[packagekit] Extending the RepoDetail signal
Anders F Björklund
afb at algonet.se
Wed Oct 13 02:45:23 PDT 2010
Duncan Mac-Vicar P. wrote:
> > Does this make any difference between whether it is the rpm
>> that are signed, or if it is the repomd.xml metadata that is signed ?
>> Currently yum doesn't make a difference between, which causes some
>> problems for other clients. Or maybe that is more of a backend
>> worry ?
> I don't see why the security model of the backend needs to be
> exposed to the user, who cares only on trusted or not trusted, if
> they care for it at all.
> Then the question if the "trusted" is a repo or a package attribute.
Apparently the "signed" repo icon (in PK) would apply to either ?
In Smart there is a GPG fingerprint on each channel (e.g. repo),
that will be checked against the metadata (e.g. repomd.xml.asc)
There is also an optional system setting for RPM backend, to make
it check .rpm signatures against the ones available in the rpmdb.
The first is available per-repo, but the second is system-wide...
PS. I'm avoiding the term "trusted" here, since it has a special
meaning in GPG that we are not using. Maybe "secure" is better
but that seems to mostly apply to HTTPS... So using "signed".
Though in latest versions of RPM, *all* packages are signed...
I think the user isn't too interested if digests / signatures
are available (they assume they are!), but more if they fail ?
More information about the PackageKit