Hi Marc,
On 13.12.21 09:35, Marc Schiffbauer wrote:
* Stefan Seyfried schrieb am 12.12.21 um 00:04 Uhr: >> Really the best solution
(if possible) would be if the new key could be
signed by the old one and thus automatically accepted by zypper et al.
I have no idea if this is even possible, nor how to implement it in OBS. A
plain "osc signkey --create" will simply wipe the old one and create a new
key, but that would cause a bad user experience :-(
Maybe we should ask security-t...@suse.de for help on how to handle this
best? They surely must be prepared for updating a key.
The signatures, that obs is attaching to the packages are not the same
that the package sin the repo are signed with: All packages are being
resigned in the release process to the mirrors.
Ok, this at least saves us from having to teach OBS to use a very custom
key ;-)
But yes, signing a new key with the old one is a good idea.
...only if the tools (zypper, yast, rpm) actually accept this "new key
signed with old one" without crazy warnings ;-)
If they still complain, then we do not win too much (but also will not
lose anything) by signing the new key with te old one.
--
Stefan Seyfried
"For a successful technology, reality must take precedence over
public relations, for nature cannot be fooled." -- Richard Feynman
_______________________________________________
Packman mailing list
Packman@links2linux.de
https://lists.links2linux.de/cgi-bin/mailman/listinfo/packman
