Dne 10. 03. 21 v 17:43 Colin Walters napsal(a):
For 3rd party repositories like COPR, as I noted in that issue I
think the best is to bootstrap trust over TLS - e.g. we have
```
gpgkeyfingerprint=<sha256>
```
Would you, as sysadmin, notice if the fingerprint changed (because of attacker)? I
definitelly not.
That
gpgkeyid=issuer(a)email.com
gpgkey_dns_verification=1
is IMO better approach.
--
Miroslav Suchy, RHCA
Red Hat, Associate Manager, Community Packaging Tools, #brno, #fedora-buildsys