Open registration is disabled at the moment due to spam.If you need a new account, please contact Keto on oftc.net IRC and provide your desired username and email.
This Bugzilla instance is no longer in active use, so you should only need an account if you wish to use the Sailfish OS community OBS.
Bug 334 - OBS repos should not have gpgcheck=1 for unsigned repos.
Summary: OBS repos should not have gpgcheck=1 for unsigned repos.
Status: NEW
Alias: None
Product: Mer Integration Tools (MINT)
Classification: Unclassified
Component: OBS (show other bugs)
Version: unspecified
Hardware: Other Mer
: Normal normal
Assignee: Not Taken
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-05-16 10:28 UTC by Marko Saukko
Modified: 2012-05-21 11:17 UTC (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marko Saukko 2012-05-16 10:28:02 UTC 
Currently the repos in community OBS are not signed, but the .repo files produced by OBS have gpgcheck=1 which slows down developers using repos.

Error shown to developer if he didn't mofidy the .repo file:
File 'repomd.xml' from repository 'Branch of Mer:fake:Core:i586 (Mer_Core_armv7hl)' is unsigned, continue? [yes/no] (no): yes

Example of the current .repo file:
[home_sage_branches_Mer_fake_Core_i586]
name=Branch of Mer:fake:Core:i586 (Mer_Core_armv7hl)
type=rpm-md
baseurl=http://repo.pub.meego.com/home:/sage:/branches:/Mer:/fake:/Core:/i586/Mer_Core_armv7hl/
gpgcheck=1
enabled=1
Comment 1 David Greaves 2012-05-21 11:16:27 UTC 
triaged

Signing meego.com packages is difficult.

Better is to make gpgcheck=0 - this is an OBS bug as it shouldn't be 1 for unsigned repos.

changed summary and relocated