On Tuesday, September 11, 2012 01:17:26 PM Kenneth Stailey wrote:
On Mon, Sep 10, 2012 at 5:39 PM, Jeffrey Blank
<blank(a)eclipse.ncsc.mil>
wrote:
The OVAL checks provided as USGCB 1.0.5.0 content do not examine the
Red Hat release key RPM summary. Instead they confirm that there is a
package installed with the name gpg-pubkey and with the version string
set to the 32-bits of the Red Hat release key ID and with the release
string set to the 32-bits of the Red Hat release key signature date.
Unlike RHEL 5, RHEL 6 comes with an auxiliary key that is used for
disaster recovery. For details:
http://www.awe.com/mark/blog/20101111.html
https://access.redhat.com/security/team/key/
It seems important to verify that the auxiliary key package is is also
installed.
Are there issues with continuing to use the (package name, key ID,
signature date) combination to specify the release key RPM?
I think that is the way to go as there is no way to dig any deeper. The gpg-
pubkey package appears to be created on demand when you do an rpm --import of
the GPG key. That's why the build system is localhost and no source package
listed.
But the idea is to work backwards from other packages to these to establish
they are all signed with a key.
-Steve