> On Aug 29, 2016, at 10:19 PM, Kacper Kornet <[email protected]> wrote:
>
> On Tue, Aug 30, 2016 at 12:53:49AM +0200, Tomasz Pala wrote:
>> Should this work this way? Is it upstream bug or PLD-specific? How about
>> RH-rpm?
>
>
>> ~: strace -erecvfrom rpm -qp keepassx-2.0.2-2.x86_64.rpm
>> keepassx-2.0.2-2.x86_64
>> +++ exited with 0 +++
>
>
>> ~: strace -erecvfrom rpm --nosignature -qp keepassx-2.0.2-2.x86_64.rpm
>> recvfrom(12, "\25\24\201\200\0\1\0\5\0\0\0\0\2ha\4pool\16sks-keyserv"...,
>> 2048, 0, {sa_family=AF_INET, sin_port=htons(53),
>> sin_addr=inet_addr("8.8.4.4")}, [16]) = 124
>> recvfrom(12, "\"\27\201\200\0\1\0\5\0\0\0\0\2ha\4pool\16sks-keyserv"...,
>> 65536, 0, {sa_family=AF_INET, sin_port=htons(53),
>> sin_addr=inet_addr("8.8.4.4")}, [16]) = 184
>> keepassx-2.0.2-2.x86_64
>> +++ exited with 0 +++
>
> According to Jeff it's a feature. See his answer:
>
> http://lists.pld-linux.org/mailman/pipermail/pld-devel-en/2015-June/024405.html
>
MANDATORY signature checking (using the non-repudiable signature that has been
generated since 2010 or so) is the feature.
At that point —no signature has very limited usage cases:
1) packages _NOT_ generated by RPM5, or not signed:
=> Sign the package and import the pubkey used.
2) pubkeys not imported and/or hkp:// disabled
==> devise your own pubkey distribution
If — as claimed — that —nosignature now has inverted meaning,
then that is a bug with POPT option processing (which likely is doing XOR
on a static bit that has now changed from 1 -> 0)
The path I am on is eliminating —nosignature entirely permitting
signing and pubkey management through any means you choose,
where RPM supplies a non-repudiable signature fallback sufficiently
to attempt MANDATORY signature verification.
hth
73 de Jeff
> --
> Kacper Kornet
> _______________________________________________
> pld-devel-en mailing list
> [email protected]
> http://lists.pld-linux.org/mailman/listinfo/pld-devel-en
_______________________________________________
pld-devel-en mailing list
[email protected]
http://lists.pld-linux.org/mailman/listinfo/pld-devel-en
