-9750 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
