[Rpm-maint] [rpm-software-management/rpm] rpm 4.20.0 alpha fallout #1 : urpmi --no-verify is broken by rpm checking on its own (Issue #3142)

[Panu Matilainen]

Yeah rpm doesn't have a meaningful way to update keys because back when I added the "is primary key id present", we didn't know anything about expiry, revokes, subkeys .. nothing. 
https://github.com/rpm-software-management/rpm/pull/3083 promises to fix that, until then the best you can do is try importing, if it already exists erase the key and try again. 

I don't know what urpmi --no-verify does, exactly. The story on rpm side is complicated as there are multiple related and partially overlapping mechanisms: the verify step during transactions is not a "signature check" per se, it's more of a payload validation step. Signatures can be used in there, but aren't by default. If urpmi's --no-verify is supposed to be a direct --nosignature counterpart then see 5ed632ae8a2a4a6de69a0d800340c9dc5d529ec0.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/3142#issuecomment-2151505422
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/issues/3142/2151505422 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20240605/73209f98/attachment.html>