I am trying to make a patch to install an update on my set of suse 8.1 machines from my local update server. I have made a build-key for myself, I have added it to /usr/lib/rpm/gnupg/pubring.gpg I have signed the patch file and the rpm with this build key. When I run online update I get this error... jdsai:~ # online_update -s Types of patches to be installed: security recommended Product: Java Desktop Version: 2003 Architecture: i386 Language: de URL: nfs://192.168.1.104/tftpboot/updates Path: ./i386/update/Java-Desktop/2003/patches Error retrieving patches: ERROR(InstSrc:error) Here is my patch file: jdsai:/tmp # cat /root/COE-vc-patch.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ## ## Patch description of patch coe version checker Kind: security Shortdescription.english: EDS COE Version check Longdescription.english: Provides the ability to check what base version and patched version the machine is at. Size: 5101 UpdateOnlyInstalled: false Postscript: Packages: ## ## -----> coe-version-check <----- ## Filename: coe-version-check.rpm Series: noarch Label: coe-version-check Size: 5101 6536 RpmGroup: System/Packages Copyright: EDS Version: 1.0.0b Requires: gtk sh-utils fileutils rpmlib -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFANqpqMDPDHXXSOZARAqmAAKCIf5IK8IpbzBmHWOw+mY0bB3/AUgCggRDO tJjmyYWG8ByloXDsN4oByAc= =rBm0 -----END PGP SIGNATURE----- If I strip off the suse build signature and resign with my signature those patch files work fine. Does anybody have any clues? Todd Ness EDS - Platform Infrastructure Engineering Phone:+1-303-255-4530 mobile : 303-263-2589 pager mail: nessts@vtext.com
I am trying to make a patch to install an update on my set of suse 8.1 machines from my local update server.
I have made a build-key for myself, I have added it to /usr/lib/rpm/gnupg/pubring.gpg I have signed the patch file and the rpm with this build key. You don't need to sign the patch file. There are only a few places where signing of the patch file is actually useful (script for version comparison, that might do something malicious).
I'd take a look at fou4s. [http://fou4s.gaugusch.at] If you add the gpg key as fully trusted key to the RPM keyring, fou4s will do updates like this automatic. Fou4s checks the signature of the patch description file only when it is useful and therefore makes it easier to write own patch files. Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \
participants (2)
-
Markus Gaugusch
-
Ness, Todd