from localhost (jalapeno [127.0.0.1])
	by spamassassin.taint.org (Postfix) with ESMTP id AC66A16F7C
	for <zzzz@localhost>; Wed,  9 Oct 2002 10:52:11 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for zzzz@localhost (single-drop); Wed, 09 Oct 2002 10:52:11 +0100 (IST)
from egwn.net (ns2.egwn.net [193.172.5.4]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g998YdK26404 for
    <zzzz-rpm@spamassassin.taint.org>; Wed, 9 Oct 2002 09:34:39 +0100
from mail.addix.net (kahless.addix.net [195.179.139.19]) by
    egwn.net (8.11.6/8.11.6/EGWN) with ESMTP id g998UHf30709 for
    <rpm-list@freshrpms.net>; Wed, 9 Oct 2002 10:30:17 +0200
from wolf359.ision-cic.de (soran.int.addix.net [212.51.6.15]
    (may be forged)) by mail.addix.net (8.9.3/8.9.3) with SMTP id KAA26671 for
    <rpm-list@freshrpms.net>; Wed, 9 Oct 2002 10:29:47 +0200
Re: Apt repository authentication: it's time
From rpm-list-admin@freshrpms.net  Wed Oct  9 10:53:11 2002

>     What's it take to ensure we're covered against this kind of
Well, I am checking the packet signatures while building the apt-tree.
Not very pretty, not very fast, but it works.

from localhost (jalapeno [127.0.0.1])
	by spamassassin.taint.org (Postfix) with ESMTP id 7447D16F7F
	for <zzzz@localhost>; Wed,  9 Oct 2002 10:52:16 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for zzzz@localhost (single-drop); Wed, 09 Oct 2002 10:52:16 +0100 (IST)
from egwn.net (auth02.nl.egwn.net [193.172.5.4]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g9999BK27619 for
    <zzzz-rpm@spamassassin.taint.org>; Wed, 9 Oct 2002 10:09:11 +0100
from python (gw01.es3.egwn.net [212.9.66.13]) (authenticated) by
    egwn.net (8.11.6/8.11.6/EGWN) with ESMTP id g9993Df23422 for
    <rpm-list@freshrpms.net>; Wed, 9 Oct 2002 11:03:13 +0200
From rpm-list-admin@freshrpms.net  Wed Oct  9 10:53:15 2002

Once upon a time, Brian wrote :
>      OK, it's now time to work out the PGP securing of apt repository
>      traffic. I've never gotten anything but "sitename.whatever will not
>      be authenticated" until running Redhat 8.0 when I get something
>      about having "No Key" for various files.
I don't think gpg signing my repositories will help anything, as it will
just ensure that my passphrase was typed to confirm the md5 signatures of
all pgklists and srclists. Basically, you'll then just be sure that it's me
who generated the files, and this will of course prevent automating the
process of updating the apt repository when Red Hat updates show up.
In Red Hat Linux 8.0 though, the warnings about "No Key" appear until you
import the right gpg public keys directly with rpm, for example :
rpm --import /usr/share/doc/apt-0.5.4cnc7/RPM-GPG-KEY
(this will import my key, which is used to sign all freshrpms.net packages)
Hopefully it is possible to the tell rpm to install *only* packages who
verify against an imported gpg key? This for me would be the optimal way to
ensure integrity with the way things curently work.
Matthias
--
Clean custom Red Hat Linux rpm packages : http://freshrpms.net/
Red Hat Linux release 7.3 (Valhalla) running Linux kernel 2.4.18-10acpi
Load : 0.14 0.18 0.17
_______________________________________________
RPM-List mailing list <RPM-List@freshrpms.net>
http://lists.freshrpms.net/mailman/listinfo/rpm-list