Re: detached gpg signature on repomd.xml

On Mon, 2006-08-28 at 14:24 +0200, Christoph Thiel wrote:
> On Mon, 28 Aug 2006, seth vidal wrote:
> 
> > On Mon, 2006-08-28 at 10:58 +0200, Christoph Thiel wrote:
> > > On Sat, 26 Aug 2006, seth vidal wrote:
> > > 
> > > > as a result of a rather lengthy and ranging discussion elsewhere it came 
> > > > out that a gpg signature of repomd.xml would heighten the security of 
> > > > using these type of repositories.
> > > 
> > > That's exactly what we have been doing with our repos for SUSE Linux 
> > > Enterprise 10 and openSUSE ;)
> > > 
> > > Check out:
> > > http://en.opensuse.org/Secure_Installation_Sources#The_.22repomd.22_or_.22YUM.22_format
> > > 
> > > 
> > 
> > Oh - in that case:
> >   do you already have any code you'd like to share? :)
> 
> Quoting http://en.opensuse.org/Secure_Installation_Sources
> 
>   "This is very simple to do:
> 
>       cd <repository directory>
>       createrepo .
>       gpg -a --detach-sign repodata/repomd.xml
> 
>   You can also use -b instead of --detach-sign for it is shorter.
> 
>   To supply your GPG key right with the source:
> 
>       gpg -a --export <your key id> > repodata/repomd.xml.key"
> 

I actually meant on the verification end, not on the signing side.

sorry, I realized that wasn't clear.
-sv