https://bugzilla.novell.com/show_bug.cgi?id=752105 https://bugzilla.novell.com/show_bug.cgi?id=752105#c1 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|security-team@suse.de |mvyskocil@suse.com --- Comment #1 from Ludwig Nussel 2012-03-14 08:47:13 CET --- That's up to the individual project maintainers. I guess they had a reason to create a new gpg key. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=752105 https://bugzilla.novell.com/show_bug.cgi?id=752105#c3 Frank Schäfer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|schaefer.frank@gmx.net | --- Comment #3 from Frank Schäfer 2012-03-14 18:13:22 UTC --- Interesting. But this bug report is not only about the JAVA-repo, it's just on example. As far as I understand, the idea of signing repositories is to increase security. But when the PGP-keys are changing often, the only result is confused/annoyed users (take a look at the warning message that appears !). Most users don't know how to check the new keys and of course they don't know why the key changed. Guess what people are doing... This will in fact decrease security, because people stop taking the messages serious. Which leads to the following question: is openSUSE/Novell taking the key changes serious ? Shouldn't someone from openSUSE/Novell should check what's going in the repos... Are you sure that all the key changes were just accidents ? ;-) So please, minimize PGP-key changes. If a key changes, there should be a simple method to verify the new key. If that's not possible, I suggest to abbolish PGP-signing. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=752105 https://bugzilla.novell.com/show_bug.cgi?id=752105#c5 --- Comment #5 from Adrian Schröter 2012-09-04 09:52:04 UTC --- Sorry, but I dunno what I should do here. The gpg key is under control of the project owners. Feel free to reopen when something is needed in OBS itself. (but not allowing the project owners to change their key is no way either...) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.