<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">The second one requires file:// based URLs, which is why I use a configuration channel. I specify it locally:<div class=""><br class=""></div><div class=""><a href="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7" class="">file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7</a></div><div class=""><br class=""></div><div class="">(The three / characters are correct: the protocol is file:// and it starts from the / directory, hence <a href="file:///etc" class="">file:///etc</a>...)</div><div class=""><br class=""></div><div class="">If the key is deployed via kickstart, it doesn't appear here (but that's OK, because it's already in the RPM database). You would need to deploy a file using a configuration channel to this location if you have non-kickstarted servers.</div><div class=""><br class=""></div><div class="">You can leave the URL field empty if all your servers will be kickstarted and have the key added during install.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">Avi</div><div class=""><br class=""><div class=""><div><blockquote type="cite" class=""><div class="">On 5 Apr 2016, at 11:18 AM, Lachlan Musicman <<a href="mailto:datakid@gmail.com" class="">datakid@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class=""><div class="">Thanks Avi - on the second one, should I be supplying the official URL, or the url of my copy of the key? Do I need to fill out all three fields, or just one?<br class=""><br class=""></div>cheers<br class=""></div>L.<br class=""></div><div class="gmail_extra"><br clear="all" class=""><div class=""><div class="gmail_signature"><div dir="ltr" class=""><div class="">------<br class="">The most dangerous phrase in the language is, "We've always done it this way."<br class=""><br class="">- Grace Hopper<br class=""></div></div></div></div> <br class=""><div class="gmail_quote">On 5 April 2016 at 11:01, Avi Miller <span dir="ltr" class=""><<a href="mailto:avi.miller@oracle.com" target="_blank" class="">avi.miller@oracle.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class="">Hi,<div class=""><br class=""></div><div class="">You put them in the first two. The third location (in the repository) is to configure SSL certificates to communicate with the repository. Commonly used for RHN-based repos (and perhaps SUSE repos, but I'm not sure about that).</div><div class=""><br class=""></div><div class="">The first location adds the GPG key to Spacewalk, so you can deploy it during kickstart.</div><div class="">The second location configures where yum will look for the GPG key (if not already installed) and how to verify that it has the right one.</div><div class=""><br class=""></div><div class="">I also have a GPG Configuration Channel so that I can deploy keys to machines that were not installed via kickstart, but still need to have the keys installed. </div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">Avi</div><div class=""><div class="h5"><div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 5 Apr 2016, at 10:44 AM, Lachlan Musicman <<a href="mailto:datakid@gmail.com" target="_blank" class="">datakid@gmail.com</a>> wrote:</div><br class=""><div class=""><div dir="ltr" class=""><div class=""><div class=""><div class=""><div class=""><div class="">One final question. Now I have the relevant GPG keys, do I put them:<br class=""><br class=""></div> - in System -> Kickstart -> GPG and SSL keys, then activate them in the profile OR<br class=""></div> - in Channels -> Manage Channels -> the Channel in question -> Basic Channel Details, at the bottom OR<br class=""></div> - in Channels -> Manage Channels -> Manage Repositories -> Repository in question.<br class=""><br class=""></div>Or do I put them in all three, or just two. In the third option - the Repositories - the drop down only allows for the single SSL cert that I created at the start, none of the GPG keys are available.<br class=""><br class=""></div><div class="">Cheers<br class=""></div><div class=""></div>L.<br class=""></div><div class="gmail_extra"><br clear="all" class=""><div class=""><div class=""><div dir="ltr" class=""><div class="">------<br class="">The most dangerous phrase in the language is, "We've always done it this way."<br class=""><br class="">- Grace Hopper<br class=""></div></div></div></div> <br class=""><div class="gmail_quote">On 5 April 2016 at 09:27, Lachlan Musicman <span dir="ltr" class=""><<a href="mailto:datakid@gmail.com" target="_blank" class="">datakid@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class=""><div class=""><div class=""><div class=""><div class="">Ah, ok. Thanks.<br class=""><br class=""></div>It's becoming clearer now. Did I miss something, or is it that I'm just not aware enough of how these systems work...<br class=""><br class=""></div>Hmmm.<br class=""><br class=""></div>cheers<span class=""><font color="#888888" class=""><br class=""></font></span></div><span class=""><font color="#888888" class="">L.<br class=""></font></span></div><div class="gmail_extra"><span class=""><br clear="all" class=""><div class=""><div class=""><div dir="ltr" class=""><div class="">------<br class="">The most dangerous phrase in the language is, "We've always done it this way."<br class=""><br class="">- Grace Hopper<br class=""></div></div></div></div> <br class=""></span><div class="gmail_quote"><div class=""><div class="">On 5 April 2016 at 08:57, Avi Miller <span dir="ltr" class=""><<a href="mailto:avi.miller@oracle.com" target="_blank" class="">avi.miller@oracle.com</a>></span> wrote:<br class=""></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class=""><div class=""><div style="word-wrap:break-word" class="">Hi,<div class=""><span class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 5 Apr 2016, at 8:41 AM, Lachlan Musicman <<a href="mailto:datakid@gmail.com" target="_blank" class="">datakid@gmail.com</a>> wrote:</div><br class=""><div class=""><div dir="ltr" style="font-family:HelveticaNeue;font-size:14px;font-style:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" class=""><div class=""><div class=""><div class="">We have an SSL cert on that page - is that not enough? Do I need a separate gpg key? I would presume the cert was sufficient - at no point in the documentation did I see an explicit instruction to make one of each?</div></div></div></div></div></blockquote></div><div class=""><br class=""></div></span><div class="">That is not sufficient. That is the CA certificate for your Spacewalk instance. It's not the GPG key for the CentOS RPMs. You need to create a GPG key with the content from CentOS and deploy it during kickstart, so that yum has a valid GPG key against which to test the signature of the RPMs.</div><div class=""><br class=""></div><div class="">So, you'd need to get a copy of the CentOS GPG key (usually found in /etc/pki/rpm-gpg on an already installed machine) and create a GPG key with the content of that key. You would then need to update your Kickstart Profile to deploy that GPG key during install, so that packages can be installed during the post-install phase, i.e. after registration with Spacewalk and post the Anaconda process.</div><div class=""><br class=""></div><div class="">Hope that helps,</div><div class="">Avi</div><br class=""><div class=""> --<br class="">Oracle <<a href="http://www.oracle.com/" target="_blank" class="">http://www.oracle.com</a>><span class=""><font color="#888888" class=""><br class="">Avi Miller | Product Management Director | <a href="tel:%2B61%20%283%29%208616%C2%A03496" value="+61386163496" target="_blank" class="">+61 (3) 8616 3496</a><br class="">Oracle Linux and Virtualization<br class="">417 St Kilda Road, Melbourne, Victoria 3004 Australia </font></span></div> <br class=""></div></div><br class=""></div></div><span class="">_______________________________________________<br class=""> Spacewalk-list mailing list<br class=""> <a href="mailto:Spacewalk-list@redhat.com" target="_blank" class="">Spacewalk-list@redhat.com</a><br class=""> <a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" rel="noreferrer" target="_blank" class="">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br class=""></span></blockquote></div><br class=""></div> </blockquote></div><br class=""></div> _______________________________________________<br class="">Spacewalk-list mailing list<br class=""><a href="mailto:Spacewalk-list@redhat.com" target="_blank" class="">Spacewalk-list@redhat.com</a><br class=""><a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank" class="">https://www.redhat.com/mailman/listinfo/spacewalk-list</a></div></blockquote></div><br class=""><div class=""> --<br class="">Oracle <<a href="http://www.oracle.com/" target="_blank" class="">http://www.oracle.com</a>><br class="">Avi Miller | Product Management Director | <a href="tel:%2B61%20%283%29%208616%C2%A03496" value="+61386163496" target="_blank" class="">+61 (3) 8616 3496</a><br class="">Oracle Linux and Virtualization<br class="">417 St Kilda Road, Melbourne, Victoria 3004 Australia </div> <br class=""></div></div></div></div><br class="">_______________________________________________<br class=""> Spacewalk-list mailing list<br class=""> <a href="mailto:Spacewalk-list@redhat.com" class="">Spacewalk-list@redhat.com</a><br class=""> <a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" rel="noreferrer" target="_blank" class="">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br class=""></blockquote></div><br class=""></div> _______________________________________________<br class="">Spacewalk-list mailing list<br class=""><a href="mailto:Spacewalk-list@redhat.com" class="">Spacewalk-list@redhat.com</a><br class="">https://www.redhat.com/mailman/listinfo/spacewalk-list</div></blockquote></div><br class=""><div class=""> --<br class="">Oracle <<a href="http://www.oracle.com" class="">http://www.oracle.com</a>><br class="">Avi Miller | Product Management Director | +61 (3) 8616 3496<br class="">Oracle Linux and Virtualization<br class="">417 St Kilda Road, Melbourne, Victoria 3004 Australia </div> <br class=""></div></div></body></html>