Re: [Security-Discuss] problem with 2005 cpio update

On 12-Jul-05, at 3:56 PM, Rolf Pedersen wrote:

>>> The rpm on my mirror, ftp.ciril.fr,  did not pass the GPG check,  
>>> even after I (re)installed the pubkey.
>>>
>>
>>
>>> [..]
>>>
>>> # rpm -K
>>> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/ 
>>> LE2005/ main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
>>> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/ 
>>> LE2005/ main_updates/./cpio-2.6-3.1.102mdk.i586.rpm:
>>> (sha1) dsa sha1 MD5 GPG NOT OK
>>>
>>
>>
>> Wierd.  Not sure why it's failing:
>>
>> [qateam@mercury RPMS]$ rpm -K cpio-2.6-3.1.102mdk.i586.rpm
>> cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa sha1 md5 gpg OK
>>
>
>
>
>> [..]
>>
>
>
>>
>> The thing that concerns me is the GPG key thing.  It shouldn't  
>> give  you that error about a failed sig.  It doesn't here.
>>
>>
> $ rpm -K cpio-2.6-3.1.102mdk.i586.rpm
> cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa sha1 md5 gpg OK
>
> $ rpm -K ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/ 
> updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
> main_updates/./cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa sha1 MD5  
> GPG NOT OK
>
>
> The downloaded file checks out OK locally.  Guess it is a problem  
> with rpm -K not working over http, or something.  Thanks.

Wierd.  Do you always do an rpm -K over the network before  
installing?  Or did urpmi give you a bad message or something that  
made you try that?

I wasn't even aware rpm could do that, but I'm not sure why you'd run  
-K on the file before downloading it.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}