Re: [Security-Discuss] Missing/Wrong gpg Keys

On 8-Jan-05, at 4:40 AM, Simon Oosthoek wrote:

>>>>> So, is there a simple method to keep all the keys in the rpm DB
>>>>> uptodate or in sync for my 120 PCs?
>>>>>
>>>> Ummm... you weren't paying attention.  The package was signed by our
>>>> key.  There is a problem with older versions of rpm that don't 
>>>> replace
>>>> the header sig.  The policy is in place.  It's the tools that are
>>>> faulty.
>>>
>>> How should this be fixed properly? Do I need to change something or 
>>> is
>>> this
>>> waiting for an update to the tools?
>>
>> Or you could just FTP the pubkey2 file and "rpm --import" it and be
>> done with it.
>
> So the tools are broken, tools for ensuring the security of security 
> fixes
> and bugfixes and to make it possible this be done automatically. And 
> instead
> of updating the tools you suggest fixing it manually, like I'm using 
> gentoo
> or slackware... (I had actually considered doing this, but I waited a 
> bit
> more in hope of a proper fix)

Yes, well, some of us have more pressing things to deal with.  No 
offense, but this is very low on my list of priorities.

> Vincent, I respect your work very much, but I'd say that Mandrakesoft 
> should
> care a bit more about keeping up the user-friendlyness of the distro.

Of course we should, and when time permits, it will get done.  I can't 
run off and delay/interrupt the important stuff to do minor things like 
this or babysit the ml archives or the many other things people are 
clamoring for my attention for.  There is such a thing as prioritizing 
things.

> I can file a bugreport about this, but it would help if you could help 
> me
> narrow down the problem to a specific tool and perhaps even a solution 
> so
> the bug report is specific enough to be fixed before the support 
> period of
> 10.0 has run out :-/

The problem would most likely be in urpmi.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}