A question about the ensure_redhat_gpgkey_installed test

Steve Grubb sgrubb at redhat.com
Tue Sep 11 17:53:01 UTC 2012


On Tuesday, September 11, 2012 01:17:26 PM Kenneth Stailey wrote:
> On Mon, Sep 10, 2012 at 5:39 PM, Jeffrey Blank <blank at eclipse.ncsc.mil> 
wrote:
> The OVAL checks provided as USGCB 1.0.5.0 content do not examine the
> Red Hat release key RPM summary.  Instead they confirm that there is a
> package installed with the name gpg-pubkey and with the version string
> set to the 32-bits of the Red Hat release key ID and with the release
> string set to the 32-bits of the Red Hat release key signature date.
> 
> Unlike RHEL 5, RHEL 6 comes with an auxiliary key that is used for
> disaster recovery.  For details:
> 
> http://www.awe.com/mark/blog/20101111.html
> https://access.redhat.com/security/team/key/
> 
> It seems important to verify that the auxiliary key package is is also
> installed.
> 
> Are there issues with continuing to use the (package name, key ID,
> signature date) combination to specify the release key RPM?

I think that is the way to go as there is no way to dig any deeper. The gpg-
pubkey package appears to be created on demand when you do an rpm --import of 
the GPG key. That's why the build system is localhost and no source package 
listed. 

But the idea is to work backwards from other packages to these to establish 
they are all signed with a key.

-Steve


More information about the scap-security-guide mailing list