<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Le 22/04/2009 11:08, James Westby a écrit :
<blockquote cite="mid:1240391297.18947.32.camel@flash" type="cite">
<pre wrap="">On Wed, 2009-04-22 at 09:50 +0100, Richard Hughes wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Tue, 2009-04-21 at 12:09 -0400, Jon McCann wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Firstly, this dialog should never - ever - appear when installing
updates from the update viewer. No excuses. Updates should not
appear in the list unless they are trusted.
</pre>
</blockquote>
<pre wrap="">Agree. The only case this will not be true is when the distro changes
the signing key mid-release, which shouldn't even happen (although
happened to Fedora in F9, but that's the exception to prove the
rule...).
</pre>
</blockquote>
<pre wrap=""><!---->
Then why not almost remove the dialog altogether.
If this will only be shown in a huge event such as the F9 one, then
you could instead pop up a dialog that says. Something has apparently
gone very wrong, and point to a web page that the repo owner specifies.
</pre>
</blockquote>
No, it can also happen the first time you install a package from an
external repository, for example Livna on Fedora. I think John's point
was that a package installed from the officiel Fedora repo shouldn't be
updated with a version from Livna...<br>
<blockquote cite="mid:1240391297.18947.32.camel@flash" type="cite">
<pre wrap="">
That web page could then explain what the issue is and how to deal with
it, and if there is a need to change the signing key it could explain
that and tell the user how to change the signing key associated with
the repo through another dialog.
Third-party repositories may kill the idea, but just allowing the user
to blindly click and carry on seems like it could be avoided. If the
only reasons that a user would see this are someone trying to compromise
their system, or some huge event that can be co-ordinated by the
repository owner, then we should be able to do better.
Thanks,
James
_______________________________________________
PackageKit mailing list
<a class="moz-txt-link-abbreviated" href="mailto:PackageKit@lists.freedesktop.org">PackageKit@lists.freedesktop.org</a>
<a class="moz-txt-link-freetext" href="http://lists.freedesktop.org/mailman/listinfo/packagekit">http://lists.freedesktop.org/mailman/listinfo/packagekit</a>
</pre>
</blockquote>
<br>
</body>
</html>