Should Fedora rpms be signed?

[Andrew]

> On Fri, October 29, 2004 02:08 PM Jeff Spaleta wrote:

> you can grab the signed metadata with the md5sums, check the sig on that.
> and then do a md5sum check comparing the md5sum values in the metadata
> and the package. You can do the md5sum check by hand. This isn't much
> different than the situation with the isos.  How do you verify you are
> using the correct isos? you check the md5sums against an md5sum list.
> How do you check the validity of the md5sum list?
> You check the md5sum list signature. 

Amen!!!!!! Thank you for restating that again. I was hoping when you
presented that before it would put all this to rest.
Thats how digital signatures "work". I think that is really the
BEST solution for this whole problem.   
 
> 
> You might argue it would be a good idea if there was a signed flat
> md5sum list for all packages as well as the xml metadata, so the
> md5sum command could use it. And then I'll tell you, you need to
> accept the inevitable future of xml for all possible human
> communication adopted by unanimous United Nations resolution, and you
> should fix md5sum to parse xml structure files for md5sum sigs :->

Exactly! 
 
> Can rawhide packages be automatically signed... of course
> Does autosigning help the intended, well informed, audience of the
> rawhide packages... yes
> Does autosigning hurt the unintended, un-informed or mis-informed
> audience... i think it does.

> 
> -jef
> 

I and think the latter is a bigger and worse impact than the 
benefit of the former!

Andrew