Fedora GPG signing/verifying question
Hi,When publishing, does Fedora: a) rebuild a maintainer's package from source and gpg sign it with their own fedora gpg key (ex. /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-11-primary) OR: b) publish the package that the maintainer personally compiled and gpg signed with their personal key?If the answer is b), why do we import a Fedora public key to verify packages/rpms? Michael Zhang Software Developer Test (WAS Install Team) Phone: 1-9054133415 E-mail: michael.zh...@ibm.com ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Fedora GPG signing/verifying question
Thanks for the response. Michael Zhang Software Developer Test (WAS Install Team) Phone: 1-9054133415 E-mail: michael.zh...@ibm.com - Original message -From: Tom Hughes To: Development discussions related to Fedora , Michael Zhang Cc:Subject: Re: Fedora GPG signing/verifying questionDate: Thu, Mar 28, 2019 12:27 PM On 28/03/2019 16:24, Michael Zhang wrote:> When publishing, does Fedora:> a) rebuild a maintainer's package from source and gpg sign it with> their own fedora gpg key> (ex. /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-11-primary)> OR:> b) publish the package that the maintainer personally compiled and> gpg signed with their personal key?>> If the answer is b), why do we import a Fedora public key to verify> packages/rpms?The first - all packages are built from source in koji and thensigned with the Fedora key.Tom--Tom Hughes (t...@compton.nu)http://compton.nu/___devel mailing list -- devel@lists.fedoraproject.orgTo unsubscribe send an email to devel-le...@lists.fedoraproject.orgFedora Code of Conduct: https://getfedora.org/code-of-conduct.htmlList Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelinesList Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Re: Fedora GPG signing/verifying question
On 28/03/2019 16:24, Michael Zhang wrote: When publishing, does Fedora: a) rebuild a maintainer's package from source and gpg sign it with their own fedora gpg key (ex. /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-11-primary) OR: b) publish the package that the maintainer personally compiled and gpg signed with their personal key? If the answer is b), why do we import a Fedora public key to verify packages/rpms? The first - all packages are built from source in koji and then signed with the Fedora key. Tom -- Tom Hughes (t...@compton.nu) http://compton.nu/ ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org