Unsigned Packages - Yum/Pk

[Frank Murphy]

PackageKit allows a forced install of unsigned pkg.

yu does the following:
Package krb5-libs-1.7.1-7.fc13.i686.rpm is not signed

I know about --nogpgcheck.

But can I edit something to the effect of:
If unsigned don't include.

[James Antill]

On Sat, 2010-04-03 at 12:52 +0100, Frank Murphy wrote:
> PackageKit allows a forced install of unsigned pkg.
>
> yu does the following:
> Package krb5-libs-1.7.1-7.fc13.i686.rpm is not signed
>
> I know about --nogpgcheck.
>
> But can I edit something to the effect of:
> If unsigned don't include.

Yum can only tell if something is signed (and by what key it is signed)
after it has downloaded the package.
 Currently we have no easy way to "exclude" packages after the download
phase (the basic problem being we'd need to go back and redo the
transaction, which was a couple of steps earlier).

Which is to say, no.

[John Reiser]

> Yum can only tell if something is signed (and by what key it is signed)
> after it has downloaded the package.
>   Currently we have no easy way to "exclude" packages after the download
> phase (the basic problem being we'd need to go back and redo the
> transaction, which was a couple of steps earlier).

Does yum "batch" the complaints about unsigned packages, so that
the user learns about each unsigned package that was in the transaction,
or does it take as many transactions as unsigned packages
in order for the user to learn the complete list to --exclude ?

--

[Frank Murphy]

On 05/04/10 17:19, John Reiser wrote:
> > Yum can only tell if something is signed (and by what key it is signed)
> > after it has downloaded the package.
> >    Currently we have no easy way to "exclude" packages after the download
> > phase (the basic problem being we'd need to go back and redo the
> > transaction, which was a couple of steps earlier).
>
> Does yum "batch" the complaints about unsigned packages,

Doesn't appear to
If at the very end it says:
Package krb5-libs-1.7.1-7.fc13.i686.rpm is not signed

I then go yum --exclude=krb5-libs

It can then come back this time and say package firefox is unsigned.
( both packages just examples)

so that
> the user learns about each unsigned package that was in the transaction,
> or does it take as many transactions as unsigned packages
> in order for the user to learn the complete list to --exclude ?

This would be some help.

But hopefully the autoqa,
thats talked about may prevent small stuff like this.