Re: [Security-Discuss] Missing/Wrong gpg Keys

On Sat, 8 Jan 2005, Simon Oosthoek wrote:

>> Or you could just FTP the pubkey2 file and "rpm --import" it and be
>> done with it.
>
> So the tools are broken, tools for ensuring the security of security fixes
> and bugfixes and to make it possible this be done automatically. And instead
> of updating the tools you suggest fixing it manually, like I'm using gentoo
> or slackware... (I had actually considered doing this, but I waited a bit
> more in hope of a proper fix)
>
> Vincent, I respect your work very much, but I'd say that Mandrakesoft should
> care a bit more about keeping up the user-friendlyness of the distro.
>
> I can file a bugreport about this, but it would help if you could help me
> narrow down the problem to a specific tool and perhaps even a solution so
> the bug report is specific enough to be fixed before the support period of
> 10.0 has run out :-/


You are right!

After all this quirks about gpg keys is use the following solution to have 
all important on all of my pc (# >100):

I've a script in /etc/cron.daily wich call urpmi.update and
urpmi --auto-select --auto. I also habe an gpg-dir (/etc/rpm/gpg) on all 
host where are alle keys are stored an kept in sync with cfengine.
To import these keys into the rpm-DB I call now my script urpmi_key2rpm 
before urpmi --auto-select --auto.

--- urpmi_key2rpm ---
#!/bin/bash
# Copy all public-keys from urpmi gpg to rpm database if needed
# Retrieve list of rpm keys from the file $LIST_OF_RPMS if this isn't 
older
# then 2 days and exist. Otherwise do a slow rpm -qa query
#
# jh, Jan 2005.
# holm-cReBFXHS9TI9HBOmPq+WUkOITlckZahNbaYZWgcc/[email protected]
#
# ps: this code should go into urpmi.update

# Home of system wide GPG keys. Kept in sync with cfengine for all hosts.
export GNUPGHOME=/etc/rpm/gnupg
LIST_OF_RPMS=/var/log/rpmpkgs

export urpmi_keys=$(gpg  --list-public-keys |tr 'A-Z' 'a-z'|sed -n 
's/^pub.*[^\/]*\/\([a-z0-9]*\).*/\1/p')


# How old are $LIST_OF_RPMS if exists
typeset -i last_modified=-1
[ -r $LIST_OF_RPMS ] && last_modified=$(expr $(date "+%s") - $(stat -c 
"%Y" $LIST_OF_RPMS))

# $last_modified valid an < 2 days?
if  [ $last_modified -ge 0 -a $last_modified -lt 172800 ];then
    rpm_keys=$(grep ^gpg- $LIST_OF_RPMS|cut -f3 -d-)
else
    rpm_keys=$(rpm -qa gpg-*|cut -f3 -d-)
fi


rpm_db_updated=

# Check all urpmi_keys are in rpm db
for i in $urpmi_keys
do
   if echo $rpm_keys|tr ' ' '\n'|grep -q "^$i";then
       :
   else
      key_file=/tmp/${0##*/}.$$
      gpg --export --armor $i >$key_file
      rpm --import $key_file
      rm $key_file
      rpm_db_updated=y
   fi
done

[ "$rpm_db_updated" = y -a -x /etc/cron.daily/rpm ] && /etc/cron.daily/rpm
--------

Hope this helps


mfg,jh

In case of mail-probs (Anti-SPAM-conf) mail to jholm-e4sNDE6/[email protected]

----------------- IT Physik / Universitaet Goettingen ------------------
  _______________________   ________.--'-`--._____  Tel:  +49 551 399363
|____==================_)  \_'===================` FAX:  +49 551 399263
        _,--___.-|__|-.______|=====/  `---'         Post: Dr. J. A. Holm
        `---------._          ~~~~~|                      Friedrich-Hund-Platz 1
                    `-._ -  -  - ,'                       37077 Goettingen
                        \_____,-'                         Deutschland
         PGP-Key:  http://www.Theorie.Physik.Uni-Goe.de/jh.html
                         "Tee. Earl Grey. Heiss!"

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________