[arch-general] Package signing: database signatures?

[Florian Pritz]

On 05.03.2012 10:39, Christian Hesse wrote:
> Hello everybody,
> 
> afaik, database files in official repositories are not signed yet. Are they?
> 
> This forces one to set SigLevel to 'Optional' instead of 'Required'. Now if
> anybody wants to provide an infected package he/she only needs to provide no
> signature at all and the package is happily accepted, no?
> 
> So when will database files from official packages be signed?
> 
> And even more interesting: Does it make sense to add a new option
> 'PkgRequired'? This could force valid signatures for packages and make it
> optional for database files.

You should read pacman.conf(5) "PACKAGE AND DATABASE SIGNATURE CHECKING"
and use "Optional PackageRequired"

-- 
Florian Pritz

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.archlinux.org/pipermail/arch-general/attachments/20120305/24541211/attachment.asc>