On Tue, Nov 14, 2023 at 8:03 AM Jaroslav Mracek <jmra...@redhat.com> wrote: > > I believe that one of the strong complains was related to not signed > packages. The use case is that when I build RPMs locally and then I install > them (see bellow). > > dnf install *.rpm --setopt=localpkg_gpgcheck=true > ... > Package dnf-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed > Package dnf-automatic-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed > Package dnf-data-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed > Package python3-dnf-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed > Package yum-4.17.1-1.git.9598.552e61e.fc38.noarch.rpm is not signed > Error: GPG check FAILED > > Jaroslav
I think for the sake of security, it'd be better if this were on by default, and you just had to specify the --nogpgcheck For convenience, the error message should probably say "Error: GPG check FAILED (try again with '--nogpgcheck' to ignore)" I don't think this use case is so important that everybody's security should be lowered to avoid the minor inconvenience of passing a simple flag. _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
