Re: centralized metadata for security

On Fri, 7 Nov 2008, Muayyad AlSadi wrote:

>> If you have out of sync. mirrors frequently enough that this is
>> a problem, you should also turn on --unique-md-filenames.
> the file I'm talking about (repomd.xml) is not affected by
> --unique-md-filenames.


but repomd.xml isn't at issue, actually. The metadata you're concerned 
with is impacted by --unique-md-filenames.


>> Better yet, provide a cryptographic signature of the repomd.xml - which yum now supports.
>
>> Or, alternatively, provide all the mirror info in a file like repomd.xml - but in the metalinks format, which yum also now supports.
>
> does fedora uses those two feature yet

I believe the metalinks one will be available and fedora SHOULD be gpg 
signing repomd.xml files in F10 though I'm not positive what the status is 
on that.

-sv