[softwaremgmt] setup own repo
Trying to set up an own repo I have run into the problem of zypper not accepting my private key signature. Following the instructions at http://en.opensuse.org/Secure_Installation_Sources I should have successfully created all necessary files: cd <repository directory> createrepo . gpg -a --detach-sign repodata/repomd.xml gpg -a --export <your key id> > repodata/repomd.xml.key ls repodata/ filelists.xml.gz primary.xml.gz repomd.xml.asc repomd.xml.key other.xml.gz repomd.xml repomd.xml.asc.oss However zypper refuses to use my repo:
zypper refresh --force Xorg-anc Forcing raw metadata refresh Retrieving repository 'Xorg-anc' metadata [error] Repository 'Xorg-anc' is invalid. File /var/tmp/TmpFile.OGmlRL doesn't contain public key data Please check if the URIs defined for this repository are pointing to a valid repository. Skipping repository 'Xorg-anc' because of the above error. Could not refresh the repositories because of errors.
Searching for similar errors on the web I have found out that zypper might have a problem with my gpg version. The oss repos repomd.xml.asc.oss starts like the following -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) while my own repomd.xml.asc looks like this: -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.12 (GNU/Linux) ..... Will I have to use an elder gpg version or should I try sth. else? -- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
On Wed, Sep 16, 2009 at 07:54:44AM +0200, Elmar Stellnberger wrote:
Trying to set up an own repo I have run into the problem of zypper not accepting my private key signature. Following the instructions at http://en.opensuse.org/Secure_Installation_Sources I should have successfully created all necessary files:
cd <repository directory> createrepo . gpg -a --detach-sign repodata/repomd.xml gpg -a --export <your key id> > repodata/repomd.xml.key
ls repodata/ filelists.xml.gz primary.xml.gz repomd.xml.asc repomd.xml.key other.xml.gz repomd.xml repomd.xml.asc.oss
However zypper refuses to use my repo:
zypper refresh --force Xorg-anc Forcing raw metadata refresh Retrieving repository 'Xorg-anc' metadata [error] Repository 'Xorg-anc' is invalid. File /var/tmp/TmpFile.OGmlRL doesn't contain public key data Please check if the URIs defined for this repository are pointing to a valid repository. Skipping repository 'Xorg-anc' because of the above error. Could not refresh the repositories because of errors.
Searching for similar errors on the web I have found out that zypper might have a problem with my gpg version. The oss repos repomd.xml.asc.oss starts like the following -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux)
while my own repomd.xml.asc looks like this: -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.12 (GNU/Linux) .....
Will I have to use an elder gpg version or should I try sth. else?
And how does your repomd.xml.asc start? also BEGIN PGP SIGNATURE? ALso what does repomd.xml.key contain? Ciao, Marcus -- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
repomd.xml.key -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.12 (GNU/Linux) mI0ESrB6NQEEALobbzzi+KmPSjZbCSOp6fJi5nHbheXuNQEqjEOBdA5mF1TG3hEf AxLh5u/UeMaYGcBbObl1TLF+R8GtsTYxCKgHh8NZpn6mIax/5wr2ciLLINPIHg/V xYoZwMHexn0cfnAV60IG0/E+EeB9dUVIVrCrqo5AIcuzoZiYAAFgnlYPABEBAAG0 QEVsbWFyIFN0ZWxsbmJlcmdlciAoaHR0cDovL3d3dy5lbHN0ZWwuY29tKSA8ZXN0 ZWxsbmJAZWxzdGVsLmNvbT6ItgQTAQIAIAUCSrB6NQIbAwYLCQgHAwIEFQIIAwQW AgMBAh4BAheAAAoJEHH1c6+xtQovk5sEAJBiCODr/WrSk/m0U1mfbRBn1n8P5oBK X3mnTnCwo7vR5q9fVNPtgRlIG+Mx1O7la9UwcRxYPLgbn6UFAg8W0pR95fTKTLnH UdHyzefeTEQ4J8w4rtZWvEjNrwExdXV+NFfuvP4bpB9hxwr9Nxx0v00MR/jP2din bjEc5Z+9+SnguI0ESrB6NQEEAP4V6ZO6TIQnyQi97p5Pu6cSNZm26G35FNQhI7c5 OOltQDLKZhBJEY0iLDWbOj9mNC/Z9yKokOUYEICs0uNjFeS/7cvN2xuLAMJUZSzL tv9x4iUg5Xq5Fzx6XeOOmaGaZRT/QxLvvYmbM32HlkexVYPb+7LyvNAcAvxc6Ye/ oixlABEBAAGInwQYAQIACQUCSrB6NQIbDAAKCRBx9XOvsbUKL6iJBAC3AH/9zvYo B5Y+ouY05II2W1KElp16rKYjGk0sPvx4mKn7fiGllGQQ/b73+0dLfJgj/lzRwfRY NApj2nQhSPwGIvuqLIWlvhXrh0sQwV6hV8mOC4FZzI1jVTGcT3yl4B6BB5XsPnW0 nvgVgzYkObV0WmK2NnlTnp/cMp8WQHEX5Q== =37xl -----END PGP PUBLIC KEY BLOCK----- repomd.xml.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.12 (GNU/Linux) iJwEAAECAAYFAkqwemcACgkQcfVzr7G1Ci9o5gQAqrDPUgcLV8Z0F4nv3Z9iWR0r S5LnTNdV8AVyjLOTc80+FzEAx55hxLRpsspVd2h0TcFmbjebLI3fOE93xpaezYAl aOKGF4fzIZn4DFLqSspjzzezEQH2Ct0HDsK+abnDc3oL3iyGs1JWi+knLk1JPGdq ANZWvy/2AKkik744T4I= =7uxu -----END PGP SIGNATURE----- Have tried it with different RSA key lengthes (1024,2048,4096) but none of them has worked. The length of the os-oss key seems to be in between 1024 and 2048: -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUASX3sH7iLL9Q9vcKEAQhTDwgA0mqfzc9XfYXttte1hl0VEbo16WzG 8beJQEGMu2fHRVjPLKVypE9ceM/2eDe81CPKwjgNmGFG91lWXzFrpw/7x9sP/aeN 02CdjcoZwz2LavCsRCClQ2Qo3YzoqzA9ZfZ902c5t0m0dJAEqoCahE9HoJ3ekcxt XhqKPGqGAptNpZBwWuTv1nC5T0OoN2nrXGzbh56UTRm6VFY1Sng3i93Di767mvON Cnwmdv+C0GiZbJpo7QFnl6WErJR5qC3UHB+jfDUUebqqj74JFKKg7mPqFuajLJi8 68ZZgtv3YTiMScBtZxmw4d08/8/IPMYT6SU91/0/CYxd+Gj30WGZFCJ/YQ== =GiRm -----END PGP SIGNATURE----- Am 15.09.2009 23:10, schrieb Marcus Meissner:
On Wed, Sep 16, 2009 at 07:54:44AM +0200, Elmar Stellnberger wrote:
Trying to set up an own repo I have run into the problem of zypper not accepting my private key signature. Following the instructions at http://en.opensuse.org/Secure_Installation_Sources I should have successfully created all necessary files:
cd <repository directory> createrepo . gpg -a --detach-sign repodata/repomd.xml gpg -a --export <your key id> > repodata/repomd.xml.key
ls repodata/ filelists.xml.gz primary.xml.gz repomd.xml.asc repomd.xml.key other.xml.gz repomd.xml repomd.xml.asc.oss
However zypper refuses to use my repo:
zypper refresh --force Xorg-anc Forcing raw metadata refresh Retrieving repository 'Xorg-anc' metadata [error] Repository 'Xorg-anc' is invalid. File /var/tmp/TmpFile.OGmlRL doesn't contain public key data Please check if the URIs defined for this repository are pointing to a valid repository. Skipping repository 'Xorg-anc' because of the above error. Could not refresh the repositories because of errors.
Searching for similar errors on the web I have found out that zypper might have a problem with my gpg version. The oss repos repomd.xml.asc.oss starts like the following -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux)
while my own repomd.xml.asc looks like this: -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.12 (GNU/Linux) .....
Will I have to use an elder gpg version or should I try sth. else?
And how does your repomd.xml.asc start? also BEGIN PGP SIGNATURE? ALso what does repomd.xml.key contain?
Ciao, Marcus
-- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
On Wed, Sep 16, 2009 at 08:21:46PM +0200, Elmar Stellnberger wrote:
repomd.xml.key
Does "gpg --import repomd.xml.key" work? No idea otherwise ... except for reviewing YAST2 logs for errors :/ Ciao, Marcus -- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
Am 16.09.2009 11:15, schrieb Marcus Meissner:
On Wed, Sep 16, 2009 at 08:21:46PM +0200, Elmar Stellnberger wrote:
repomd.xml.key
Does "gpg --import repomd.xml.key" work?
No idea otherwise ... except for reviewing YAST2 logs for errors :/
Ciao, Marcus
Which key should I try to import? There are multiple keys on the DVD and no repomd.xml.key in repo/oss/suse/repodata. Besides this it won`t be possible to sign repodata/repomd.xml with --detach-sign because I can not import the private key of repo-oss. Isn`t it possible to put a repo online without having to sign at all? All repos I have investigated have been using gpg 1.x (packman, dld.os.org/repos, repo-oss) -- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
On Wed, Sep 16, 2009 at 09:50:09PM +0200, Elmar Stellnberger wrote:
Am 16.09.2009 11:15, schrieb Marcus Meissner:
On Wed, Sep 16, 2009 at 08:21:46PM +0200, Elmar Stellnberger wrote:
repomd.xml.key
Does "gpg --import repomd.xml.key" work?
No idea otherwise ... except for reviewing YAST2 logs for errors :/
Ciao, Marcus
Which key should I try to import? There are multiple keys on the DVD and no repomd.xml.key in repo/oss/suse/repodata. Besides this it won`t be possible to sign repodata/repomd.xml with --detach-sign because I can not import the private key of repo-oss. Isn`t it possible to put a repo online without having to sign at all? All repos I have investigated have been using gpg 1.x (packman, dld.os.org/repos, repo-oss)
The one you generated... The libzypp failure you quoted is a failing import of _YOUR_ repomd.xml.key I think. Ciao, Marcus -- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
After isntalling gpg1 and performing all steps with gpg1 the problem stays the same. Even specifying the --no-gpg-checks option for zypper has no effect. Can anybody help me? Have I made a mistake in setting up the repo? How do other people manage to set up an rpm-md repo?
gpg1 --gen-key gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
Bitte wählen Sie, welche Art von Schlüssel Sie möchten: (1) DSA und Elgamal (voreingestellt) (2) DSA (nur unterschreiben/beglaubigen) (5) RSA (nur signieren/beglaubigen) Ihre Auswahl? 5 RSA-Schlüssel können zwischen 1024 und 4096 Bit lang sein. Welche Schlüssellänge wünschen Sie? (2048) Die verlangte Schlüssellänge beträgt 2048 Bit Bitte wählen Sie, wie lange der Schlüssel gültig bleiben soll. 0 = Schlüssel verfällt nie <n> = Schlüssel verfällt nach n Tagen <n>w = Schlüssel verfällt nach n Wochen <n>m = Schlüssel verfällt nach n Monaten <n>y = Schlüssel verfällt nach n Jahren Wie lange bleibt der Schlüssel gültig? (0) Schlüssel verfällt nie Ist dies richtig? (j/N) j Sie benötigen eine User-ID, um Ihren Schlüssel eindeutig zu machen; das Programm baut diese User-ID aus Ihrem echten Namen, einem Kommentar und Ihrer Email-Adresse in dieser Form auf: "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>" Ihr Name ("Vorname Nachname"): Elmar Stellnberger Email-Adresse: estellnb@elstel.com Kommentar: http://www.elstel.com Sie haben diese User-ID gewählt: "Elmar Stellnberger (http://www.elstel.com) <estellnb@elstel.com>" Ändern: (N)ame, (K)ommentar, (E)-Mail oder (F)ertig/(B)eenden? F Sie benötigen eine Passphrase, um den geheimen Schlüssel zu schützen. Wir müssen eine ganze Menge Zufallswerte erzeugen. Sie können dies unterstützen, indem Sie z.B. in einem anderen Fenster/Konsole irgendetwas tippen, die Maus verwenden oder irgendwelche anderen Programme benutzen. ....+++++ ...+++++ gpg: Schlüssel 64E1ABFE ist als uneingeschränkt vertrauenswürdig gekennzeichnet Öffentlichen und geheimen Schlüssel erzeugt und signiert. gpg: "Trust-DB" wird überprüft gpg: 3 marginal-needed, 1 complete-needed, PGP Vertrauensmodell gpg: Tiefe: 0 gültig: 1 unterschrieben: 0 Vertrauen: 0-, 0q, 0n, 0m, 0f, 1u pub 2048R/64E1ABFE 2009-09-16 Schl.-Fingerabdruck = 4CFB 0D19 6B44 6413 5ACA 0C1C 660A 4390 64E1 ABFE uid Elmar Stellnberger (http://www.elstel.com) <estellnb@elstel.com> Bitte beachten Sie, daß dieser Schlüssel nicht zum Verschlüsseln benutzt werden kann. Sie können aber mit dem Befehl "--edit-key" einen Unterschlüssel für diesem Zweck erzeugen. elm:/xorg-repo> gpg --list-secret-keys /home/elm/.gnupg/secring.gpg ---------------------------- sec 2048R/64E1ABFE 2009-09-16 uid Elmar Stellnberger (http://www.elstel.com) <estellnb@elstel.com> cd <repository directory> createrepo . gpg -a --detach-sign repodata/repomd.xml gpg -a --export "Elmar Stellnberger" > repodata/repomd.xml.key
Ciao, Marcus
-- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
'gpg' '-v' '--no-default-keyring' '--fixed-list-mode' '--with-fingerprint' '--with-colons' '--homedir' '/home/elm' '--quiet' '--no-tty' '--no-greeting' '--batch' '--status-fd' '1' repomd.xml.key gpg: WARNUNG: Unsichere Zugriffsrechte des Home-Verzeichnis `/home/elm' Version: GnuPG v1.4.9 (GNU/Linux) gpg: ASCII-Hülle: gpg: verwende Vertrauensmodell PGP
Is this a bug of zypper? The zypper log says: 2009-09-16 22:23:12 <1> linux-k7n1(4816) [zypp] PathInfo.cc(_Log_Result):292 copy /var/cache/zypp/raw/Xorg-ancyyqrfO/repodata/repomd.xml.key -> /var/tmp/TmpFile.TLFizk 2009-09-16 22:23:12 <1> linux-k7n1(4816) [zypp] PublicKey.cc(readFromFile):101 Reading pubkey from /var/tmp/TmpFile.TLFizk of size 893 and sha1 996a14f8c2404eae465da3e7ef575df915fe722a 2009-09-16 22:23:12 <1> linux-k7n1(4816) [zypp++] ExternalProgram.cc(start_program):210 Executing 'gpg' '-v' '--no-default-keyring' '--fixed-list-mode' '--with-fingerprint' '--with-colons' '--homedir' '/var/tmp/TmpDir.xILBHV' '--quiet' '--no-tty' '--no-greeting' '--batch' '--status-fd' '1' '/var/tmp/TmpFile.TLFizk' 2009-09-16 22:23:12 <1> linux-k7n1(4816) [zypp++] ExternalProgram.cc(start_program):354 pid 4902 launched 2009-09-16 22:23:12 <1> linux-k7n1(4816) [zypp++] ExternalProgram.cc(checkStatus):401 Pid 4902 exited with status 2 2009-09-16 22:23:12 <5> linux-k7n1(4816) [zypp] Exception.cc(log):119 PublicKey.cc(readFromFile):188 THROW: PublicKey.cc(readFromFile):188: File /var/tmp/TmpFile.TLFizk doesn't contain public key data However if I run gpg manually everything seems to work: pub:-:2048:1:660A439064E1ABFE:1253131896:::-:Elmar Stellnberger (http\x3a//www.elstel.com) <estellnb@elstel.com>: fpr:::::::::4CFB0D196B4464135ACA0C1C660A439064E1ABFE: sig:::1:660A439064E1ABFE:1253131896:::::[selfsig]::13x:
echo $? 0
-- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
After isntalling gpg1 and performing all steps with gpg1 the problem stays the same. Even specifying the --no-gpg-checks option for zypper has no effect. Can anybody help me? Have I made a mistake in setting up the repo? How do other people manage to set up an rpm-md repo?
gpg1 --gen-key gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
Bitte wählen Sie, welche Art von Schlüssel Sie möchten: (1) DSA und Elgamal (voreingestellt) (2) DSA (nur unterschreiben/beglaubigen) (5) RSA (nur signieren/beglaubigen) Ihre Auswahl? 5 RSA-Schlüssel können zwischen 1024 und 4096 Bit lang sein. Welche Schlüssellänge wünschen Sie? (2048) Die verlangte Schlüssellänge beträgt 2048 Bit Bitte wählen Sie, wie lange der Schlüssel gültig bleiben soll. 0 = Schlüssel verfällt nie <n> = Schlüssel verfällt nach n Tagen <n>w = Schlüssel verfällt nach n Wochen <n>m = Schlüssel verfällt nach n Monaten <n>y = Schlüssel verfällt nach n Jahren Wie lange bleibt der Schlüssel gültig? (0) Schlüssel verfällt nie Ist dies richtig? (j/N) j Sie benötigen eine User-ID, um Ihren Schlüssel eindeutig zu machen; das Programm baut diese User-ID aus Ihrem echten Namen, einem Kommentar und Ihrer Email-Adresse in dieser Form auf: "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>" Ihr Name ("Vorname Nachname"): Elmar Stellnberger Email-Adresse: estellnb@elstel.com Kommentar: http://www.elstel.com Sie haben diese User-ID gewählt: "Elmar Stellnberger (http://www.elstel.com) <estellnb@elstel.com>" Ändern: (N)ame, (K)ommentar, (E)-Mail oder (F)ertig/(B)eenden? F Sie benötigen eine Passphrase, um den geheimen Schlüssel zu schützen. Wir müssen eine ganze Menge Zufallswerte erzeugen. Sie können dies unterstützen, indem Sie z.B. in einem anderen Fenster/Konsole irgendetwas tippen, die Maus verwenden oder irgendwelche anderen Programme benutzen. ....+++++ ...+++++ gpg: Schlüssel 64E1ABFE ist als uneingeschränkt vertrauenswürdig gekennzeichnet Öffentlichen und geheimen Schlüssel erzeugt und signiert. gpg: "Trust-DB" wird überprüft gpg: 3 marginal-needed, 1 complete-needed, PGP Vertrauensmodell gpg: Tiefe: 0 gültig: 1 unterschrieben: 0 Vertrauen: 0-, 0q, 0n, 0m, 0f, 1u pub 2048R/64E1ABFE 2009-09-16 Schl.-Fingerabdruck = 4CFB 0D19 6B44 6413 5ACA 0C1C 660A 4390 64E1 ABFE uid Elmar Stellnberger (http://www.elstel.com) <estellnb@elstel.com> Bitte beachten Sie, daß dieser Schlüssel nicht zum Verschlüsseln benutzt werden kann. Sie können aber mit dem Befehl "--edit-key" einen Unterschlüssel für diesem Zweck erzeugen. elm:/xorg-repo> gpg --list-secret-keys /home/elm/.gnupg/secring.gpg ---------------------------- sec 2048R/64E1ABFE 2009-09-16 uid Elmar Stellnberger (http://www.elstel.com) <estellnb@elstel.com> cd <repository directory> createrepo . gpg -a --detach-sign repodata/repomd.xml gpg -a --export "Elmar Stellnberger" > repodata/repomd.xml.key
Ciao, Marcus
-- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
issue has been resolved. problem was that I have selected CNAME(ALias) instead of URL-Redirect by accident. The repo is now online under http://repos.elstel.com/xorg-anc and can be used to install the Xorg of OpenSuSE 11.2, Milestone 6. Current versions have problems with Xinerama mode and Plug and Play detection at me (monitor out of sync/staying black). -- To unsubscribe, e-mail: opensuse-softwaremgmt+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-softwaremgmt+help@opensuse.org
participants (2)
-
Elmar Stellnberger -
Marcus Meissner