hi all, gpg / rpm --checksig are driving me crazy.... i have two systems... suse 7.3 the one, suse 8.0 the other... i have downloaded to both systems the latest webmin 1.060 webmin-1.060-1.noarch.rpm, and they gpg/pgp key from the author http://switch.dl.sourceforge.net/sourceforge/webadmin/webmin-1.060-1.noarch.... http://www.webmin.com/jcameron-key.asc the problem is, the one system gives me errors when rpm --checksig webmin-1.060-1.noarch.rpm the other system works fine... both have gpg installed and i have imported the public key of the webmin author... i dont see any difference... see here: the correctly working system (suse 7.3) # gpg --list-keys -v /root/.gnupg/pubring.gpg ------------------------ gpg: NOTE: signature key 9C800ACA expired Sat Oct 19 15:17:53 2002 CEST pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key gpg: NOTE: signature key 9C800ACA expired Sat Oct 19 15:17:53 2002 CEST sig 9C800ACA 2000-10-19 SuSE Package Signing Key sub 2048g/8495160C 2000-10-19 [expires: 2002-10-19] sig 9C800ACA 2000-10-19 SuSE Package Signing Key pub 1024D/11F63C51 2002-02-28 Jamie Cameron sig 11F63C51 2002-02-28 Jamie Cameron sub 1024g/1B24BE83 2002-02-28 sig 11F63C51 2002-02-28 Jamie Cameron --------------- then rpm: # rpm --checksig webmin-1.060-1.noarch.rpm -v webmin-1.060-1.noarch.rpm: MD5 sum OK: 547eb528952c96eec64ae3910e9c5aa5 gpg: Signature made Wed Feb 5 00:48:41 2003 CET using DSA key ID 11F63C51 gpg: Good signature from "Jamie Cameron " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. gpg: Fingerprint: 1719 003A CE3E 5A41 E2DE 70DF D97A 3AE9 11F6 3C51 everything fine here, signature's been correctly checked on the suse 7.3 system... ------------------------------------------------------------------------- ------------------------------------------------------------------------- now in contrast the suse 8.0 system: # gpg --list-keys -v /root/.gnupg/pubring.gpg ------------------------ pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team sig B1CA3C45 1999-03-06 [User id not found] sig 3D25D3D9 1999-03-06 SuSE Security Team sig 000AABA4 2001-06-06 [User id not found] sig CEFC9215 1999-08-15 [User id not found] sig B0DFF780 2000-11-21 [User id not found] pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key sig 9C800ACA 2000-10-19 SuSE Package Signing Key sig 000AABA4 2001-01-25 [User id not found] sig 3D25D3D9 2001-01-25 SuSE Security Team sig 9C800ACA 2002-02-13 SuSE Package Signing Key sub 2048g/8495160C 2000-10-19 [expires: 2006-02-12] sig 9C800ACA 2000-10-19 SuSE Package Signing Key sig 9C800ACA 2002-02-13 SuSE Package Signing Key pub 1024D/AFB66D7C 2002-04-28 fou4s build key sig AFB66D7C 2002-04-28 fou4s build key sub 1024g/8B6432D7 2002-04-28 sig AFB66D7C 2002-04-28 fou4s build key pub 1024D/11F63C51 2002-02-28 Jamie Cameron sig 11F63C51 2002-02-28 Jamie Cameron sub 1024g/1B24BE83 2002-02-28 sig 11F63C51 2002-02-28 Jamie Cameron ------------- now the rpm output: rpm -v --checksig webmin-1.060-1.noarch.rpm webmin-1.060-1.noarch.rpm: MD5 sum OK: 547eb528952c96eec64ae3910e9c5aa5 gpg: Signature made Wed Feb 5 00:48:41 2003 CET using DSA key ID 11F63C51 gpg: Can't check signature: public key not found ---------------- jeez... am i stupid or not seeing the problem here? what the heck.... the pub key of jcameron@webmin.com is there on both systems... so what the heck is wrong here??? the md5 hash key is the very same on both systems, so the downloaded files are exactly the same... so why the heck cant suse 8.0 verify the file then???? can anyone help?? thanks and regards, andy