Mandriva error message - please help novice (also in alt.os.linux)

On 2005-11-21, Proteus <proteus@uselessemail.net> wrote:

> On Mon, 21 Nov 2005 12:03:20 +0000, Neil Hindry wrote:
> ...

>> The following packages have bad signatures:- Fribidi-0-10.4-5mdk.i586.rpm
>> Invalid key ID ((sha1) dsa sha1.md5 gpg GPG#707717.ff3 OK) gstreamer-
>>
>> Does this message mean anything to anyone?
>>
>> I am assuming the key is invalid or corrupt, is this correct? What is the
>> key for? Is it safe to continue with the installation or should I stop it?
>>
>> I get this message the majority of times I try to install something but
>> obviously the filenames are different.

> ...
>
> I always get that too when installing packages off the Mandriva discs, I
> think it has to do with incorrect or missing MD5 (signature) files, or
> soemthing like that; I just go ahead and install the files anyhow and
> disregard the error msgs. I do not usually get those errors when I
> install packages with urpmi from remote repositories (if you did, it
> could indicate a possible corrupt download, or virus/trojan infected
> file). Perhaps Mandriva needs to do a better job setting up their discs?

'Configure your computer' - 'Software Management' - 'Select from where
software packages are downloaded when updating the system' - 'Manage
Keys'. You need to be on-line to download the 'keys'.

The message you mention refers to the 'digital signature' added to the
files by Mandriva as an additional layer of security. The 'md5sum' check
is different and less secure, but adequate if you trust the source of the
file.

I'm not sure that I would trust a key for a digital signature, if it were
to come from the same CD as the signed file; the whole point of digital
signatures is that you get the key from a trusted source that is seperate
from the file :))

Urpmi generally fetches the keys when you set up a 'source', but it can't
do that for the installation discs if you aren't on line at the time those
discs are added to your 'sources' (which happens automatically on
installation).

If you know that you have the correct key for the file but still get the
'bad signature' message, then that is indeed a warning of possible
problems.

--
-- ^^^^^^^^^^
-- Whiskers
-- ~~~~~~~~~~

On Mon, 21 Nov 2005 15:54:58 +0000, Whiskers wrote:

> 'Configure your computer' - 'Software Management' - 'Select from where
> software packages are downloaded when updating the system' - 'Manage
> Keys'. You need to be on-line to download the 'keys'.
>
> The message you mention refers to the 'digital signature' added to the
> files by Mandriva as an additional layer of security. The 'md5sum' check
> is different and less secure, but adequate if you trust the source of the
> file.

> I'm not sure that I would trust a key for a digital signature, if it were
> to come from the same CD as the signed file; the whole point of digital
> signatures is that you get the key from a trusted source that is seperate
> from the file :))
>
> Urpmi generally fetches the keys when you set up a 'source', but it can't
> do that for the installation discs if you aren't on line at the time those
> discs are added to your 'sources' (which happens automatically on
> installation).
>
> If you know that you have the correct key for the file but still get the
> 'bad signature' message, then that is indeed a warning of possible
> problems.

Nice info, I am getting educated! Thank you.

On Mon, 21 Nov 2005 08:55:32 -0500, Proteus <proteus@uselessemail.net> wrote:

> I always get that too when installing packages off the Mandriva discs, I

Best thing to do is get all of the Mandrake/Mandriva keys on your rpm keyring.

See http://groups.google.com/group/alt.o...7?dmode=source

If you still get errors after that, then the problem is with the
urpmi setup, or a bad copy burnt to the cds.

Regards, Dave Hodgins

--
Change nomail.afraid.org to rogers.com to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

On 2005-11-21, Proteus <proteus@uselessemail.net> wrote:

snip

> Nice info, I am getting educated! Thank you.

I hope it's right then <G>

--
-- ^^^^^^^^^^
-- Whiskers
-- ~~~~~~~~~~