unsigned packages - again

Hi,

I have a question regarding signing of jpackage packages.

I've seen Richard Newton's email about this, I'm running into this issue 
too.

Most packages in JPackage are signed with the key that's also bundled in 
the jpackage-release package.

But some packages are unsigned - just a few of them, but that breaks yum 
installs (and I would rather not turn off signature checking).

In my case, I've encountered this for 
apache-commons-logging-1.1.3-1.jpp6.noarch.rpm

An earlier version of the package is signed (1.1.1-18)

I can see the unsigned packages have been mostly built on 
linux.fritz.box, while packages with proper signature were mostly built 
on flat.netmindz.net (according to the RPM BuildHost information).

Would anyone have some insight into what is happening and why?

And can you please update the insigned packages to be signed?


Cheers,
Vlad

PS: I am running a scan to see which packages are signed and which are 
not.  So far (in alphabetical order), I could find these:

> activeio3-3.1.1-1.jpp6.noarch.rpm
> activeio3-javadoc-3.1.1-1.jpp6.noarch.rpm
> apache-bval-0.4-2.jpp6.noarch.rpm
> apache-bval-javadoc-0.4-2.jpp6.noarch.rpm
> apache-commons-codec-1.8-1.jpp6.noarch.rpm
> apache-commons-codec-javadoc-1.8-1.jpp6.noarch.rpm
> apache-commons-codec-repolib-1.8-1.jpp6.noarch.rpm
> apache-commons-daemon-1.0.15-1.jpp6.noarch.rpm
> apache-commons-daemon-javadoc-1.0.15-1.jpp6.noarch.rpm
> apache-commons-daemon-repolib-1.0.15-1.jpp6.noarch.rpm
> apache-commons-logging-1.1.3-1.jpp6.noarch.rpm
> apache-commons-logging-javadoc-1.1.3-1.jpp6.noarch.rpm
> apache-commons-logging-manual-1.1.3-1.jpp6.noarch.rpm
> apache-commons-pool-1.5.7-1.jpp6.noarch.rpm
> apache-commons-pool-javadoc-1.5.7-1.jpp6.noarch.rpm
> apache-commons-pool-manual-1.5.7-1.jpp6.noarch.rpm
> apache-commons-pool-repolib-1.5.7-1.jpp6.noarch.rpm
> apache-commons-pool-tomcat5-1.5.7-1.jpp6.noarch.rpm

... plus the tomcat7 packages at version 7.0.54-1 (scan is still ongoing 
but this is another one I know about...)

-- 
Vladimir Mencl, Ph.D.
E-Research Services and Systems Consultant
BlueFern Computing Services
University of Canterbury
Private Bag 4800
Christchurch 8140
New Zealand

http://www.bluefern.canterbury.ac.nz
mailto:vladimir.mencl-F+z8Qja7x9Xokq/[email protected]
Phone: +64 3 364 3012
Mobile: +64 21 997 352
Fax: +64 3 364 3002