https://bugzilla.novell.com/show_bug.cgi?id=654346
https://bugzilla.novell.com/show_bug.cgi?id=654346#c0
Summary: repository in Buildservice
openSUSE:/11.3:/Contrib/standard/ is broken
Classification: openSUSE
Product: openSUSE.org
Version: unspecified
Platform: Other
OS/Version: openSUSE 11.3
Status: NEW
Severity: Major
Priority: P5 - None
Component: Download Infrastructure
AssignedTo: lrupp@novell.com
ReportedBy: david.werner@iws.uni-stuttgart.de
QAContact: lrupp@novell.com
Found By: ---
Blocker: ---
User-Agent: Mozilla/5.0 (compatible; Konqueror/4.5; Linux) KHTML/4.5.2
(like Gecko) SUSE
The Repository
http://download.opensuse.org/repositories/openSUSE:/11.3:/Contrib/standard/
is broken.
The repokey repodata/repomd.xml.key is:
pub 2048R/3DBDC284 2008-11-07 openSUSE Project Signing Key
while the packages as 3dto3d-3.5-62.1.i586.rpm are signed with key ID:
3c51f898.
Automatic update fails, autoyast fails if want wants not to switch to insecure
settings etc, user can get irritated by not matching keys. Thus content of
repository renders quite unusable to a serious person.
additional remarks:
Please do not change to often keys of existing repositories and if change is
unavoidable do it in the right way.
There should be also infrastructure which tells admins and users about which
keys are in use or have changed at which time. package keys should also be
signed, that an user can verify signatures by a web of trust? Is that too
complicated?
Reproducible: Always
Steps to Reproduce:
1. apply 'gpg repomd.xml.key'
2. apply 'rpm -qp 3dto3d-3.5-62.1.i586.rpm'
3.
Actual Results:
keyids of repository-key and signature within rpm are different
Expected Results:
keyids of repository-key and signature within rpm within rom should/must be imo
the same
Existing installations procedures like autoyast with it as add-on repository
and update-procedures fail or get noisy.
--
Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
