| |||||||||||||
|
| |||||||||||||
The proposed Fedora key-migration planThe proposed Fedora key-migration planPosted Aug 29, 2008 1:27 UTC (Fri) by jamesh (subscriber, #1159)Parent article: The proposed Fedora key-migration plan
If they kill the old key in people's RPM database (step 7), won't that prevent people from verifying the contents of their local RPM database? Or is there some other way to import the new signatures for the existing installed packages?
(Log in to post comments)
The proposed Fedora key-migration plan Posted Aug 29, 2008 16:46 UTC (Fri) by pizza (subscriber, #46) [Link]
If I recall correctly, the signatures are only used to verify the actual packages (ie RPMs) prior to installation. Once installed, the package signatures serve no further use as the packages are discarded.
Verification of the files installed by various packages takes place against RPM's local database of all installed files -- but that can't tell you if the original package was trustworthy or not.
|
|
||||||||||||