signatures for non-rpm files in $arch/os trees?

[Todd Zullinger]

Hi all,

Is there some way to verify the integrity of the non-rpm files
included in the $arch/os tree?  I'm thinking of the images/
specifically.

If I want to kick off an install I could download the rescue disk iso,
check the gpg sig on the SHA1SUM file, and then verify the sha1sum for
the rescue image.  But if I just want to grab boot.iso or diskboot.img
and do the same thing, I don't know of a way to verify those images.

Is there some way to do this or is there good reason that doing so is
pointless?

[Till Maas]

On So März 25 2007, Todd Zullinger wrote:

[verify boot.iso and diskboot.img]

The only way I know of, is to download the DVD or maybe the first CD, verify 
it (there are gpg signed sha1sums available) and then extrac boot.iso and 
diskboot.img from it.

Regards,
Till

[Todd Zullinger]

Till Maas wrote:
> On So März 25 2007, Todd Zullinger wrote:
>
> [verify boot.iso and diskboot.img]
>
> The only way I know of, is to download the DVD or maybe the first
> CD, verify it (there are gpg signed sha1sums available) and then
> extrac boot.iso and diskboot.img from it.

:-)  True, that is one way.  But of course it defeats the purpose of
only having to download a tiny file to boot from.