Le lundi 25 octobre 2004 à 14:06 -0400, Paul Iadonisi a écrit : > But, I tend to agree with what someone posted about packages signed > with keys that are not password protected being only marginally better > than packages not signed at all. This is wrong. The important thing, is the keep the secret key ... secret. Check FC3 kernel, it have signed modules and modules are signed without passphrase. Sure, having a passphrase is better to keep the secret key ... secret :-) btw, http://www.redhat.com/security/team/key.html * Rawhide Package Signing From time to time Red Hat make development software available, usually as part of Rawhide. These packages may be signed by an automated build signing key. Because this key is used automatically we expect to change the key we sign with from time to time. The current Red Hat automated build signing public key has key ID 0xe418e3aa and is available from a number of places: Useless ? rawhide packages during RH8.0 and RH9 beta are signed with an "automated build signing key". As far as I remember, first none signed packages come in FC1 test. Why ? Seem Red Hat don't want to take attention to this. RH8.0 and RH9 have (automatically) signed rpm during beta test.
Attachment:
signature.asc
Description: Ceci est une partie de message =?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=