scim-libs not signed error when using yum??

[Gianluca Cecchi]

Hello,
with fc5 devel installed, after syncronizing with
ftp.mirror.ac.uk::fedora.redhat.com/development/i386/
and trying to do
yum localupdate *rpm
under Fedora/RPMS directory, I get

[snip]
Installing for dependencies:
 xscreensaver-extras     i386       1:4.22-21.2      development       2.9 M

Transaction Summary
=============================================================================
Install      3 Package(s)
Update      16 Package(s)
Remove       2 Package(s)
Total download size: 116 M
Is this ok [y/N]: y
Downloading Packages:

Package scim-libs-1.4.2-9.i386.rpm is not signed

I tried also rpm --import RPM-GPG-KEY under the root i386 dir,
but nothing changes.
As there are various KEY files, different in size, in this directory, do I
have to import all of them?
These problem was there also yesterday and with "rpm -Fvh *rpm" the
yesterday packages
were upgraded (no new instal needed). With the same method I should install
xscreensaver-extras and eventually dependancies and then run -Fvh for the
rest
I would like to wait, going through yum if possible
Any hints?
yum version is the latest: 2.5.0

Thanks in advance
Gianluca

PS: This environment is under VMware workstation 5.5 so I can trick with
snapshots
or similar if useful.

[Rahul Sundaram]

Gianluca Cecchi wrote:
> Hello,
> with fc5 devel installed, after syncronizing with
> ftp.mirror.ac.uk::fedora.redhat.com/development/i386/
> and trying to do
> yum localupdate *rpm
> under Fedora/RPMS directory, I get
>
> [snip]
> Installing for dependencies:
>  xscreensaver-extras     i386       1:4.22-21.2      development       
> 2.9 M
> Transaction Summary
>
> Install      3 Package(s)
> Update      16 Package(s)
> Remove       2 Package(s)
> Total download size: 116 M
> Is this ok [y/N]: y
> Downloading Packages:
>
> Package scim-libs-1.4.2-9.i386.rpm is not signed
>
> I tried also rpm --import RPM-GPG-KEY under the root i386 dir,
> but nothing changes.
> As there are various KEY files, different in size, in this directory, 
> do I have to import all of them?

You can try importing all of the keys or disable gpg key check just for 
the rawhide installation.
> These problem was there also yesterday and with "rpm -Fvh *rpm" the 
> yesterday packages
> were upgraded (no new instal needed). With the same method I should 
> install
> xscreensaver-extras and eventually dependancies and then run -Fvh for 
> the rest
> I would like to wait, going through yum if possible
> Any hints?

yum install xscreensaver-extras works fine here.

regards
Rahul

[Rodd Clarkson]

On Tue, 2005-12-20 at 11:28 +0530, Rahul Sundaram wrote:
> Gianluca Cecchi wrote:
> > Hello,
> > with fc5 devel installed, after syncronizing with
> > ftp.mirror.ac.uk::fedora.redhat.com/development/i386/
> > and trying to do
> > yum localupdate *rpm
> > under Fedora/RPMS directory, I get
> >
> > [snip]
> > Installing for dependencies:
> >  xscreensaver-extras     i386       1:4.22-21.2      development       
> > 2.9 M
> > Transaction Summary
> >
> > Install      3 Package(s)
> > Update      16 Package(s)
> > Remove       2 Package(s)
> > Total download size: 116 M
> > Is this ok [y/N]: y
> > Downloading Packages:
> >
> > Package scim-libs-1.4.2-9.i386.rpm is not signed
> >
> > I tried also rpm --import RPM-GPG-KEY under the root i386 dir,
> > but nothing changes.
> > As there are various KEY files, different in size, in this directory, 
> > do I have to import all of them?
>
> You can try importing all of the keys or disable gpg key check just for 
> the rawhide installation.
> > These problem was there also yesterday and with "rpm -Fvh *rpm" the 
> > yesterday packages
> > were upgraded (no new instal needed). With the same method I should 
> > install
> > xscreensaver-extras and eventually dependancies and then run -Fvh for 
> > the rest
> > I would like to wait, going through yum if possible
> > Any hints?
>
> yum install xscreensaver-extras works fine here.
>
> regards
> Rahul

Try yum update yum and then try to install xcreensaver-extras.

I version of yum a few version back did this a bit.

Rodd
>

[Gianluca Cecchi]

> > You can try importing all of the keys or disable gpg key check just for the

rawhide installation.

Imported all the RPM-GPG keys files, but nothing changes.
Also, the command "yum localinstall xscreensaver-extra" gives the same error
about xscreensaver-extra not being signed....
How to disable gpg check? Is it safe?
> > yum install xscreensaver-extras works fine here.

It works also for me, but I would like not to download packages two times,
one for syncronizing and one for updating...
Gianluca

[Rahul Sundaram]

Gianluca Cecchi wrote:
> > > You can try importing all of the keys or disable gpg key check just
>
> for the rawhide installation.
>
> Imported all the RPM-GPG keys files, but nothing changes.
> Also, the command "yum localinstall xscreensaver-extra" gives the same 
> error
> about xscreensaver-extra not being signed....
> How to disable gpg check? Is it safe?
> > > yum install xscreensaver-extras works fine here.
>
> It works also for me, but I would like not to download packages two 
> times, one for syncronizing and one for updating...
> Gianluca

Not sure what you mean here.  Yum checks the repository and downloads 
the repository metadata once if the local cache is not in sync with the 
mirror and then downloads the packages requested. Subsequent runs of Yum 
on rawhide does not redownload metadata and uses the local cache for the 
specified expiration period which is controlled by the metadata_expire 
in yum.conf with the default value of 1800 (seconds). If you perform a 
network installation you are only downloading these packages once. In 
any case the number of times you download a package does not vary while 
using  yum as compared to RPM.

regards
Rahul

[Jens-Ulrik Petersen]

Gianluca Cecchi wrote:
> Package scim-libs-1.4.2-9.i386.rpm is not signed

Packages in FC Devel are not usually signed (except for packages included
from test releases).

Please set "gpgcheck=0" in the appropriate repos file in
"/etc/yum.repos.d/".

Jens

[Gianluca Cecchi]

For Jens:
> Please set "gpgcheck=0" in the appropriate repos file in
> "/etc/yum.repos.d/".
>
> Jens

I already had gpgcheck=0 in all files under yum.repos.d directory. But the
error remained.
It seems that to get yum working with the "localupdate" flag it is also
necessary to change
the /etc/yum.conf file setting gpgcheck=0 there. After changing it, it
worked out.
Thanks for the suggestion about the way to follow.
The doubt about correct use of "localupdate" still remains for a production
system yet....

For Raul:
> > Not sure what you mean here.

I mean that I use rsync command on one system; then in the other one
(virtual machine)
I mount the RPMS directory via nfs and use yum using the flag "localupdate" and
specifying
*rpm for all packages contained. In this way yum should use local rpm files
without downloading, and download eventually
only files that are missing from the local *rpm list and that are necessary
for dependencies.

Gianluca

[Horst H. von Brand]

Jens Petersen  wrote:
> Gianluca Cecchi wrote:
> > Package scim-libs-1.4.2-9.i386.rpm is not signed
> Packages in FC Devel are not usually signed (except for packages included
> from test releases).

Could The Powers That Be consider signing the packages? Even with a
rawhide-only key? That way I'd sleep a little better, knowing I've got no
malicious gunk installed on my machine.

[Jesse Keating]

On Tuesday 20 December 2005 09:37, Horst von Brand wrote:
> Could The Powers That Be consider signing the packages? Even with a
> rawhide-only key? That way I'd sleep a little better, knowing I've got no
> malicious gunk installed on my machine.

It is test software, we aren't completely sure it isn't malicious gunk from 
upstream....

[Horst H. von Brand]

Jesse Keating  wrote:
> On Tuesday 20 December 2005 09:37, Horst von Brand wrote:
> > Could The Powers That Be consider signing the packages? Even with a
> > rawhide-only key? That way I'd sleep a little better, knowing I've got no
> > malicious gunk installed on my machine.
> It is test software, we aren't completely sure it isn't malicious gunk from 
> upstream....

At least I know it is the high-explosive gunk from rawhide...

[Nicolas Mailhot]

On Mar 20 décembre 2005 22:44, Horst von Brand wrote:
> Jesse Keating  wrote:
> > On Tuesday 20 December 2005 09:37, Horst von Brand wrote:
> > > Could The Powers That Be consider signing the packages? Even with a
> > > rawhide-only key? That way I'd sleep a little better, knowing I've got
> >
> > no
> > > malicious gunk installed on my machine.
> > It is test software, we aren't completely sure it isn't malicious gunk
> > from
> > upstream....
>
> At least I know it is the high-explosive gunk from rawhide...

+1

There's a difference between raw packages (devel) and malicious packages.

[Warren Togami]

Horst von Brand wrote:
> Jens Petersen  wrote:
> > Gianluca Cecchi wrote:
> > > Package scim-libs-1.4.2-9.i386.rpm is not signed
> > Packages in FC Devel are not usually signed (except for packages included
> > from test releases).
>
> Could The Powers That Be consider signing the packages? Even with a
> rawhide-only key? That way I'd sleep a little better, knowing I've got no
> malicious gunk installed on my machine.

It is possible that we can do this in the future after we implement a 
key piece of infrastructure, but until then it will remain unsigned like 
all past years of rawhide.

I am pushing for signing of rawhide using a separate less trusted 
automatic signing key.  It will happen one day...

Warren Togami
[e-mail]