warning to list

[Matias Féliciano]

Le lundi 25 octobre 2004 à 14:06 -0400, Paul Iadonisi a écrit :
>   But, I tend to agree with what someone posted about packages signed
> with keys that are not password protected being only marginally better
> than packages not signed at all.

This is wrong. The important thing, is the keep the secret key ...
secret. Check FC3 kernel, it have signed modules and modules are signed
without passphrase. Sure, having a passphrase is better to keep the
secret key ... secret :-)

btw, http://www.redhat.com/security/team/key.html
        * Rawhide Package Signing
        From time to time Red Hat make development software available,
        usually as part of Rawhide. These packages may be signed by an
        automated build signing key. Because this key is used
        automatically we expect to change the key we sign with from time
        to time.
        
        The current Red Hat automated build signing public key has key
        ID 0xe418e3aa and is available from a number of places:

Useless ?

rawhide packages during RH8.0 and RH9 beta are signed with an "automated
build signing key".

As far as I remember, first none signed packages come in FC1 test.
Why ? Seem Red Hat don't want to take attention to this.
RH8.0 and RH9 have (automatically) signed rpm during beta test.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Ceci est une partie de message num?riquement sign?e
URL: <http://listman.redhat.com/archives/fedora-test-list/attachments/20041025/f8dfec85/attachment.sig>