Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
tisdagen den 28 januari 2003 17.08 skrev Warly: > Oden Eriksson <[EMAIL PROTECTED]> writes: > > måndagen den 27 januari 2003 22.54 skrev Todd Lyons: > >> -BEGIN PGP SIGNED MESSAGE- > >> Hash: SHA1 > >> > >> > >> Vincent will correct me if I'm wrong, but there are only three keys that > >> are used to officially sign packages in Main. Those three keys get > >> installed automatically into root's keyring when the gnupg package is > >> installed. If a developer happens to also package some Contrib rpm, the > >> sig will be good. If a community contributor packages the Contrib rpm, > >> then the end user who's installing it must go and manually retrieve > >> (just once) the packager's public key. > > > > So I guess resigning my packages while the upload procedure is running > > with one of this 3 keys is out of the question then? > > At present contrib are not signed. > > One of the idea for future is to have different keys and allow the user to > select which keys are valid for packages, for example: > > - Stable release > - Contrib stable release > - Development release > - Security updates > > e.g. the user will have to explicitely select development key to be able to > install cooker packages on a stable release. > > It is not likely that we have time to do this for 9.1. I know very little about this, but could we make a rpm package containing contributers public keys and put that one in main? -- Regards // Oden Eriksson, Deserve-IT.com
Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Oden Eriksson wrote on Mon, Jan 27, 2003 at 11:49:40PM +0100 : > > > So I guess resigning my packages while the upload procedure is running with > one of this 3 keys is out of the question then? That I do not know. I'm guessing that Warly or FredL could answer that question with much more authority (or even prove part of what I said previously wrong). Blue skies... Todd - -- MandrakeSoft USA http://www.mandrakesoft.com Mandrake: An amalgam of good ideas from RedHat, Debian, and MandrakeSoft. All in all, IMHO, an unbeatable combination. --Levi Ramsey on Cooker ML Mandrake Cooker Devel Version, Kernel 2.4.20-2mdk -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+NuHXlp7v05cW2woRAjmwAJ9DwHOIp6EERQ10KZ/Ajeq3szt/wQCeP9mD yzUyEX8M88rcEElxZH8e2fQ= =z8GQ -END PGP SIGNATURE-
Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
Warly wrote: > Oden Eriksson <[EMAIL PROTECTED]> writes: > > At present contrib are not signed. > > One of the idea for future is to have different keys and allow the user to select > which keys are valid for packages, for example: > > - Stable release > - Contrib stable release > - Development release > - Security updates > The hope was that it would be implemented per-urpmi-source, so that for example if I was maintaining a bunch of desktops with 3rd-party software, I could associate a company key with the company urpmi source, and packages would be updated automatically (if I run urpmi --update from cron). PLF would also gain from this? > e.g. the user will have to explicitely select development key to be able to install > cooker packages on a stable release. > That's also a good thing, seen too many "cdbakeoven-1.8.9-5mdk doesn't work on 9.0" when I have -4mdk in club for 9.0 and -5mdk in cooker contrib ... > It is not likely that we have time to do this for 9.1. > Pity. Buchan -- |--Another happy Mandrake Club member--| Buchan MilneMechanical Engineer, Network Manager Cellphone * Work+27 82 472 2231 * +27 21 8828820x121 Stellenbosch Automotive Engineering http://www.cae.co.za GPG Key http://ranger.dnsalias.com/bgmilne.asc 1024D/60D204A7 2919 E232 5610 A038 87B1 72D6 AC92 BA50 60D2 04A7
Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
Oden Eriksson <[EMAIL PROTECTED]> writes: > måndagen den 27 januari 2003 22.54 skrev Todd Lyons: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> >> Vincent will correct me if I'm wrong, but there are only three keys that >> are used to officially sign packages in Main. Those three keys get >> installed automatically into root's keyring when the gnupg package is >> installed. If a developer happens to also package some Contrib rpm, the >> sig will be good. If a community contributor packages the Contrib rpm, >> then the end user who's installing it must go and manually retrieve >> (just once) the packager's public key. > > So I guess resigning my packages while the upload procedure is running with > one of this 3 keys is out of the question then? At present contrib are not signed. One of the idea for future is to have different keys and allow the user to select which keys are valid for packages, for example: - Stable release - Contrib stable release - Development release - Security updates e.g. the user will have to explicitely select development key to be able to install cooker packages on a stable release. It is not likely that we have time to do this for 9.1. -- Warly
Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
måndagen den 27 januari 2003 22.54 skrev Todd Lyons: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Oden Eriksson wrote on Mon, Jan 27, 2003 at 02:47:29AM +0100 : > > > The following packages have bad signatures: > > > /home/Mandrake/contrib/RPMS/chkrootkit-0.38-2mdk.i586.rpm > > > I hope this is just a bad signature. Can someone enlighten me? This is > > > one package that must be trusted to be useful. > > > > I have my key at: http://d-srv.com/Cooker/ > > Still to this day I can't really figure out why Mandrake seems to lack my > > key... (?) > > Vincent will correct me if I'm wrong, but there are only three keys that > are used to officially sign packages in Main. Those three keys get > installed automatically into root's keyring when the gnupg package is > installed. If a developer happens to also package some Contrib rpm, the > sig will be good. If a community contributor packages the Contrib rpm, > then the end user who's installing it must go and manually retrieve > (just once) the packager's public key. So I guess resigning my packages while the upload procedure is running with one of this 3 keys is out of the question then? -- Regards // Oden Eriksson, Deserve-IT.com
Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Oden Eriksson wrote on Mon, Jan 27, 2003 at 02:47:29AM +0100 : > > The following packages have bad signatures: > > /home/Mandrake/contrib/RPMS/chkrootkit-0.38-2mdk.i586.rpm > > I hope this is just a bad signature. Can someone enlighten me? This is one > > package that must be trusted to be useful. > I have my key at: http://d-srv.com/Cooker/ > Still to this day I can't really figure out why Mandrake seems to lack my > key... (?) Vincent will correct me if I'm wrong, but there are only three keys that are used to officially sign packages in Main. Those three keys get installed automatically into root's keyring when the gnupg package is installed. If a developer happens to also package some Contrib rpm, the sig will be good. If a community contributor packages the Contrib rpm, then the end user who's installing it must go and manually retrieve (just once) the packager's public key. Blue skies... Todd - -- MandrakeSoft USA http://www.mandrakesoft.com cat /boot/vmlinuz > /dev/dsp #for great justice Mandrake Cooker Devel Version, Kernel 2.4.20-2mdk -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+NaqGlp7v05cW2woRAnGuAJwMMSn+dO8w4Jmj/+txksKN/Df8gQCfYhMh 2g4lGTn9oQKcC0kL9fi1Mmw= =U7lH -END PGP SIGNATURE-
Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
On Sunday 26 January 2003 08:47 pm, Oden Eriksson wrote: > måndagen den 27 januari 2003 02.23 skrev Salane: > > The following packages have bad signatures: > > /home/Mandrake/contrib/RPMS/chkrootkit-0.38-2mdk.i586.rpm > > > > I hope this is just a bad signature. Can someone enlighten me? This is > > one package that must be trusted to be useful. > > I have my key at: http://d-srv.com/Cooker/ > > Still to this day I can't really figure out why Mandrake seems to lack my > key... (?) thanks it matched. For those interested, trusting and lazy. with wordwrap off lynx -source http://www.deserve-it.com/Cooker/.oden.eriksson.gpg | gpg --import
Re: [Cooker] Re: [Contrib-Rpm] chkrootkit-0.38-2mdk
måndagen den 27 januari 2003 02.23 skrev Salane: > The following packages have bad signatures: > /home/Mandrake/contrib/RPMS/chkrootkit-0.38-2mdk.i586.rpm > > I hope this is just a bad signature. Can someone enlighten me? This is one > package that must be trusted to be useful. I have my key at: http://d-srv.com/Cooker/ Still to this day I can't really figure out why Mandrake seems to lack my key... (?) -- Regards // Oden Eriksson, Deserve-IT.com
