Re: Debian Etch: problems with unauthenticated packages

"RS Chakravarti" <[email protected]> writes:

> I have been using apt-move in Woody and Sarge,
> so I know how to edit /etc/apt/sources.list.
> The only problem is encryption.

No;  this is  not  encryption, but  *authentication*.  You can  safely
ignore the warning messages if you trust the repository. 

> I ran (as root) "gpg --gen-key".

You need not be root to do this.  All you need is a key, and it can be
generated by any user.

The normal procedure within Debian is to generate a key for the 
archive, which is valid for only one year, and this key is 
authenticated by a Debian Developer. 

> Now the only thing to be done is to fill in the entry
> "SIGNINKEY="
> in /etc/apt-move.conf (the instruction given is
> "set this to key name to be used for signing
> release files").

You need to add the PUBLIC key generated using `gpg --gen-key` to 
/etc/apt/trusted.gpg file, using the `apt-key` command.

Here is how:-

Say, he key id (the 8  didig number you get) is 12121212; issue the
command (as root)

# gpg --export 12121212 | apt-key add -
   
Note the pipe (|) and the hyphen (-) at the end of the command line.

> I have set "PKGCOMP=none".

Does not matter.

HTH.

-- 
Mahesh T. Pai   ||  http://paivakil.blogspot.com
He is wise who knows the sources of knowledge --
who knows who has written and where it is to be found.
   --A.A. Hodge