status of up2date and rhn-applet

[seth vidal]

> Handling it like the key checking that ssh does (with a warning and an
> option to continue) might be the way to go.

yum does that now. It asks you if you want to import the key and you
have to press y or n.

> It would prevent some widespread trojan installation possible by a
> popular third-party repo's key getting compromised, malicious repo
> owners and possible future repo slap-fights.

the only thing that will prevent that is if users wisen up about what
they're doing. It's the same thing as what protects them from sending
their CC to a nefarious site or one unprotected by encryption. They have
to be aware of what's going on around them.

> 
> It seems that right now, some owner of pooptastic-updates can offer up
> the wonderful superfoo package, convince some users to install their
> pooptastic.repo containing a URL to the pooptastic.key. At that point,
> they could replace any package on your system at update time with little
> indication to the user.

If they already agreed to import the key, yes.

-sv