[prev in list] [next in list] [prev in thread] [next in thread] 

List:       debian-devel
Subject:    Re: APT public key updates?
From:       Thomas Viehmann <tv () beamnet ! de>
Date:       2006-01-11 6:43:55
Message-ID: 43C4A92B.6040300 () beamnet ! de
[Download RAW message or body]

Frans Pop wrote:
> On Saturday 20 February 2010 09:15, Joey Hess wrote:
>>Nonzero exit; odd, it doesn't seem to notice that the key is expired at
>>all. But apt won't use gpgv like that, I suppose, but instead like
>>this:

> Note though that other packages, like debmirror, do:
> 
> my $GPG="gpg --no-tty -q";
> [...]
> if (!-f "$tempdir/dists/$dist/Release.gpg" || \
>     !-f "$tempdir/dists/$dist/Release" || \
>     system("$GPG --verify $tempdir/dists/$dist/Release.gpg $tempdir/dists/$dist/Release")) {
Well, anyone using the mirror can then verify.
If you're just trying to determine whether or not Release corresponds to
Release.gpg this behaviour is much saner than assuming Release invalid,
because debmirror would attempt to fix that by regetting.

Kind regards

T.
-- 
Thomas Viehmann, http://thomas.viehmann.net/


-- 
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

[prev in list] [next in list] [prev in thread] [next in thread]