Re: [Security-Discuss] problem with 2005 cpio update

Vincent Danen wrote:

>
> On 12-Jul-05, at 3:56 PM, Rolf Pedersen wrote:
>
>> $ rpm -K cpio-2.6-3.1.102mdk.i586.rpm
>> cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa sha1 md5 gpg OK
>>
>> $ rpm -K ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/ 
>> updates/LE2005/main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
>> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
>> main_updates/./cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa sha1 MD5  GPG 
>> NOT OK
>>
>>
>> The downloaded file checks out OK locally.  Guess it is a problem  
>> with rpm -K not working over http, or something.  Thanks.
>
>
> Wierd.  Do you always do an rpm -K over the network before  
> installing?  Or did urpmi give you a bad message or something that  
> made you try that?
>
> I wasn't even aware rpm could do that, but I'm not sure why you'd run  
> -K on the file before downloading it.
>

I used to do rpm queries on packages over the network (I use urpm tools 
much more and rpm much less, now) and tried -K in this instance as I 
didn't have a copy of the rpm locally.  I can't recall whether it ever 
worked for me before but my motivation was that I might be able to find 
out what I needed to know about the integrity of the package w/o having 
to download the whole rpm, then have a no-longer-needed file on my 
disk.  Actually, I would expect urpmi to warn me about a bad GPG or 
md5sum but it was acting in a way I had never seen before (asking for a 
dependency that was installed), so I tried to {-K|--checksig} the rpm, 
in a way that is, apparently, not supported. :)

 From the manual:

[..]
-p, --package PACKAGE_FILE
              Query  an  (uninstalled) package PACKAGE_FILE.  The 
PACKAGE_FILE
              may be specified as an ftp or http style URL, in which 
case  the
              package  header  will  be  downloaded and queried.  See 
FTP/HTTP
              OPTIONS for information on rpm's internal ftp  and  http  
client
              support.
[..]

[..]
FTP/HTTP OPTIONS
       rpm  can  act  as  an  FTP  and/or  HTTP client so that packages 
can be
       queried or installed from the internet.   Package  files  for  
install,
       upgrade,  and query operations may be specified as an ftp or http 
style
       URL:

       ftp://USER:PASSWORD@HOST:PORT/path/to/package.rpm

       If the :PASSWORD portion is omitted, the password will be 
prompted  for
       (once  per user/hostname pair). If both the user and password are 
omit-
       ted, anonymous ftp is used.  In all cases, passive (PASV) ftp 
transfers
       are performed.
[..]

hmmm...
Maybe it is an ftp/http thing?

$ rpm -K 
http://gulus.usherbrooke.ca/pub/distro/Mandrakelinux/official/updates/10.2/main_updates/cpio-2.6-3.1.102mdk.i586.rpm
http://gulus.usherbrooke.ca/pub/distro/Mandrakelinux/official/updates/10.2/main_updates/cpio-2.6-3.1.102mdk.i586.rpm: 
(sha1) dsa sha1 md5 gpg OK


Anyway, a pretty marginal concern, for me, atm ;)

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________