-----Original Message-----
From: fedora-devel-list-bounces(a)redhat.com [mailto:fedora-devel-list-
bounces(a)redhat.com] On Behalf Of Avi Kivity
Sent: Sunday, January 28, 2007 2:58 AM
To: Development discussions related to Fedora Core
Subject: Re: Install about 12 min quicker today
Jesse Keating wrote:
> On Saturday 27 January 2007 23:41, Jerry Williams wrote:
>
>> Also is there a reason that all the keys just don't get imported?
>> I keep getting the guetenprint update and it asks for the
>> RPM-GPG-KEY-fedora-extras key to be imported.
>>
>
> Because it is up to you to verify that the key provided on media is the
right
> key. If we automatically import it for you, whats the point of the key?
>
If the media is untrusted, there's no point in answering any questions
it asks (as it could ignore the response, or fake the key fingerprint,
or install a rootkit regardless of any key). If the media is trusted,
there's no point in asking the question in the first place.
That was kind of my thinking. And I guess I didn't say it very well.
I have the original media or a mirror of it and I am doing the initial
install. At that point it never asks me to install a key to do the install.
But all of the keys are there. So at that point I would think since I trust
the media, that all of the keys should be installed. Then when an update
does come up it doesn't have to ask about a key because I already have them.
And does the box that asks me if I want to install a key give me enough
information to make that decision?