Re: upgrading from rh7.2 to 7.3 -- dependency problem

On Sun, 2002-08-11 at 02:06, Greg Kurtzer wrote:
> BTW, Apt rocks! I have found that it is better then even RPM for figuring out
> dependencies! It is not as user friendly, and does not have as many
> usability features. The only thing that it does that GRAB needs to do is
> package verification using PGP|GPG. Any volunteers?


The GPG sig checking shouldnt be all that difficult to do.  Poking
around a little it looks like the version of rpm in redhat 7.3 doesnt
have gpg sig verification enabled...just md5 checking. But my limbo
system seems to know about gpg sigs.  I'd imagine the best way to do it
would be to run the rpm --checksig command after the download
step...right before the upgrade/install attempt.  But like I said im not
sure GPG is working in an rpm version prior to limbo.

The big issue is whether or not you have grab try to install vendor keys
on the gpg keyring.  If you don't worry about that, just have a
verification step after download.

On a related note.  Can you make a little logic change in the version
nunber ordering so that something like 1.0rc3 is understood as being an
older version to 1.0.  

-jef