Forwarded to RPM Fusion users discussion list. Bye,
Andrea. ---------- Forwarded message ---------- From: Bram_Gro <[email protected]> Date: Mon, Mar 16, 2009 at 5:49 PM Subject: GPG verification "before" the actual installation. To: [email protected] Hi, As part of my general migration to Fedora, I would like to be able to verify the two Rpmfusion installation files,(both free and non-free) "before" they are imported into Packagekit and their subsequent installation, instead of the other way around. I could simply do it this way: su -c 'rpm -Uvh http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-stable.noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-stable.noarch.rpm' yum update And later rpm --checksig -v ./Download/rpmfusion-free-release-stable.noarch.rpm /Download/rpmfusion-free-release-stable.noarch.rpm Only now its possible to verify them, because they are already installed and the keys are present in the /etc/pki/rpm-gpg folder. But I always like to be able to verify something before I actually install it. I used the same security principle to verify the (then still from within Windows) F10-x86_64-Live.iso. I compared the sha-1sum with the corresponding key with GPG, before I installed F10. This instead of checking it after the actual installation. That would defeat the whole security benefit of checking in the first place. Especially when it comes to these two rpm's, that are used to eventually to download many other rpm's. >From within Fedora, I imported both of these keys into GPA (a GUI for GPG), but now I need to manually import then into the /etc/pki/rpm-gpg folder. I tried this through the GUI, something that is obviously not permitted by the sys. So I'm basically stuck here. Downloaded from pgp.mit.edu. pub 1024D/49C8885A 2008-07-12 Key fingerprint = 870F EA14 0067 8204 7151 BA87 8550 99B2 49C8 885A uid RPM Fusion repository (Fedora - free) <[email protected]> sub 2048g/A2F04C4B 2008-07-12 pub 1024D/B1981B68 2008-07-12 Key fingerprint = 1CF2 6645 C90E 3A34 D518 6273 206F 8182 B198 1B68 uid RPM Fusion repository (Fedora - nonfree) <[email protected]> sub 2048g/71458DC6 2008-07-12 I've already contacted the official Fedora forum and stated this question multiple times in different threads, but they seem to misunderstand what is meant and don't seem to be able to specifically answer my question. Here: http://forums.fedoraforum.org/showthread.php?t=216935 http://forums.fedoraforum.org/showthread.php?t=216716 Do you know how I can achieve this? If so, maybe then you can post a solution in the FAQ, for people who also like to know how it can be done. Thanks in advance, Bram.
