pierre_stephane.baton@xxxxxxxxxxxxxxxxxxxxxx wrote:
https://www.redhat.com/security/team/key/
Try to import the gpg key from the RHEL Official CDROM (should not be
corrupted) using rpm --import
The key should be in /usr/share/rhn/RPM-GPG-KEY too.
I've already got that. What I was looking for was an alternate key to match
these updated packages.
The strange thing is that if I download the individual RPMs from RHN, the GPG
signature is fine, and they install without any problem. If I use up2date the
signature is incorrect.
For example, if I attempt to update alsa-utils I get this message output on the
terminal:
"warning: rpmts_HdrFromFdno: V3 DSA signature: NOKEY, key ID 897da07a"
I take this to mean that the GPG key ID of the package which up2date is
downloading is "897da07a". However, if I download the RPM it shows:
#rpm --checksig -v alsa-utils-1.0.6-5.i386.rpm
alsa-utils-1.0.6-5.i386.rpm:
Header V3 DSA signature: OK, key ID db42a60e
Header SHA1 digest: OK (b4d8f5d43648ec683dcc8e025ae4b6c7d4eb375c)
MD5 digest: OK (86118c7a4017f9ee10415b03f6ca591b)
V3 DSA signature: OK, key ID db42a60e
i.e. the correct ID of "db42a60e"
So, what's happening here? Is up2date broken, is it downloading packages from
alternate locations which are incorrectly signed? up2date is setup to use
https://xmlrpc.rhn.redhat.com/XMLRPC as the download source.
--
Nigel Wade, System Administrator, Space Plasma Physics Group,
University of Leicester, Leicester, LE1 7RH, UK
E-mail : nmw@xxxxxxxxxxxx
Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
