After discovering that some Fedora servers have been illegally accessed, the Fedora Project is, as of today, converting the signing keys for Linux distribution packages.
The Red Hat sponsored Linux distribution became aware of the intrusion at the end of August. One of the servers compromised was a server used for signing Fedora packages and as a result, the project has decided to change the key. Project leader Paul Frields writes: "While there is no definitive evidence that the Fedora key has been compromised, because Fedora packages are distributed via multiple third-party mirrors and repositories, we have decided to convert to new Fedora signing keys."
The project developers will use the so called Phase 1 to initiate updates for Fedora 8 and 9, which will begin the conversion. From today the new packages are available on the mirror servers. Among others, the packages 'fedora-release', 'package-kit' and 'gnome-package kit' are being re-vamped.
The user will have to verify and import the updates with the new GPG key. The software guides the user through the download process but instructions are also available at Fedora-Wiki. After that, the package management receives updates as newly signed packages from a new repository.
In Phase 2, Fedora developers will not only update, but will assign new keys to all Fedora 8 and 9 releases.
Get 3 Issues + 3 DVDs for the price of a single issue!
Let Linux Magazine's hands-on, technical articles guide you in your daily Linux use. Check out bonus DVDs like Ubuntu, SUSE, or Fedora and save the download.
Only available for a limited time. Don't miss out!
Comments