Re: Should Fedora rpms be signed?
by Satish Balay
Jeff,
your replies from gmail appear to send 2 e-mails - with the following
headers (causing me some confusion here)
1: without cc:fedora-test-list
2: with cc:fedora-test-list
Hence resending this reply to the list.
Satish
On Mon, 1 Nov 2004, Satish Balay wrote:
>
>
> On Mon, 1 Nov 2004, Jeff Spaleta wrote:
>
> > On Mon, 1 Nov 2004 14:51:34 -0600 (CST), Satish Balay <balay(a)fastmail.fm> wrote:
> > > And as Matias already pointed out - lets not mix QA perception with
> > > 'signature'.
> >
> >
> > I'm not.. i havent talked about QA at all. I'm talking about "trust"
> > as defined in mature pgp/gpg implementations. Would you like
> > references that talk about the trust metric inherent in something like gnupg?
> > I'm saying that comparing packaging signing as implemented inside the
> > rpm to general purpose gpg signing using gnupg is a somewhat apples to
> > oranges discussion, and that the principles associated with general
> > purpose gpg usage using an implementation like gnupg can not be mapped
> > over to rpm's signing implementation without acknowledgment that rpm's
> > lack of that inherent "trust" metric has greatly impacted what rpm
> > package signing has meant historically. Changing the meaning now,
> > simply by changing documentation isn't good enough for me. I believe
> > the web-of-trust concept is a vital part of a full gpg implementation,
> > and that historically the lack of a web-of-trust metric has meant that
> > signed packages have been used both for shallow verification and as an
> > inherent measure of "trust". Once there is an inherent "trust" metric
> > respect of signed keys inside rpm, many of my concerns would be
> > addressed. I encourage you to read up on how gnupg( aka gpg)
> > calculates its trust database.... it has nothing to do with QA.
>
>
> Long statements spin my head.
>
> You say:
>
> - rpm's package signing is not same as 'gnupg' signing
> - the big difference is 'trust' mechanism (there is none for rpm)
> - there is an inherent 'trust' in rpm signed packages due the absence of other proper means.
> - signing rawhide breaks this inherent trust.
> - rpm implementing web-of-trust is the solution.
>
> I'm not much famililar with gnupg (just ssh keys) - so I keep thinking
> - the 'trust' mechanism' of gnupg is primarily to validate 'public'
> keys.
>
> I still don't understand how you get the extra security of 'inherent'
> trust' - and how 'rahide signed' pacakges (with a different key)
> breaks this. The public keys are what I trust - and I'd like to use
> each key differently.
>
> Satish
>
19 years, 5 months
FC3T2 EggCups Crashing
by Will H. Backman
After updating today, I keep getting a popup that egg-cups has crashed
(Restart?)
It seems to be when I stick a CD in with a windows autorun. I'll have to
dig more. Anyone else seeing this?
--
Will Backman
Coastal Enterprises, Inc.
- A computer is a device used to convert data into error messages.
19 years, 5 months
fc3test upgrade to fc3 final
by Petr Fischer
Hi,
can I upgrade from Fedora Core 3 Test 3 to Fedora Core 3 Final _without_
_problems_ in future with Yum?
I can't wait for FC3 final release and FC2 kernel has some problems with
my ASUS board.
Thanks, pf
19 years, 5 months
qt headers missing in FC3rc3+ ?
by Kim Lux
I'm trying to build a package with the process that worked fine in fc2
and fc3t3. It doesn't work properly in fc3rc3+ (or whatever "they" call
what I am running these days...)
When I run ./configure I get:
<snip>
checking for libjpeg6b... no
checking for libjpeg... -ljpeg
checking for perl... /usr/bin/perl
checking for Qt... configure: error: Qt (>= Qt 3.2) (headers and
libraries) notfound. Please check your installation!
For more details about this problem, look at the end of config.log.
$ echo $QTDIR
/usr/lib/qt-3.3
$ echo $KDELIB
/usr/lib/kde3
$ ls $QTDIR
bin etc lib plugins
<bin is empty>
Any ideas ?
19 years, 5 months
Re: Should Fedora rpms be signed?
by Jef Spaleta
On Mon, 1 Nov 2004 14:51:34 -0600 (CST), Satish Balay <balay(a)fastmail.fm> wrote:
> And as Matias already pointed out - lets not mix QA perception with
> 'signature'.
I'm not.. i havent talked about QA at all. I'm talking about "trust"
as defined in mature pgp/gpg implementations. Would you like
references that talk about the trust metric inherent in something like gnupg?
I'm saying that comparing packaging signing as implemented inside the
rpm to general purpose gpg signing using gnupg is a somewhat apples to
oranges discussion, and that the principles associated with general
purpose gpg usage using an implementation like gnupg can not be mapped
over to rpm's signing implementation without acknowledgment that rpm's
lack of that inherent "trust" metric has greatly impacted what rpm
package signing has meant historically. Changing the meaning now,
simply by changing documentation isn't good enough for me. I believe
the web-of-trust concept is a vital part of a full gpg implementation,
and that historically the lack of a web-of-trust metric has meant that
signed packages have been used both for shallow verification and as an
inherent measure of "trust". Once there is an inherent "trust" metric
respect of signed keys inside rpm, many of my concerns would be
addressed. I encourage you to read up on how gnupg( aka gpg)
calculates its trust database.... it has nothing to do with QA.
-jef
19 years, 5 months
Strange Yum Error
by Stephen John Smoogen
Sorry for the bug and run.. wanted to email this before I forgot in meetings.
[root@localhost SPECS]# yum install autoconf213
Setting up Install Process
Setting up Repo: development
repomd.xml 100% |=========================| 1.1 kB 00:00
Setting up Repo: testing
repomd.xml 100% |=========================| 1.1 kB 00:00
Reading repository metadata in from local files
developmen: ################################################## 3426/3426
testing : ################################################## 2622/2622
Traceback (most recent call last):
File "/usr/bin/yum", line 8, in ?
yummain.main(sys.argv[1:])
File "/usr/share/yum-cli/yummain.py", line 68, in main
result, resultmsgs = base.doCommands()
File "/usr/share/yum-cli/cli.py", line 374, in doCommands
return self.installPkgs()
File "/usr/share/yum-cli/cli.py", line 734, in installPkgs
pkglist = returnBestPackages(toBeInstalled)
File "/usr/lib/python2.3/site-packages/yum/packages.py", line 123,
in returnBestPackages
elif rpmUtils.arch.isMultiLibArch(arch=a):
File "/usr/lib/python2.3/site-packages/rpmUtils/arch.py", line 69,
in isMultiLibArch
if multilibArches.has_key(arches[arch]):
KeyError: 'noarch'
The testing repo is the testing.fedora.redhat.com and the devel one is
straight out of the RPMs.
Again sorry for the quick email. Will try to bugzilla later.
--
Stephen J Smoogen.
CSIRT/Linux System Administrator
19 years, 5 months
Urgent - Potential security hole.
by Paul F. Johnson
Hi,
I think I've found a hole!
I logged into this box from work yesterday via ssh, compiled Mono and
some other bits then decided to try if I could run a C# app from this
machine and view it at work.
I don't have X forwarding enabled and can see this by trying to run
Firefox on this machine when logged into my sons box - firefox fails to
run.
The C# application ran and I could use it at work.
I'm using the 643 kernel with everything updated. I'm not sure if this
is a mono thing or X forwarding being broken. I'm using selinux
targetted.
This could be a serious problem and I want to be sure before putting it
into bugzilla as a blocker.
TTFN
Paul
--
"Trust me, I know what I'm doing" - Det. Sledgehammer
19 years, 5 months
Yum update error message
by Elaine Normandy
I am running a clean install of Fedora Core 3 RC5, and would like
assistance on getting yum update to work. My current error message is
Setting up Update Process
Setting up Repo: base
Cannot find a valid baseurl for repo: base
(FC3RC5 is very slick, by the way. I am impressed.)
--
Elaine Normandy
Weblog: http://www.stardel.com/fiveacres/
19 years, 5 months
Re: Gnome can not start
by Darek Borkowski
> Message: 3
> Date: Mon, 01 Nov 2004 17:26:21 +0000
> From: "Michael A. Peters" <mpeters(a)mac.com>
> Subject: Re: Gnome can not start
> To: fedora-test-list(a)redhat.com
> Message-ID: <1099329981l.3989l.0l(a)devel.mpeters.us>
> Content-Type: text/plain; charset=ISO-8859-1; DelSp=Yes; Format=Flowed
>
> On 11/01/2004 06:09:25 AM, Darek Borkowski wrote:
> > I forgot to add some info:
> > gnome-session-2.6.0-4,
> > FC2 was not clean install but upgrade form FC1, where I had same
> > problem.
> > FC1 was clean install.
> >
> > Darek Borskowski
> >
> >
>
> I'm just curious - I don't have this problem, my /home has been from
> RH8 to LFS to FC2 to FC1 to FC2 to FC3Test.
Yuo are lucky guy.
> I wonder if the problem is a specific application doing something it
> shouldn't do.
Maybe, bu I have no idea what is would be.
> Note that I always do a clean install of the OS, but I keep the same
> home directory and thus all of the same settings.
Two times I did upgrade. 2 times clean install.
> Are you running any third party updates to fedora provided software?
Of course, I have few repositories configured in apt-get/synaptic
(dries, ATrpms, freshrpms, DAG, livna, macromedia, gnugadu) and use it
extensively
19 years, 5 months
yum errors on unsigned package and on --exclude
by Kim Lux
I am trying to update my FC3rc3 installation using yum.
I've done a yum install yum.
Everything appears to work OK until I receive this error:
<snip>
Update: python.i386 0:2.3.4-11
Update: python-devel.i386 0:2.3.4-11
Update: system-config-packages.noarch 0:1.2.20-1
Update: up2date.i386 0:4.3.47-5
Update: up2date-gnome.i386 0:4.3.47-5
Update: xinitrc.noarch 0:4.0.14-1
Is this ok [y/N]: y
Downloading Packages:
unsigned
package //var/cache/yum/development/packages/gthumb-2.4.2-4.i386.rpm
<end of snip>
So then I try to exclude it from the update and because it doesn't find
a match for it, it won't proceed with the update:
<snip>
Could not find update match for --exclude=gthumb-2.4.2-2
No Packages marked for Update/Obsoletion
<End of snip>
"Packages" I've tried:
gthumb
gthumb-2.4.2-2
gthumb-2.4.2-4
gthumb-2.4.2-4.i386
gthumb-2.4.2-i386.rpm
up2date has a similar sort of problem in that it will error out because
one package isn't signed.
How do I get my update done ? What am I missing about using --exclude ?
Thanks
19 years, 5 months