As you well know, we have been working hard to get updates for 8 and 9
flowing again, complete with new package signing keys. Discussion has
been somewhat quiet on this front as we've all had our heads down and
have been working hard toward a solution, one that involves little to no
manual effort on behalf of our users.

Today we've reached a major milestone in this progress. We have done a
successful compose of all the existing and as of yesterday pending
updates for Fedora 8 and Fedora 9, all signed with our new keys. These
updates will soon hit mirrors in a new set of directory locations. What
we don't have quite yet is the updated fedora-release package in the old
updates location that will get you the new keys and the new repo
locations. The last mile testing of this update requires that new
updates be live on the mirrors.

Due to the size of the resigned updates, it may take a good while for
our sync process. This may delay getting the new fedora-release out
until tomorrow, but we'll be working hard on it.

While we're working on this update, we'll also be drafting a FAQ page to
explain to users what it is that we're doing, and hopefully answer some
of the questions that will come up. This document will be living
though, and as you encounter questions yourself, or questions via one of
our many avenues of support (email, IRC, forums, LUGS, etc..) please
help us in growing that document. Announcements regarding the location
of said document and how to help with content will be coming shortly.

We deeply appreciate the enormous magnitude of patience you the greater
community has shown us the Fedora project as we work though these
serious issues. It is a great testament to how wonderful it is to work
in and with the Fedora community.

--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
_______________________________________________
Fedora-devel-announce mailing list
Fedora-devel-announce@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-announce--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Jesse Keating wrote:

As you well know, we have been working hard to get updates for 8 and 9
flowing again, complete with new package signing keys. Discussion has
been somewhat quiet on this front as we've all had our heads down and
have been working hard toward a solution, one that involves little to no
manual effort on behalf of our users.

Today we've reached a major milestone in this progress. We have done a
successful compose of all the existing and as of yesterday pending
updates for Fedora 8 and Fedora 9, all signed with our new keys. These
updates will soon hit mirrors in a new set of directory locations. What
we don't have quite yet is the updated fedora-release package in the old
updates location that will get you the new keys and the new repo
locations. The last mile testing of this update requires that new
updates be live on the mirrors.

Due to the size of the resigned updates, it may take a good while for
our sync process. This may delay getting the new fedora-release out
until tomorrow, but we'll be working hard on it.

While we're working on this update, we'll also be drafting a FAQ page to
explain to users what it is that we're doing, and hopefully answer some
of the questions that will come up. This document will be living
though, and as you encounter questions yourself, or questions via one of
our many avenues of support (email, IRC, forums, LUGS, etc..) please
help us in growing that document. Announcements regarding the location
of said document and how to help with content will be coming shortly.

We deeply appreciate the enormous magnitude of patience you the greater
community has shown us the Fedora project as we work though these
serious issues. It is a great testament to how wonderful it is to work
in and with the Fedora community.




First, thanks for all the work to get this back on track.

I went and got the new spins of qt-4.4. Now I can't install the because
I don't have the new key. I realize I could turn off the key, but after
last month, that seems dicier than it used to be.


In any event, is the new key for updates 9 available someplace. I
realize it'll be part of fedora release eventually. But the public key
itself, is it out there someplace now?


Thanks again.

sean

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

sean darcy a écrit :

> In any event, is the new key for updates 9 available someplace. I
> realize it'll be part of fedora release eventually. But the public key
> itself, is it out there someplace now?

It will in the next "fedora-released" RPM update

It's also available on keys server :
http://pgp.mit.edu:11371/pks/lookup?search=0x6DF2196F&op=index

++

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

>> As you well know, we have been working hard to get updates for 8 and 9
>> flowing again, complete with new package signing keys. Discussion has
>> been somewhat quiet on this front as we've all had our heads down and
>> have been working hard toward a solution, one that involves little to no
>> manual effort on behalf of our users.
>>
>> Today we've reached a major milestone in this progress. We have done a
>> successful compose of all the existing and as of yesterday pending
>> updates for Fedora 8 and Fedora 9, all signed with our new keys. These
>> updates will soon hit mirrors in a new set of directory locations. What
>> we don't have quite yet is the updated fedora-release package in the old
>> updates location that will get you the new keys and the new repo
>> locations. The last mile testing of this update requires that new
>> updates be live on the mirrors.
>>
>> Due to the size of the resigned updates, it may take a good while for
>> our sync process. This may delay getting the new fedora-release out
>> until tomorrow, but we'll be working hard on it.
>>
>> While we're working on this update, we'll also be drafting a FAQ page to
>> explain to users what it is that we're doing, and hopefully answer some
>> of the questions that will come up. This document will be living
>> though, and as you encounter questions yourself, or questions via one of
>> our many avenues of support (email, IRC, forums, LUGS, etc..) please
>> help us in growing that document. Announcements regarding the location
>> of said document and how to help with content will be coming shortly.
>>
>> We deeply appreciate the enormous magnitude of patience you the greater
>> community has shown us the Fedora project as we work though these
>> serious issues. It is a great testament to how wonderful it is to work
>> in and with the Fedora community.
>>
>>
>
> First, thanks for all the work to get this back on track.
>
> I went and got the new spins of qt-4.4. Now I can't install the because I
> don't have the new key. I realize I could turn off the key, but after last
> month, that seems dicier than it used to be.
>
> In any event, is the new key for updates 9 available someplace. I realize
> it'll be part of fedora release eventually. But the public key itself, is it
> out there someplace now?

I think its part of the new fedora-release package and is available on
the fedora project site here http://fedoraproject.org/keys.html

Peter

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

sean darcy wrote:
> In any event, is the new key for updates 9 available someplace. I
> realize it'll be part of fedora release eventually. But the public
> key itself, is it out there someplace now?

The keys are in CVS for fedora-release:

http://cvs.fedoraproject.org/viewvc/fedora-release/?root=fedora

The fingerprints can be verified at:

https://fedoraproject.org/keys

--
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~
In some cultures what I do would be considered normal.

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On 2008-09-06, 16:23 GMT, Todd Zullinger wrote:
> The fingerprints can be verified at:
>
> https://fedoraproject.org/keys

Except that the webpage mentions email fedora@redhat.com whereas
the real key is signed for fedora@fedoraproject.org

Matěj

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Matej Cepl wrote:
> On 2008-09-06, 16:23 GMT, Todd Zullinger wrote:
>> The fingerprints can be verified at:
>>
>> https://fedoraproject.org/keys
>
> Except that the webpage mentions email fedora@redhat.com whereas
> the real key is signed for fedora@fedoraproject.org

It only uses that address in the example, which uses the old key in
/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora and in the "Obsolete Keys"
section when giving details for the old key. And that address is
correct for the old key.

The information there for RPM-GPG-KEY-fedora-8-and-9-primary and
RPM-GPG-KEY-fedora-test-8-and-9-primary should be correct. If it does
not match what is in the updated files in fedora-release, please yell
loudly.

--
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~
Now I'm finding truth is a ruin
Nauseous end that nobody is pursuing

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

2008/9/6 Todd Zullinger <tmz@pobox.com>:
> Matej Cepl wrote:
>> On 2008-09-06, 16:23 GMT, Todd Zullinger wrote:
>>> The fingerprints can be verified at:
>>>
>>> https://fedoraproject.org/keys
>>
>> Except that the webpage mentions email fedora@redhat.com whereas
>> the real key is signed for fedora@fedoraproject.org
>
> It only uses that address in the example, which uses the old key in
> /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora and in the "Obsolete Keys"
> section when giving details for the old key. And that address is
> correct for the old key.
>
> The information there for RPM-GPG-KEY-fedora-8-and-9-primary and
> RPM-GPG-KEY-fedora-test-8-and-9-primary should be correct. If it does
> not match what is in the updated files in fedora-release, please yell
> loudly.

What would be even better is if the new GPG keys would be able to be
verified through the GPG web of trust. I'm not sure how much time is
left in Fudcon Brno, but maybe the folks over there could arrange an
impromptu keysigning to expand the GPG web of trust among Fedorans.

--
Jeff Ollie

"You know, I used to think it was awful that life was so unfair. Then
I thought, wouldn't it be much worse if life were fair, and all the
terrible things that happen to us come because we actually deserve
them? So, now I take great comfort in the general hostility and
unfairness of the universe."

-- Marcus to Franklin in Babylon 5: "A Late Delivery from Avalon"

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Jeffrey Ollie escreveu:

2008/9/6 Todd Zullinger <tmz@pobox.com>:


Matej Cepl wrote:


On 2008-09-06, 16:23 GMT, Todd Zullinger wrote:


The fingerprints can be verified at:

https://fedoraproject.org/keys


Except that the webpage mentions email fedora@redhat.com whereas
the real key is signed for fedora@fedoraproject.org


It only uses that address in the example, which uses the old key in
/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora and in the "Obsolete Keys"
section when giving details for the old key. And that address is
correct for the old key.

The information there for RPM-GPG-KEY-fedora-8-and-9-primary and
RPM-GPG-KEY-fedora-test-8-and-9-primary should be correct. If it does
not match what is in the updated files in fedora-release, please yell
loudly.



What would be even better is if the new GPG keys would be able to be
verified through the GPG web of trust. I'm not sure how much time is
left in Fudcon Brno, but maybe the folks over there could arrange an
impromptu keysigning to expand the GPG web of trust among Fedorans.



Doing as told in the page we get:



[root@terra rpm-gpg]# rpm
--import PUBKEY

erro: PUBKEY: leitura de importação falhou (-1).

[root@terra rpm-gpg]#



error: PUBKEY: import reading failed (-1).





--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Casimiro de Almeida Barreto wrote:
> Doing as told in the page we get:
>
> [root@terra rpm-gpg]# rpm --import PUBKEY
> erro: PUBKEY: leitura de importação falhou (-1).
> [root@terra rpm-gpg]#
>
> error: PUBKEY: import reading failed (-1).

That is just a usage example, you need to replace PUBKEY with the path
to a key, like /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-8-and-9-primary.
Note that yum will do this for you automatically in most cases, so it
is not necessary. (As the page says just above that example: "The
keys used by Fedora are enabled in the yum repository configuration,
so you generally don't need to manually import them into the rpm
database.")

More likely, you'd want to use gpg to import the key and then verify
the fingerprint, as the later examples show.

--
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~
It is impossible to enjoy idling thoroughly unless one has plenty of
work to do.
-- Jerome K. Jerome

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list