Changes between Version 1 and Version 2 of Ticket #20422, comment 3


Ignore:
Timestamp:
Oct 21, 2016, 10:48:02 AM (3 years ago)
Author:
boklm
Comment:

Legend:

Unmodified
Added
Removed
Modified
  • Ticket #20422, comment 3

    v1 v2  
    11I think to fix this we can:
    2 * email the pycrypto author to ask if they have an updated key
    3 * check the checksum of the file instead of its gpg signature
    4 * check for EXPKEYSIG in addition to GOODSIG in the gpg status output, to allow signatures from expired keys. This will however apply to all packages. If we do this we should also clean all the keyring files we use to remove obsolete expired keys to make sure they cannot be used.
     21. email the pycrypto author to ask if they have an updated key
     32. check the checksum of the file instead of its gpg signature
     43. check for EXPKEYSIG in addition to GOODSIG in the gpg status output, to allow signatures from expired keys. This will however apply to all packages. If we do this we should also clean all the keyring files we use to remove obsolete expired keys to make sure they cannot be used.