On Tue, 31 Oct 2023 16:23:41 +0100 Petr Pisar ppisar@redhat.com wrote:
I would would like to hear your opinion: Should DNF5 start verifying all packages? Should DNF5 keep ignoring signatures for out-of-repository packages? Or should rather narrow the verification skip to packages from a local file system? Any other options?
I build a local kernel from the src.rpm, and install it with
dnf -C install [etc.]
I never see this warning (dnf4). Would I start seeing it with dnf5? It is easy enough to add the --no-gpgchecks option if it is required, and it seems like a good reminder that the package being installed might be a security risk. Though, in my specific case, that isn't true if the fedora src.rpm is valid. A pretty safe bet.