Mailinglist Archive: opensuse-security (12 mails)

["Carlos E. R." <robin.listas@xxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On Wednesday, 2009-04-01 at 18:43 +0200, Michael Ströder wrote:

> Thomas R. Jones wrote:
> > On Wed, 2009-04-01 at 17:41 +0200, Michael Ströder wrote:
> > > What's up with this?
> > >
> > > -------------------- snip --------------------
> > > # zypper refresh
> > > Repository 'openSUSE-11.1-Non-Oss' is up to date.
> > > Signature verification failed for file 'repomd.xml' from repository
> > > 'openSUSE-11.1-Update'.
> > > Warning: This might be caused by a malicious change in the file!
> > > Continuing might be risky. Continue anyway? [yes/NO]:
> > > -------------------- snip --------------------
> >
> > Data corruption failure during transfer? Works on my system.
>
> Hmm, I had tried it several times from different systems. Now it worked
> probably from another mirror. IMO zypper should display from which
> mirror server the repo file was obtained if signature verification failed.

I thought that metadata was obtained directly from the redirector in the 
case of OS11.1, not from the mirrors. Is repomd.xml considered metadata?

- -- 
Cheers,
       Carlos E. R.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAknT/4QACgkQtTMYHG2NR9UGYwCfVFDlK7PikYi0WqZbFc2yFoU0
KSYAnjTB+U3FJQZ/m/XOrvc5qoOKEDqL
=fIMz
-----END PGP SIGNATURE-----