Fedora converts package keys

Sep 10, 2008

After discovering that some Fedora servers have been illegally accessed, the Fedora Project is, as of today, converting the signing keys for Linux distribution packages.

The Red Hat sponsored Linux distribution became aware of the intrusion at the end of August. One of the servers compromised was a server used for signing Fedora packages and as a result, the project has decided to change the key. Project leader Paul Frields writes: "While there is no definitive evidence that the Fedora key has been compromised, because Fedora packages are distributed via multiple
third-party mirrors and repositories, we have decided to convert to new Fedora signing keys."

The project developers will use the so called Phase 1 to initiate updates for Fedora 8 and 9, which will begin the conversion. From today the new packages are available on the mirror servers. Among others, the packages 'fedora-release', 'package-kit' and 'gnome-package kit' are being re-vamped.

The user will have to verify and import the updates with the new GPG key. The software guides the user through the download process but instructions are also available at Fedora-Wiki. After that, the package management receives updates as newly signed packages from a new repository.

In Phase 2, Fedora developers will not only update, but will assign new keys to all Fedora 8 and 9 releases.

Related content

  • (Update:) Fedora: Chronicle of a Server Break-in

    In August 2008, the Fedora team noticed irregularities on its server. Project leader Paul W. Frields has now released a detailed report of the break-in.

  • Fedora Backpedals on Password Free Installation

    A new feature in Fedora 12 was that users could install RPM packages from signed repositories without a root password. "Not good," said many users, so the project decided to reverse the policy.

  • Fedora Investigates Security Incident

    "Based on the results of our investigation so far, we do not believe that any Fedora packages or other Fedora contributor accounts were affected by thiscompromise," said Fedora project leader, Jared Smith in an email to the Fedora announce mailing list.

  • Installing Software

    We provide an introduction to installing and managing RPM packages.

  • Red Hat Custom Install

    If you’re one of those users who just wants to slip the CD into the drive and answer the prompts,your are probably content with a Red Hat installation. But if you are someone who wants it your own way,you might be looking for a better fit.We’ll show you how to get it.

comments powered by Disqus

Issue 19: Linux Shell Handbook 5th Ed./Special Editions

Buy this issue as a PDF

Digital Issue: Price $15.99
(incl. VAT)

News

njobs Europe
What:
Where:
Country:
Njobs Netherlands Njobs Deutschland Njobs United Kingdom Njobs Italia Njobs France Njobs Espana Njobs Poland
Njobs Austria Njobs Denmark Njobs Belgium Njobs Czech Republic Njobs Mexico Njobs India Njobs Colombia