[packagekit] Extending the RepoDetail signal

[Anders F Björklund]

Duncan Mac-Vicar P. wrote:

>  > Does this make any difference between whether it is the rpm  
> packages
>> that are signed, or if it is the repomd.xml metadata that is signed ?
>>
>> Currently yum doesn't make a difference between, which causes some
>> problems for other clients. Or maybe that is more of a backend  
>> worry ?
>
> I don't see why the security model of the backend needs to be  
> exposed to the user, who cares only on trusted or not trusted, if  
> they care for it at all.
>
> Then the question if the "trusted" is a repo or a package attribute.

Apparently the "signed" repo icon (in PK) would apply to either ?

In Smart there is a GPG fingerprint on each channel (e.g. repo),
that will be checked against the metadata (e.g. repomd.xml.asc)

There is also an optional system setting for RPM backend, to make
it check .rpm signatures against the ones available in the rpmdb.

The first is available per-repo, but the second is system-wide...

--anders

PS. I'm avoiding the term "trusted" here, since it has a special
     meaning in GPG that we are not using. Maybe "secure" is better
     but that seems to mostly apply to HTTPS... So using "signed".
     Though in latest versions of RPM, *all* packages are signed...

     I think the user isn't too interested if digests / signatures
     are available (they assume they are!), but more if they fail ?