Bug 1744 - /etc/RPM-GPG-KEYS are not Mageia's but belong in Mandriva only
Summary: /etc/RPM-GPG-KEYS are not Mageia's but belong in Mandriva only
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact:
URL:
Whiteboard: 3final
Keywords:
Depends on:
Blocks:
 
Reported: 2011-06-11 05:18 CEST by Dick Gevers
Modified: 2014-05-08 18:04 CEST (History)
7 users (show)

See Also:
Source RPM: gnupg
CVE:
Status comment:


Attachments

Description Dick Gevers 2011-06-11 05:18:15 CEST
[ Please reassign to proper component / rpm if not okay ]

* This concerns an install on a formatted disk, not an upgrade.

ls -al /etc/RPM-GPG-KEYS

-rw-r--r--   1 root root  8080 Aug 23  2003 22458a98.asc # Mandriva Security
-rw-r--r--   1 root root  1430 Aug 23  2003 70771ff3.asc # Mandriva Linux
-rw-r--r--   1 root root  1462 Aug 23  2003 9b4a4024.asc # MandrakeSoft

$ gpg --list-keys mageia
pub   4096R/80420F66 2011-02-07 [expires: 2012-03-13]
uid                  Mageia Packages <packages@mageia.org>

pub   4096R/DA10B483 2011-03-08 [expires: 2012-04-11]
uid                  Mageia Release <release@mageia.org>

pub   4096R/41BCD9E7 2011-04-18 [expires: 2012-05-22]
uid                  Mageia Software <software@mageia.org>

$ rpm -qa |grep pubk
gpg-pubkey-80420f66-4d4fe123
D Morgan 2011-06-11 08:37:18 CEST

CC: (none) => dmorganec
Source RPM: drakx-installer-stage2-13.58-2.mga1 => gnupg

Comment 1 D Morgan 2011-06-11 08:38:43 CEST
in the gnupg rpm this is in SOURCES/mdk-keys.tar.bz2  which  should be changed.
Comment 2 Michael Scherer 2011-06-11 08:55:28 CEST
The following snippet should do the trick to regenerate the keys :

 for i in  41BCD9E7 DA10B483  80420F66; do gpg --recv $i ; gpg -a -o $i.asc --export $i ;done; 

I guess this warrant a update

CC: (none) => misc

Comment 3 Michael Scherer 2011-06-11 08:59:48 CEST
On the other hand, do we need to keep the directory ? 

What is it used for, with current rpm ?

Status: NEW => ASSIGNED

Comment 4 Dick Gevers 2011-06-11 09:40:34 CEST
In my idea Michael's snippet may not do the trick: last time I tried a gnupg key with exteral signatures did not import into rpm. After all, rpm may not even use the said keys from /etc, but IMHO they are supposed to be rpm-workable keys.

Gnupg can strip everything external, or surely at Mageia there is a clean set of keys saved somewhere.

But my attempts at importing keys into rpm date from 6 to 8 years ago, so what I say may no longer be true.
Comment 5 Dick Gevers 2011-06-11 11:19:09 CEST
If one want's to clean the key with gnupg: gpg --edit-key <keyid> followed by minimize, quit and --export...
Comment 6 D Morgan 2011-06-11 13:26:31 CEST
sorry, i need to give a keyserver, which one can i give ?

gpg: no keyserver known (use option --keyserver)
gpg: keyserver receive failed: bad URI
Comment 7 Dick Gevers 2011-06-11 14:47:46 CEST
Normally in ~/.gnupg/gpg.conf, but this should always work:
--keyserver hkp://pgp.mit.edu:11371
Comment 8 Dick Gevers 2011-06-11 18:41:30 CEST
The 'pubkey' file - if need be with added extension '.asc' - in the media_info directory of each repository is equal in content to the clean rpm-gpg-keys.
Comment 9 Dick Gevers 2011-06-11 18:42:45 CEST
e.g. mv pubkey pubkey.asc
gpg --import pubkey.asc

and observe stdout !
Thierry Vignaud 2011-10-04 17:48:08 CEST

Component: Installer => RPM Packages

Comment 10 Manuel Hiebel 2011-10-30 01:35:27 CEST
Bug assigned to the package maintainer.

Assignee: bugsquad => boklm

Comment 11 Dick Gevers 2011-12-11 20:41:14 CET
@boklm @dmorgan:

Kindly review. IMHO this should be a release blocker for Mga2.

Thanks!
Comment 12 Jeff Johnson 2012-01-07 19:47:09 CET
tracked at https://bugs.launchpad.net/rpm/+bug/913222

CC: (none) => n3npq

Comment 13 Marja Van Waes 2012-05-26 13:02:36 CEST
Hi,

This bug was filed against cauldron, but we do not have cauldron at the moment.

Please report whether this bug is still valid for Mageia 2.

Thanks :)

Cheers,
marja

Keywords: (none) => NEEDINFO

Comment 14 Dick Gevers 2012-05-28 11:39:17 CEST
Still valid for 2 and Cauldron.
Sander Lepik 2012-05-28 12:49:24 CEST

Keywords: NEEDINFO => (none)
CC: (none) => sander.lepik
Whiteboard: (none) => MGA2TOO

Comment 15 Manuel Hiebel 2012-10-20 22:05:51 CEST
 .

Status: ASSIGNED => NEW
Assignee: boklm => bugsquad

Comment 16 Dick Gevers 2013-03-15 16:05:20 CET
Still valid for beta3.

Isn't is about time this was solved? It looks really bad on Mageia if we cannot fix this before final release !

Whiteboard: MGA2TOO => 3beta3

Johnny A. Solbu 2013-04-11 05:56:59 CEST

CC: (none) => cooker

Comment 17 Dick Gevers 2013-05-11 13:43:04 CEST
Valid for 3RC. Almost 2 years old

Summary: /etc/RPM-GPG-KEYS are not Mageia's => /etc/RPM-GPG-KEYS are not Mageia's but belong in Mandriva only
Whiteboard: 3beta3 => 3RC

Comment 18 Dick Gevers 2013-05-11 23:36:18 CEST
Valid for prerelease isos of Mageia 3 final

Whiteboard: 3RC => 3final

Sander Lepik 2013-05-11 23:42:48 CEST

CC: (none) => thierry.vignaud, tmb

Comment 19 Nicolas Vigier 2013-05-15 00:56:14 CEST
Package updated in svn to remove /etc/RPM-GPG-KEYS.

CC: (none) => boklm

Comment 20 Nicolas Vigier 2013-05-15 10:21:45 CEST
And submitted to Mageia 3 by ennael.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 21 Dick Gevers 2013-05-15 20:43:44 CEST
Nicolas: thanks for the fix. But for good order's sake: did you ascertain that the absence of the directory has no negative effects for anything like rpm building or other?
Comment 22 Nicolas Vigier 2013-05-16 01:35:25 CEST
I couldn't find anything using that directory. And since the directory had wrong keys since the begining of Mageia, we should have noticed if it broke something important.
Comment 23 Dick Gevers 2013-05-16 21:31:12 CEST
'like the way u think.
Nicolas Vigier 2014-05-08 18:04:47 CEST

CC: boklm => (none)


Note You need to log in before you can comment on or make changes to this bug.