Up2date - users - Fedora Mailing-Lists

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

1996

1995

1994

1993

1992

1991

1990

1989

1988

1987

1986

1985

1984

1983

1982

1981

1980

Up2date

RE: error

Install Older Kernel

TongKe Xue

Thursday, 30 September 2004 Thu, 30 Sep '04

6:18 p.m.

Hi all, I hav a few questions concerning up2date. 1) What is RedHat's GPG key? Up2date said it was going to "install the key" but didn't say what the key was. 2) How can I ensure that the packages I download are from RedHat/Fedora and not spoofed/trojaned? (By the man in middle attack) Thanks, --TongKe -- Knowledge is freedom. Read http://watchtower.org

Reply

Show replies by date

G.Wolfe Woodbury

Thursday, 30 September Thu, 30 Sep

6:33 p.m.

On Thu, Sep 30, 2004 at 04:18:57PM -0700, TongKe Xue wrote:

Hi all, I hav a few questions concerning up2date. 1) What is RedHat's GPG key? Up2date said it was going to "install the key" but didn't say what the key was.

The RPM-GPG-KEY is included in the top (root) of the CD images and is also available under the /usr/share/rhn directory

2) How can I ensure that the packages I download are from RedHat/Fedora and not spoofed/trojaned? (By the man in middle attack)

That is supposedly what the GPG keys do. For rawhide, however, they don't usually sign all the packages. To some extent you have to trust the connections to wherever. If you have a real reason for paranoia you might want to consider buying a distribution rather than downloading it. -- G.Wolfe Woodbury `- -' RHCT U The Line Eater is a boojum!

Reply

Alexander Dalloz

7 p.m.

Am Fr, den 01.10.2004 schrieb TongKe Xue um 1:18:

1) What is RedHat's GPG key? Up2date said it was going to "install the key" but didn't say what the key was.

http://www.fedorafaq.org/#gpgsig

2) How can I ensure that the packages I download are from RedHat/Fedora and not spoofed/trojaned? (By the man in middle attack)

This is the intend of the GPG signing and md5sum. You can run rpm -Kv packagename-version.arch.rpm and check the output. rpm or the "frontends" up2date or yum handle the signature and checksum checking automatically.

--TongKe

Alexander -- Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13 Fedora GNU/Linux Core 2 (Tettnang) kernel 2.6.8-1.521smp Serendipity 01:57:46 up 1 day, 4:23, load average: 1.16, 0.73, 0.69

Reply

7149

days inactive

7150

days old

users@lists.fedoraproject.org

Manage subscription

2 comments

3 participants

tags (0)

participants (3)

Alexander Dalloz
G.Wolfe Woodbury
TongKe Xue