Re: [Security-Discuss] Missing/Wrong gpg Keys

On Tue, 28 Dec 2004, Vincent Danen wrote:

>
> On 28-Dec-04, at 3:50 AM, Juergen Holm wrote:
>
>> I'm new to this list, because of:
>> 
>> The updated packages *qt3*3.2.3-19.5.100mdk  for 10.0 are signed by 
>> "Mandrake Linux KDE Team <kde-7Aj/b8uzpy6AmYF/[email protected]>" Key ID dd684d7a26752624
>> but I don't find the public key.
>
> Is this from community?  It can't be from updates.

It can:

Date: 18 Aug 2004 23:23:55 -0000
From: Mandrake Linux Security Team <[email protected]>
Reply-To: security-discuss-J4tZAbal8pkzaQFa27Lw39BPR1lH4CV8@public.gmane.org
To: security-announce-J4tZAbal8pkzaQFa27Lw39BPR1lH4CV8@public.gmane.org
Subject: [Security Announce] MDKSA-2004:085 - Updated qt3 packages fix
multiple vulnerabilities

Sisko:RPMS>rpm --checksig libqt3-3.2.3-19.5.100mdk.i586.rpm
libqt3-3.2.3-19.5.100mdk.i586.rpm: (SHA1) DSA sha1 md5 gpg NOT OK
Sisko:RPMS>pwd
/usr/rpm/Mandrakelinux/official/updates/10.0/RPMS

For the Key ID see above. Updates are mirrored from ftp.club-internet.fr

>> Why isn't there a webfrontend to the MDK-Keyserver?
>> Exist a MDK-keyserver? URL?
>
> No, there doesn't (anymore).

Right, not necessary if packages have KNOWN signs.


>> I suggest:
>> Publish a list of gpg-Keys and do NOT allow packages in 
>> Mandrakelinux/official/updates signed with other keys.
>
> IIRC, packages going into community should be re-signed with a valid devel 
> key.

Ok, please resign the .../updates/10.0/RPMS/*qt3* packages.

How about an automatic check (rpm --checksig) for each new package in 
updates/ ?
The *qt3* prevent an automatic update of other sec updates, and THIS is 
very dangerous!

>
>> Subscribing to this list may also be a problem, because the 
>> "mandrakesecure.net" link on the bottom of 
>> http://archives.mandrakelinux.com/ is dead!
>
> Yes, because mandrakesecure.net no longer exists.

Yes, I saw the the "Not Found"


mfg,jh

In case of mail-probs (Anti-SPAM-conf) mail to jholm-e4sNDE6/[email protected]

----------------- IT Physik / Universitaet Goettingen ------------------
  _______________________   ________.--'-`--._____  Tel:  +49 551 399363
|____==================_)  \_'===================` FAX:  +49 551 399263
        _,--___.-|__|-.______|=====/  `---'         Post: Dr. J. A. Holm
        `---------._          ~~~~~|                      Friedrich-Hund-Platz 1
                    `-._ -  -  - ,'                       37077 Goettingen
                        \_____,-'                         Deutschland
         PGP-Key:  http://www.Theorie.Physik.Uni-Goe.de/jh.html
                         "Tee. Earl Grey. Heiss!"

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________