Bram_Gro wrote:
Andrea Musuruane wrote:
---------- Forwarded message ----------
From: مؤيد السعدي <[email protected]>
Date: Mon, Mar 16, 2009 at 11:12 PM
Subject: Re: Fwd: GPG verification "before" the actual installation.
To: RPM Fusion users discussion list
<[email protected]>
wget
http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-stable.noarch.rpm
rpm --checksig -v rpmfusion-free-release-stable.noarch.rpm
if it's ok then install it with
rpm -Uvh rpmfusion-free-release-stable.noarch.rpm
or do that at once with &&
the first command get the rpm without installing
the second check it
and the third installs it
but do you have the public keys ?
and from where you are going to get them ?
you will say from rpmfusion.org
and here we go again
Hi,
The problem is not how to verify the two files or where to get keys from
on the net, its how to import the two public keys into the
/etc/pki/rpm-gpg folder, to successfully complete the verification.
rpm doesn't read keys from that folder - yum does (because that's where
packages drop the key files and refer to them from repo definitions in
/etc/yum.repos.d/*.repo). When yum comes across a package signed with a
key not known to rpm, it tries to import it into rpm from the file(s)
configured in the .repo file.
You can import a key directly into the rpm database yourself by doing:
# rpm --import /path/to/keyfile
The location of this file does not matter.
You can get a list of keys known in the rpm database by doing:
rpm -q gpg-pubkey
Paul.
