[fedora-virt] GPG signatures for Rawhide virt repo

[Mark McLoughlin]

Hi Ján,

On Fri, 2009-06-05 at 13:21 +0200, Ján ONDREJ (SAL) wrote:
> Hello,
> 
>   Mark, can you please add signatures to vire-preview packages? Installation
> of totally unsigned packages on my machine is not a good idea, because I
> don't know, if they was changed by an attacker on internet.

I've added this to the TODO list[1], but I don't think it takes priority
over the other items on the list since the repository is a subset of
rawhide and rawhide is usually unsigned.

If we do this, though, we should implement this in a relatively secure
manner so as to not merely give the illusion of security e.g.

 1) The key should be password protected and kept somewhere safe; I
    don't see why people should have confidence in packages signed with
    a password-less key stored on my laptop

 2) Key distribution - putting the public key in a text file in the repo
    doesn't help; if the repo can be compromised, so can that text file
    - perhaps we could include the key in an F-11 RPM?

Thanks,
Mark.

[1] - http://markmc.fedorapeople.org/virt-preview/README