[Security-Discuss] problem with 2005 cpio update

I updated my --update source and used urpmi, as I always do, to try the 
update.  There was an unsatisfied /sbin/rmt, which exact file I could 
not find in the distro.  The rpm on my mirror, ftp.ciril.fr, did not 
pass the GPG check, even after I (re)installed the pubkey.  After 
downloading the file, urpmi prompted to install the apparent dependency 
and I chose tar, which got cpio upgraded but tar, it turns out, was 
already installed.  The date on the cpio rpm on the mirror is

cpio-2.6-3.1.102mdk.i586.rpm  	108 KB  07/06/2005  11:19:00 PM

which seems strange, as that is 5 days before the date of the advisory.

# urpmi --clean --skip kernel-source --update --auto-select
Some package requested cannot be installed:
cpio-2.6-3.1.102mdk.i586 (due to unsatisfied /sbin/rmt)
Continue? (Y/n)
# urpmf /sbin/rmt
tar:/sbin/rmt-tar
rmt:/sbin/rmt-dump
openafs-server:/usr/sbin/rmtsysd
star:/usr/sbin/rmt-star
# rpm -K
ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm:
(sha1) dsa sha1 MD5 GPG NOT OK
# rpm --import
ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/main_updates/media_info/pubkey
# rpm -K
ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm:
(sha1) dsa sha1 MD5 GPG NOT OK
# wget
ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
# md5sum cpio-2.6-3.1.102mdk.i586.rpm
9db16a5fa7bfc85aa7bb2d199ab5d825 cpio-2.6-3.1.102mdk.i586.rpm
# urpmi cpio-2.6-3.1.102mdk.i586.rpm
One of the following packages is needed:
1- tar-1.15.1-2mdk.i586 : A GNU file archiving program (to upgrade)
2- rmt-0.4b37-2mdk.i586 : Provides certain programs with access to
remote tapedevices (to upgrade)
What is your choice? (1-2) 1

installing cpio-2.6-3.1.102mdk.i586.rpm
Preparing... #############################################
1/1: cpio
# rpm -q tar
tar-1.15.1-2mdk
# rpm -qa --last | head
cpio-2.6-3.1.102mdk Tue 12 Jul 2005 08:56:53 AM PDT
gpg-pubkey-22458a98-3969e7de Tue 12 Jul 2005 08:47:39 AM PDT
gcombust-0.1.55-4mdk Fri 08 Jul 2005 06:41:51 PM PDT
cdrecord-cdda2wav-2.01.01-0.a01.6.1.102mdk Fri 08 Jul 2005 06:41:50
PM PDT
[..]

# rpm -q cpio
cpio-2.6-3.1.102mdk

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________