update error..

[Todd]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Michael Schwendt wrote:
> On Sun, 01 Feb 2004 12:32:09 +0000, WipeOut wrote:
[...]
>> rpm on RH7.2 does not appear to have a "--import" option..
>>
>> I installed the new yum package manually which seemed to work..
>> Will have to see what happenes when an update is released..
>
> With the older RPM, you need to import the key into your GPG
> key-ring.  Download it and "gpg --import FILE".

Just to clarify this for the archives (and to make sure I have this
right), yum 1 uses root's gpg keyring for checking.  yum 2 uses the
rpm database.

On a stock RH 8.0 install with rpm-4.1 and yum 1, you'd need to use
rpm --import if you wanted to check a sig using rpm -K, for example,
when you initially install yum on the system (you do check the gpg
signature before installing, right? :).  Then you'd use gpg --import
so that yum could check signatures of packages it was installing.

Sort of a mess, really.  If you use yum for everything, you'd only
need to do one rpm --import and that would be for the key used to sign
the yum package.  All other keys would be imported using gpg --import.
But you'll still get a surprise the first time you go to use rpm -K to
check a signature.

Perhaps this is something that might be weighed in deciding whether to
push out yum 2 and rpm 4.1.1 on RH 8.0?  At the least, it'll probably
have to be explained in some clearer way for the instructions that end
up on the web page.

- -- 
Todd        OpenPGP -> KeyID: 0xD654075A | URL: www.pobox.com/~tmz/pgp
======================================================================
Eighty three million gun owners didn't shoot someone yesterday.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: When crypto is outlawed bayl bhgynjf jvyy unir cevinpl.

iD8DBQFAHUV6uv+09NZUB1oRAuMPAJ4oCpXyqTjloZPPqNux+VhJoHEYMgCg5Buc
TSy7XWQdlKt6lkZoEKajw9k=
=pTax
-----END PGP SIGNATURE-----