<html><head></head><body>fedora-repos should have all the keys needed for upgrade. So the only thing needing the keys is mock. However I'm not sure you should include rpmfusion keys in Fedora.<br>
<br>
Dennis<br><br><div class="gmail_quote">On October 16, 2015 2:26:16 AM CDT, "Miroslav Suchý" <msuchy@redhat.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Dne 15.10.2015 v 23:23 Alexander Ploumistos napsal(a):<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Hello,<br /> <br /> Please forgive my ignorance, but how is this supposed to be used? I<br /> guess it's handy to keep track of all the current keys, but unlike,<br /> say rpmfusion-free-release, the keys are not placed or linked in<br /> /etc/pki/, nor are they imported in a gpg keyring. What am I missing?<br /> <br /> Also, shouldn't there be "SourceX" entries for each key in the spec file?<br /> <br /></blockquote><br /><br />Right now at least two projects (mock and fedora-upgrade) contains and use those keys.<br />So once this get into Fedora (and Epel) I can remove those keys from fedora-upgrade and mock and use this common package.<br /><br />Mock need CentOS and Epel keys when installing epel chroot and vice versa when installing fedora chroots on RHEL/CentOS.<br />It can not use
epel-release because it is not available on Fedora.<br /><br />The other keys (rpmfusion and in future Copr) are there just because we can. It is meant as safe way of delivery.<br />Instead of manual downloading from web and verification that the download is correct (do you really do that?) you<br />download distribution-gpg-keys package. Dnf will automatically check that gpg key of this package so you can be sure<br />that those keys are downloaded correctly and has not been altered by man in the middle.<br /><br />I do not want to place them to /etc/pki and automatically import them. I will leave it up to user if he really want to<br />import them (or some of them) or other tools. E.g. fedora-upgrade automatically import some of them.<br /><br />I announced it here, because in past I seen several people asking about such collection of GPG keys. They usually ended<br />with mock collection. So I thought that this may be useful for somebody too.<br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>